@op0ai/sdk 0.1.0

package/dist/index.js

@@ -0,0 +1,175 @@
+// @op0-ai/cord — the H2–H5 cord runtime + authoring SDK. Still PURE TS, zero deps — it runs in plain Node
+// (the verify path, no npm) AND inside a Worker. The production runtime is Flue (agent = a Durable Object)
+// on Pi on the CF Agents SDK (ADR-1/2/3); this shim implements the SAME authoring surface
+// (defineCord / use / guards / expose / run) plus the H2–H5 run pipeline, so a cord authored here ports to
+// the real runtime unchanged.
+//
+// H2  exposure         — `expose:{codemode,mcp,cli,openapi}` is carried into the generated manifest + the
+//                        Worker's /mcp + /openapi.json. Code-mode is hosted by executor (not self-hosted).
+// H3  vault write      — after the gate redacts, the run persists its deliverable via the Vault seam.
+// H4  deepsec gate     — scope check (deny off-allow-list) + redaction + a hash-chained audit, per run.
+// H5  cycle-guard      — every sub-cord call reserves against a shared RunBudget (cap + maxDepth) so a
+//     + publish/fork     composition can't recurse/spend without bound; `manifest`/`wellKnown` emit the
+//                        forkable cord.json + /.well-known/op0.json (ADR-18/25).
+export * from "./hash.js";
+export * from "./vault.js";
+export * from "./guards.js";
+export * from "./platform.js";
+export * from "./agent.js";
+// Governed-CF-Agent surface (2026-06-30 reconciliation): the typed bidirectional Source, the AG-UI event layer
+// (wire + observability), and the typed governed-tool port. The CF binding (define.ts) + thin typed client land next.
+export * from "./source.js";
+export * from "./agui.js";
+export * from "./tool.js";
+export * from "./config.js";
+export * from "./define.js";
+// Vendor adapters (gatewayModel, toAiTools, runCordChat) live in @op0-ai/cord-ai — core stays vendor-free (dep-lint enforced).
+// evlog lane (2026-06-30): wide-events → Analytics Engine + a tamper-evident, DO-persisted audit chain, tied to
+// the run via cordObserver. The ops+audit sibling of the AG-UI timeline (same runId).
+export * from "./evlog.js";
+// host ledger contract (C1.1): the ask-event defined ONCE — host builds it, sink validates it, meter counts it.
+export * from "./events.js";
+// usectx (2026-06-30): the context-acquisition seam — acquire(target) => FileSet, routed via connections
+// (github/executor/http/fs/custom) with in-band redaction + audit. The READ-side Source (sibling to source.ts's write side).
+export * from "./usectx.js";
+// skill-distiller (2026-06-30): sessions → reusable skills (the distillation flywheel). One Session envelope over
+// cord evlog sessions + coding-agent (lapdog/trajectory) sessions; distill(session, note) → SkillDraft → sink.
+export * from "./distill.js";
+// DataDO data-plane (2026-06-30): Convex-style query/mutation/action over a DO's single-writer store + the reactive
+// engine (read-set tracking → recompute only intersecting subscriptions → push full result + version). onloop app data.
+export * from "./data.js";
+import { hashHex, slug, newId } from "./hash.js";
+import { makeAuditChain } from "./guards.js";
+/** Mount an OWNED sub-cord in-process (deterministic trunk). */
+export function use(sc) {
+    return { id: sc.id, mount: "local", run: sc.run };
+}
+/** Mount a THIRD-PARTY/registry cord over MCP (the trust boundary; an executor toolkit). */
+export function useRemote(sc) {
+    return { id: sc.id, mount: "registry", run: sc.call };
+}
+const now = () => (typeof performance !== "undefined" ? performance.now() : Date.now());
+const errOf = (e) => ({ code: "cord.run", why: e instanceof Error ? e.message : String(e) });
+export function defineCord(def) {
+    const guards = def.guards ?? [];
+    const expose = def.expose ?? { codemode: true };
+    const manifest = {
+        id: def.id, version: "0.1.0",
+        kind: def.kind ?? "agent-ful", inference: def.inference ?? "managed",
+        ...(def.scope !== undefined ? { scope: def.scope } : {}), expose,
+        subcords: Object.values(def.subcords ?? {}).map((s) => s.id),
+        guards: guards.map((g) => g.name),
+        needs: def.needs ?? [],
+    };
+    const runFull = async (input, opts = {}) => {
+        const runId = newId();
+        const tenantId = opts.tenantId ?? "local";
+        const scope = opts.scope ?? def.scope;
+        const budget = { cap: opts.budget?.cap ?? 64, used: 0, depth: 0, maxDepth: opts.budget?.maxDepth ?? 8 };
+        const events = [];
+        const chain = makeAuditChain();
+        const emit = (e) => { events.push(e); opts.onEvent?.(e); for (const g of guards)
+            g.onEvent?.(e); };
+        const span = (kind, name, ms, ok, error, attrs) => ({
+            ts: new Date().toISOString(), runId, tenantId, cordId: def.id, kind, name, durationMs: Math.round(ms), ok,
+            ...(scope !== undefined ? { scope } : {}),
+            ...(error !== undefined ? { error } : {}),
+            ...(attrs !== undefined ? { attrs } : {}),
+        });
