@intentrax/sdk 1.0.0

package/examples/adapters/claude-code.md

@@ -0,0 +1,27 @@
+# Claude Code Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible Claude Code hook in under a minute:
+
+~~~bash
+npx @intentrax/sdk init claude-code --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/claude-code-pre-tool-use.mjs`, plus
+`.intentrax/wiring/claude-code-host-wiring.md`. Open the wiring guide to import
+`beforeClaudeCodeToolUse` from the host pre-tool-use hook. Submit the sample
+only after setting the runtime credential in your shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps Claude Code tool hooks onto `MCP_TOOL_CALL` with the `GENERIC_MCP_PROOF_ADAPTER`. Tool execution, payload mutation, policy re-evaluation, and proof generation stay outside the adapter boundary.

package/examples/adapters/cursor.md

@@ -0,0 +1,27 @@
+# Cursor Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible Cursor shell or tool hook in under a minute:
+
+~~~bash
+npx @intentrax/sdk init cursor --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/cursor-before-shell-execution.mjs`, plus
+`.intentrax/wiring/cursor-host-wiring.md`. Open the wiring guide to import
+`beforeCursorShellExecution` from the host shell-execution hook. Submit the
+sample only after setting the runtime credential in your shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps Cursor execution hooks onto `MCP_TOOL_CALL` with the `GENERIC_MCP_PROOF_ADAPTER`. Intentrax receives proof references and hashes only; the adapter does not execute tools or mutate prompts.

package/examples/adapters/langchain.md

@@ -0,0 +1,27 @@
+# LangChain Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible LangChain callback or tool wrapper in under a minute:
+
+~~~bash
+npx @intentrax/sdk init langchain --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/langchain-callback-wrapper.mjs`, plus
+`.intentrax/wiring/langchain-host-wiring.md`. Open the wiring guide to import
+`withIntentraxLangChainCallback` from the callback or tool wrapper boundary.
+Submit the sample only after setting the runtime credential in your shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps LangChain callbacks onto `SDK_AGENT_CALL` with the `SDK_AGENT_PROOF_ADAPTER`. The adapter submits hash-bound evidence references and does not re-run policy or generate proof.

package/examples/adapters/langgraph.md

@@ -0,0 +1,28 @@
+# LangGraph Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible LangGraph node middleware path in under a minute:
+
+~~~bash
+npx @intentrax/sdk init langgraph --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/langgraph-node-middleware.mjs`, plus
+`.intentrax/wiring/langgraph-host-wiring.md`. Open the wiring guide to import
+`withIntentraxLangGraphNode` from node middleware before checkpointed state
+commits. Submit the sample only after setting the runtime credential in your
+shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps LangGraph middleware onto `SDK_AGENT_CALL` with the `SDK_AGENT_PROOF_ADAPTER`. Graph execution stays in the application; Intentrax receives normalized admission evidence.

package/examples/adapters/mcp.md

@@ -0,0 +1,27 @@
+# Generic MCP Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible generic MCP tool-call admission path in under a minute:
+
+~~~bash
+npx @intentrax/sdk init mcp --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/mcp-tool-call-admission.mjs`, plus
+`.intentrax/wiring/mcp-host-wiring.md`. Open the wiring guide to import
+`beforeMCPToolCall` before forwarding `tools/call` to the upstream handler.
+Submit the sample only after setting the runtime credential in your shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps MCP `tools/call` evidence onto `MCP_TOOL_CALL` with the `GENERIC_MCP_PROOF_ADAPTER`. MCP protocol truth remains upstream; AEVN/AEP evidence remains authoritative inside Intentrax.

