@bjoernrochel/sevro 1.0.0 → 1.1.0

package/dist/src/schema-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema-types.js.map

package/dist/src/schema-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-types.js","sourceRoot":"","sources":["schema-types.ts"],"names":[],"mappings":"","sourcesContent":["import type { AdvisoryAssessment } from \"./advisory\";\nimport type {\n  ArtifactReference,\n  Assessment,\n  CheckOutcome,\n  Diagnostic,\n  DomainOutcome,\n  EvidenceRoute,\n  ExecutionStatus,\n  ExitCode,\n  GradingStatus,\n  MetricEvidence,\n  ObservationCompleteness,\n  ObservationEvidence,\n  OutcomeStatus,\n  RawResultReference,\n  TaskVerdict,\n  UsageEvidence,\n} from \"./contract-types\";\nimport type { IdentityDimensions } from \"./identity\";\nimport type { InstrumentationRequest } from \"./instrumentation\";\n\n/** Wire assessments additionally allow optional serialized error codes. */\nexport type WireAssessment = {\n  execution: Assessment[\"execution\"] & { errorCode?: string };\n  grading: Assessment[\"grading\"] & { errorCode?: string };\n  task: Assessment[\"task\"];\n};\n\n/** Validated v1 wire data also represents failures before run allocation. */\nexport type CliResultData = WireAssessment & {\n  format: \"sevro.cli-result.v1\";\n  runId: string | null;\n  exitCode: ExitCode;\n  evidencePath: string | null;\n  cases: Array<CliResultDataCase>;\n  diagnostic?: Diagnostic;\n};\nexport type CliResultDataTrial = WireAssessment & {\n  trial: number;\n  checks: Array<CheckOutcome>;\n  domainOutcomes?: Array<DomainOutcome>;\n  artifactPath: string | null;\n};\nexport type CliResultDataCase = WireAssessment & {\n  caseId: string;\n  trials: Array<CliResultDataTrial>;\n};\n\n/** Structural contracts for data validated by the versioned JSON schemas. */\nexport type RunEvidenceData = {\n  format: \"sevro.run-evidence.v1\";\n  runId: string;\n  evaluationIdentity: {\n    algorithm: \"sevro.identity.v1\";\n    digest: RunEvidenceDataDigest;\n    dimensions: IdentityDimensions;\n  };\n  configuration: {\n    digest: RunEvidenceDataDigest;\n    redacted: Record<string, unknown>;\n    resolved?: Record<string, unknown>;\n  };\n  runner: RunEvidenceDataRunner;\n  project: {\n    root: RunEvidenceDataFileUrl;\n    revision: string | null;\n    dirtyPatchDigest: RunEvidenceDataDigest | null;\n  };\n  extension: null | RunEvidenceDataExtension;\n  condition: {\n    requested: \"passive\" | \"enforced\";\n    actual: \"passive\" | \"enforced\" | \"unknown\";\n    requestedInstrumentation: InstrumentationRequest[];\n    appliedInstrumentation: InstrumentationRequest[];\n  };\n  graders: {\n    active: Array<RunEvidenceDataGrader>;\n    replacedDefaults: Array<string>;\n  };\n  routes: Array<EvidenceRoute>;\n  result: CliResultData;\n  trials: Array<RunEvidenceDataTrialEvidence>;\n  diagnostic?: Diagnostic;\n};\ntype RunEvidenceDataDigest = string;\ntype RunEvidenceDataFileUrl = string;\ntype RunEvidenceDataRunner =\n  | {\n      source: \"package\";\n      packageName: string;\n      version: string;\n      buildDigest: RunEvidenceDataDigest;\n    }\n  | {\n      source: \"checkout\";\n      root: RunEvidenceDataFileUrl;\n      revision: string;\n      dirtyPatchDigest: RunEvidenceDataDigest | null;\n      buildDigest: RunEvidenceDataDigest;\n    };\ntype RunEvidenceDataExtension = {\n  id: string;\n  version: string;\n  sourceDigest: RunEvidenceDataDigest;\n  configurationDigest: RunEvidenceDataDigest;\n  protocol: \"sevro.extension.v1\";\n  capabilities: Array<string>;\n  replacements: { graders: Array<string>; taskVerdictPolicy: string | null };\n};\ntype RunEvidenceDataGrader = {\n  id: string;\n  source: \"builtin\" | \"extension\";\n  version: string;\n};\nexport type AdvisoryReviewData = {\n  status: \"completed\" | \"failed\" | \"not_run\";\n  assessment: AdvisoryAssessment | null;\n  usage: UsageEvidence;\n  rawResult: RawResultReference;\n};\nexport type RunEvidenceDataTrialEvidence = {\n  caseId: string;\n  trial: number;\n  executionMode: \"executed\" | \"dry\" | \"unknown\";\n  candidateDurationMs?: number | null;\n  condition: {\n    requested: \"passive\" | \"enforced\";\n    actual: \"passive\" | \"enforced\" | \"unknown\";\n    appliedInstrumentation: InstrumentationRequest[];\n  };\n  observationCompleteness: ObservationCompleteness;\n  observations: Array<ObservationEvidence>;\n  metrics: Array<MetricEvidence>;\n  domainOutcomes?: Array<DomainOutcome>;\n  taskVerdictPolicy: null | {\n    id: string;\n    recommendation: TaskVerdict | null;\n  };\n  advisoryReview?: AdvisoryReviewData | null;\n  routes: Array<EvidenceRoute>;\n  usage: UsageEvidence;\n  rawResult: RawResultReference;\n  artifactRefs: Array<ArtifactReference>;\n};\nexport type ReportData = {\n  format: \"sevro.report.v1\";\n  inputs: Array<ReportDataInput>;\n  rows: Array<ReportDataRow>;\n  summary: {\n    cases: number;\n    passed: number;\n    failed: number;\n    notAssessed: number;\n  };\n};\ntype ReportDataPath = string;\ntype ReportDataDigest = string;\n/** The report wire schema deliberately allows either state family in rows. */\ntype ReportDataState = ExecutionStatus | GradingStatus;\ntype ReportDataInput = {\n  resultFile: ReportDataPath;\n  execution: ExecutionStatus;\n  grading: GradingStatus;\n  task: TaskVerdict;\n  exitCode: ExitCode;\n  caseCount: number;\n};\ntype ReportDataRoute = Omit<EvidenceRoute, \"role\">;\ntype ReportDataOutcome = {\n  trial: number;\n  id: string;\n  status: OutcomeStatus;\n};\ntype ReportDataRow = {\n  nativeTranscripts?: { retained: number; pruned: number };\n  resultFile: ReportDataPath;\n  evidencePath: string | null;\n  runId: string | null;\n  caseId: string;\n  execution: ReportDataState;\n  grading: ReportDataState;\n  task: TaskVerdict;\n  exitCode: ExitCode;\n  trialCount: number;\n  taskPassRate: number | null;\n  candidateDurationMs: number | null;\n  inputTokens: number | null;\n  outputTokens: number | null;\n  costUsd: number | null;\n  runnerBuildDigest: ReportDataDigest | null;\n  evaluationDigest: ReportDataDigest | null;\n  requestedCondition: \"passive\" | \"enforced\" | null;\n  actualCondition: \"passive\" | \"enforced\" | \"unknown\" | null;\n  candidateRoute: ReportDataRoute | null;\n  routes: Array<EvidenceRoute>;\n  domainOutcomes: Array<ReportDataOutcome>;\n};\n"]}

