@oni.bot/core 0.6.3 → 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,126 @@
+# Changelog
+
+All notable changes to @oni.bot/core are documented here.
+
+Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
+This project uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [1.0.0] — 2026-03-13
+
+### Breaking Changes
+- `oni-code` AI coding assistant extracted to `@oni.bot/code` (separate package)
+- `sentinel` code analysis engine extracted to `@oni.bot/sentinel` (separate package)
+- `oni` and `oni-code` CLI binaries removed from this package (install `@oni.bot/code` for the CLI)
+
+### Added
+- `./config` sub-module export (`@oni.bot/core/config`) — JSONC config loader with env var substitution and hierarchical merge
+- `"sideEffects": false` — enables full tree shaking in bundlers
+
+### Framework
+- 5 model adapters (anthropic, openai, openrouter, google, ollama) — zero runtime dependencies
+- 21 total exports: root + 20 named subpaths
+
+## [0.7.0] - 2026-03-08
+
+### Added
+- Structured error codes with `ONI_<CATEGORY>_<NAME>` taxonomy — every error carries code, category, recoverable flag, suggestion, and context
+- Per-node timeouts via `addNode(name, fn, { timeout: ms })` with `NodeTimeoutError`
+- Global default timeout via `compile({ defaults: { nodeTimeout: ms } })`
+- Circuit breaker pattern: `addNode(name, fn, { circuitBreaker: { threshold, resetAfter, fallback? } })`
+- Dead letter queue: `compile({ deadLetterQueue: true })` captures failed node inputs for recovery
+- OpenTelemetry tracing adapter (`ONITracer`) — zero-dep, user brings own tracer
+- Backpressure streaming with `BoundedBuffer` (drop-oldest and error strategies)
+- Testing utilities: `mockModel()`, `assertGraph()`, `createTestHarness()` via `@oni.bot/core/testing`
+- `oni init` CLI command for project scaffolding
+- 7 new error types: `NodeTimeoutError`, `CircuitBreakerOpenError`, `SwarmDeadlockError`, `ModelRateLimitError`, `ModelContextLengthError`, `CheckpointCorruptError`, `StoreKeyNotFoundError`
+
+### Changed
+- `ONIError` now accepts optional `ONIErrorOptions` as second constructor parameter
+- All existing error classes enhanced with structured codes (backward compatible)
+
+## [0.6.3] - 2026-03-05
+
+### Added
+- `set()` alias for `put()` on `InMemoryStore` and `NamespacedStore`
+
+## [0.6.2] - 2026-03-05
+
+### Fixed
+- `createReactAgent` now accepts `ONIModel` (auto-adapts chat to invoke)
+
+### Changed
+- Package renamed from `@oni-bot/core` to `@oni.bot/core`
+
+## [0.6.1] - 2026-03-05
+
+### Changed
+- Removed all external framework references from codebase and documentation
+
+### Fixed
+- Resolved TypeScript strict errors in swarm template `Send` casts
+
+## [0.6.0] - 2026-03-04
+
+### Added
+- `SwarmGraph` builder for multi-agent orchestration
+- `SwarmGraph.hierarchical()` template — supervisor-workers pattern
+- `SwarmGraph.fanOut()` template — parallel agent execution with reducer
+- `SwarmGraph.pipeline()` template — linear chain with conditional transitions
+- `SwarmGraph.peerNetwork()` template — decentralized agent handoffs
+- `SwarmGraph.mapReduce()` template — parallel map with reducer
+- `SwarmGraph.debate()` template — multi-round parallel debate with judge
+- `SwarmGraph.hierarchicalMesh()` template — nested team coordination
+- Lazy coordination auto-wiring (broker and pubsub) on `SwarmGraph`
+- Handoff execution — agent `Handoff` returns converted to `Command` routing
+- Retry-then-fallback — agents retry on failure, fall back to supervisor
+
+### Changed
+- Replaced `SwarmLLM` with `ONIModel` in supervisor routing
+
+## [0.5.0] - 2026-03-04
+
+### Added
+- `ONIModel` interface and core LLM types
+- Anthropic LLM adapter
+- OpenAI LLM adapter
+- Ollama LLM adapter
+- Google Gemini LLM adapter
+- Models export path and re-exports
+- Tool framework with `defineTool()` and `ToolContext`
+- `AgentContext` and agent types
+- `defineAgent()` declarative agent factory
+- `agent()` functional agent factory
+- `addAgent()` on `StateGraph` to wire agent nodes
+- Request/response and pub/sub coordination patterns
+- Tool permission guardrails
+- Budget tracking and cost control guardrails
+- Content filtering guardrails
+- Audit trail and guardrails exports
+- `EventBus` for structured lifecycle events
+- Guardrails and event bus wired into compile/execution pipeline
+- Integration tests for agents, tools, and guardrails
+
+### Removed
+- Direct `openai` dependency (adapters are now bring-your-own-client)
+
+## [0.4.0] - 2026-03-04
+
+### Added
+- `StateGraph` builder with `addNode()`, `addEdge()`, `addConditionalEdges()`
+- Pregel execution engine (`ONIPregelRunner`) with parallel superstep execution
+- `Command` and `Send` primitives for dynamic routing
+- Subgraph support via `addSubgraph()`
+- Functional API (`entrypoint`, `task`)
+- `MemoryCheckpointer` and `NoopCheckpointer`
+- `InMemoryStore` and `NamespacedStore` for shared key-value state
+- Human-in-the-loop via `interrupt()` and `getUserInput()`
+- Token streaming with `emitToken()` and `TokenStreamWriter`
+- Stream modes: `values`, `updates`, `events`, `messages`, `custom`
+- Graph inspection via `getGraphDef()`
+- `createReactAgent` prebuilt for tool-calling loops
+- `ToolNode` prebuilt for automatic tool dispatch
+- Messages reducer (`messagesReducer`, `addMessages`, `removeMessages`)
+- Retry policies with configurable backoff
+- Swarm primitives: `AgentRegistry`, `AgentPool`, `Mailbox`, `Supervisor`
+- Ephemeral channel support
+- Map-reduce parallel fan-out pattern