package/examples/adapters/vercel-ai-sdk.md

@@ -0,0 +1,28 @@
+# Vercel AI SDK Adapter Quickstart
+
+Use the packaged CLI quickstart when you want a contract-admissible Vercel AI SDK route wrapper in under a minute:
+
+~~~bash
+npx @intentrax/sdk init vercel-ai-sdk --output-dir .
+~~~
+
+The command writes `.intentrax/agent-adapter.json`,
+`.intentrax/sample-admission-request.json`, `.intentrax/action-receipt.json`,
+and
+`.intentrax/hooks/vercel-ai-sdk-route-wrapper.mjs`, plus
+`.intentrax/wiring/vercel-ai-sdk-host-wiring.md`. Open the wiring guide to
+import `withIntentraxVercelAIRoute` inside the route handler before side effects
+proceed. Submit the sample only after setting the runtime credential in your
+shell:
+
+~~~bash
+export INTENTRAX_API_KEY="..."
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" \
+  -H "content-type: application/json" \
+  -H "X-Intentrax-Tenant-ID: tenant-local-dev" \
+  -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" \
+  -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" \
+  --data-binary @.intentrax/sample-admission-request.json
+~~~
+
+The generated request maps TypeScript route wrapper evidence onto `SDK_AGENT_CALL` with the `SDK_AGENT_PROOF_ADAPTER`. The SDK wrapper preserves AEVN/AEP authority and never stores private key material.

