@op0ai/sdk 0.3.0 → 0.4.0

package/LICENSE

@@ -1,38 +1,38 @@
-op0 SDK & CLI — Proprietary License
-Copyright (c) 2026 op0 (op0.ai). All rights reserved.
-
-This software (the "op0 SDK", the `op0` package, including its SDK library and
-CLI) is licensed, not sold. It is NOT open source.
-
-1. GRANT (use-with-op0). You are granted a non-exclusive, non-transferable,
-   revocable license to install and use this software SOLELY to build, deploy,
-   and operate agents on the op0 runtime — whether the managed op0 cloud
-   (op0.ai) or an op0 runtime you self-host under a separate commercial license
-   from op0. All normal development use in service of that purpose (local dev,
-   CI, running the CLI, importing the SDK into your agent code) is permitted.
-
-2. RESTRICTIONS. You may not, except as this License expressly permits:
-   (a) redistribute, resell, sublicense, or publish this software or substantial
-       portions of it as a standalone package or SDK;
-   (b) use it to build, train, or operate a runtime or platform that competes
-       with the op0 runtime, or to reimplement the op0 runtime API for a
-       competing service;
-   (c) remove or obscure this notice, or represent the software as open source.
-
-3. SELF-HOSTING. Running the op0 runtime outside the managed op0 cloud requires
-   a separate commercial license. Contact arth@op0.ai.
-
-4. WHAT IS OPEN. This License covers the SDK and CLI only. op0's examples,
-   patterns, and templates are published separately under their own permissive
-   (MIT) licenses — see the op0 repositories and LICENSING.md. Nothing here
-   restricts those.
-
-5. NO WARRANTY. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-   EXPRESS OR IMPLIED. IN NO EVENT SHALL op0 BE LIABLE FOR ANY CLAIM, DAMAGES,
-   OR OTHER LIABILITY ARISING FROM THE SOFTWARE OR ITS USE.
-
-6. TERMINATION. This License terminates automatically if you breach it. On
-   termination you must cease use and destroy your copies.
-
-op0 may release future versions under different terms (including a delayed-open
-license) based on usage patterns; that is a possibility, not a commitment.
+op0 Use License (use-with-op0), v1.0
+Copyright (c) 2026-present op0 (op0.ai)
+
+Permission is hereby granted, free of charge, to any person or organization
+obtaining a copy of this software (the "Software") to use, copy, and modify
+the Software SOLELY for the purpose of building, testing, deploying, and
+operating agents and fleets on the op0 platform (the op0 runtime and the
+op0 managed cloud, op0.ai / op0.dev), subject to the following conditions:
+
+1. Use with op0. The Software may be used only in connection with the op0
+   platform. Transient local development and testing of software intended
+   to run on op0 is use in connection with op0.
+
+2. No redistribution. The Software, modified or unmodified, may not be
+   published, sublicensed, sold, or otherwise redistributed outside your
+   organization. Installing the Software from the official npm packages is
+   not redistribution.
+
+3. No competing service. The Software may not be used to build, operate, or
+   assist a runtime, platform, or hosted service that competes with op0.
+
+4. Your work is yours. Agent functions, configurations, and scaffold output
+   you author with the Software are yours, under whatever terms you choose.
+   This license covers the Software itself, not what you build with it.
+
+5. Notices. This notice shall be included in all copies of the Software.
+
+Self-hosting the op0 runtime and any use outside these terms require a
+separate commercial license: arth@op0.ai. See LICENSING.md for the full
+licensing map (what teaches op0 is open; what runs op0 is licensed).
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE. This license terminates automatically upon breach.

package/dist/guards.d.ts

@@ -1,61 +1 @@
-export type GuardEvent = {
-    cord: string;
-    tool?: string;
-    scope?: string;
-    input: unknown;
-};
-export type WideEvent = {
-    ts: string;
-    runId: string;
-    tenantId: string;
-    cordId: string;
-    kind: "turn" | "step" | "model" | "tool" | "eval";
-    name: string;
-    durationMs: number;
-    ok: boolean;
-    scope?: string;
-    error?: {
-        code: string;
-        why: string;
-    };
-    attrs?: Record<string, unknown>;
-};
-export type AuditEntry = {
-    seq: number;
-    ts: string;
-    actor: string;
-    action: string;
-    scopeId: string;
-    payloadHash: string;
-    prevHash: string;
-    hash: string;
-};
-export type Guard = {
-    name: string;
-    /** Gate hook: deny by throwing (deepsec scope check), or instrument by side-effect. */
-    onCall?: (ev: GuardEvent) => void | Promise<void>;
-    /** Output transform applied before persist/export (deepsec redaction). */
-    redact?: <T>(value: T) => T;
-    /** Wide-event sink (deepeval instrumentation). */
-    onEvent?: (e: WideEvent) => void;
-};
-export type AuditChain = {
-    entries: AuditEntry[];
-    append(e: {
-        actor: string;
-        action: string;
-        scopeId: string;
-        payload: unknown;
-    }): AuditEntry;
-};
-export declare const makeAuditChain: () => AuditChain;
-/** Re-derive every hash; any insert/edit/delete breaks the chain → returns false. (The S7 red test.) */
-export declare const verifyChain: (entries: AuditEntry[]) => boolean;
-/** deepsec — scope gate + redaction (ADR-10). The runtime also drives an audit chain tagged actor="deepsec". */
-export declare const deepsec: (opts?: {
-    allow?: string[];
-    secrets?: RegExp[];
-}) => Guard;
-/** deepeval — instruments every run (ADR-24). Collects wide-events; prod forwards to evlog (OTLP + PostHog). */
-export declare const deepeval: (sink?: WideEvent[]) => Guard;
-//# sourceMappingURL=guards.d.ts.map
+export * from "./types/guards.js";