+        // H4 — gate: deepsec authorizes the run scope (throws if off-allow-list), then audit the authorization.
+        // Guards run in the author-declared order (def.guards) and any may throw to refuse the run — sequential
+        // by design (a later guard should see the run as already vetted by earlier ones, not race them).
+        const gev = { cord: def.id, ...(scope !== undefined ? { scope } : {}), input };
+        for (const g of guards) {
+            // oxlint-disable-next-line no-await-in-loop
+            await g.onCall?.(gev);
+        }
+        chain.append({ actor: "deepsec", action: "run.authorize", scopeId: scope ?? "", payload: { cord: def.id, tenantId } });
+        // Resolve host-bound resources (the adapter model). opts.vault is a shorthand for resources.vault. A cord
+        // that declares `needs` fails fast here if the host bound none — a missing binding is a deploy bug, not a
+        // silent no-op. (Trust boundary: validate, never simplify away — ponytail.)
+        const res = { ...opts.resources };
+        if (opts.vault && !res.vault)
+            res.vault = opts.vault;
+        for (const need of def.needs ?? []) {
+            if (!res[need])
+                throw new Error(`cord ${def.id}: required resource "${need}" not bound by the host`);
+        }
+        // H5 — wrap each sub-cord with the cycle-guard (budget + maxDepth) and a per-step wide-event.
+        const ctx = {};
+        for (const key of Object.keys(def.subcords ?? {})) {
+            const sc = def.subcords[key];
+            if (!sc)
+                continue;
+            ctx[key] = async (i) => {
+                if (budget.depth >= budget.maxDepth)
+                    throw new Error(`cord: cycle-guard tripped (maxDepth ${budget.maxDepth}) at ${sc.id}`);
+                if (budget.used + 1 > budget.cap)
+                    throw new Error(`cord: run budget exhausted (cap ${budget.cap}) at ${sc.id}`);
+                budget.used += 1;
+                budget.depth += 1;
+                const s0 = now();
+                try {
+                    const out = await sc.run(i);
+                    emit(span("step", sc.id, now() - s0, true));
+                    return out;
+                }
+                catch (e) {
+                    emit(span("step", sc.id, now() - s0, false, errOf(e)));
+                    throw e;
+                }
+                finally {
+                    budget.depth -= 1;
+                }
+            };
+        }
+        // the deterministic trunk
+        const t0 = now();
+        let output;
+        try {
+            output = await def.run(input, ctx, res);
+            emit(span("turn", def.id, now() - t0, true, undefined, { used: budget.used }));
+        }
+        catch (e) {
+            emit(span("turn", def.id, now() - t0, false, errOf(e)));
+            chain.append({ actor: "deepsec", action: "run.error", scopeId: scope ?? "", payload: errOf(e) });
+            throw e;
+        }
+        // H4 — redaction: scrub secrets/PII before the output is persisted or exported.
+        let safe = output;
+        for (const g of guards)
+            if (g.redact)
+                safe = g.redact(safe);
+        // H3 — vault write: every assess leaves a versioned deliverable.
+        let artifact;
+        if (res.vault) {
+            // ponytail: key by cord id + runId. Was keyed off input.target (deepeval-specific leaking into the
+            // generic core) — keying by the cord is correct for every cord.
+            const key = `reports/${slug(def.id)}/${runId}.json`;
+            artifact = await res.vault.put(key, JSON.stringify(safe, null, 2), { runId, tenantId, cord: def.id });
+            chain.append({ actor: "deepsec", action: "artifact.write", scopeId: scope ?? "", payload: { key: artifact.key, version: artifact.version, hash: artifact.hash } });
+        }
+        chain.append({ actor: "deepsec", action: "run.settle", scopeId: scope ?? "", payload: { runId, ok: true, used: budget.used } });
+        return { output: safe, runId, ...(artifact !== undefined ? { artifact } : {}), audit: chain.entries, events, budget };
+    };
+    return {
+        id: def.id,
+        expose,
+        manifest,
+        run: async (input, opts) => (await runFull(input, opts)).output,
+        runFull,
+    };
+}
+// ---- H5: publish/fork — the forkable manifest + the generated discovery endpoint ----
+/** /.well-known/op0.json (ADR-18) generated from the cord's `expose`. Host is filled at deploy. */
+export const wellKnown = (m, host = "https://host") => ({
+    mcp: m.expose.mcp ? [`${host}${m.expose.mcp}`] : [],
+    docs: `${host}/llms.txt`,
+    ...(m.expose.openapi ? { openapi: `${host}/openapi.json` } : {}),
+    ...(m.expose.cli ? { cli: `${host}/cli` } : {}),
+    skills: "/.well-known/agent-skills/",
+    ...(m.scope ? { auth: { type: "oauth2", scopes: [m.scope] } } : {}),
+});
+/** Content-address the manifest for skillkit publish/fork lineage (signed → forkOf{atCommit} later, ADR-22). */
