@openvulcan/dsh-vulcancode 0.0.0-stage → 0.4.3

package/node_modules/@openvulcan/vulcan-decision/lib/local/packs.js

@@ -0,0 +1,195 @@
+/**
+ * Runtime packs: the optional local runtimes, installed on demand next to the cloud-only default.
+ *
+ * A pack is a prebuilt python-build-standalone interpreter plus the official wheels its lock file
+ * (`runtime-packs/<pack>.json`, written by `scripts/lock_runtime.py`) pins for this platform.
+ * Installing downloads exactly those files, verifies each against its size and SHA-256, unpacks
+ * the interpreter, installs the wheels offline with the interpreter's own pip and checks that the
+ * runtime imports. Nothing is compiled and no driver is installed: GPU packs bring their CUDA
+ * libraries as NVIDIA's wheels and only need a recent enough driver.
+ */
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { fetchPinned } from '../download.js';
+import { writeFileAtomic } from '../home.js';
+import { WorkerProcess } from './worker.js';
+/** Packs with a lock file, in the order they are offered. */
+export const PACK_IDS = ['onnx-cpu', 'onnx-cuda', 'torch-cpu', 'torch-cu128'];
+/**
+ * Packs waiting for a release: an NPU needs an ONNX model exported for it, which is not
+ * published yet. They are listed so a host can show what this machine will be able to use.
+ */
+export const PLANNED_PACKS = [
+    { id: 'onnx-openvino', backend: 'onnx', accelerator: 'intel-npu' },
+    { id: 'onnx-qnn', backend: 'onnx', accelerator: 'qualcomm-npu' },
+];
+const LOCK_DIR = fileURLToPath(new URL('../../runtime-packs/', import.meta.url));
+/** The target this process runs on, or undefined when no pack supports it. */
+export function currentTarget(platform = process.platform, arch = process.arch) {
+    if (platform === 'win32' && arch === 'x64')
+        return 'win-x64';
+    if (platform === 'linux' && arch === 'x64')
+        return 'linux-x64';
+    if (platform === 'linux' && arch === 'arm64')
+        return 'linux-arm64';
+    if (platform === 'darwin' && arch === 'arm64')
+        return 'mac-arm64';
+    return undefined;
+}
+export function isPackId(value) {
+    return typeof value === 'string' && PACK_IDS.includes(value);
+}
+/** The lock file shipped with this package for `pack`. */
+export function readLock(pack) {
+    const lock = JSON.parse(fs.readFileSync(path.join(LOCK_DIR, `${pack}.json`), 'utf8'));
+    if (lock.format !== 1 || lock.pack !== pack)
+        throw new Error(`the lock file of ${pack} is malformed`);
+    return lock;
+}
+/** The installed pack in `home`, or undefined when it is missing or unreadable. */
+export function installedPack(home, pack) {
+    try {
+        const record = JSON.parse(fs.readFileSync(path.join(home.packs, pack, 'pack.json'), 'utf8'));
+        return record.format === 1 && record.pack === pack ? record : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** The interpreter of an installed pack. */
+export function packPython(home, record) {
+    return path.join(home.packs, record.pack, ...record.python.split('/'));
+}
+/**
+ * Install `pack` for this platform, replacing an installed one only once the new one works.
+ * @throws Error when the pack has no build for this platform, a download fails verification, or
+ *   the installed runtime does not start.
+ */
+export async function installPack(home, pack, options = {}) {
+    const lock = readLock(pack);
+    const target = options.target ?? currentTarget();
+    const build = target === undefined ? undefined : lock.targets[target];
+    if (target === undefined || build === undefined) {
+        throw new Error(`${pack} has no build for ${process.platform}-${process.arch}`);
+    }
+    const downloads = path.join(home.downloads, `pack-${lock.id}`);
+    const staging = path.join(home.packs, `.staging-${pack}`);
+    if (target === 'win-x64' && staging.length + DEEPEST_PACK_PATH > WINDOWS_MAX_PATH) {
+        throw new Error(`the data directory ${home.root} is too deep for Windows paths: a pack's files would exceed `
+            + `${WINDOWS_MAX_PATH} characters; use a data directory at most ${WINDOWS_MAX_PATH - DEEPEST_PACK_PATH - (staging.length - home.root.length)} characters long`);
+    }
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(staging, { recursive: true });
+    try {
+        let done = 0;
+        for (const file of build.files) {
+            const start = done;
+            await fetchPinned(file, path.join(downloads, file.name), {
+                ...options.source === undefined ? {} : { source: options.source },