package/README.md

@@ -1,308 +1,109 @@
-# @oni.bot/core
+<p align="center">
+  <strong>@oni.bot/core</strong>
+</p>
 
-> The graph execution engine for agent swarms — build single agents or orchestrate multi-agent systems in TypeScript.
-> Zero dependencies. Full TypeScript generics. Pregel-based superstep engine. 7 swarm templates.
+<h3 align="center">The graph execution engine for production agent swarms.</h3>
 
-Part of the **ONI Platform** (Open Neural Infrastructure).
+<p align="center">
+  <a href="https://www.npmjs.com/package/@oni.bot/core"><img src="https://img.shields.io/npm/v/@oni.bot/core.svg" alt="npm version" /></a>
+  <a href="./LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="MIT License" /></a>
+  <img src="https://img.shields.io/badge/dependencies-0-brightgreen" alt="zero dependencies" />
+</p>
 
 ---
 
-## What It Is
-
-`@oni.bot/core` is a graph execution framework in TypeScript with production-ready swarm orchestration. Build single agents or multi-agent swarms with:
-
-- **State management** — typed channels with pluggable reducers (`lastValue`, `appendList`, `mergeObject`, `ephemeralValue`)
-- **Graph execution** — Pregel superstep model with parallel node execution, fan-out/fan-in, map-reduce
-- **5 stream modes** — `values`, `updates`, `debug`, `messages` (token-level), and `custom` events
-- **Checkpointing** — Memory, SQLite, PostgreSQL, or custom backends with time travel and fork
-- **Human-in-the-loop** — compile-time interrupts + runtime `interrupt()` with resume, typed input, approval, selection
-- **Messages** — smart reducer with deduplication, `RemoveMessage`, `UpdateMessage`, filtering, trimming
-- **Cross-thread Store** — namespaced KV store with semantic search for agent long-term memory
-- **Runtime context** — `getConfig()`, `getStore()`, `getStreamWriter()` via AsyncLocalStorage
-- **Swarm orchestration** — 7 swarm templates: hierarchical, fan-out, pipeline, peer-network, map-reduce, debate, hierarchical-mesh
-- **Functional API** — `task()`, `entrypoint()`, `pipe()`, `branch()` as alternatives to the builder pattern
-- **Prebuilt agents** — `createReactAgent()` with bring-your-own LLM
-- **Injected tools** — tools that auto-receive state + store from runtime context
-- **Graph inspection** — topology descriptors, Mermaid diagrams, cycle detection
-
----
-
-## Installation
+## Install
 
 ```bash
 npm install @oni.bot/core
 ```
 
