@pellux/goodvibes-sdk 1.0.0 → 1.2.0

package/dist/platform/daemon/http/webui-serving.js

@@ -0,0 +1,230 @@
+/**
+ * webui-serving.ts
+ *
+ * Two opt-in capabilities that let a browser-hosted web UI reach the daemon:
+ *
+ *   1. Same-origin bundle serving (PRIMARY). When `controlPlane.webui.serve` is
+ *      on, the daemon serves a configured build directory at `/` so the bundle
+ *      and the API share an origin — the browser's same-origin policy is then a
+ *      non-issue. This is wire-compatible with `tailscale serve`, which fronts
+ *      the single daemon origin over HTTPS: bundle + API arrive same-origin.
+ *      The bundle is public (served without a token); the app itself
+ *      token-authenticates its API calls, so no wire data leaks from serving
+ *      static files.
+ *
+ *   2. Cross-origin request support (SECONDARY). When `controlPlane.cors.enabled`
+ *      is on, OPTIONS preflight is answered and Access-Control-Allow-* headers
+ *      are emitted ONLY for origins on the explicit `controlPlane.cors.allowedOrigins`
+ *      allowlist (the Vite dev server, a deliberately separate origin, etc.).
+ *      There is no wildcard: the matched origin is echoed back, credentials are
+ *      allowlist-gated, and `Vary: Origin` is always set so caches stay correct.
+ *
+ * BOTH default OFF. With both off the daemon behaves exactly as before: no bundle
+ * is served and no Access-Control-Allow-Origin is ever emitted. The loopback
+ * default posture is unchanged; these capabilities are explicit opt-ins, never
+ * auto-enabled by network host mode.
+ */
+import { resolve, sep } from 'node:path';
+import { readStringList } from '../helpers.js';
+function readConfig(configManager, key) {
+    const getter = configManager.get;
+    return typeof getter === 'function' ? getter.call(configManager, key) : undefined;
+}
+/** Read the current serving posture from config. Cheap; called per request. */
+export function resolveWebuiServingPosture(configManager) {
+    const serveBundle = readConfig(configManager, 'controlPlane.webui.serve') === true;
+    const bundleDirRaw = readConfig(configManager, 'controlPlane.webui.bundleDir');
+    const corsEnabled = readConfig(configManager, 'controlPlane.cors.enabled') === true;
+    const allowedOrigins = readStringList(readConfig(configManager, 'controlPlane.cors.allowedOrigins')) ?? [];
+    const openaiPrefixRaw = readConfig(configManager, 'controlPlane.openaiCompatible.pathPrefix');
+    return {
+        serveBundle,
+        bundleDir: typeof bundleDirRaw === 'string' ? bundleDirRaw.trim() : '',
+        cors: { enabled: corsEnabled, allowedOrigins },
+        openaiPathPrefix: typeof openaiPrefixRaw === 'string' && openaiPrefixRaw.trim() ? openaiPrefixRaw.trim() : '/v1',
+    };
+}
+// ---------------------------------------------------------------------------
+// CORS (secondary path)
+// ---------------------------------------------------------------------------
+/** Append a token to an existing Vary header without duplicating it. */
+function appendVary(existing, token) {
+    if (!existing)
+        return token;
+    const parts = existing.split(',').map((p) => p.trim()).filter(Boolean);
+    if (parts.some((p) => p.toLowerCase() === token.toLowerCase()))
+        return existing;
+    return [...parts, token].join(', ');
+}
+/** True when the origin is on the explicit allowlist (exact match, no wildcard). */
+function isOriginAllowed(origin, allowlist) {
+    return allowlist.includes(origin);
+}
+/**
+ * Answer a CORS preflight (OPTIONS). Emits Access-Control-Allow-* only for an
+ * allowlisted origin; a non-allowlisted origin is refused honestly (403, no
+ * Access-Control-Allow-Origin) so the browser preflight fails cleanly.
+ */