package/dist/src/schema.js

@@ -0,0 +1,16 @@
+import cliValidator from "./generated/cli-result.cjs";
+import runValidator from "./generated/run-evidence.cjs";
+import reportValidator from "./generated/report.cjs";
+export function assertCliResult(value) {
+    if (!cliValidator(value))
+        throw new Error("invalid Sevro CLI result");
+}
+export function assertRunEvidence(value) {
+    if (!runValidator(value))
+        throw new Error("invalid Sevro retained evidence");
+}
+export function assertReport(value) {
+    if (!reportValidator(value))
+        throw new Error("invalid Sevro report");
+}
+//# sourceMappingURL=schema.js.map

package/dist/src/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["schema.ts"],"names":[],"mappings":"AAKA,OAAO,YAAY,mCAAmC;AACtD,OAAO,YAAY,qCAAqC;AACxD,OAAO,eAAe,+BAA+B;AAErD,MAAM,UAAU,eAAe,CAC7B,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,KAAc;IAEd,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AACvE,CAAC","sourcesContent":["import type {\n  CliResultData,\n  RunEvidenceData,\n  ReportData,\n} from \"./schema-types\";\nimport cliValidator from \"./generated/cli-result.cjs\";\nimport runValidator from \"./generated/run-evidence.cjs\";\nimport reportValidator from \"./generated/report.cjs\";\n\nexport function assertCliResult(\n  value: unknown,\n): asserts value is CliResultData {\n  if (!cliValidator(value)) throw new Error(\"invalid Sevro CLI result\");\n}\n\nexport function assertRunEvidence(\n  value: unknown,\n): asserts value is RunEvidenceData {\n  if (!runValidator(value)) throw new Error(\"invalid Sevro retained evidence\");\n}\n\nexport function assertReport(value: unknown): asserts value is ReportData {\n  if (!reportValidator(value)) throw new Error(\"invalid Sevro report\");\n}\n"]}

package/dist/src/shell.js

@@ -0,0 +1,5 @@
+/** Encode one literal argument for a POSIX shell, including empty strings. */
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+//# sourceMappingURL=shell.js.map

package/dist/src/shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell.js","sourceRoot":"","sources":["shell.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC","sourcesContent":["/** Encode one literal argument for a POSIX shell, including empty strings. */\nexport function shellQuote(value: string): string {\n  return `'${value.replaceAll(\"'\", `'\"'\"'`)}'`;\n}\n"]}

package/dist/src/sqlite-lock.js

@@ -0,0 +1,18 @@
+import { createRequire } from "node:module";
+const require = createRequire(import.meta.url);
+/** Both drivers use SQLite file locks, including across Node and Bun runners. */
+export function openLockDatabase(path) {
+    if (process.versions.bun) {
+        const { Database } = require("bun:sqlite");
+        const database = new Database(path);
+        return {
+            exec: (sql) => database.run(sql),
+            close() {
+                database.close();
+            },
+        };
+    }
+    const { DatabaseSync } = require("node:sqlite");
+    return new DatabaseSync(path);
+}
+//# sourceMappingURL=sqlite-lock.js.map

package/dist/src/sqlite-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-lock.js","sourceRoot":"","sources":["sqlite-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,oBAAoB;AAE5C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAO/C,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACzB,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,YAAY,CAAgC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpC,OAAO;YACL,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,KAAK;gBACH,QAAQ,CAAC,KAAK,EAAE,CAAC;YACnB,CAAC;SACF,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,GACpB,OAAO,CAAC,aAAa,CAAiC,CAAC;IACzD,OAAO,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC","sourcesContent":["import { createRequire } from \"node:module\";\n\nconst require = createRequire(import.meta.url);\n\ninterface LockDatabase {\n  exec(sql: string): unknown;\n  close(): void;\n}\n\n/** Both drivers use SQLite file locks, including across Node and Bun runners. */\nexport function openLockDatabase(path: string): LockDatabase {\n  if (process.versions.bun) {\n    const { Database } = require(\"bun:sqlite\") as typeof import(\"bun:sqlite\");\n    const database = new Database(path);\n    return {\n      exec: (sql) => database.run(sql),\n      close() {\n        database.close();\n      },\n    };\n  }\n  const { DatabaseSync } =\n    require(\"node:sqlite\") as typeof import(\"node:sqlite\");\n  return new DatabaseSync(path);\n}\n"]}