-**Optional peer dependencies:**
-
-```bash
-npm install better-sqlite3          # for SqliteCheckpointer
-npm install pg                      # for PostgresCheckpointer
-```
+- **Zero runtime dependencies.** Self-contained TypeScript. No transitive supply-chain risk. Runs in Node.js 18+, serverless functions, and edge runtimes without adaptation.
+- **5 model adapters via raw HTTP.** Anthropic, OpenAI, OpenRouter, Google, and Ollama — no vendor SDKs required.
+- **21 exports.** Root package plus 20 named subpaths for precise tree shaking.
 
 ---
 
 ## Quick Start
 
-### Minimal graph
-
 ```ts
-import { StateGraph, START, END, lastValue, appendList } from "@oni.bot/core";
+import { StateGraph, START, END, lastValue, anthropic } from "@oni.bot/core";
+
+type State = {
+  question: string;
+  answer: string;
+};
 
-type MyState = { query: string; answer: string; log: string[] };
+const model = anthropic("claude-sonnet-4-6");
 
-const graph = new StateGraph<MyState>({
+const graph = new StateGraph<State>({
   channels: {
-    query:  lastValue(() => ""),
-    answer: lastValue(() => ""),
-    log:    appendList(() => []),
+    question: lastValue<string>(() => ""),
+    answer:   lastValue<string>(() => ""),
   },
 });
 
-graph.addNode("agent", async (state) => {
-  return { answer: `Response to: ${state.query}`, log: ["agent ran"] };
+graph.addNode("answer", async (state) => {
+  const response = await model.chat({
+    messages: [{ role: "user", content: state.question }],
+  });
+  return { answer: response.content as string };
 });
 
-graph.addEdge(START, "agent");
-graph.addEdge("agent", END);
+graph.addEdge(START, "answer");
+graph.addEdge("answer", END);
 
 const app = graph.compile();
-const result = await app.invoke({ query: "What is ONI?" });
-```
-
-### Streaming
-
-```ts
-for await (const event of app.stream({ query: "hello" }, { streamMode: "updates" })) {
-  console.log(event.node, event.data);
-}
 
-// Multiple modes simultaneously
-for await (const evt of app.stream(input, { streamMode: ["values", "messages"] })) {
-  if (evt.mode === "messages") process.stdout.write(evt.data.chunk);
+for await (const chunk of app.stream(
+  { question: "What is a Pregel execution model?" },
+  { streamMode: "values" },
+)) {
+  console.log(chunk.answer);
 }
 ```
 
-### Functional API
-
-```ts
-import { entrypoint, lastValue } from "@oni.bot/core";
-
-const app = entrypoint(
-  { channels: { query: lastValue(() => ""), answer: lastValue(() => "") } },
-  async (state) => ({ answer: await myLLM(state.query) })
-);
-
-const result = await app.invoke({ query: "hello" });
-```
-
----
-
-## Swarm Templates
-
-Build multi-agent systems with pre-wired templates. Each template configures routing, coordination, and error handling automatically.
-
-### Hierarchical (Supervisor -> Workers)
-
-```ts
-import { SwarmGraph } from "@oni.bot/core/swarm";
-
-const swarm = SwarmGraph.hierarchical<MyState>({
-  supervisor: { model: myModel, strategy: "llm", maxRounds: 10 },
-  agents: [researcher, writer, critic],
-  onError: "fallback",
-});
-
-const app = swarm.compile();
-const result = await app.invoke({ task: "Write a blog post about AI" });
-```
-
-### All 7 Templates
-
-| Template | Use case | Pattern |
-|---|---|---|
-| `SwarmGraph.hierarchical()` | Supervisor routes to workers | Supervisor -> Agent -> Supervisor -> END |
-| `SwarmGraph.fanOut()` | Parallel execution + aggregation | Send to all -> Collect -> Reduce |
-| `SwarmGraph.pipeline()` | Sequential processing chain | A -> B -> C -> END |
-| `SwarmGraph.peerNetwork()` | Agents hand off to each other | Dynamic peer-to-peer routing |
-| `SwarmGraph.mapReduce()` | Distribute N items across pool | Split -> AgentPool -> Collect -> Reduce |
-| `SwarmGraph.debate()` | Multi-round argumentation | Judge -> Debaters -> Judge -> consensus? |
-| `SwarmGraph.hierarchicalMesh()` | Nested supervisor teams | Coordinator -> Team subgraphs -> Coordinator |
-
-See `examples/swarm/` for complete runnable examples of each template.
-
-### Single Agent — No Swarm Required
-
-The swarm layer is purely additive. If you just need one agent:
-
-```ts
-import { defineAgent } from "@oni.bot/core/agents";
-import { anthropic } from "@oni.bot/core/models";
-
-const agent = defineAgent({
-  name: "assistant",
-  model: anthropic("claude-sonnet-4-6"),
-  tools: [webSearch],
-  systemPrompt: "You are a helpful assistant.",
-});
-
-const result = await agent.invoke({ messages: [{ role: "user", content: "Hello!" }] });
-```
-
-Entry points at every level: `ONIModel` -> `defineAgent()` -> `StateGraph` -> `SwarmGraph`.
-
 ---
 