+export function handleCorsPreflight(req, posture) {
+    const origin = req.headers.get('origin');
+    // A preflight with no Origin is not a browser CORS preflight — answer 204 with
+    // no allow-origin (nothing to grant); never emit a wildcard.
+    if (origin === null) {
+        return new Response(null, { status: 204, headers: { Vary: 'Origin' } });
+    }
+    if (!isOriginAllowed(origin, posture.cors.allowedOrigins)) {
+        return Response.json({ error: 'ORIGIN_NOT_ALLOWED', code: 'ORIGIN_NOT_ALLOWED', message: 'Origin is not on controlPlane.cors.allowedOrigins.' }, { status: 403, headers: { Vary: 'Origin' } });
+    }
+    // Echo the requested headers when present, otherwise a safe default that always
+    // includes Authorization so the bearer-token API flow works cross-origin.
+    const requestedHeaders = req.headers.get('access-control-request-headers');
+    const allowHeaders = requestedHeaders && requestedHeaders.trim()
+        ? requestedHeaders
+        : 'Authorization, Content-Type';
+    return new Response(null, {
+        status: 204,
+        headers: {
+            'Access-Control-Allow-Origin': origin,
+            'Access-Control-Allow-Credentials': 'true',
+            'Access-Control-Allow-Methods': 'GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers': allowHeaders,
+            'Access-Control-Max-Age': '600',
+            Vary: 'Origin',
+        },
+    });
+}
+/**
+ * Decorate an actual (non-preflight) response with CORS headers when the request
+ * carries an allowlisted Origin. `Vary: Origin` is always added while CORS is
+ * enabled so caches never serve an allow-origin to the wrong origin. A
+ * non-allowlisted origin gets Vary but NO Access-Control-Allow-Origin — the
+ * browser then blocks the read honestly.
+ */
+export function applyCorsHeaders(req, response, posture) {
+    const origin = req.headers.get('origin');
+    if (origin === null)
+        return response;
+    const headers = new Headers(response.headers);
+    headers.set('Vary', appendVary(headers.get('Vary'), 'Origin'));
+    if (isOriginAllowed(origin, posture.cors.allowedOrigins)) {
+        headers.set('Access-Control-Allow-Origin', origin);
+        headers.set('Access-Control-Allow-Credentials', 'true');
+    }
+    return new Response(response.body, { status: response.status, statusText: response.statusText, headers });
+}
+// ---------------------------------------------------------------------------
+// Static bundle serving (primary path)
+// ---------------------------------------------------------------------------
+/** Extension → content type for the common web-bundle asset kinds. */
+const CONTENT_TYPES = {
+    html: 'text/html; charset=utf-8',
+    js: 'text/javascript; charset=utf-8',
+    mjs: 'text/javascript; charset=utf-8',
+    css: 'text/css; charset=utf-8',
+    json: 'application/json; charset=utf-8',
+    map: 'application/json; charset=utf-8',
+    svg: 'image/svg+xml',
+    png: 'image/png',
+    jpg: 'image/jpeg',
+    jpeg: 'image/jpeg',
+    gif: 'image/gif',
+    webp: 'image/webp',
+    avif: 'image/avif',
+    ico: 'image/x-icon',
+    woff: 'font/woff',
+    woff2: 'font/woff2',
+    ttf: 'font/ttf',
+    wasm: 'application/wasm',
+    txt: 'text/plain; charset=utf-8',
+    webmanifest: 'application/manifest+json',
+};
+function extensionOf(pathname) {
+    const base = pathname.slice(pathname.lastIndexOf('/') + 1);
+    const dot = base.lastIndexOf('.');
+    return dot > 0 ? base.slice(dot + 1).toLowerCase() : '';
+}
+function contentTypeFor(pathname) {
+    return CONTENT_TYPES[extensionOf(pathname)] ?? 'application/octet-stream';
+}
+/** True when a path belongs to the daemon API/route surface and must never be