package/examples/agent-gateway-admission.md

@@ -0,0 +1,72 @@
+# TypeScript Agent Gateway Admission Example
+
+This generated example is downstream from the locked runtime Agent Gateway fixture.
+
+- SDK/client reference: sdk/typescript/http.js
+- Shared spec: sdk/shared-specs/agent-gateway-admission-examples.v1.json
+- Endpoint: POST /v1/agent/admissions
+- Required API scope: agent.gateway.admit
+
+The SDK lane should submit the normalized admission request body exactly as shown after deriving it from the MCP or A2A protocol envelope. The SDK must not execute tools, deliver A2A messages, re-evaluate policy, generate proofs, mutate proof artifacts, or handle private key material in this path.
+
+## MCP Admission Request Body
+
+~~~json
+{
+  "schema_version": "intentrax.runtime.agent_admission_request/1.0",
+  "tenant_id": "tenant-alpha",
+  "surface_id": "MCP_TOOL_CALL",
+  "action": "GET_PROOF",
+  "adapter_id": "GENERIC_MCP_PROOF_ADAPTER",
+  "evidence_refs": [
+    "sha256:46f136e995bf1921533652a0721e8ea47816d250aee0da951258bec5645754af",
+    "sha256:4c6a9a6ce776170fa968682c51efafdd39301390f94176b2029e22594917ee1f",
+    "sha256:8a6d71f9e60ab0ef32de1eb63d049adb3820104c30489a5c42e7acaeeb222ce1",
+    "sha256:8c63d17014da7fd015b77c10fb702bcf005f0ed1dee1516991747e230c3dbfc0",
+    "sha256:b4c6a6ab375273436e38f7b5fb58b1c270a453297a184c019c4cabab3007e698",
+    "sha256:b9d82729f18f8720ee4d8575192966b9aec2320b25a8e79c6e2862c005053787"
+  ],
+  "proof_refs": [
+    "sha256:46f136e995bf1921533652a0721e8ea47816d250aee0da951258bec5645754af",
+    "sha256:4c6a9a6ce776170fa968682c51efafdd39301390f94176b2029e22594917ee1f",
+    "sha256:8a6d71f9e60ab0ef32de1eb63d049adb3820104c30489a5c42e7acaeeb222ce1",
+    "sha256:8c63d17014da7fd015b77c10fb702bcf005f0ed1dee1516991747e230c3dbfc0",
+    "sha256:b4c6a6ab375273436e38f7b5fb58b1c270a453297a184c019c4cabab3007e698",
+    "sha256:b9d82729f18f8720ee4d8575192966b9aec2320b25a8e79c6e2862c005053787"
+  ],
+  "request_payload_hash": "6ae40172c3a90cd17e4e20800103a0255ec4e0c1ea34dab4cd3623c337284b6b",
+  "protocol_payload_ref": "sha256:6ae40172c3a90cd17e4e20800103a0255ec4e0c1ea34dab4cd3623c337284b6b",
+  "idempotency_key_hash": "78f5d628566a249e99a7468f670dcfa0fb175464a4540626294460179801e808"
+}
+~~~
+
+## A2A Admission Request Body
+
+~~~json
+{
+  "schema_version": "intentrax.runtime.agent_admission_request/1.0",
+  "tenant_id": "tenant-alpha",
+  "surface_id": "A2A_DELEGATION",
+  "action": "HAND_OFF_PROOF",
+  "adapter_id": "GENERIC_A2A_PROOF_ADAPTER",
+  "evidence_refs": [
+    "sha256:46f136e995bf1921533652a0721e8ea47816d250aee0da951258bec5645754af",
+    "sha256:4c6a9a6ce776170fa968682c51efafdd39301390f94176b2029e22594917ee1f",
+    "sha256:8a6d71f9e60ab0ef32de1eb63d049adb3820104c30489a5c42e7acaeeb222ce1",
+    "sha256:8c63d17014da7fd015b77c10fb702bcf005f0ed1dee1516991747e230c3dbfc0",
+    "sha256:b4c6a6ab375273436e38f7b5fb58b1c270a453297a184c019c4cabab3007e698",
+    "sha256:b9d82729f18f8720ee4d8575192966b9aec2320b25a8e79c6e2862c005053787"
+  ],
+  "proof_refs": [
+    "sha256:46f136e995bf1921533652a0721e8ea47816d250aee0da951258bec5645754af",
+    "sha256:4c6a9a6ce776170fa968682c51efafdd39301390f94176b2029e22594917ee1f",
+    "sha256:8a6d71f9e60ab0ef32de1eb63d049adb3820104c30489a5c42e7acaeeb222ce1",
+    "sha256:8c63d17014da7fd015b77c10fb702bcf005f0ed1dee1516991747e230c3dbfc0",
+    "sha256:b4c6a6ab375273436e38f7b5fb58b1c270a453297a184c019c4cabab3007e698",
+    "sha256:b9d82729f18f8720ee4d8575192966b9aec2320b25a8e79c6e2862c005053787"
+  ],
+  "request_payload_hash": "60ca15bd3edbdf8086638d66ab7fa735c51c63bcd044b29f620038fcc0df6add",
+  "protocol_payload_ref": "sha256:60ca15bd3edbdf8086638d66ab7fa735c51c63bcd044b29f620038fcc0df6add",
+  "idempotency_key_hash": "ca33f77093da4a962f26fe1f0f41f5b478a8fc30772d358e46a1412de8d9701f"
+}
+~~~