-## Features at a Glance
-
-| Feature | Description | Example | Guide |
-|---|---|---|---|
-| Channels | Typed state with pluggable reducers | `examples/ephemeral-channels.ts` | [Section 2](docs/GUIDE.md#2-channels-deep-dive) |
-| Command routing | State update + routing in one return | `examples/command-routing.ts` | [Section 3](docs/GUIDE.md#3-edges-and-routing) |
-| Token streaming | `messages` mode + `getStreamWriter()` | `examples/messages-stream.ts` | [Section 4](docs/GUIDE.md#4-streaming) |
-| Multi-stream | Multiple stream modes simultaneously | `examples/multi-stream.ts` | [Section 4](docs/GUIDE.md#4-streaming) |
-| Custom events | Emit named events via StreamWriter | `examples/custom-stream.ts` | [Section 4](docs/GUIDE.md#4-streaming) |
-| Messages | Smart reducer, helpers, RemoveMessage | `examples/messages-reducer.ts` | [Section 5](docs/GUIDE.md#5-messages) |
-| Checkpointing | Memory, SQLite, PostgreSQL backends | `examples/time-travel.ts` | [Section 6](docs/GUIDE.md#6-checkpointing) |
-| HITL interrupts | `interrupt()`, `getUserApproval()` | `examples/hitl/` | [Section 7](docs/GUIDE.md#7-human-in-the-loop) |
-| Dynamic interrupts | Runtime breakpoint conditions | `examples/dynamic-interrupt.ts` | [Section 7](docs/GUIDE.md#7-human-in-the-loop) |
-| Cross-thread Store | Namespaced KV with semantic search | `examples/store-memory.ts` | [Section 8](docs/GUIDE.md#8-cross-thread-store) |
-| Subgraphs | Nested skeletons + Command.PARENT | `examples/subgraph.ts` | [Section 9](docs/GUIDE.md#9-subgraphs) |
-| Parallel fan-out | Static + dynamic (Send API) | `examples/parallel-fanout.ts` | [Section 10](docs/GUIDE.md#10-parallel-execution) |
-| Map-reduce | Send + fan-in barrier | `examples/map-reduce.ts` | [Section 10](docs/GUIDE.md#10-parallel-execution) |
-| Runtime context | `getConfig()`, `getStore()`, etc. | `examples/runtime-context.ts` | [Section 11](docs/GUIDE.md#11-runtime-context) |
-| Retry + cache | Per-node retry policy with backoff | `examples/retry-policy.ts` | [Section 12](docs/GUIDE.md#12-retry-and-cache) |
-| Functional API | `task`, `entrypoint`, `pipe`, `branch` | `examples/functional-api.ts` | [Section 13](docs/GUIDE.md#13-functional-api) |
-| ReAct agent | Prebuilt agent loop with tools | `examples/react-agent.ts` | [Section 14](docs/GUIDE.md#14-prebuilt-components) |
-| Graph inspection | Topology, Mermaid, cycle detection | `examples/graph-inspection.ts` | [Section 16](docs/GUIDE.md#16-graph-inspection) |
-| Time travel | `getHistory`, `getStateAt`, `forkFrom` | `examples/time-travel.ts` | [Section 17](docs/GUIDE.md#17-time-travel) |
-| Swarm | 7 templates + Supervisor, Handoff, retry-fallback, coordination | `examples/swarm/` | [Section 18](docs/GUIDE.md#18-swarm-orchestration) |
+## Sub-modules
 