+ *  served as a static file (API routes keep precedence). Boundary-aware so a SPA
+ *  route like `/tasks` is not mistaken for the daemon's `/task` route. */
+function isReservedApiPath(pathname, openaiPrefix) {
+    const reserved = ['/api', '/login', '/webhook', '/task', openaiPrefix];
+    return reserved.some((base) => pathname === base || pathname.startsWith(`${base}/`));
+}
+/** True when the request looks like an SPA navigation (HTML document) rather than
+ *  a fetch for a concrete asset — used to decide whether the index.html fallback
+ *  applies. A missing concrete asset must 404, not return the HTML shell. */
+function isNavigationRequest(req, pathname) {
+    if (extensionOf(pathname) === '')
+        return true;
+    return (req.headers.get('accept') ?? '').includes('text/html');
+}
+function cacheControlFor(pathname, isShell) {
+    if (isShell || extensionOf(pathname) === 'html')
+        return 'no-cache';
+    if (pathname.includes('/assets/'))
+        return 'public, max-age=31536000, immutable';
+    return 'public, max-age=3600';
+}
+async function fileResponse(req, file, pathname, isShell) {
+    const headers = {
+        'Content-Type': contentTypeFor(pathname),
+        'Cache-Control': cacheControlFor(pathname, isShell),
+    };
+    if (req.method === 'HEAD') {
+        const size = await file.size;
+        return new Response(null, { status: 200, headers: { ...headers, 'Content-Length': String(size) } });
+    }
+    return new Response(file, { status: 200, headers });
+}
+/**
+ * Serve a file from the configured bundle directory, with SPA fallback to
+ * index.html for navigation routes. Returns null when serving is disabled, the
+ * request is not a GET/HEAD, or the path is a reserved API route — in every
+ * "null" case the caller continues with normal daemon routing, so behavior is
+ * unchanged when the capability is off. Path traversal outside the bundle
+ * directory is refused with 403.
+ */
+export async function serveWebuiBundle(req, posture) {
+    if (!posture.serveBundle || !posture.bundleDir)
+        return null;
+    if (req.method !== 'GET' && req.method !== 'HEAD')
+        return null;
+    const url = new URL(req.url);
+    let pathname;
+    try {
+        pathname = decodeURIComponent(url.pathname);
+    }
+    catch {
+        return new Response('Bad Request', { status: 400 });
+    }
+    if (pathname.includes('\0'))
+        return new Response('Bad Request', { status: 400 });
+    if (isReservedApiPath(pathname, posture.openaiPathPrefix))
+        return null;
+    const root = resolve(posture.bundleDir);
+    const relative = pathname === '/' ? 'index.html' : pathname.replace(/^\/+/, '');
+    const resolved = resolve(root, relative);
+    // Reject anything that escapes the bundle root (path traversal).
+    if (resolved !== root && !resolved.startsWith(root + sep)) {
+        return new Response('Forbidden', { status: 403 });
+    }
+    const file = Bun.file(resolved);
+    if (await file.exists()) {
+        const isShell = resolved === resolve(root, 'index.html');
+        // Derive the content type from the resolved file path, not the request path —
+        // a `GET /` serves index.html and must answer text/html, not octet-stream.
+        return fileResponse(req, file, resolved, isShell);
+    }
+    // SPA fallback: an unknown navigation route serves the app shell; a missing
+    // concrete asset is an honest 404 (never the HTML shell in a JS/CSS request).
+    if (isNavigationRequest(req, pathname)) {
+        const indexFile = Bun.file(resolve(root, 'index.html'));
+        if (await indexFile.exists()) {
+            return fileResponse(req, indexFile, '/index.html', true);
+        }
+    }
+    return new Response('Not Found', { status: 404 });
+}