package/examples/one-command-init.md

@@ -0,0 +1,94 @@
+# One-Command Adapter Init
+
+The TypeScript SDK package exposes a small `intentrax` CLI for local adapter
+onboarding.
+
+```bash
+npx @intentrax/sdk init claude-code --dry-run
+npx @intentrax/sdk init cursor
+npx @intentrax/sdk init mcp --output-dir .
+npx @intentrax/sdk init langchain
+npx @intentrax/sdk init langgraph
+npx @intentrax/sdk init vercel-ai-sdk
+npx @intentrax/sdk init cursor --force
+npx @intentrax/sdk check-init --output-dir .
+```
+
+The six commands above are the MVP-native one-command adapters. Expanded
+scaffold aliases are also available for `custom-agent`, `crewai`, `autogen`,
+`openclaw`, `n8n`, and `deepflow`; they emit the same no-secret files and pass
+the same offline `check-init` verifier, but remain scaffold aliases rather than
+MVP-native hooks.
+
+On Windows PowerShell shells that block npm/npx `.ps1` shims, use `npx.cmd`
+with the same arguments.
+
+Without `--dry-run`, the command writes:
+
+- `.intentrax/agent-adapter.json`
+- `.intentrax/sample-admission-request.json`
+- `.intentrax/action-receipt.json`
+- `.intentrax/submit_sample.curl`
+- `.intentrax/hooks/<adapter-native-hook>.mjs`
+- `.intentrax/wiring/<adapter-host-wiring>.md`
+
+The files contain adapter metadata and a deterministic sample admission
+envelope plus a no-secret native hook or wrapper starter and a concrete host
+wiring guide. The local action receipt is a non-authoritative developer summary
+that binds the sample, hook starter, host wiring guide, submit command, and
+future AEVN/AEP evidence path by hash. The sample is contract-admissible for
+the locked private-alpha Agent Gateway bundle and the selected adapter surface.
+It does not contain API keys, tenant secrets, signing keys, or private key
+material.
+
+`intentrax init` is safe to rerun when the generated files are unchanged. If an
+existing `.intentrax` file has local edits, the CLI refuses to overwrite it and
+exits before writing anything. Use `--force` only after reviewing local changes
+that should be replaced by freshly generated scaffolding.
+
+The hook starter sanitizes auth-like fields before building event hashes and
+fails closed when runtime admission is denied or unavailable. It is still a
+bridge into the Intentrax runtime only: tool execution, payload mutation,
+policy re-evaluation, and proof generation remain outside the adapter.
+
+After initialization, verify the generated adapter offline:
+
+```bash
+npx @intentrax/sdk check-init --output-dir . --json
+```
+
+`check-init` requires no `INTENTRAX_API_KEY` and does not submit to the runtime.
+It verifies the expected `.intentrax` files, recomputes the action receipt,
+hook source, and host wiring guide hash bindings, validates the Agent Gateway
+sample fixture, and imports the generated hook in no-submit mode with a
+secret-bearing fixture to prove the starter does not leak secrets or require
+network access.
+
+The CLI output also writes `.intentrax/submit_sample.curl`, a no-secret command
+file that uses the generated sample unchanged:
+
+```bash
+curl -sS "http://127.0.0.1:8080/v1/agent/admissions" -H "content-type: application/json" -H "X-Intentrax-Tenant-ID: tenant-local-dev" -H "X-Intentrax-Api-Key: $INTENTRAX_API_KEY" -H "X-Intentrax-Idempotency-Key: <sample idempotency_key_hash>" --data-binary "@.intentrax/sample-admission-request.json"
+```
+
+MVP adapter sample shapes:
+
+| Adapter | Surface | Adapter ID | Action |
+| --- | --- | --- | --- |
+| `claude-code` | `MCP_TOOL_CALL` | `GENERIC_MCP_PROOF_ADAPTER` | `GET_PROOF` |
+| `cursor` | `MCP_TOOL_CALL` | `GENERIC_MCP_PROOF_ADAPTER` | `GET_PROOF` |
+| `mcp` | `MCP_TOOL_CALL` | `GENERIC_MCP_PROOF_ADAPTER` | `GET_PROOF` |
+| `langchain` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |
+| `langgraph` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |
+| `vercel-ai-sdk` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |
+
+Expanded scaffold sample shapes:
+
+| Adapter | Surface | Adapter ID | Action |
+| --- | --- | --- | --- |
+| `custom-agent` | `DIRECT_TOOL_CALL` | `DIRECT_TOOL_PROOF_ADAPTER` | `GET_PROOF` |
+| `crewai` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |
+| `autogen` | `A2A_DELEGATION` | `GENERIC_A2A_PROOF_ADAPTER` | `HAND_OFF_PROOF` |
+| `openclaw` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |
+| `n8n` | `DIRECT_TOOL_CALL` | `DIRECT_TOOL_PROOF_ADAPTER` | `GET_PROOF` |
+| `deepflow` | `SDK_AGENT_CALL` | `SDK_AGENT_PROOF_ADAPTER` | `SUBMIT_INTENT` |