package/dist/src/storage.js

@@ -0,0 +1,21 @@
+import { mkdir, rename, unlink, writeFile } from "node:fs/promises";
+import { basename, dirname, join } from "node:path";
+import { randomUUID } from "node:crypto";
+/** Write a private JSON artifact and publish it with one atomic rename. */
+export async function atomicWriteJson(path, value) {
+    const parent = dirname(path);
+    await mkdir(parent, { recursive: true, mode: 0o700 });
+    const temporary = join(parent, `.${basename(path)}.${randomUUID()}.tmp`);
+    try {
+        await writeFile(temporary, `${JSON.stringify(value, null, 2)}\n`, {
+            flag: "wx",
+            mode: 0o600,
+        });
+        await rename(temporary, path);
+    }
+    catch (error) {
+        await unlink(temporary).catch(() => { });
+        throw error;
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/src/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,yBAAyB;AACpE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AACpD,OAAO,EAAE,UAAU,EAAE,oBAAoB;AAEzC,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAY,EACZ,KAAc;IAEd,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YAChE,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC","sourcesContent":["import { mkdir, rename, unlink, writeFile } from \"node:fs/promises\";\nimport { basename, dirname, join } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n\n/** Write a private JSON artifact and publish it with one atomic rename. */\nexport async function atomicWriteJson(\n  path: string,\n  value: unknown,\n): Promise<void> {\n  const parent = dirname(path);\n  await mkdir(parent, { recursive: true, mode: 0o700 });\n  const temporary = join(parent, `.${basename(path)}.${randomUUID()}.tmp`);\n  try {\n    await writeFile(temporary, `${JSON.stringify(value, null, 2)}\\n`, {\n      flag: \"wx\",\n      mode: 0o600,\n    });\n    await rename(temporary, path);\n  } catch (error) {\n    await unlink(temporary).catch(() => {});\n    throw error;\n  }\n}\n"]}

package/dist/src/transcript-retention.js

@@ -0,0 +1,109 @@
+import { readFile, rm } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { canonicalJson, sha256 } from "./identity.js";
+import { retainedFile } from "./results-lock.js";
+import { atomicWriteJson } from "./storage.js";
+function isNativeTranscript(artifact) {
+    return /^(?:sevro\.(?:semantic(?:\.[a-f0-9]{64})?|advisory)\.)?sevro\.native-transcripts\.bundle$/.test(artifact.id);
+}
+function transcriptArtifacts(evidence) {
+    return evidence.trials.flatMap((trial) => trial.artifactRefs.filter(isNativeTranscript).map((artifact) => ({
+        caseId: trial.caseId,
+        trial: trial.trial,
+        ...artifact,
+    })));
+}
+function pruningRecord(evidence) {
+    return {
+        format: "sevro.pruned-native-transcripts.v1",
+        runId: evidence.runId,
+        artifacts: transcriptArtifacts(evidence),
+    };
+}
+function pruningPath(evidence) {
+    if (evidence.result.evidencePath === null)
+        throw new Error("native transcript retention requires a retained evidence path");
+    return join(dirname(evidence.result.evidencePath), "native-transcripts-pruned.json");
+}
+function transcriptPath(evidence, artifact) {
+    const path = fileURLToPath(artifact.path);
+    if (dirname(path) !== dirname(pruningPath(evidence)))
+        throw new Error("native transcript artifact is outside its retained result directory");
+    if (metadataPaths(evidence).includes(path))
+        throw new Error("native transcript artifact aliases retained result metadata");
+    if (otherArtifactPaths(evidence).includes(path))
+        throw new Error("native transcript artifact aliases other retained evidence");
+    return path;
+}
+function otherArtifactPaths(evidence) {
+    return evidence.trials
+        .flatMap((trial) => [
+        trial.rawResult.path,
+        trial.advisoryReview?.rawResult.path,
+        ...trial.artifactRefs
+            .filter((ref) => !isNativeTranscript(ref))
+            .map((ref) => ref.path),
+    ])
+        .filter((path) => path != null)
+        .map((path) => fileURLToPath(path));
+}
+function metadataPaths(evidence) {
+    const receipt = pruningPath(evidence);
+    return [
+        receipt,
+        evidence.result.evidencePath,
+        join(dirname(receipt), "result.json"),
+        join(dirname(receipt), "latest.json"),
+        ...evidence.result.cases.flatMap((selected) => selected.trials.map((trial) => trial.artifactPath)),
+    ];
+}
+async function transcriptPresent(evidence, artifact) {
+    const path = transcriptPath(evidence, artifact);
+    if (!(await retainedFile(path)))
+        return false;
+    if (sha256(await readFile(path)) !== artifact.sha256)
+        throw new Error("retained native transcript evidence hash differs");
+    return true;
+}
+/** Keep capture evidence immutable; a separate receipt records intentional removal. */
+export async function pruneNativeTranscripts(evidence) {
+    const artifacts = transcriptArtifacts(evidence);
+    if (!artifacts.length)
+        return 0;
+    await atomicWriteJson(pruningPath(evidence), pruningRecord(evidence));
+    let removed = 0;
+    for (const artifact of artifacts) {
+        const path = transcriptPath(evidence, artifact);
+        if (!(await retainedFile(path)))
+            continue;
+        await rm(path);
+        removed++;
+    }
+    return removed;
+}
+/** Missing native bytes require an exact receipt bound to their original references. */
+async function hasPruningRecord(evidence) {
+    const path = pruningPath(evidence);
+    const marked = await retainedFile(path);
+    if (marked) {
+        const receipt = JSON.parse(await readFile(path, "utf8"));
+        if (canonicalJson(receipt) !== canonicalJson(pruningRecord(evidence)))
+            throw new Error("native transcript pruning record differs from retained evidence");
+    }
+    return marked !== null;
+}
+export async function nativeTranscriptRetention(evidence) {
+    if (!evidence)
+        return [];
+    const marked = await hasPruningRecord(evidence);
+    const states = [];
+    for (const artifact of transcriptArtifacts(evidence)) {
+        const present = await transcriptPresent(evidence, artifact);
+        if (!present && !marked)
+            throw new Error("retained native transcript evidence is missing without a pruning record");
+        states.push({ caseId: artifact.caseId, pruned: !present });
+    }
+    return states;
+}
+//# sourceMappingURL=transcript-retention.js.map