+                ...options.signal === undefined ? {} : { signal: options.signal },
+                onBytes: bytes => {
+                    done += bytes;
+                    options.onProgress?.({ phase: 'download', done, total: build.bytes, file: file.name });
+                },
+            });
+            done = start + file.bytes;
+        }
+        options.onProgress?.({ phase: 'unpack' });
+        const interpreter = build.files.find(file => file.kind === 'python');
+        if (interpreter === undefined)
+            throw new Error(`the lock file of ${pack} has no interpreter`);
+        await run(tarCommand(), ['-xzf', path.join(downloads, interpreter.name), '-C', staging], options.signal);
+        const python = target === 'win-x64' ? 'python/python.exe' : 'python/bin/python3';
+        const pythonPath = path.join(staging, ...python.split('/'));
+        if (!fs.existsSync(pythonPath))
+            throw new Error('the interpreter archive did not contain python');
+        options.onProgress?.({ phase: 'install' });
+        const wheels = build.files.filter(file => file.kind === 'wheel').map(file => path.join(downloads, file.name));
+        await run(pythonPath, ['-I', '-m', 'pip', 'install', '--no-index', '--no-deps', '--disable-pip-version-check',
+            '--no-warn-script-location', '--quiet', ...wheels], options.signal);
+        options.onProgress?.({ phase: 'probe' });
+        const worker = new WorkerProcess(pythonPath);
+        let probe;
+        try {
+            probe = await worker.probe();
+        }
+        finally {
+            await worker.stop();
+        }
+        const missing = lock.backend === 'onnx' ? probe.onnxruntime === undefined : probe.torch === undefined;
+        if (missing)
+            throw new Error(`${pack} installed but its ${lock.backend} runtime does not import`);
+        const record = {
+            format: 1, pack, lock: lock.id, target, backend: lock.backend, device: lock.device, python,
+            installed_at: new Date().toISOString(), probe,
+        };
+        writeFileAtomic(path.join(staging, 'pack.json'), `${JSON.stringify(record, null, 2)}\n`);
+        replaceDirectory(staging, path.join(home.packs, pack));
+        fs.rmSync(downloads, { recursive: true, force: true });
+        return record;
+    }
+    catch (error) {
+        fs.rmSync(staging, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Longest Windows path pip can write without long-path support, without the terminating NUL. */
+const WINDOWS_MAX_PATH = 259;
+/**
+ * Longest path inside a pack directory, with room to spare: `python\Lib\site-packages\` plus
+ * torch's deepest header (144 characters for torch 2.9.1).
+ */
+const DEEPEST_PACK_PATH = 150;
+/** Remove an installed pack and any partial download of it. */
+export function removePack(home, pack) {
+    const dir = path.join(home.packs, pack);
+    const existed = fs.existsSync(dir);
+    fs.rmSync(dir, { recursive: true, force: true });
+    fs.rmSync(path.join(home.downloads, `pack-${readLock(pack).id}`), { recursive: true, force: true });
+    return existed;
+}
+/** Move `staging` to `dest`, keeping the old `dest` until the move succeeded. */
+export function replaceDirectory(staging, dest) {
+    const old = `${dest}.old-${process.pid}`;
+    const hadOld = fs.existsSync(dest);
+    if (hadOld)
+        fs.renameSync(dest, old);
+    try {
+        fs.renameSync(staging, dest);
+    }
+    catch (error) {
+        if (hadOld)
+            fs.renameSync(old, dest);
+        throw error;
+    }
+    if (hadOld)
+        fs.rmSync(old, { recursive: true, force: true });
+}
+/**
+ * The archive tool: Windows' own bsdtar, so a GNU tar earlier on PATH (Git Bash, MSYS) cannot
+ * mistake a drive letter for a remote host.
+ */
+function tarCommand() {
+    if (process.platform !== 'win32')
+        return 'tar';
+    return path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'tar.exe');
+}
+function run(command, args, signal) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(command, args, { stdio: ['ignore', 'ignore', 'pipe'], windowsHide: true, ...signal === undefined ? {} : { signal } });
+        let stderr = '';
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => {
+            stderr = (stderr + chunk).slice(-4000);
+        });
+        child.on('error', reject);
+        child.on('close', code => {
+            if (code === 0)
+                resolve();
+            else
+                reject(new Error(`${path.basename(command)} failed (exit ${code}): ${stderr.trim()}`));
+        });
+    });
+}