package/dist/guards.js

@@ -1,88 +1 @@
-// guards.ts — the system-cord guards, made REAL for H4 (no longer H0 no-op stubs).
-//
-//  • deepsec (ADR-10, the security harness): (1) scope check at the gate — deny a run whose scope is off the
-//    allow-list; (2) redaction — scrub secrets/PII from the output BEFORE it is persisted to the vault or
-//    exported; (3) a tamper-evident, hash-chained audit (evlog AuditEntry shape, ADR-12).
-//  • deepeval (ADR-24, the quality harness): instruments every run — emits evlog wide-events (one fat event
-//    per unit of work). In prod the worker forwards these to OTLP + PostHog (companion 23 evlog §3).
-//
-// Both are plain functions returning a Guard the runtime (index.ts) drives. Pure TS; no deps beyond hash.ts.
-import { hashHex } from "./hash.js";
-const entryHash = (e) => hashHex([e.seq, e.ts, e.actor, e.action, e.scopeId, e.payloadHash, e.prevHash].join("|"));
-export const makeAuditChain = () => {
-    const entries = [];
-    return {
-        entries,
-        append({ actor, action, scopeId, payload }) {
-            const seq = entries.length;
-            const ts = new Date().toISOString();
-            const prevHash = seq === 0 ? "GENESIS" : entries[seq - 1]?.hash ?? "GENESIS";
-            const payloadHash = hashHex(JSON.stringify(payload ?? null));
-            const base = { seq, ts, actor, action, scopeId, payloadHash, prevHash };
-            const entry = { ...base, hash: entryHash(base) };
-            entries.push(entry);
-            return entry;
-        },
-    };
-};
-/** Re-derive every hash; any insert/edit/delete breaks the chain → returns false. (The S7 red test.) */
-export const verifyChain = (entries) => {
-    for (let i = 0; i < entries.length; i++) {
-        const e = entries[i];
-        if (!e)
-            return false;
-        const prevHash = i === 0 ? "GENESIS" : entries[i - 1]?.hash ?? "GENESIS";
-        if (e.prevHash !== prevHash)
-            return false;
-        const { hash, ...base } = e;
-        if (hash !== entryHash(base))
-            return false;
-    }
-    return true;
-};
-// ---- redaction ----
-// Provider token shapes + key material. Loose-but-real; prod (deepsec lane) uses the full secret-scanner set.
-const DEFAULT_SECRET_RES = [
-    /gh[poursa]_[A-Za-z0-9]{20,}/g, // GitHub PAT / oauth / app tokens
-    /github_pat_[A-Za-z0-9_]{20,}/g, // fine-grained PAT
-    /xox[baprs]-[A-Za-z0-9-]{10,}/g, // Slack
-    /AKIA[0-9A-Z]{16}/g, // AWS access key id
-    /sk-[A-Za-z0-9]{20,}/g, // OpenAI-style secret keys
-    /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/g, // PEM private keys
-];
-const redactValue = (v, res) => {
-    if (typeof v === "string") {
-        let s = v;
-        for (const re of res)
-            s = s.replace(re, "[redacted]");
-        return s;
-    }
-    if (Array.isArray(v))
-        return v.map((x) => redactValue(x, res));
-    if (v && typeof v === "object") {
-        const o = {};
-        for (const k of Object.keys(v))
-            o[k] = redactValue(v[k], res);
-        return o;
-    }
-    return v;
-};
-/** deepsec — scope gate + redaction (ADR-10). The runtime also drives an audit chain tagged actor="deepsec". */
-export const deepsec = (opts = {}) => {
-    const res = opts.secrets ?? DEFAULT_SECRET_RES;
-    return {
-        name: "deepsec",
-        onCall: ({ scope }) => {
-            if (opts.allow && scope !== undefined && !opts.allow.includes(scope)) {
-                throw new Error(`deepsec: scope "${scope}" not in allow-list [${opts.allow.join(", ")}]`);
-            }
-        },
-        redact: (value) => redactValue(value, res),
-    };
-};
-/** deepeval — instruments every run (ADR-24). Collects wide-events; prod forwards to evlog (OTLP + PostHog). */
-export const deepeval = (sink = []) => ({
-    name: "deepeval",
-    onEvent: (e) => { sink.push(e); },
-});
-//# sourceMappingURL=guards.js.map
+var a=t=>{let r=2166136261;for(let n=0;n<t.length;n++)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(16).padStart(8,"0")};var g=t=>a([t.seq,t.ts,t.actor,t.action,t.scopeId,t.payloadHash,t.prevHash].join("|")),A=()=>{let t=[];return{entries:t,append({actor:r,action:n,scopeId:e,payload:o}){let s=t.length,p=new Date().toISOString(),u=s===0?"GENESIS":t[s-1]?.hash??"GENESIS",l=a(JSON.stringify(o??null)),c={seq:s,ts:p,actor:r,action:n,scopeId:e,payloadHash:l,prevHash:u},d={...c,hash:g(c)};return t.push(d),d}}},f=t=>{for(let r=0;r<t.length;r++){let n=t[r];if(!n)return!1;let e=r===0?"GENESIS":t[r-1]?.hash??"GENESIS";if(n.prevHash!==e)return!1;let{hash:o,...s}=n;if(o!==g(s))return!1}return!0},h=[/gh[poursa]_[A-Za-z0-9]{20,}/g,/github_pat_[A-Za-z0-9_]{20,}/g,/xox[baprs]-[A-Za-z0-9-]{10,}/g,/AKIA[0-9A-Z]{16}/g,/sk-[A-Za-z0-9]{20,}/g,/-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/g],i=(t,r)=>{if(typeof t=="string"){let n=t;for(let e of r)n=n.replace(e,"[redacted]");return n}if(Array.isArray(t))return t.map(n=>i(n,r));if(t&&typeof t=="object"){let n={};for(let e of Object.keys(t))n[e]=i(t[e],r);return n}return t},w=(t={})=>{let r=t.secrets??h;return{name:"deepsec",onCall:({scope:n})=>{if(t.allow&&n!==void 0&&!t.allow.includes(n))throw new Error(`deepsec: scope "${n}" not in allow-list [${t.allow.join(", ")}]`)},redact:n=>i(n,r)}},x=(t=[])=>({name:"deepeval",onEvent:r=>{t.push(r)}});export{x as deepeval,w as deepsec,A as makeAuditChain,f as verifyChain};