package/dist/platform/knowledge/knowledge-api.d.ts

@@ -75,7 +75,7 @@ export interface MemoryApi {
 export type MemoryApiRegistry = Pick<MemoryRegistry, 'add' | 'doctor' | 'delete' | 'exportBundle' | 'get' | 'getAll' | 'importBundle' | 'link' | 'linksFor' | 'rebuildVectors' | 'rebuildVectorsAsync' | 'review' | 'reviewQueue' | 'search' | 'searchSemantic' | 'update' | 'vectorStats'>;
 /**
  * memory-api-parallel query surface for the repo source-tree code index
- * (Wave-5 wo802, W5.3 Stage A). Deliberately NOT folded into MemoryApi:
+ * (Stage A, see CHANGELOG 0.38.0). Deliberately NOT folded into MemoryApi:
  * CodeContextResult/CodeIndexStats are a different record shape than
  * MemoryRecord, and code-index retrieval carries no cls/reviewState/trustTier
  * provenance semantics — see createCodeIndexApi / createMemoryApi below.

package/dist/platform/orchestration/budget.d.ts

@@ -1,10 +1,10 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Budget enforcement (Wave 4, wo701). Enforcement point is BEFORE the
+ * Budget enforcement (see CHANGELOG 0.38.0). Enforcement point is BEFORE the
  * scheduler claims an item into a new phase (i.e. before a new agent spawn)
  * — never mid-item. An in-flight item's phase always runs to completion even
  * if a later check here would refuse a NEW claim: honest semantics, never a
- * mid-run kill on budget (see design doc (e)).
+ * mid-run kill on budget.
  *
  * Usage is summed directly from WorkItem.usage, which phase-runner.ts
  * populates from the SAME `priceUsage` function threaded through

package/dist/platform/orchestration/cancellation.d.ts

@@ -1,7 +1,7 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Per-work-item cancellation registry (Wave 4, wo701) — the deferred W0.1
- * cooperative-cancellation piece.
+ * Per-work-item cancellation registry (see CHANGELOG 0.38.0) — closing a
+ * previously deferred cooperative-cancellation gap.
  *
  * One AbortController per in-flight WorkItem. `engine.kill(itemId)` aborts
  * the controller here AND calls `agentManager.cancel(agentId, 'kill')` — the

package/dist/platform/orchestration/controller-compat.d.ts

@@ -1,8 +1,7 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Controller-compat (Wave 4, wo701) — stage 1 of the 3-stage WrfcController
- * migration (see design doc (g) and the work-order report's design-
- * divergences section).
+ * Controller-compat (see CHANGELOG 0.38.0) — stage 1 of the 3-stage WrfcController
+ * migration.
  *
  * `fromChainSpec()` produces the canned two-phase engineer->review
  * WORKSTREAM SPEC that a `WrfcController.createChain(ownerRecord)` call

package/dist/platform/orchestration/controller-compat.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"controller-compat.d.ts","sourceRoot":"","sources":["../../../src/platform/orchestration/controller-compat.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,SAAI,GAAG,SAAS,EAAE,CAK5F;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC,EAC7C,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,aAAa,CAAC,GACxD,qBAAqB,CAOvB"}
+{"version":3,"file":"controller-compat.d.ts","sourceRoot":"","sources":["../../../src/platform/orchestration/controller-compat.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAErF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEhE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,eAAe,EAAE,QAAQ,SAAI,GAAG,SAAS,EAAE,CAK5F;AAED,wBAAgB,aAAa,CAC3B,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,GAAG,MAAM,CAAC,EAC7C,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,aAAa,CAAC,GACxD,qBAAqB,CAOvB"}

package/dist/platform/orchestration/dirty-guard.js

@@ -1,6 +1,6 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Dirty-residue guard (Wave 6, wo-F item 4) — prevents an orchestration
+ * Dirty-residue guard (see CHANGELOG 0.38.0) — prevents an orchestration
  * engine run's scoped commit from sweeping in uncommitted changes that were
  * ALREADY sitting in the working tree before this engine launched (typically
  * residue left behind by a previously killed run sharing the same