+export const signManifest = (m) => ({ manifest: m, hash: hashHex(JSON.stringify(m)) });
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0GAA0G;AAC1G,2GAA2G;AAC3G,0FAA0F;AAC1F,2GAA2G;AAC3G,8BAA8B;AAC9B,EAAE;AACF,0GAA0G;AAC1G,2GAA2G;AAC3G,sGAAsG;AACtG,wGAAwG;AACxG,uGAAuG;AACvG,wGAAwG;AACxG,iFAAiF;AACjF,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,YAAY,CAAC;AAC3B,+GAA+G;AAC/G,sHAAsH;AACtH,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,+HAA+H;AAC/H,gHAAgH;AAChH,sFAAsF;AACtF,cAAc,YAAY,CAAC;AAC3B,gHAAgH;AAChH,cAAc,aAAa,CAAC;AAC5B,yGAAyG;AACzG,6HAA6H;AAC7H,cAAc,aAAa,CAAC;AAC5B,kHAAkH;AAClH,+GAA+G;AAC/G,cAAc,cAAc,CAAC;AAC7B,oHAAoH;AACpH,wHAAwH;AACxH,cAAc,WAAW,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAGjD,OAAO,EAAE,cAAc,EAAgE,MAAM,aAAa,CAAC;AAU3G,gEAAgE;AAChE,MAAM,UAAU,GAAG,CAAO,EAAiD;IACzE,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC;AACpD,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,SAAS,CAAO,EAAkD;IAChF,OAAO,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAyDD,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,OAAO,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;AACxF,MAAM,KAAK,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEtG,MAAM,UAAU,UAAU,CAAgB,GAA2B;IACnE,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,MAAM,MAAM,GAAW,GAAG,CAAC,MAAM,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IACxD,MAAM,QAAQ,GAAiB;QAC7B,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO;QAC5B,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;QACpE,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM;QAChE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACjC,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,EAAE;KACvB,CAAC;IAEF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAY,EAAE,OAAgB,EAAE,EAA8B,EAAE;QACrF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC;QACtC,MAAM,MAAM,GAAc,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,IAAI,CAAC,EAAE,CAAC;QACnH,MAAM,MAAM,GAAgB,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,CAAC,CAAY,EAAE,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9G,MAAM,IAAI,GAAG,CAAC,IAAuB,EAAE,IAAY,EAAE,EAAU,EAAE,EAAW,EAAE,KAA0B,EAAE,KAA+B,EAAa,EAAE,CACtJ,CAAC;YACC,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE;YACzG,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,CAAC,CAAC;QAEL,wGAAwG;QACxG,wGAAwG;QACxG,iGAAiG;QACjG,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;QAC3F,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,4CAA4C;YAC5C,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAEvH,0GAA0G;QAC1G,0GAA0G;QAC1G,4EAA4E;QAC5E,MAAM,GAAG,GAAc,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7C,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,wBAAwB,IAAI,yBAAyB,CAAC,CAAC;QACvG,CAAC;QAED,8FAA8F;QAC9F,MAAM,GAAG,GAAiD,EAAE,CAAC;QAC7D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;YAClD,MAAM,EAAE,GAAG,GAAG,CAAC,QAAS,CAAC,GAAG,CAAC,CAAC;YAC9B,IAAI,CAAC,EAAE;gBAAE,SAAS;YAClB,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,EAAE,CAAM,EAAE,EAAE;gBAC1B,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,MAAM,CAAC,QAAQ,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC5H,IAAI,MAAM,CAAC,IAAI,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;gBAChH,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC;gBAAC,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpC,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC;oBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;oBAC5C,OAAO,GAAG,CAAC;gBACb,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACvD,MAAM,CAAC,CAAC;gBACV,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;gBACpB,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;QAED,0BAA0B;QAC1B,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,MAAM,CAAC,CAAC;QACV,CAAC;QAED,gFAAgF;QAChF,IAAI,IAAI,GAAG,MAAM,CAAC;QAClB,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,IAAI,CAAC,CAAC,MAAM;gBAAE,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE5D,iEAAiE;QACjE,IAAI,QAAuC,CAAC;QAC5C,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,mGAAmG;YACnG,gEAAgE;YAChE,MAAM,GAAG,GAAG,WAAW,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,KAAK,OAAO,CAAC;YACpD,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrK,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxH,CAAC,CAAC;IAEF,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM;QACN,QAAQ;QACR,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM;QAC/D,OAAO;KACR,CAAC;AACJ,CAAC;AAED,wFAAwF;AAExF,mGAAmG;AACnG,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAe,EAAE,IAAI,GAAG,cAAc,EAAE,EAAE,CAAC,CAAC;IACpE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;IACnD,IAAI,EAAE,GAAG,IAAI,WAAW;IACxB,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/C,MAAM,EAAE,4BAA4B;IACpC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CACpE,CAAC,CAAC;AAEH,gHAAgH;AAChH,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAe,EAA4C,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC"}