package/node_modules/@openvulcan/vulcan-decision/lib/local/worker.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The host side of `python/vulcan_decision_worker.py`: one child process per runtime pack and
+ * model, answering JSON-line requests in order. Any failure, timeout or exit becomes an error;
+ * none of them is ever an answer.
+ */
+import { type JudgeInput, type ModelResult } from '../protocol.js';
+/** The worker script shipped with this package. */
+export declare const WORKER_SCRIPT: string;
+/** What `probe` reports about a pack's interpreter. */
+export interface ProbeResult {
+    readonly python: string;
+    readonly machine: string;
+    readonly system: string;
+    readonly onnxruntime?: string;
+    readonly onnx_providers?: readonly string[];
+    readonly torch?: string;
+    readonly torch_cuda?: string | null;
+    readonly cuda_devices?: readonly {
+        readonly name: string;
+        readonly capability: string;
+    }[];
+}
+export type ModelFormat = 'onnx-delivery' | 'torch-release';
+/** Request and batch limits an ONNX package declares in its `runtime-config.json`. */
+export interface BatchLimits {
+    /** Longest call in tokens; longer calls are answered as over the limit, not evaluated. */
+    readonly max_tokens: number;
+    /** Most calls one `judge` request may carry; the host splits larger groups. */
+    readonly max_request_items: number;
+    /** Most rows one graph run takes. */
+    readonly micro_batch: number;
+    /** Most padded tokens (rows times the longest row) one graph run takes. */
+    readonly padded_batch_tokens: number;
+}
+export interface LoadResult {
+    readonly load_seconds: number;
+    readonly format: ModelFormat;
+    readonly root: string;
+    readonly device: string;
+    /** Present for ONNX packages; a torch release batches on its own. */
+    readonly limits?: BatchLimits;
+}
+export declare class WorkerProcess {
+    private readonly python;
+    private child;
+    private readonly pending;
+    private nextId;
+    private stderr;
+    constructor(python: string);
+    get running(): boolean;
+    probe(): Promise<ProbeResult>;
+    load(format: ModelFormat, root: string, device: string): Promise<LoadResult>;
+    judge(inputs: readonly JudgeInput[]): Promise<ModelResult[]>;
+    /** Kill the process; pending requests fail. Resolves once the process has exited. */
+    stop(): Promise<void>;
+    private start;
+    private request;
+    private receive;
+    private failAll;
+    private lastError;
+}