package/dist/hash.d.ts

@@ -1,6 +1 @@
-export declare const hashHex: (s: string) => string;
-/** A url-safe slug for vault keys (target → reports/<slug>/<runId>.json). */
-export declare const slug: (s: string) => string;
-/** A short, sortable-ish run id (timestamp + entropy). No node: deps. */
-export declare const newId: () => string;
-//# sourceMappingURL=hash.d.ts.map
+export * from "./types/hash.js";

package/dist/hash.js

@@ -1,18 +1 @@
-// hash.ts — a tiny, deterministic, dependency-free hash for the H-shim (content-addressing + the audit
-// chain). It is NOT cryptographic: production swaps in SHA-256 via Web Crypto (`crypto.subtle.digest`,
-// available in both Workers and Node ≥18) — that's async, so the chain/manifest become async there. For the
-// pure-Node verify path we want a sync, zero-dep hash so the whole runtime stays portable (Node AND a
-// Worker, no imports). FNV-1a (32-bit) is enough to make tamper-evidence + content-addressing demonstrable.
-export const hashHex = (s) => {
-    let h = 0x811c9dc5;
-    for (let i = 0; i < s.length; i++) {
-        h ^= s.charCodeAt(i);
-        h = Math.imul(h, 0x01000193);
-    }
-    return (h >>> 0).toString(16).padStart(8, "0");
-};
-/** A url-safe slug for vault keys (target → reports/<slug>/<runId>.json). */
-export const slug = (s) => s.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80) || "target";
-/** A short, sortable-ish run id (timestamp + entropy). No node: deps. */
-export const newId = () => Date.now().toString(36) + "-" + Math.random().toString(36).slice(2, 8);
-//# sourceMappingURL=hash.js.map
+var n=t=>{let r=2166136261;for(let e=0;e<t.length;e++)r^=t.charCodeAt(e),r=Math.imul(r,16777619);return(r>>>0).toString(16).padStart(8,"0")},o=t=>t.trim().toLowerCase().replace(/^https?:\/\//,"").replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,80)||"target",a=()=>Date.now().toString(36)+"-"+Math.random().toString(36).slice(2,8);export{n as hashHex,a as newId,o as slug};