----
-
-## Core Concepts
-
-### Channels
-
-Every state field has a **channel** — a reducer + default factory that controls how concurrent updates merge.
-
-```ts
-import { lastValue, appendList, mergeObject, ephemeralValue } from "@oni.bot/core";
-
-const channels = {
-  query:    lastValue(() => ""),          // last write wins
-  messages: appendList(() => []),         // arrays concatenate
-  context:  mergeObject(() => ({})),      // shallow merge
-  scratch:  ephemeralValue(() => null),   // resets each superstep
-};
-```
-
-### Nodes, edges, compile
-
-```ts
-graph.addNode("agent", async (state, config?) => {
-  return { answer: "partial update" };  // or Command, or void
-});
-
-graph.addEdge(START, "agent");
-graph.addConditionalEdges("agent", (state) => state.done ? END : "tools");
-
-const app = graph.compile({ checkpointer, store });
-```
+21 entry points — import only what you use.
 
-### Invoke / Stream / Batch
-
-```ts
-const result  = await app.invoke(input, { threadId: "t1" });
-const stream  = app.stream(input, { streamMode: "updates" });
-const results = await app.batch([input1, input2]);
-```
-
-For the full progressive tutorial, see **[docs/GUIDE.md](docs/GUIDE.md)**.
-
----
-
-## Sub-module Exports
-
-Tree-shakeable sub-module imports for bundle optimization:
-
-| Import path | Contents |
+| Subpath | Description |
 |---|---|
-| `@oni.bot/core` | Everything (116+ exports) |
-| `@oni.bot/core/prebuilt` | `createReactAgent`, `createToolNode`, `toolsCondition`, types |
-| `@oni.bot/core/swarm` | `SwarmGraph` (7 templates), `AgentRegistry`, `AgentPool`, `Handoff`, `Supervisor`, `Mailbox`, coordination |
-| `@oni.bot/core/hitl` | `interrupt`, `getUserInput`, `getUserApproval`, `getUserSelection`, session store |
-| `@oni.bot/core/store` | `BaseStore`, `InMemoryStore`, `NamespacedStore`, `AgentMemoryStore` |
-| `@oni.bot/core/messages` | `messagesChannel`, `messagesReducer`, helpers, `RemoveMessage`, `UpdateMessage` |
-| `@oni.bot/core/checkpointers` | `SqliteCheckpointer`, `PostgresCheckpointer`, `NamespacedCheckpointer` |
-| `@oni.bot/core/functional` | `task`, `entrypoint`, `pipe`, `branch` |
-| `@oni.bot/core/inspect` | `buildGraphDescriptor`, `toMermaidDetailed` |
-| `@oni.bot/core/streaming` | `emitToken`, `TokenStreamWriter`, `StreamWriterImpl` |
-| `@oni.bot/core/models` | `ONIModel`, `anthropic()`, `openai()` model factories |
-| `@oni.bot/core/agents` | `defineAgent`, `agent()`, `AgentContext`, types |
-| `@oni.bot/core/coordination` | `RequestReplyBroker`, `PubSub` coordination primitives |
-| `@oni.bot/core/guardrails` | `InputGuardrail`, `OutputGuardrail`, guardrail types |
-| `@oni.bot/core/tools` | `defineTool`, `createInjectedTool`, tool types |
-
----
-
-## Architecture
-
-```
-@oni.bot/core v0.6.0
-├── StateGraph / MessageGraph     ← fluent graph builder
-│   ├── addNode / addSubgraph     ← nodes are async functions or compiled skeletons
-│   ├── addEdge / addConditional  ← static + dynamic routing
-│   └── compile()
-│       └── ONIPregelRunner       ← superstep execution engine
-│           ├── parallel node execution (Promise.all per superstep)
-│           ├── channel reducers (state merging)
-│           ├── edge resolution + Command routing