package/node_modules/@openvulcan/vulcan-decision/lib/local/worker.js

@@ -0,0 +1,123 @@
+/**
+ * The host side of `python/vulcan_decision_worker.py`: one child process per runtime pack and
+ * model, answering JSON-line requests in order. Any failure, timeout or exit becomes an error;
+ * none of them is ever an answer.
+ */
+import { spawn } from 'node:child_process';
+import os from 'node:os';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+import { DecisionError } from '../protocol.js';
+/** The worker script shipped with this package. */
+export const WORKER_SCRIPT = fileURLToPath(new URL('../../python/vulcan_decision_worker.py', import.meta.url));
+/** Longest wait for a probe. */
+const PROBE_TIMEOUT_MS = 120_000;
+/** Longest wait for loading a model; the first CUDA start can take a while. */
+const LOAD_TIMEOUT_MS = 600_000;
+/** Longest wait for one judgement, which may hold up to the model's full token limit on a CPU. */
+const JUDGE_TIMEOUT_MS = 180_000;
+export class WorkerProcess {
+    python;
+    child;
+    pending = new Map();
+    nextId = 1;
+    stderr = '';
+    constructor(python) {
+        this.python = python;
+    }
+    get running() {
+        return this.child !== undefined;
+    }
+    probe() {
+        return this.request('probe', {}, PROBE_TIMEOUT_MS);
+    }
+    load(format, root, device) {
+        return this.request('load', { format, root, device }, LOAD_TIMEOUT_MS);
+    }
+    judge(inputs) {
+        return this.request('judge', { inputs }, JUDGE_TIMEOUT_MS);
+    }
+    /** Kill the process; pending requests fail. Resolves once the process has exited. */
+    stop() {
+        const child = this.child;
+        this.child = undefined;
+        this.failAll(new DecisionError('backend_unavailable', 'the local model process was stopped'));
+        if (child === undefined || child.exitCode !== null || child.signalCode !== null)
+            return Promise.resolve();
+        const exited = new Promise(resolve => child.once('exit', () => resolve()));
+        child.kill();
+        return exited;
+    }
+    start() {
+        if (this.child !== undefined)
+            return this.child;
+        const child = spawn(this.python, ['-I', '-B', WORKER_SCRIPT], {
+            // Outside the pack, so a running process never keeps the pack directory busy.
+            cwd: os.homedir(),
+            stdio: ['pipe', 'pipe', 'pipe'],
+            windowsHide: true,
+        });
+        this.child = child;
+        this.stderr = '';
+        child.stderr.setEncoding('utf8');
+        child.stderr.on('data', (chunk) => {
+            this.stderr = (this.stderr + chunk).slice(-8000);
+        });
+        createInterface({ input: child.stdout }).on('line', line => this.receive(line));
+        const ended = (reason) => {
+            if (this.child === child)
+                this.child = undefined;
+            this.failAll(new DecisionError('backend_unavailable', `the local model process ${reason}${this.lastError()}`));
+        };
+        child.on('error', error => ended(`could not start: ${error.message}`));
+        child.on('exit', code => ended(`exited with code ${code}`));
+        return child;
+    }
+    request(op, fields, timeoutMs) {
+        const child = this.start();
+        const id = this.nextId++;
+        return new Promise((resolve, reject) => {
+            const timer = setTimeout(() => {
+                // A request that never answers leaves the process in an unknown state.
+                void this.stop();
+                reject(new DecisionError('backend_unavailable', `the local model did not answer ${op} within ${timeoutMs / 1000} s`));
+            }, timeoutMs);
+            this.pending.set(id, { resolve, reject, timer });
+            child.stdin.write(`${JSON.stringify({ id, op, ...fields })}\n`);
+        });
+    }
+    receive(line) {
+        let message;
+        try {
+            message = JSON.parse(line);
+        }
+        catch {
+            void this.stop();
+            return;
+        }
+        const pending = typeof message.id === 'number' ? this.pending.get(message.id) : undefined;
+        if (pending === undefined)
+            return;
+        this.pending.delete(message.id);
+        clearTimeout(pending.timer);
+        if (message.ok === true) {
+            pending.resolve(message.result);
+        }
+        else {
+            const code = message.error?.code;
+            const text = typeof message.error?.message === 'string' ? message.error.message : 'unknown error';
+            pending.reject(new DecisionError(code === 'invalid_request' ? 'invalid_request' : 'model_failed', `${String(code)}: ${text}`));
+        }
+    }
+    failAll(error) {
+        for (const [id, pending] of this.pending) {
+            clearTimeout(pending.timer);
+            pending.reject(error);
+            this.pending.delete(id);
+        }
+    }
+    lastError() {
+        const lines = this.stderr.trim().split(/\r?\n/).filter(Boolean);
+        return lines.length === 0 ? '' : `: ${lines.at(-1)}`;
+    }
+}