package/dist/platform.d.ts

@@ -0,0 +1,97 @@
+import type { Vault } from "./vault.ts";
+/**
+ * Durable, strongly-consistent mutable state keyed by string.
+ *  - CF host  → a Durable Object (single-threaded actor → `incr` is atomic). See worker/src/kv.ts.
+ *  - Node host → a Map (memKv) now; sqlite/Redis when state must outlive the process.
+ */
+export interface Kv {
+    get(key: string): Promise<string | null>;
+    put(key: string, value: string): Promise<void>;
+    /** Atomic read-modify-write; returns the new total. Safe because the backing actor serialises writes. */
+    incr(key: string, by?: number): Promise<number>;
+}
+export type ToolCall = {
+    id: string;
+    name: string;
+    args: Record<string, unknown>;
+};
+export type Message = {
+    role: "system" | "user" | "assistant" | "tool";
+    content: string;
+    toolCallId?: string;
+    toolCalls?: ToolCall[];
+};
+/** A callable the agent may invoke — almost always a thin wrapper over a governed port (governed-tools = ports).
+ *  `parameters` is the JSON-schema for args (function-calling models need it); fakeInference ignores it. */
+export type ToolSpec = {
+    name: string;
+    description: string;
+    parameters?: Record<string, unknown>;
+    run: (args: Record<string, unknown>) => Promise<unknown>;
+};
+/** The model call (chat + tool-calling). Adapters: fakeInference (tests) · AI Gateway / Anthropic (worker). */
+export interface Inference {
+    generate(req: {
+        messages: Message[];
+        tools?: ToolSpec[];
+    }): Promise<{
+        text?: string;
+        toolCalls?: ToolCall[];
+    }>;
+}
+/** The agent loop (model → tools → stop). Adapters: minimalHarness (in-house, stack-native) · Flue · Project Think. */
+export interface Harness {
+    run(spec: {
+        instructions: string;
+        input: string;
+        tools: ToolSpec[];
+        maxSteps?: number;
+    }): Promise<{
+        output: string;
+        steps: number;
+    }>;
+}
+/** What a host provides to a run. A cord declares the keys it needs; the runtime validates they're bound. */
+export interface Resources {
+    vault?: Vault;
+    kv?: Kv;
+    inference?: Inference;
+    harness?: Harness;
+}
+export type ResourceNeed = keyof Resources;
+/** In-memory Kv — the Node/verify host. ponytail: a Map; swap for sqlite/Redis when state must outlive the run. */
+export declare const memKv: () => Kv;
+/** The full computer, when a cord binds one — NEVER the foundation (the spine runs without it).
+ *  Adapters: fake/mem (tests) · node-local (dev) · the governed remote path via usectx (fleet cords, R3+)
+ *  · CF Sandbox / E2B host-side where containers exist. */
+export interface Sandbox {
+    exec(cmd: string, opts?: {
+        cwd?: string;
+        timeoutMs?: number;
+        env?: Record<string, string>;
+    }): Promise<{
+        ok: boolean;
+        stdout: string;
+        stderr: string;
+    }>;
+    readFile(path: string): Promise<string | null>;
+    writeFile(path: string, content: string): Promise<void>;
+}
+/** A cord run IS a governed loop, declared up front. Goal condition (when to stop), scope (what it may
+ *  touch), stop rules (success / failure / budget), verifier (who checks). The market's /loop vocabulary,
+ *  native to the cord. */
+export interface RunSpec {
+    /** The verifiable end state — a run without one is a wander, not a loop. */
+    goal: string;
+    /** What the run may touch (paths, tools, connections) — grants are the hard boundary; this is the declared intent. */
+    scope?: string[];
+    stop?: {
+        /** Hard step ceiling for the loop (default: the harness's own cap). */
+        maxSteps?: number;
+        /** Spend ceiling (model + tool cost units) — exceeded ⇒ honest halt, ledgered. */
+        budget?: number;
+    };
+    /** Who checks the result: a verifier cord/tool name, or "none" (explicitly unverified). */
+    verifier?: string;
+}
+//# sourceMappingURL=platform.d.ts.map

package/dist/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;GAIG;AACH,MAAM,WAAW,EAAE;IACjB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,yGAAyG;IACzG,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACjD;AAQD,MAAM,MAAM,QAAQ,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC;AAInF,MAAM,MAAM,OAAO,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;CAAE,CAAC;AACvI;4GAC4G;AAC5G,MAAM,MAAM,QAAQ,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC;AAE7J,+GAA+G;AAC/G,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAA;KAAE,CAAC,CAAC;CAChH;AAED,uHAAuH;AACvH,MAAM,WAAW,OAAO;IACtB,GAAG,CAAC,IAAI,EAAE;QAAE,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtI;AAED,6GAA6G;AAC7G,MAAM,WAAW,SAAS;IACxB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,EAAE,CAAC,EAAE,EAAE,CAAC;IACR,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;CAEnB;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC;AAE3C,mHAAmH;AACnH,eAAO,MAAM,KAAK,QAAO,EAOxB,CAAC;AAGF;;2DAE2D;AAC3D,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvJ,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAGD;;0BAE0B;AAC1B,MAAM,WAAW,OAAO;IACtB,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;IACb,sHAAsH;IACtH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,IAAI,CAAC,EAAE;QACL,uEAAuE;QACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,kFAAkF;QAClF,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/platform.js