-│           ├── Send API (dynamic fan-out)
-│           ├── checkpointing (Memory / SQLite / Postgres / custom)
-│           ├── interrupt handling (boundary + in-node)
-│           ├── retry engine (exponential backoff)
-│           ├── runtime context (AsyncLocalStorage)
-│           └── stream writer (tokens + custom events + messages)
-│
-├── Messages         ← smart reducer, dedup, RemoveMessage, UpdateMessage
-├── HITL             ← interrupt(), getUserInput, sessions, resume
-├── Store            ← BaseStore, InMemoryStore, NamespacedStore, AgentMemoryStore
-├── Swarm            ← SwarmGraph (7 templates), Supervisor, Handoff, AgentPool, coordination
-│   ├── Templates    ← hierarchical, fanOut, pipeline, peerNetwork, mapReduce, debate, hierarchicalMesh
-│   ├── Coordination ← RequestReplyBroker, PubSub (lazy auto-wired)
-│   └── Retry        ← retry-then-fallback error recovery
-├── Functional       ← task, entrypoint, pipe, branch
-├── Prebuilt         ← createReactAgent, createToolNode, toolsCondition
-├── Inspect          ← graph descriptors, Mermaid, cycle detection
-├── Injected Tools   ← createInjectedTool (state + store auto-injected)
-├── Stream Events    ← streamEvents v2 protocol
-└── Errors           ← ONIError hierarchy, ONIInterrupt
-```
+| `@oni.bot/core` | Core engine: `StateGraph`, `START`, `END`, channels, `Command`, `Send` |
+| `@oni.bot/core/prebuilt` | Prebuilt agents: `createReactAgent`, `defineAgent` |
+| `@oni.bot/core/swarm` | Swarm templates: `SwarmGraph` (hierarchical, fan-out, pipeline, peer-network, map-reduce, debate, mesh) |
+| `@oni.bot/core/hitl` | Human-in-the-loop: `interrupt`, `getUserInput`, `getUserApproval` |
+| `@oni.bot/core/store` | Cross-thread KV store: `InMemoryStore`, `BaseStore`, `NamespacedStore` |
+| `@oni.bot/core/messages` | Message channel primitives: `messagesChannel`, `MessageAnnotation` |
+| `@oni.bot/core/checkpointers` | Persistence backends: `MemoryCheckpointer`, `SqliteCheckpointer` |
+| `@oni.bot/core/functional` | Functional API: `task`, `entrypoint`, `pipe`, `branch` |
+| `@oni.bot/core/inspect` | Graph inspection: `buildGraphDescriptor`, `toMermaid`, cycle detection |
+| `@oni.bot/core/streaming` | Token streaming: `emitToken`, `getStreamWriter`, `StreamWriter` |
+| `@oni.bot/core/models` | LLM adapters: `anthropic`, `openai`, `openrouter`, `google`, `ollama` |
+| `@oni.bot/core/tools` | Tool definition: `defineTool`, `ToolSchema`, `ToolResult` |
+| `@oni.bot/core/agents` | Agent builder: `defineAgent`, `AgentDefinition` |
+| `@oni.bot/core/coordination` | Inter-agent messaging: `RequestReplyBroker`, `PubSub` |
+| `@oni.bot/core/events` | Event bus: `EventBus`, 10 lifecycle event types |
+| `@oni.bot/core/guardrails` | Budget and safety: `BudgetTracker`, `ContentFilter`, `PermissionGuard` |
+| `@oni.bot/core/testing` | Test utilities: `mockModel`, `assertGraph`, `createTestHarness` |
+| `@oni.bot/core/harness` | Agentic loop: `ONIHarness`, `AgentLoop`, `HooksEngine`, `ContextCompactor` |
+| `@oni.bot/core/mcp` | MCP client: JSON-RPC/stdio tool bridge |
+| `@oni.bot/core/lsp` | LSP client: language server protocol primitives |
+| `@oni.bot/core/config` | Config loader: JSONC parsing, environment variable resolution |
 