package/dist/src/transcript-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transcript-retention.js","sourceRoot":"","sources":["transcript-retention.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,yBAAyB;AAChD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB;AAC1C,OAAO,EAAE,aAAa,EAAE,iBAAiB;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,sBAAmB;AAEnD,OAAO,EAAE,YAAY,EAAE,0BAAuB;AAC9C,OAAO,EAAE,eAAe,EAAE,qBAAkB;AAE5C,SAAS,kBAAkB,CAAC,QAA2B;IACrD,OAAO,2FAA2F,CAAC,IAAI,CACrG,QAAQ,CAAC,EAAE,CACZ,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAyB;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CACvC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,GAAG,QAAQ;KACZ,CAAC,CAAC,CACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,OAAO;QACL,MAAM,EAAE,oCAAoC;QAC5C,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,SAAS,EAAE,mBAAmB,CAAC,QAAQ,CAAC;KACzC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAAyB;IAC5C,IAAI,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,IAAI;QACvC,MAAM,IAAI,KAAK,CACb,+DAA+D,CAChE,CAAC;IACJ,OAAO,IAAI,CACT,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,EACrC,gCAAgC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CACrB,QAAyB,EACzB,QAA2B;IAE3B,MAAM,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,qEAAqE,CACtE,CAAC;IACJ,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,4DAA4D,CAC7D,CAAC;IACJ,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAyB;IACnD,OAAO,QAAQ,CAAC,MAAM;SACnB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,KAAK,CAAC,SAAS,CAAC,IAAI;QACpB,KAAK,CAAC,cAAc,EAAE,SAAS,CAAC,IAAI;QACpC,GAAG,KAAK,CAAC,YAAY;aAClB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;aACzC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KAC1B,CAAC;SACD,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,IAAI,IAAI,CAAC;SAC9C,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,QAAyB;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO;QACL,OAAO;QACP,QAAQ,CAAC,MAAM,CAAC,YAAY;QAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;QACrC,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC5C,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CACnD;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,QAAyB,EACzB,QAA2B;IAE3B,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ,CAAC,MAAM;QAClD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,QAAyB;IACpE,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAChC,MAAM,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC1C,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,wFAAwF;AACxF,KAAK,UAAU,gBAAgB,CAAC,QAAyB;IACvD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,iEAAiE,CAClE,CAAC;IACN,CAAC;IACD,OAAO,MAAM,KAAK,IAAI,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgC;IAEhC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,EAAE,CAAC;IAClB,KAAK,MAAM,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM;YACrB,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { readFile, rm } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport type { RunEvidenceData } from \"./schema-types\";\nimport { canonicalJson, sha256 } from \"./identity\";\nimport type { ArtifactReference } from \"./contract-types\";\nimport { retainedFile } from \"./results-lock\";\nimport { atomicWriteJson } from \"./storage\";\n\nfunction isNativeTranscript(artifact: ArtifactReference) {\n  return /^(?:sevro\\.(?:semantic(?:\\.[a-f0-9]{64})?|advisory)\\.)?sevro\\.native-transcripts\\.bundle$/.test(\n    artifact.id,\n  );\n}\n\nfunction transcriptArtifacts(evidence: RunEvidenceData) {\n  return evidence.trials.flatMap((trial) =>\n    trial.artifactRefs.filter(isNativeTranscript).map((artifact) => ({\n      caseId: trial.caseId,\n      trial: trial.trial,\n      ...artifact,\n    })),\n  );\n}\n\nfunction pruningRecord(evidence: RunEvidenceData) {\n  return {\n    format: \"sevro.pruned-native-transcripts.v1\",\n    runId: evidence.runId,\n    artifacts: transcriptArtifacts(evidence),\n  };\n}\n\nfunction pruningPath(evidence: RunEvidenceData) {\n  if (evidence.result.evidencePath === null)\n    throw new Error(\n      \"native transcript retention requires a retained evidence path\",\n    );\n  return join(\n    dirname(evidence.result.evidencePath),\n    \"native-transcripts-pruned.json\",\n  );\n}\n\nfunction transcriptPath(\n  evidence: RunEvidenceData,\n  artifact: ArtifactReference,\n) {\n  const path = fileURLToPath(artifact.path);\n  if (dirname(path) !== dirname(pruningPath(evidence)))\n    throw new Error(\n      \"native transcript artifact is outside its retained result directory\",\n    );\n  if (metadataPaths(evidence).includes(path))\n    throw new Error(\n      \"native transcript artifact aliases retained result metadata\",\n    );\n  if (otherArtifactPaths(evidence).includes(path))\n    throw new Error(\n      \"native transcript artifact aliases other retained evidence\",\n    );\n  return path;\n}\n\nfunction otherArtifactPaths(evidence: RunEvidenceData) {\n  return evidence.trials\n    .flatMap((trial) => [\n      trial.rawResult.path,\n      trial.advisoryReview?.rawResult.path,\n      ...trial.artifactRefs\n        .filter((ref) => !isNativeTranscript(ref))\n        .map((ref) => ref.path),\n    ])\n    .filter((path): path is string => path != null)\n    .map((path) => fileURLToPath(path));\n}\n\nfunction metadataPaths(evidence: RunEvidenceData) {\n  const receipt = pruningPath(evidence);\n  return [\n    receipt,\n    evidence.result.evidencePath,\n    join(dirname(receipt), \"result.json\"),\n    join(dirname(receipt), \"latest.json\"),\n    ...evidence.result.cases.flatMap((selected) =>\n      selected.trials.map((trial) => trial.artifactPath),\n    ),\n  ];\n}\n\nasync function transcriptPresent(\n  evidence: RunEvidenceData,\n  artifact: ArtifactReference,\n) {\n  const path = transcriptPath(evidence, artifact);\n  if (!(await retainedFile(path))) return false;\n  if (sha256(await readFile(path)) !== artifact.sha256)\n    throw new Error(\"retained native transcript evidence hash differs\");\n  return true;\n}\n\n/** Keep capture evidence immutable; a separate receipt records intentional removal. */\nexport async function pruneNativeTranscripts(evidence: RunEvidenceData) {\n  const artifacts = transcriptArtifacts(evidence);\n  if (!artifacts.length) return 0;\n  await atomicWriteJson(pruningPath(evidence), pruningRecord(evidence));\n  let removed = 0;\n  for (const artifact of artifacts) {\n    const path = transcriptPath(evidence, artifact);\n    if (!(await retainedFile(path))) continue;\n    await rm(path);\n    removed++;\n  }\n  return removed;\n}\n\n/** Missing native bytes require an exact receipt bound to their original references. */\nasync function hasPruningRecord(evidence: RunEvidenceData) {\n  const path = pruningPath(evidence);\n  const marked = await retainedFile(path);\n  if (marked) {\n    const receipt: unknown = JSON.parse(await readFile(path, \"utf8\"));\n    if (canonicalJson(receipt) !== canonicalJson(pruningRecord(evidence)))\n      throw new Error(\n        \"native transcript pruning record differs from retained evidence\",\n      );\n  }\n  return marked !== null;\n}\n\nexport async function nativeTranscriptRetention(\n  evidence: RunEvidenceData | null,\n) {\n  if (!evidence) return [];\n  const marked = await hasPruningRecord(evidence);\n  const states = [];\n  for (const artifact of transcriptArtifacts(evidence)) {\n    const present = await transcriptPresent(evidence, artifact);\n    if (!present && !marked)\n      throw new Error(\n        \"retained native transcript evidence is missing without a pruning record\",\n      );\n    states.push({ caseId: artifact.caseId, pruned: !present });\n  }\n  return states;\n}\n"]}