package/dist/index.d.ts

@@ -1,121 +1 @@
-export * from "./hash.ts";
-export * from "./vault.ts";
-export * from "./guards.ts";
-export * from "./platform.ts";
-export * from "./agent.ts";
-export * from "./source.ts";
-export * from "./agui.ts";
-export * from "./tool.ts";
-export * from "./config.ts";
-export * from "./define.ts";
-export * from "./contract.ts";
-export * from "./evlog.ts";
-export * from "./events.ts";
-export * from "./usectx.ts";
-export * from "./distill.ts";
-export * from "./data.ts";
-import type { Vault } from "./vault.ts";
-import type { Resources, ResourceNeed } from "./platform.ts";
-import { type Guard, type WideEvent, type AuditEntry } from "./guards.ts";
-/** A sub-cord: an encapsulated unit composed into a parent. `any` generics (not `unknown`) so a typed
- *  `subcords` record — { scan: Subagent<string,Facts>, score: Subagent<Facts,EvalResult>, ... } — is assignable
- *  to Record<string, Subagent> (Subagent<X,Y> is NOT assignable to Subagent<unknown,unknown> — invariant `run`
- *  param — but IS assignable to Subagent<any,any>). Same heterogeneous-registry seam as data.ts's AnyFn. */
-export type Subagent<I = any, O = any> = {
-    id: string;
-    mount: "local" | "registry";
-    run: (input: I) => Promise<O>;
-};
-/** Mount an OWNED sub-cord in-process (deterministic trunk). */
-export declare function use<I, O>(sc: {
-    id: string;
-    run: (input: I) => Promise<O>;
-}): Subagent<I, O>;
-/** Mount a THIRD-PARTY/registry cord over MCP (the trust boundary; an executor toolkit). */
-export declare function useRemote<I, O>(sc: {
-    id: string;
-    call: (input: I) => Promise<O>;
-}): Subagent<I, O>;
-export type Expose = {
-    codemode?: boolean;
-    mcp?: string;
-    cli?: boolean;
-    openapi?: boolean;
-};
-export type AgentDef<Input, Output> = {
-    id: string;
-    kind?: "agent-ful" | "agent-less";
-    inference?: "managed" | "byo";
-    /** The scope this cord's run requests — checked by deepsec against its allow-list (H4). */
-    scope?: string;
-    expose?: Expose;
-    guards?: Guard[];
-    subcords?: Record<string, Subagent>;
-    /** Durable resources this cord requires; the host MUST bind them or the run fails fast (validated post-gate). */
-    needs?: ResourceNeed[];
-    /** The deterministic trunk: compose sub-cords (ctx) + use the host-bound resources (res). */
-    run: (input: Input, ctx: Record<string, (input: any) => Promise<any>>, res: Resources) => Promise<Output>;
-};
-export type RunBudget = {
-    cap: number;
-    used: number;
-    depth: number;
-    maxDepth: number;
-};
-export type RunOpts = {
-    tenantId?: string;
-    scope?: string;
-    vault?: Vault;
-    resources?: Resources;
-    budget?: Partial<Pick<RunBudget, "cap" | "maxDepth">>;
-    onEvent?: (e: WideEvent) => void;
-};
-export type RunResult<O> = {
-    output: O;
-    runId: string;
-    artifact?: {
-        key: string;
-        version: string;
-        hash: string;
-    };
-    audit: AuditEntry[];
-    events: WideEvent[];
-    budget: RunBudget;
-};
-export type AgentManifest = {
-    id: string;
-    version: string;
-    kind: "agent-ful" | "agent-less";
-    inference: "managed" | "byo";
-    scope?: string;
-    expose: Expose;
-    subcords: string[];
-    guards: string[];
-    needs: ResourceNeed[];
-};
-export type Agent<Input, Output> = {
-    id: string;
-    expose: Expose;
-    manifest: AgentManifest;
-    run: (input: Input, opts?: RunOpts) => Promise<Output>;
-    runFull: (input: Input, opts?: RunOpts) => Promise<RunResult<Output>>;
-};
-export declare function defineAgent<Input, Output>(def: AgentDef<Input, Output>): Agent<Input, Output>;
-/** /.well-known/op0.json (ADR-18) generated from the cord's `expose`. Host is filled at deploy. */
-export declare const wellKnown: (m: AgentManifest, host?: string) => {
-    auth?: {
-        type: string;
-        scopes: string[];
-    };
-    skills: string;
-    cli?: string;
-    openapi?: string;
-    mcp: string[];
-    docs: string;
-};
-/** Content-address the manifest for skillkit publish/fork lineage (signed → forkOf{atCommit} later, ADR-22). */
-export declare const signManifest: (m: AgentManifest) => {
-    manifest: AgentManifest;
-    hash: string;
-};
-//# sourceMappingURL=index.d.ts.map
+export * from "./types/index.js";