 ---
 
-## ONI Platform
-
-`@oni.bot/core` is the foundation layer. Other ONI packages build on top:
-
-| Package | Built on |
-|---|---|
-| `@oni/agentOS` | AgentOS ADE — multi-agent orchestration |
-| `@oni/vectorforge` | VectorForge — knowledge base & SOP retrieval |
-| `@oni/cic` | CIC Agent Assist — call center intelligence |
-| `@oni/oats` | OATS — Five9 AI Agent Assist integration |
-
----
+## Ecosystem
 
-## Documentation
+**Built on @oni.bot/core:**
 
-- **[Developer Guide](docs/GUIDE.md)** — Progressive tutorial from zero to advanced (19 sections)
-- **[API Reference](docs/API.md)** — Complete reference for all 116+ public exports
-- **[Examples](examples/)** — 30+ runnable example files covering every feature
+- [`@oni.bot/code`](https://github.com/AP3X-Dev) — AI coding assistant CLI *(coming soon)*
+- [`@oni.bot/sentinel`](https://github.com/AP3X-Dev) — Code analysis and review engine *(coming soon)*
 
 ---
 
 ## License
 
-MIT — ONI Platform
+MIT — [AP3X Dev](https://github.com/AP3X-Dev)

package/SECURITY.md

@@ -0,0 +1,71 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.7.x   | :white_check_mark: |
+| < 0.7   | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in `@oni.bot/core`, please report it responsibly:
+
+1. **Do not** open a public GitHub issue
+2. Email **security@oni.bot** with:
+   - Description of the vulnerability
+   - Steps to reproduce
+   - Potential impact
+   - Suggested fix (if any)
+3. You will receive acknowledgment within **48 hours**
+4. A fix will be released within **7 days** for critical issues
+
+## Security Considerations
+
+### Tool Execution
+
+`@oni.bot/core` provides a tool execution framework. The framework itself does not execute arbitrary code, but user-defined node functions and tools can. Users are responsible for:
+
+- Validating tool inputs before execution
+- Using the built-in `Permissions` guardrail to restrict tool access
+- Implementing appropriate sandboxing for untrusted tool code
+
+### Model API Keys
+
+API keys for model providers (OpenAI, Anthropic, etc.) should be:
+
+- Stored in environment variables, not in code
+- Never logged or included in error messages
+- Rotated regularly
+
+### Budget Enforcement
+
+The `BudgetTracker` guardrail provides cost limits but should not be the sole control:
+
+- Set conservative budget limits
+- Monitor usage through the telemetry/audit system
+- Implement server-side rate limiting for production deployments
+
+### Checkpoint Data
+
+Checkpoint data may contain sensitive state. When using persistent checkpointers:
+
+- Use encrypted storage for SQLite/PostgreSQL backends
+- Implement TTL-based cleanup for old checkpoints
+- Restrict access to checkpoint storage
+
+### Content Filtering
+
+The guardrails module provides content filters (PII, topic). These are best-effort:
+
+- Do not rely solely on built-in filters for compliance
+- Layer additional filtering for sensitive domains (healthcare, finance)
+- Audit filter effectiveness regularly
+
+## Dependencies
+
+`@oni.bot/core` ships with **zero runtime dependencies**. Optional peer dependencies:
+
+- `better-sqlite3` — for SQLite checkpointing (optional)
+
+This minimizes supply chain attack surface.

package/dist/checkpointers/sqlite.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/checkpointers/sqlite.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAQzF,qBAAa,kBAAkB,CAAC,CAAC,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAvC,OAAO;WAEM,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IA2BhE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAOvD,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IA6BjF,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAK7E,KAAK,IAAI,IAAI;IAEb,OAAO,CAAC,WAAW;CAYpB"}
+{"version":3,"file":"sqlite.d.ts","sourceRoot":"","sources":["../../src/checkpointers/sqlite.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AASzF,qBAAa,kBAAkB,CAAC,CAAC,CAAE,YAAW,eAAe,CAAC,CAAC,CAAC;IAC1C,OAAO,CAAC,QAAQ,CAAC,EAAE;IAAvC,OAAO;WAEM,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;IA4BhE,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAOvD,GAAG,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAaxC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC;IA6BjF,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAK7E,KAAK,IAAI,IAAI;IAEb,OAAO,CAAC,WAAW;CA4BpB"}