package/node_modules/@openvulcan/vulcan-decision/lib/protocol.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Shapes shared by the cloud and local backends and the host plugins.
+ */
+/** The model's three candidate decisions, in classifier order. */
+export declare const DECISIONS: readonly ["allow", "review", "block"];
+export type Decision = typeof DECISIONS[number];
+/** The fixed authorization options the decision model was trained with; see the model's policy. */
+export interface DecisionOptions {
+    /** Ordinary writes outside the project: run them, or ask first. */
+    readonly cross_project_writes: 'allow' | 'review';
+    /** Database drops, truncations and unrestricted data writes. */
+    readonly database_reset: 'confirm' | 'allow';
+    /** Deleting or resetting the whole current project or its source history. */
+    readonly project_reset: 'confirm' | 'allow';
+}
+/** The policy's defaults. */
+export declare const DEFAULT_OPTIONS: DecisionOptions;
+/** Version of the fixed policy every backend must answer with. */
+export declare const POLICY_VERSION = "fixed-options-no-intent-v2-critical-writes";
+/** One tool call to judge before it runs. */
+export interface JudgeCall {
+    /** Root of the project the call works on, when the host knows it. Never guessed. */
+    readonly project?: string;
+    /** Tool name exactly as the host reports it. */
+    readonly tool: string;
+    /**
+     * Tool arguments exactly as the host reports them, in their original key order, except for
+     * file bodies that a host plugin removes from edit and write calls.
+     */
+    readonly arguments: Readonly<Record<string, unknown>>;
+}
+/** One model input: the options and the rendered call (see `renderCall`). */
+export interface JudgeInput {
+    readonly settings: DecisionOptions;
+    readonly rendered: string;
+}
+/** One model answer, as the local worker and the cloud endpoint produce it. */
+export interface ModelResult {
+    readonly decision: Decision;
+    /** Raw allow/review/block scores; not calibrated probabilities. */
+    readonly logits?: readonly number[];
+    readonly input_tokens?: number;
+    readonly model_evaluated: boolean;
+    /** Set when a rule decided without evaluating the model. */
+    readonly reason_code?: string;
+}
+export type BackendKind = 'cloud' | 'local';
+/** The answer for one call, with where it came from. */
+export interface Verdict extends ModelResult {
+    readonly backend: BackendKind;
+    /** Cloud model id or installed local model id. */
+    readonly model: string;
+    /** Cloud endpoint id, or the local runtime pack. */
+    readonly via: string;
+    readonly elapsed_ms: number;
+}
+/**
+ * Machine-readable failure kinds; hosts must never treat any of them as an allow.
+ * - `invalid_request`: the call cannot be rendered or the options are unknown.
+ * - `not_signed_in`: the cloud backend needs an OpenVulcan sign-in.
+ * - `backend_unavailable`: the cloud cannot be reached or the local process is not running.
+ * - `rate_limited`: the cloud refused for now; `retry_after_ms` may say for how long.
+ * - `not_installed`: the selected local runtime pack or model is not installed.
+ * - `model_failed`: the model or the endpoint answered something unusable.
+ */
+export type ErrorCode = 'invalid_request' | 'not_signed_in' | 'backend_unavailable' | 'rate_limited' | 'not_installed' | 'model_failed';
+/** A failure with its code. */
+export declare class DecisionError extends Error {
+    readonly code: ErrorCode;
+    readonly retryAfterMs?: number | undefined;
+    constructor(code: ErrorCode, message: string, retryAfterMs?: number | undefined);
+}
+/** Check a model result before anyone acts on it. */
+export declare function checkResult(value: unknown): ModelResult;

package/node_modules/@openvulcan/vulcan-decision/lib/protocol.js

@@ -0,0 +1,31 @@
+/**
+ * Shapes shared by the cloud and local backends and the host plugins.
+ */
+/** The model's three candidate decisions, in classifier order. */
+export const DECISIONS = ['allow', 'review', 'block'];
+/** The policy's defaults. */
+export const DEFAULT_OPTIONS = { cross_project_writes: 'allow', database_reset: 'confirm', project_reset: 'confirm' };
+/** Version of the fixed policy every backend must answer with. */
+export const POLICY_VERSION = 'fixed-options-no-intent-v2-critical-writes';
+/** A failure with its code. */
+export class DecisionError extends Error {
+    code;
+    retryAfterMs;
+    constructor(code, message, retryAfterMs) {
+        super(message);
+        this.code = code;
+        this.retryAfterMs = retryAfterMs;
+        this.name = 'DecisionError';
+    }
+}
+/** Check a model result before anyone acts on it. */
+export function checkResult(value) {
+    const result = value;
+    if (typeof result !== 'object' || result === null || !DECISIONS.includes(result.decision)) {
+        throw new DecisionError('model_failed', 'the model answered without a decision');
+    }
+    if (result.logits !== undefined && (!Array.isArray(result.logits) || result.logits.length !== 3 || !result.logits.every(Number.isFinite))) {
+        throw new DecisionError('model_failed', 'the model answered malformed scores');
+    }
+    return result;
+}