package/dist/src/value-guards.js

@@ -0,0 +1,26 @@
+/** Narrow JSON containers before accessing untrusted members. */
+export function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function requireRecord(value, message) {
+    if (!isRecord(value))
+        throw new Error(message);
+    return value;
+}
+export function validQualifiedId(value) {
+    return (typeof value === "string" &&
+        /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/.test(value));
+}
+export function containsControl(value) {
+    return Array.from(value).some((character) => character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f);
+}
+export function isUnknownArray(value) {
+    return Array.isArray(value);
+}
+export function isStringArray(value) {
+    return (isUnknownArray(value) && value.every((item) => typeof item === "string"));
+}
+export function isOptionalNonblankString(value) {
+    return (value === undefined || (typeof value === "string" && Boolean(value.trim())));
+}
+//# sourceMappingURL=value-guards.js.map

package/dist/src/value-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"value-guards.js","sourceRoot":"","sources":["value-guards.ts"],"names":[],"mappings":"AAAA,iEAAiE;AACjE,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAc,EACd,OAAe;IAEf,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,oCAAoC,CAAC,IAAI,CAAC,KAAK,CAAC,CACjD,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAC3B,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,CACL,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CACzE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,OAAO,CACL,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC","sourcesContent":["/** Narrow JSON containers before accessing untrusted members. */\nexport function isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nexport function requireRecord(\n  value: unknown,\n  message: string,\n): Record<string, unknown> {\n  if (!isRecord(value)) throw new Error(message);\n  return value;\n}\n\nexport function validQualifiedId(value: unknown): value is string {\n  return (\n    typeof value === \"string\" &&\n    /^[a-z][a-z0-9]*(?:[.-][a-z0-9]+)+$/.test(value)\n  );\n}\n\nexport function containsControl(value: string): boolean {\n  return Array.from(value).some(\n    (character) =>\n      character.charCodeAt(0) < 0x20 || character.charCodeAt(0) === 0x7f,\n  );\n}\n\nexport function isUnknownArray(value: unknown): value is unknown[] {\n  return Array.isArray(value);\n}\n\nexport function isStringArray(value: unknown): value is string[] {\n  return (\n    isUnknownArray(value) && value.every((item) => typeof item === \"string\")\n  );\n}\n\nexport function isOptionalNonblankString(value: unknown): boolean {\n  return (\n    value === undefined || (typeof value === \"string\" && Boolean(value.trim()))\n  );\n}\n"]}

package/docs/architecture.md

@@ -4,7 +4,7 @@ Sevro owns generic execution/evidence contracts. Projects own cases and policy.
 This lets Darrow and other integrations use the same runner without importing
 their benchmark policy into it.
 
-This page explains this checkout's implementation and points to acceptance
+This page explains Sevro's implementation and points to acceptance
 tests for changes. [Current contracts](contracts.md) define public behavior;
 [historical validation](https://github.com/BjRo/sevro/blob/main/docs/evidence.md) records bounded past observations. The
 [engine slice](https://github.com/BjRo/sevro/blob/main/docs/engine-slice.md) retains its earlier scope and detailed lifecycle
@@ -12,7 +12,10 @@ explanation. Implementation paths and test scenarios here are navigation, not
 evidence that a particular candidate passed validation.
 