package/dist/platform/orchestration/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/platform/orchestration/engine.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAkBrF,OAAO,KAAK,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAatF,OAAO,EAIL,KAAK,aAAa,EAElB,KAAK,0BAA0B,EAC/B,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,SAAS,EAEd,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAIlE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,aAAa,CAAC,CAAC;IACnE,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,eAAe,CAAC,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,aAAa,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IACvG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrD,qIAAqI;IACrI,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,wHAAwH;IACxH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,iNAAiN;IACjN,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAAC;IAC3D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C,eAAe,IAAI,UAAU,EAAE,CAAC;IAChC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;IACvF,qHAAqH;IACrH,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+GAA+G;IAC/G,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;IAChF;;;;;;;;OAQG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IAC9D,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD,4KAA4K;IAC5K,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjE,sEAAsE;IACtE,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,gGAAgG;IAChG,iBAAiB,IAAI,MAAM,CAAC;IAC5B,EAAE,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,IAAI,CAAC;IACrD,OAAO,IAAI,IAAI,CAAC;CACjB;AAMD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CA4mB5F"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/platform/orchestration/engine.ts"],"names":[],"mappings":"AAAA,qFAAqF;AAiBrF,OAAO,KAAK,EAAE,2BAA2B,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAatF,OAAO,EAIL,KAAK,aAAa,EAElB,KAAK,0BAA0B,EAC/B,KAAK,KAAK,EACV,KAAK,WAAW,EAChB,KAAK,SAAS,EAEd,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EAC1B,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAIlE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,YAAY,EAAE,2BAA2B,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,GAAG,aAAa,CAAC,CAAC;IACnE,QAAQ,CAAC,UAAU,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,MAAM,eAAe,CAAC,GAAG,SAAS,CAAC;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,aAAa,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,SAAS,CAAC;IACvG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACrD,qIAAqI;IACrI,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,SAAS,CAAC;IAC1C,wHAAwH;IACxH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,iNAAiN;IACjN,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/C;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,SAAS,YAAY,EAAE,CAAC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,SAAS,CAAC;IACrD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,UAAU,CAAC;IAC3D,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAAC;IAC7C,eAAe,IAAI,UAAU,EAAE,CAAC;IAChC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,CAAC;IACvF,qHAAqH;IACrH,KAAK,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,+GAA+G;IAC/G,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B;;;;;;OAMG;IACH,YAAY,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,SAAS,GAAG,OAAO,CAAC;IAChF;;;;;;;;OAQG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;IACnC,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,WAAW,EAAE,CAAC;IAC9D,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACzD,4KAA4K;IAC5K,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IACjE,sEAAsE;IACtE,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAChD,gGAAgG;IAChG,iBAAiB,IAAI,MAAM,CAAC;IAC5B,EAAE,CAAC,QAAQ,EAAE,0BAA0B,GAAG,MAAM,IAAI,CAAC;IACrD,OAAO,IAAI,IAAI,CAAC;CACjB;AAMD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,uBAAuB,GAAG,mBAAmB,CA4mB5F"}

package/dist/platform/orchestration/engine.js

@@ -1,9 +1,8 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * OrchestrationEngine (Wave 4, wo701) — owns Workstream state and drives the
+ * OrchestrationEngine (see CHANGELOG 0.38.0) — owns Workstream state and drives the
  * pipeline. WRAPS a canned/authored workstream; does not rewrite or touch
- * WrfcController (stage 1 of the 3-stage migration — see controller-compat.ts
- * and the work-order report).
+ * WrfcController (stage 1 of the 3-stage migration — see controller-compat.ts).
  *
  * The tick loop is reactive, not timer-driven: `start()` runs one tick;
  * every phase-run completion re-runs tick() for its workstream. Because JS
@@ -49,7 +48,7 @@ export function createOrchestrationEngine(deps) {
         listeners.add(listener);
         return () => listeners.delete(listener);
     }
-    // Dirty-residue guard (Wave 6, wo-F item 4): snapshot the working tree's
+    // Dirty-residue guard (see CHANGELOG 0.38.0): snapshot the working tree's
     // dirty paths + content hashes ONCE, right at engine launch (synchronous —
     // see dirty-guard.ts's doc comment for why this must not be a promise
     // backed by real subprocess I/O), before any phase of this run has had a

package/dist/platform/orchestration/persistence.js

@@ -1,6 +1,6 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Persistence (Wave 4, wo701) — mirrors the WrfcController chain seams
+ * Persistence (see CHANGELOG 0.38.0) — mirrors the WrfcController chain seams
  * exactly: serializeChain:323 / deserializeChain:345 (including the
  * future-schemaVersion-reject guard at :364) / importChain:402. Writes to
  * `.goodvibes/orchestration/<workstreamId>.json` — SEPARATE from the TUI's
@@ -164,7 +164,7 @@ export function attachDebouncedWriter(projectRoot, getWorkstream, getCompletedRe
         timers.set(workstreamId, timer);
     }
     const unsubscribe = subscribe((event) => {
-        // 'dirty-tree-at-launch' (Wave 6, wo-F item 4) is engine-wide, not
+        // 'dirty-tree-at-launch' (see CHANGELOG 0.38.0) is engine-wide, not
         // workstream-scoped — it has no workstreamId to schedule a write for.
         if (event.type === 'dirty-tree-at-launch')
             return;