package/node_modules/@openvulcan/vulcan-decision/lib/render.d.ts

@@ -0,0 +1,15 @@
+import { type JudgeCall } from './protocol.js';
+/**
+ * Render a call in the text format the model was trained on:
+ *
+ * ```text
+ * Project: <project root>      (omitted when unknown)
+ * Tool: <tool name>
+ * Arguments: <compact JSON of the actual arguments, keys in their original order>
+ * ```
+ *
+ * Nothing is invented: no task description, previous message, working directory or file state.
+ * `JSON.stringify` matches the reference `json.dumps(..., ensure_ascii=False,
+ * separators=(',', ':'))` for JSON-shaped values.
+ */
+export declare function renderCall(call: Pick<JudgeCall, 'project' | 'tool' | 'arguments'>): string;

package/node_modules/@openvulcan/vulcan-decision/lib/render.js

@@ -0,0 +1,33 @@
+import { DecisionError } from './protocol.js';
+/**
+ * Render a call in the text format the model was trained on:
+ *
+ * ```text
+ * Project: <project root>      (omitted when unknown)
+ * Tool: <tool name>
+ * Arguments: <compact JSON of the actual arguments, keys in their original order>
+ * ```
+ *
+ * Nothing is invented: no task description, previous message, working directory or file state.
+ * `JSON.stringify` matches the reference `json.dumps(..., ensure_ascii=False,
+ * separators=(',', ':'))` for JSON-shaped values.
+ */
+export function renderCall(call) {
+    if (typeof call.tool !== 'string' || call.tool === '')
+        throw new DecisionError('invalid_request', 'the call has no tool name');
+    if (typeof call.arguments !== 'object' || call.arguments === null || Array.isArray(call.arguments)) {
+        throw new DecisionError('invalid_request', 'the call arguments must be an object');
+    }
+    if (call.project !== undefined && typeof call.project !== 'string') {
+        throw new DecisionError('invalid_request', 'the project root must be a string');
+    }
+    const prefix = call.project === undefined || call.project === '' ? '' : `Project: ${call.project}\n`;
+    return `${prefix}Tool: ${call.tool}\nArguments: ${JSON.stringify(call.arguments, finiteOnly)}`;
+}
+function finiteOnly(_key, value) {
+    // The reference serializer refuses NaN and infinities instead of writing null for them.
+    if (typeof value === 'number' && !Number.isFinite(value)) {
+        throw new DecisionError('invalid_request', 'the call arguments contain a non-finite number');
+    }
+    return value;
+}

package/node_modules/@openvulcan/vulcan-decision/lib/version.d.ts

@@ -0,0 +1,2 @@
+/** This package's version, as `package.json` declares it. */
+export declare const VERSION: string;

package/node_modules/@openvulcan/vulcan-decision/lib/version.js

@@ -0,0 +1,4 @@
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+/** This package's version, as `package.json` declares it. */
+export const VERSION = require('../package.json').version;

package/node_modules/@openvulcan/vulcan-decision/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@openvulcan/vulcan-decision",
+  "version": "0.4.3",
+  "description": "Vulcan Decision: judge AI coding tool calls before they run, with OpenVulcan cloud endpoints or an optional local model runtime.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/OpenVulcan/dsh-vulcancode.git",
+    "directory": "packages/vulcan-decision"
+  },
+  "type": "module",
+  "bin": {
+    "vulcan-decision": "bin/vulcan-decision.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cli": "./lib/cli.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "bin",
+    "lib",
+    "!lib/**/*.test.*",
+    "python/*.py",
+    "runtime-packs/*.json",
+    "!runtime-packs/spec.json"
+  ],
+  "engines": {
+    "node": ">=20.19"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@openvulcan/openvulcan-account": "0.4.3"
+  }
+}