 [`engine.ts`](../src/engine.ts) remains the programmatic facade, and
-[`cli.ts`](../src/cli.ts) remains the installed command entrypoint. The CLI
+[`cli.ts`](../src/cli.ts) builds to the installed `dist/src/cli.js` entrypoint.
+The package runs on Node.js and Bun; contributor commands still use Bun.
+[Process adapters](../src/runtime-process.ts) normalize child processes and
+Web Streams. [SQLite locking](../src/sqlite-lock.ts) selects the runtime's native driver, preserving shared file-lock semantics. The CLI
 loads and assembles evaluation options; evaluation modules coordinate the run
 and its trials.
 

package/docs/creating-cases.md

@@ -114,9 +114,8 @@ The [grader reference](builtin-graders-v1.md) defines their limits.
 To grade skill selection or verify explicit invocation, use an extension that
 prepares skill mounts and interprets complete native host evidence. The
 [extension protocol](extension-protocol-v1.md) defines repository and plugin
-invocations; the checkout's [guide evals](guide-evaluation.md) demonstrate the
-approach. Check those capabilities against your exact installed release:
-this checkout can contain [changes beyond its published version](installing.md#published-package-and-checkout).
+invocations; the repository's [guide evals](guide-evaluation.md) demonstrate the
+approach.
 
 ## Reusable project policy
 

package/docs/development-cli.md

@@ -12,9 +12,14 @@ grading, evidence, and extension lifecycle.
 and maintains the latest report index. Bare pruning keeps the newest ten results;
 `--keep`, `--older-than`, and `--latest` select explicit retention policies.
 
-Examples assume [Sevro and Bun are on `PATH`](installing.md#make-the-command-available).
+Examples assume [Sevro and Node are on `PATH`](installing.md#make-the-command-available).
 For a contributor checkout, use `bun src/cli.ts` in place of `sevro`.
 
+Use JavaScript adapter modules for portable Node and Bun execution. Bun can
+load TypeScript source adapters directly. Node's native TypeScript loading has
+syntax and dependency-directory restrictions; compile adapters that need full
+TypeScript support before selecting them with `--adapter-module`.
+
 Use `sevro --help`, `sevro run --help`, `sevro report --help`, or
 `sevro prune --help` for examples,
 required options, and defaults without preparing a run. `sevro --version` prints
@@ -34,7 +39,7 @@ configuration are independent of the caller's files and runtime policy.
 An ordinary run needs a case source and candidate route. For example:
 
 ```sh
-sevro run --case-file ./case.json --adapter-module ./host-adapter.ts
+sevro run --case-file ./case.json --adapter-module ./host-adapter.js
 ```
 