@@ -0,0 +1,10 @@
+/** In-memory Kv — the Node/verify host. ponytail: a Map; swap for sqlite/Redis when state must outlive the run. */
+export const memKv = () => {
+    const m = new Map();
+    return {
+        async get(k) { return m.get(k) ?? null; },
+        async put(k, v) { m.set(k, v); },
+        async incr(k, by = 1) { const n = Number(m.get(k) ?? 0) + by; m.set(k, String(n)); return n; },
+    };
+};
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAwDA,mHAAmH;AACnH,MAAM,CAAC,MAAM,KAAK,GAAG,GAAO,EAAE;IAC5B,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;KAC/F,CAAC;AACJ,CAAC,CAAC"}

package/dist/session.d.ts

@@ -0,0 +1,47 @@
+import { verifyChain, type WideEvent, type AuditEntry } from "./guards.ts";
+export type SessionMode = "owned" | "attached" | "streamed";
+export type CaptureVector = "hook" | "proxy" | "watcher" | "backfill";
+/** A normalized coding-session event (mirrors lapdog/trajectory capture). */
+export type SessionEvent = {
+    ts: string;
+    kind: "lifecycle" | "prompt" | "model" | "tool_call" | "tool_result" | "permission";
+    name: string;
+    vector: CaptureVector;
+    attrs?: Record<string, unknown>;
+    tokensIn?: number;
+    tokensOut?: number;
+    costUsd?: number;
+};
+export type SessionStream = {
+    mode: SessionMode;
+    harness: string;
+    runId: string;
+    events: SessionEvent[];
+};
+export type Decision = "allow" | "deny" | "approve";
+export type Rule = {
+    id: string;
+    match: (e: SessionEvent) => boolean;
+    decision: Decision;
+    why: string;
+};
+export declare const DEFAULT_RULES: Rule[];
+export type Interception = {
+    event: SessionEvent;
+    rule: Rule;
+    decision: Decision;
+    enforceable: boolean;
+};
+export declare const intercept: (stream: SessionStream, rules?: Rule[]) => Interception[];
+export type SessionTrace = {
+    runId: string;
+    harness: string;
+    mode: SessionMode;
+    events: WideEvent[];
+    audit: AuditEntry[];
+    interceptions: Interception[];
+};
+export declare const ingestSession: (stream: SessionStream, rules?: Rule[]) => SessionTrace;
+export declare const fromTrajectoryJsonl: (jsonl: string, harness: string, mode?: SessionMode) => SessionStream;
+export { verifyChain };
+//# sourceMappingURL=session.d.ts.map

package/dist/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAkB,WAAW,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAG3F,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,GAAG,UAAU,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,UAAU,CAAC;AAEtE,6EAA6E;AAC7E,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,WAAW,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,aAAa,GAAG,YAAY,CAAC;IACpF,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CACzD,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,CAAC;AAG1G,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AACpD,MAAM,MAAM,IAAI,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,CAAC,CAAC,EAAE,YAAY,KAAK,OAAO,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAExG,eAAO,MAAM,aAAa,EAAE,IAAI,EAI/B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAAC;AAOzG,eAAO,MAAM,SAAS,GAAI,QAAQ,aAAa,EAAE,QAAO,IAAI,EAAkB,KAAG,YAAY,EAQ5F,CAAC;AAGF,MAAM,MAAM,YAAY,GAAG;IACzB,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC;IAClD,MAAM,EAAE,SAAS,EAAE,CAAC;IAAC,KAAK,EAAE,UAAU,EAAE,CAAC;IAAC,aAAa,EAAE,YAAY,EAAE,CAAC;CACzE,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,QAAQ,aAAa,EAAE,QAAO,IAAI,EAAkB,KAAG,YAoBpF,CAAC;AAKF,eAAO,MAAM,mBAAmB,GAAI,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,OAAM,WAAwB,KAAG,aAcpG,CAAC;AAEF,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/session.js