 | Setting                                                     | Default                                                                                                                 |
@@ -108,9 +113,9 @@ An installed package records its name, version, and a digest of its packaged
 runtime and public contract files without reading runner Git metadata. The CLI
 derives the project digest from its revision and dirty patch, or from a bounded
 content snapshot when the project has no Git revision. Result and run-state
-directories are excluded from that snapshot and untracked Git identity. When running this source checkout
+directories are excluded from that snapshot and untracked Git identity. When running from source
 for coordinated development, pass `--runner-checkout-root` with the absolute
-path to this checkout. Sevro verifies that it is the code actually running and
+path to the running Sevro checkout. Sevro verifies that it is the code actually running and
 records its revision and dirty-patch digest instead of package provenance.
 `bun run test:package-install` verifies the packed package from a separate
 temporary project without runner Git metadata.
@@ -118,7 +123,7 @@ temporary project without runner Git metadata.
 ```sh
 sevro run --json \
   --case-file /absolute/path/case.json \
-  --adapter-module /absolute/path/host-adapter.ts \
+  --adapter-module /absolute/path/host-adapter.js \
   --project-root /absolute/path/project \
   --results-root /absolute/path/results \
   --condition passive --trials 1 --threshold 1
@@ -355,7 +360,7 @@ separate turn event artifacts remain bounded and private. The last response
 is graded, and only complete per-call usage and cost series are summed.
 
 For cases with `sevro.semantic` checks, also pass
-`--semantic-adapter-module /absolute/path/semantic-adapter.ts` to load an
+`--semantic-adapter-module /absolute/path/semantic-adapter.js` to load an
 explicit second `HostAdapter` for grading. Alternatively, select the bundled
 Codex route with `--semantic-host codex --semantic-model <model>
 --semantic-effort <effort>`. That route also requires `--codex-bin` and
@@ -367,7 +372,7 @@ runs after a complete candidate response in its own empty workspace; missing
 or malformed semantic verdicts produce a grading error.
 
 For generated Git or repository fixtures, add
-`--advisory-adapter-module /absolute/path/advisory-adapter.ts` to request an
+`--advisory-adapter-module /absolute/path/advisory-adapter.js` to request an
 independent quality review. Alternatively, use `--advisory-host codex
 --advisory-model <model> --advisory-effort <effort>` with the shared Codex binary
 and auth file options. Repeat `--advisory-exclude <fixture-relative-path>` for

package/docs/documentation-quality.md

@@ -12,8 +12,9 @@ It validates the guide inventory's source/static destinations and case coverage.
 It ignores code contents as links and excludes inactive fixture snapshots.
 Local checks need no network. Run `bun run test:docs-examples` for the exact
 marked tutorial commands in fresh consumer/contributor directories, including
-expected verdicts and saved evidence. Candidate and released-package runs are
-reported separately. These commands create and clean temporary directories.
+expected verdicts and saved evidence. Candidate commands run against compiled JavaScript. The released-package
+check uses the tutorial bundled in that published version; the two results
+are reported separately. These commands create and clean temporary directories.
 The [recipe verifier](../scripts/documentation-recipes.ts) runs the new packaged
 projects separately from the current published version. It executes actual
 isolated tool/check positive and negative controls and both native hosts' dry
@@ -23,7 +24,7 @@ are mandatory, including UV and mise's declared Node installation.
 
 `package.json.version` is the authoritative current version. `bun run docs:sync`
 updates only the marked [Current release](installing.md#current-release) section
-with its exact installation command. Keep its markers and heading in place;
+with its exact npm and Bun installation commands. Keep its markers and heading in place;
 the command refuses missing, duplicate, or reversed markers and invalid versions.
 The rest of the page stays ordinary Markdown. `check:docs` compares this section
 without writing; release preparation and package-install validation also reject

package/docs/evaluation-workflow.md

@@ -5,7 +5,7 @@ result with the installed `sevro` command.
 
 ## Try the demo and create a project
 
-You need Bun 1.3.13. [Install Sevro](installing.md) and
+Use Node.js 24.13.0 or newer, or Bun 1.3.13. [Install Sevro](installing.md) and
 [make its command available on `PATH`](installing.md#make-the-command-available),
 then run:
 
@@ -52,7 +52,7 @@ sevro report --latest
 The first run's adapter returns exactly `ready`; its regex assertion must pass.
 The negative control returns `wrong`: expect exit `1`, completed execution and
 grading, task `failed`, and the named `ready` check's reason. Then edit `case.json`
-and `adapter.ts`, prepare again and rerun. Explicit flags override saved settings;
+and `adapter.js` (`adapter.ts` when initialized from contributor sources), prepare again and rerun. Explicit flags override saved settings;
 `--trials 3` repeats the task without rewriting `run.json`.
 
 Progress uses stderr at actual preparation, candidate, grading and evidence
@@ -88,16 +88,16 @@ Reports label bundles intentionally removed by that command as pruned.
 
 ## Choose another starter
 
-| Template           | Real assertions                                                                                                    | Prerequisites and interpretation                                                                           |
-| ------------------ | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------- |
-| `response`         | Exact `ready` response; negative control returns `wrong`                                                           | Bun; no model credentials                                                                                  |
-| `coding`           | Edit `add.sh`; isolated checks test positive, negative and zero addition                                           | Bun plus `sandbox-exec` on macOS or `bubblewrap`/`socat` on Linux; negative control leaves subtraction bug |
-| `repository-skill` | Actual `.agents/skills/startup-guide/SKILL.md` mount; explicit invocation evidence; correct start command and port | Bun, Git, Codex, native isolation, explicit model/effort and readable auth file; dry is unassessed         |
+| Template           | Real assertions                                                                                                    | Prerequisites and interpretation                                                                                   |
+| ------------------ | ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------ |
+| `response`         | Exact `ready` response; negative control returns `wrong`                                                           | Node or Bun; no model credentials                                                                                  |
+| `coding`           | Edit `add.sh`; isolated checks test positive, negative and zero addition                                           | Node or Bun plus `sandbox-exec` on macOS or `bubblewrap`/`socat` on Linux; negative control leaves subtraction bug |
+| `repository-skill` | Actual `.agents/skills/startup-guide/SKILL.md` mount; explicit invocation evidence; correct start command and port | Node or Bun, Git, Codex, native isolation, explicit model/effort and readable auth file; dry is unassessed         |
 
 From a new parent directory, use `sevro init --template coding --directory ./coding-eval`
 or `sevro init --template repository-skill --directory ./skill-eval`. Read its generated
 README for controls and dry/live commands. Repository-skill `command.json` records
-absolute Bun/extension argv; regenerate it after moving the project.
+the selected runtime executable and absolute extension path; regenerate it after moving the project.
 
 For model evaluations, replace a saved adapter route with explicit `--host`,
 `--model`, `--effort` and host authentication options. Candidate, semantic and

package/docs/getting-started.md

@@ -1,6 +1,6 @@
 # Your first evaluation
 
-Run a deterministic case and inspect its evidence. You need Bun 1.3.13; no
+Run a deterministic case and inspect its evidence. Use Node.js 24.13.0 or newer, or Bun 1.3.13; no
 Darrow checkout, Codex/Claude login, or model credentials are required. The
 adapter returns `ready`; Sevro grades that response against `^ready$`.
 This teaches the runner lifecycle, not the quality of an actual model.
@@ -33,15 +33,16 @@ Prepare a new directory:
 ```sh
 mkdir sevro-demo
 cd sevro-demo
-bun init -y
+npm init -y
 ```
 
-Install the [current release](installing.md#current-release) there, then return
-here to run the example. See [licensing](licensing.md) for the current terms and
+Install the [current release](installing.md#current-release)
+there, then return here to run the example. See [licensing](licensing.md) for the current terms and
 the licenses retained by historical releases.
 
 Make the local installation available on `PATH` for this shell, then call
-`sevro` directly. Bun must also be on `PATH`.
+`sevro` directly with Node on `PATH`. Bun users can use the
+[explicit Bun invocation](installing.md#make-the-command-available).
 
 <!-- sevro-example:consumer -->
 
@@ -50,7 +51,7 @@ export PATH="$PWD/node_modules/.bin:$PATH"
 mkdir -p project
 sevro run --json \
   --case-file "$PWD/node_modules/@bjoernrochel/sevro/examples/basic/graded.json" \
-  --adapter-module "$PWD/node_modules/@bjoernrochel/sevro/examples/basic/host.ts" \
+  --adapter-module "$PWD/node_modules/@bjoernrochel/sevro/dist/examples/basic/host.js" \
   --project-root "$PWD/project" --results-root "$PWD/sevro-results" \
   --condition passive --trials 1 --threshold 1 > sevro-result.json
 ```

package/docs/guide-evaluation.md

@@ -5,7 +5,7 @@ and a small extension for guide-specific evidence and fixtures. The inventory an
 cases remain under `.agents/skills/sevro-guide/evals/`. The
 [extension modules](../scripts/guide/README.md) do not implement a second runner.
 
-From this checkout, validate fixture preparation without launching a model:
+From the Sevro repository root, validate fixture preparation without launching a model:
 
 ```sh
 bun run eval:guide --case-id orientation --host codex \

package/docs/identity-v1.md

@@ -30,7 +30,10 @@ SHA-256(UTF-8("sevro.identity.v1\n") || UTF-8(JCS(dimensions)))
 
 The CLI derives `runnerBuildDigest` from sorted packaged file paths and their
 SHA-256 bytes under `src/`, `schemas/`, `docs/`, and `examples/`, plus `README.md` and
-`package.json`. For a Git project, `projectDigest` binds the revision and dirty
+`package.json`. Installed JavaScript execution also hashes `dist/`, including
+the compiled runtime, examples and source maps. This binds evidence to executed
+output; raw checkout execution excludes generated builds. The same installed
+artifact has the same build digest under Node and Bun. For a Git project, `projectDigest` binds the revision and dirty
 patch digest without the checkout path. Without a revision it hashes a bounded
 file snapshot, excluding `.git`, results, and run-state storage. Results and
 run-state storage are also excluded from untracked Git identity, so repeated

package/docs/installing.md

@@ -1,8 +1,13 @@
 # Install, update, or remove Sevro
 
-Use Bun 1.3.13 for this TypeScript/Bun CLI. Installation does not make it a
-Node-only executable. Full validation and native isolation target macOS and
-Ubuntu 24.04 x64. See the [bounded platform evidence](native-hosts.md#validated-platform-scope);
+<a id="node-support-preview"></a>
+
+## Runtime requirements
+
+The installed package contains compiled JavaScript and runs with Node.js
+24.13.0 or newer, or Bun 1.3.13. Node users do not need Bun for installation
+or execution. Development and release builds continue to use Bun. Native
+isolation targets macOS and Ubuntu 24.04 x64. See the [bounded platform evidence](native-hosts.md#validated-platform-scope);
 Windows remains unverified.
 
 ## Install locally
@@ -10,7 +15,7 @@ Windows remains unverified.
 ```sh
 mkdir sevro-demo
 cd sevro-demo
-bun init -y
+npm init -y
 ```
 
 Then install the [current release](#current-release) in that directory.
@@ -23,10 +28,16 @@ Local installation records the selected version in the project lockfile.
 
 ## Current release
 
-The current release is `1.0.0`. Install this exact version:
+The current release is `1.1.0`. Install this exact version with npm:
 
 ```sh
-bun add --exact @bjoernrochel/sevro@1.0.0
+npm install --save-exact @bjoernrochel/sevro@1.1.0
+```
+
+Or with Bun:
+
+```sh
+bun add --exact @bjoernrochel/sevro@1.1.0
 ```
 
 <!-- sevro-current-release:end -->
@@ -42,20 +53,24 @@ export PATH="$PWD/node_modules/.bin:$PATH"
 
 This selects the locally installed version for the current shell, including
 after changing directories. If your installed `sevro` is already on `PATH`,
-no adjustment is needed. Bun must also be on `PATH`: the executable uses
-`#!/usr/bin/env bun`.
+no adjustment is needed. The executable uses `#!/usr/bin/env node`, so Node
+must be on `PATH` for a direct `sevro` invocation. For Bun execution, use
+`bun run --bun sevro` from the installation directory, or run
+`bun ./node_modules/@bjoernrochel/sevro/dist/src/cli.js` with the same arguments.
+Bun-only users can initialize with `bun init -y` and install with `bun add`.
 
 ## Published package and checkout
 
 See [licensing](licensing.md) for Sevro's source-available terms and historical
 licensing transitions.
 
-The npm package contains sources, schemas, examples, documentation,
+The npm package contains compiled runtime and example modules under `dist/`,
+alongside TypeScript sources, schemas, examples, documentation,
 LICENSE, and contribution guidance. It excludes tests, developer scripts, Git
 metadata, and repository guide mounts. Use a source checkout for the guide.
 
-Source checkouts can include changes beyond their package version; compare the
-exact release tag when establishing provenance.
+Use the exact release tag and package integrity when establishing provenance;
+see the [release workflow](releases.md).
 
 ## Work from source
 
@@ -65,7 +80,8 @@ cd sevro
 bun install --frozen-lockfile
 ```
 
-Run the [checkout tutorial](getting-started.md#from-a-contributor-checkout).
+Run the [contributor tutorial](getting-started.md#from-a-contributor-checkout).
+To build and install a development archive, follow [Contributing](../CONTRIBUTING.md#install-a-development-archive).
 `bun run test:package-install` packs and installs a local tarball in temporary
 directories; it does not publish. [Contributing](../CONTRIBUTING.md) lists checks.
 
@@ -81,8 +97,10 @@ Rollback uses the prior exact version and another verification run.
 ## Remove
 
 ```sh
-bun remove @bjoernrochel/sevro
+npm uninstall @bjoernrochel/sevro
 ```
 
+With Bun, use `bun remove @bjoernrochel/sevro`.
+
 This updates the dependency and lockfile, not saved cases, results, or model
 logins. Remove those separately only when wanted.

package/docs/licensing.md

@@ -1,6 +1,6 @@
 # Sevro licensing
 
-[LICENSE](../LICENSE) is authoritative for this checkout. Sevro Source Available
+[LICENSE](../LICENSE) defines Sevro's licensing terms. Sevro Source Available
 License 1.0 allows free use in all contexts, modification, and free redistribution
 under the same terms. Commercial work, paid education, research, CI, and
 consulting are permitted.
@@ -23,7 +23,7 @@ it does not promise that alternative licenses will never be offered.
 
 Published `0.1.0-rc.1` and `0.1.0-rc.2` retain BUSL-1.1, their original
 production grant, and their per-version change date. Each changes to MPL-2.0
-two years after its first public availability. This checkout does not revoke
+two years after its first public availability. The current license does not revoke
 or rewrite earlier grants. The [retained rc.2 license](licenses/BUSL-1.1-0.1.0-rc.2.txt)
 records those terms.
 

package/docs/native-hosts.md

@@ -35,7 +35,7 @@ observations are also available. Unsupported instrumentation is refused.
 
 Select `--host claude`, an absolute `--claude-bin`, and the desired model/effort.
 The route supports passive candidate turns. Explicit `--claude-credential-file`
-takes precedence. Otherwise this checkout forwards inherited API/OAuth
+takes precedence. Otherwise Sevro forwards inherited API/OAuth
 credentials, then uses the saved login from the macOS Keychain or saved credential
 file. Trials receive only an access token; the parent refreshes a saved login and
 writes it back, so evaluations leave your normal Claude login working. See the