@@ -0,0 +1,88 @@
+// session.ts — the Session seam (ADR-30): coding-ops over harness-agnostic LIVE sessions.
+//
+// Parallel to the Source seam (source.ts = static repos; this = live coding sessions). Three modes:
+//   owned    — op0 creates the session in our runtime (WfP/Sandbox): full control + full intercept.
+//   attached — op0 drives an EXISTING session via the session-connector (local daemon, ADR-4d): partial.
+//   streamed — op0 observes + intercepts a session it does NOT run, via the lapdog/trajectory pattern:
+//              HOOKS = observe (fail-open, fire-and-forget) · model-PROXY = in-path = INTERCEPTABLE.
+//              This is how we "audit work we're not controlling" AND keep a governance gate (deepsec)
+//              on the proxy path even for sessions we didn't launch.
+//
+// Harness-agnostic (Claude Code / Codex / Cursor / Gemini / opencode / Copilot / Factory / Pi): MINE the
+// OSS reference `datadog-labs/trajectory` (per-client hook/proxy/watcher/backfill instrumentation) rather
+// than hand-rolling — the "check for an existing OSS framework first" lesson. *Verify its license before
+// adapting code; otherwise inspiration-only and build our thin capture on the same vectors.* Observability
+// is commoditized by Datadog (lapdog/trajectory) — our moat is the ACT half: govern · intercept · turn the
+// session into a governed onloop run · the flywheel. evlog ingests these traces as just another Source.
+//
+// Pure TS, zero deps (Node + Worker). Reuses the @op0-ai/cord guards so a streamed session yields the SAME
+// evlog WideEvents + tamper-evident audit as an owned cord run.
+import { makeAuditChain, verifyChain } from "./guards.js";
+import { newId } from "./hash.js";
+export const DEFAULT_RULES = [
+    { id: "force-push", match: (e) => e.kind === "tool_call" && /\bgit\s+push\b.*--force(?!-with-lease)/.test(e.name), decision: "deny", why: "force-push without --force-with-lease" },
+    { id: "rm-rf", match: (e) => e.kind === "tool_call" && /\brm\s+-rf\b/.test(e.name), decision: "approve", why: "destructive delete — needs human approval" },
+    { id: "secret-exfil", match: (e) => e.kind === "tool_call" && /(curl|wget)\b.*(\.env|secret|token|key)/i.test(e.name), decision: "approve", why: "possible secret exfiltration" },
+];
+// enforceable ONLY when the event is actionable: owned/attached (we drive it) or streamed-via-PROXY (in-path).
+// streamed-via-hook is observe-only (fail-open) → we can flag/audit but not block.
+const canEnforce = (mode, vector) => mode === "owned" || mode === "attached" || (mode === "streamed" && vector === "proxy");
+export const intercept = (stream, rules = DEFAULT_RULES) => {
+    const out = [];
+    for (const e of stream.events) {
+        for (const r of rules) {
+            if (r.match(e))
+                out.push({ event: e, rule: r, decision: r.decision, enforceable: canEnforce(stream.mode, e.vector) });
+        }
+    }
+    return out;
+};
+export const ingestSession = (stream, rules = DEFAULT_RULES) => {
+    const chain = makeAuditChain();
+    chain.append({ actor: "deepsec", action: "session.capture", scopeId: stream.mode, payload: { harness: stream.harness, mode: stream.mode } });
+    const events = stream.events.map((e) => ({
+        ts: e.ts, runId: stream.runId, tenantId: "op0", cordId: "@op0/coding-ops",
+        kind: e.kind === "tool_call" || e.kind === "tool_result" ? "tool" : e.kind === "model" ? "model" : "step",
+        name: e.name, durationMs: 0, ok: true,
+        attrs: { vector: e.vector, ...(e.attrs ?? {}) },
+    }));
+    const interceptions = intercept(stream, rules);
+    for (const i of interceptions) {
+        chain.append({
+            actor: "deepsec",
+            action: i.enforceable ? `intercept.${i.decision}` : "intercept.flag",
+            scopeId: stream.mode,
+            payload: { rule: i.rule.id, why: i.rule.why, event: i.event.name, enforceable: i.enforceable },
+        });
+    }
+    chain.append({ actor: "deepsec", action: "session.settle", scopeId: stream.mode, payload: { runId: stream.runId, events: events.length, interceptions: interceptions.length } });
+    return { runId: stream.runId, harness: stream.harness, mode: stream.mode, events, audit: chain.entries, interceptions };
+};
+// --- streamed adapter: parse a lapdog/trajectory-style JSONL capture into a SessionStream ---
+// (lapdog hooks POST one JSON per event; trajectory writes JSONL timelines. This is a minimal normalized
+//  subset for the spike; the real adapter maps each harness's hook/proxy schema — mine trajectory's.)
+export const fromTrajectoryJsonl = (jsonl, harness, mode = "streamed") => {
+    const events = [];
+    for (const line of jsonl.split("\n")) {
+        const t = line.trim();
+        if (!t)
+            continue;
+        let o;
+        try {
+            o = JSON.parse(t);
+        }
+        catch {
+            continue;
+        }
+        events.push({
+            ts: o.ts ?? new Date().toISOString(),
+            kind: o.kind ?? "lifecycle",
+            name: o.name ?? o.tool ?? o.event ?? "event",
+            vector: o.vector ?? "hook",
+            attrs: o.attrs, tokensIn: o.tokensIn, tokensOut: o.tokensOut, costUsd: o.costUsd,
+        });
+    }
+    return { mode, harness, runId: newId(), events };
+};
+export { verifyChain };
+//# sourceMappingURL=session.js.map

package/dist/session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,EAAE;AACF,oGAAoG;AACpG,oGAAoG;AACpG,yGAAyG;AACzG,uGAAuG;AACvG,qGAAqG;AACrG,sGAAsG;AACtG,qEAAqE;AACrE,EAAE;AACF,yGAAyG;AACzG,0GAA0G;AAC1G,yGAAyG;AACzG,2GAA2G;AAC3G,2GAA2G;AAC3G,wGAAwG;AACxG,EAAE;AACF,2GAA2G;AAC3G,gEAAgE;AAChE,OAAO,EAAE,cAAc,EAAE,WAAW,EAAmC,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAqBlC,MAAM,CAAC,MAAM,aAAa,GAAW;IACnC,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,wCAAwC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,uCAAuC,EAAE;IACnL,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,2CAA2C,EAAE;IAC3J,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,EAAE,8BAA8B,EAAE;CAClL,CAAC;AAIF,+GAA+G;AAC/G,mFAAmF;AACnF,MAAM,UAAU,GAAG,CAAC,IAAiB,EAAE,MAAqB,EAAE,EAAE,CAC9D,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,CAAC,CAAC;AAEzF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAqB,EAAE,QAAgB,aAAa,EAAkB,EAAE;IAChG,MAAM,GAAG,GAAmB,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAAqB,EAAE,QAAgB,aAAa,EAAgB,EAAE;IAClG,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAgB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpD,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB;QACzE,IAAI,EAAE,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;QACzG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE;KAChD,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,KAAK,CAAC,MAAM,CAAC;YACX,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,gBAAgB;YACpE,OAAO,EAAE,MAAM,CAAC,IAAI;YACpB,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE;SAC/F,CAAC,CAAC;IACL,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjL,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;AAC1H,CAAC,CAAC;AAEF,+FAA+F;AAC/F,yGAAyG;AACzG,sGAAsG;AACtG,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAa,EAAE,OAAe,EAAE,OAAoB,UAAU,EAAiB,EAAE;IACnH,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QACxC,IAAI,CAAM,CAAC;QAAC,IAAI,CAAC;YAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,WAAW;YAC3B,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,IAAI,OAAO;YAC5C,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,MAAM;YAC1B,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO;SACjF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC,CAAC;AAEF,OAAO,EAAE,WAAW,EAAE,CAAC"}

package/dist/source.d.ts

@@ -0,0 +1,65 @@
+/** A blob store — the R2 shape, structural. The CF host binds R2; Node tests bind a fake. */
+export interface Store {
+    get(key: string): Promise<{
+        text(): Promise<string>;
+    } | null>;
+    put(key: string, value: string | ArrayBuffer): Promise<unknown>;
+    delete(key: string): Promise<void>;
+    list(options: {
+        prefix: string;
+    }): Promise<{
+        objects: ReadonlyArray<{
+            key: string;
+        }>;
+    }>;
+}
+/** An external commit target (the by-design Source over HTTPS). Adapter: {@link githubCommitter}. */
+export interface Committer {
+    commit(files: ReadonlyArray<FlushedFile>): Promise<CommitResult>;
+}
+export interface FlushedFile {
+    readonly path: string;
+    readonly text: string;
+}
+export interface CommitResult {
+    readonly committed: number;
+    readonly total: number;
+    readonly target: string;
+}
+/** Result of a flush: what landed in the backing store, plus the external committer's outcome (or "skipped"). */
+export interface FlushResult {
+    readonly committed: number;
+    readonly paths: readonly string[];
+    readonly external: CommitResult | "skipped";
+}
+export interface Source {
+    /** Read committed content for a path (null if absent). */
+    read(path: string): Promise<string | null>;
+    /** Stage an edit; committed on the next {@link Source.flush} (the host debounces flush via its scheduler). */
+    stage(path: string, content: string): Promise<void>;
+    /** Commit all staged edits idempotently: backing store first, then the external committer (if configured). */
+    flush(): Promise<FlushResult>;
+}
+/** Create a bidirectional Source over a backing {@link Store} (+ optional external {@link Committer}). */
+export declare function bidirectionalSource(options: {
+    store: Store;
+    committer?: Committer;
+    /** Namespace every key under this prefix (e.g. a tenant id). Optional. */
+    prefix?: string;
+}): Source;
+/** UTF-8 → base64 for the GitHub Contents API (Workers has `btoa`, not `Buffer`; encode bytes so unicode survives). */
+export declare function toBase64(text: string): string;
+/**
+ * GitHub-commit Source adapter (HTTPS, Contents API). Idempotent: GET the existing blob sha, then PUT
+ * (create or update) under `<base>/<path>`. `fetch` is injectable for tests.
+ */
+export declare function githubCommitter(config: {
+    token: string;
+    owner: string;
+    repo: string;
+    branch?: string;
+    /** Path prefix inside the repo. Defaults to "cord". */
+    base?: string;
+    fetch?: typeof fetch;
+}): Committer;
+//# sourceMappingURL=source.d.ts.map

package/dist/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAOA,6FAA6F;AAC7F,MAAM,WAAW,KAAK;IACpB,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,CAAC;YAAE,GAAG,EAAE,MAAM,CAAA;SAAE,CAAC,CAAA;KAAE,CAAC,CAAC;CACzF;AAED,qGAAqG;AACrG,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAClE;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,iHAAiH;AACjH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,MAAM;IACrB,0DAA0D;IAC1D,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC3C,8GAA8G;IAC9G,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,8GAA8G;IAC9G,KAAK,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CAC/B;AAID,0GAA0G;AAC1G,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,KAAK,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAkCT;AAED,uHAAuH;AACvH,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK7C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACtC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,GAAG,SAAS,CAyCZ"}

package/dist/source.js

@@ -0,0 +1,96 @@
+// source.ts — the bidirectional Source: a cord's read/write content layer behind ONE flush seam, with
+// interchangeable adapters (an R2-shaped backing store + an optional external committer e.g. GitHub). It is
+// STRUCTURALLY typed — runs in a Worker (R2 bound) AND in Node tests (a Map-backed fake) — which keeps the
+// ports model honest. The debounce itself is the host's durable scheduler (CF Agents `this.schedule`); this
+// module owns staging, the idempotent flush across adapters, and read-back. (Reconciliation of @op0-ai/cord to
+// the governed-CF-Agent reality, ADR-cord-2026-06-30.)
+const PENDING = "pending/";
+/** Create a bidirectional Source over a backing {@link Store} (+ optional external {@link Committer}). */
+export function bidirectionalSource(options) {
+    const { store, committer } = options;
+    const ns = (key) => (options.prefix ? `${options.prefix}/${key}` : key);
+    const pendingPrefix = ns(PENDING);
+    return {
+        async read(path) {
+            const object = await store.get(ns(path));
+            return object ? await object.text() : null;
+        },
+        async stage(path, content) {
+            await store.put(ns(PENDING + path), content);
+        },
+        async flush() {
+            const listed = await store.list({ prefix: pendingPrefix });
+            // Each pending object is independent (its own key, no cross-object state) — the get→put→delete
+            // sequence for ONE object must stay in order, but different objects can flush concurrently.
+            const results = await Promise.all(listed.objects.map(async (object) => {
+                const staged = await store.get(object.key);
+                if (!staged)
+                    return null;
+                const path = object.key.slice(pendingPrefix.length);
+                const text = await staged.text();
+                await store.put(ns(path), text); // commit to the backing store
+                await store.delete(object.key); // clear the staged copy
+                return { path, text };
+            }));
+            const flushed = results.filter((f) => f !== null);
+            const external = committer && flushed.length > 0 ? await committer.commit(flushed) : "skipped";
+            return { committed: flushed.length, paths: flushed.map((f) => f.path), external };
+        },
+    };
+}
+/** UTF-8 → base64 for the GitHub Contents API (Workers has `btoa`, not `Buffer`; encode bytes so unicode survives). */
+export function toBase64(text) {
+    const bytes = new TextEncoder().encode(text);
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+/**
+ * GitHub-commit Source adapter (HTTPS, Contents API). Idempotent: GET the existing blob sha, then PUT
+ * (create or update) under `<base>/<path>`. `fetch` is injectable for tests.
+ */
+export function githubCommitter(config) {
+    const branch = config.branch ?? "main";
+    const base = config.base ?? "cord";
+    const doFetch = config.fetch ?? fetch;
+    const api = `https://api.github.com/repos/${config.owner}/${config.repo}/contents`;
+    const headers = {
+        authorization: `Bearer ${config.token}`,
+        accept: "application/vnd.github+json",
+        "user-agent": "op0-cord",
+        "content-type": "application/json",
+    };
+    return {
+        async commit(files) {
+            let committed = 0;
+            // Sequential by necessity: the GitHub Contents API creates one commit per file PUT against the SAME
+            // branch ref. Concurrent PUTs here would race on that ref (each PUT reads then advances branch HEAD),
+            // risking "sha is not current" 409/422s — not just a style preference, a correctness requirement.
+            for (const file of files) {
+                const url = `${api}/${base}/${file.path}`;
+                let sha;
+                // oxlint-disable-next-line no-await-in-loop
+                const head = await doFetch(`${url}?ref=${encodeURIComponent(branch)}`, { headers });
+                // oxlint-disable-next-line no-await-in-loop
+                if (head.ok)
+                    sha = (await head.json()).sha;
+                // oxlint-disable-next-line no-await-in-loop
+                const put = await doFetch(url, {
+                    method: "PUT",
+                    headers,
+                    body: JSON.stringify({
+                        message: `cord: commit ${file.path}`,
+                        content: toBase64(file.text),
+                        branch,
+                        ...(sha ? { sha } : {}),
+                    }),
+                });
+                if (put.ok)
+                    committed += 1;
+            }
+            return { committed, total: files.length, target: `${config.owner}/${config.repo}@${branch}` };
+        },
+    };
+}
+//# sourceMappingURL=source.js.map