package/dist/platform/orchestration/phase-runner.d.ts

@@ -1,6 +1,6 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Phase-runner (Wave 4, wo701) — runs one WorkItem through one Phase: spawn
+ * Phase-runner (see CHANGELOG 0.38.0) — runs one WorkItem through one Phase: spawn
  * agent, await completion, verify claims, run gates, commit, cleanup.
  *
  * REUSES the hardened WRFC primitives verbatim (same functions WrfcController
@@ -26,7 +26,7 @@
  * itself has either. This module therefore mirrors WrfcController's ACTUAL
  * (shared-directory) behavior rather than the brief's aspirational
  * per-item-isolated-worktree fan-out; true fan-out isolation is a valuable,
- * separately-scoped follow-up (see the work-order report).
+ * separately-scoped follow-up.
  *
  * SECOND REALITY-WINS DIVERGENCE: AgentManager.spawn()'s root-spawn
  * normalization (tools/agent/wrfc-batch-policy.ts isRootReviewRoleTask) force
@@ -84,8 +84,8 @@ export interface PhaseRunnerDeps {
     readonly priceUsage?: ((model: string | undefined, usage: WorkItemUsage) => number | null) | undefined;
     readonly skipClaimVerification?: boolean | undefined;
     /**
-     * The dirty-tree snapshot taken synchronously at engine launch (Wave 6,
-     * wo-F item 4 — see dirty-guard.ts). Absent (undefined) degrades to
+     * The dirty-tree snapshot taken synchronously at engine launch (see
+     * CHANGELOG 0.38.0 and dirty-guard.ts). Absent (undefined) degrades to
      * today's behavior: no exclusion, every candidate path is committed.
      */
     readonly launchDirtySnapshot?: DirtyLaunchSnapshot | undefined;

package/dist/platform/orchestration/scheduler.d.ts

@@ -1,6 +1,6 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Scheduler (Wave 4, wo701) — pure capacity-matching helpers, no side
+ * Scheduler (see CHANGELOG 0.38.0) — pure capacity-matching helpers, no side
  * effects. The hard departure from WrfcController's pairwise
  * engineer<->reviewer binding (startReview:883/startFix:1042): each tick,
  * for every phase in ordinal order, free capacity slots (capacity minus

package/dist/platform/orchestration/types.d.ts

@@ -1,6 +1,6 @@
 /** SDK-owned platform module. This implementation is maintained in goodvibes-sdk. */
 /**
- * Orchestration engine — the model (W4.1, wo701).
+ * Orchestration engine — the model (see CHANGELOG 0.38.0).
  *
  * A phase/work-item pipeline layered OVER (not replacing) WrfcController. The
  * hard departure from WrfcController is pipeline semantics: an item advances
@@ -297,7 +297,7 @@ export interface GateOutcome {
     readonly unsatisfiedConstraintIds?: readonly string[] | undefined;
 }
 /**
- * Recorded on a PhaseResult when a scoped commit (Wave 6, wo-F item 4)
+ * Recorded on a PhaseResult when a scoped commit (see CHANGELOG 0.38.0)
  * excluded one or more candidate paths because they were already dirty
  * before this engine run launched and this phase never actually touched
  * them (see dirty-guard.ts's excludeUntouchedLaunchResidue). `skipped: true`
@@ -521,7 +521,7 @@ export type OrchestrationEvent = {
     readonly disposition: 'adopted' | 'reported';
 }
 /**
- * Emitted once per engine instance (Wave 6, wo-F item 4), right after the
+ * Emitted once per engine instance (see CHANGELOG 0.38.0), right after the
  * launch-time dirty-tree snapshot resolves, ONLY when it is non-empty.
  * Engine-wide, not workstream-scoped — `workstreamId` is absent (unlike
  * every other variant above) because it fires before any workstream is

package/dist/platform/presentation/glyphs.d.ts

@@ -4,7 +4,7 @@
  * and src/renderer/status-glyphs.ts (STATE_GLYPHS).
  *
  * This is one of the four genuinely-duplicated presentation tables named by the
- * W4-R1 renderer/input parity audit (both the TUI and the agent shipped a near-twin
+ * renderer/input parity audit (see CHANGELOG 1.0.0; both the TUI and the agent shipped a near-twin
  * copy). The TUI is the reference: it is the more-complete, more-recently-fixed
  * copy, and per the presentation-contract decision record its `status` group is
  * the one both renderers converge on.

package/dist/platform/presentation/glyphs.js

@@ -4,7 +4,7 @@
  * and src/renderer/status-glyphs.ts (STATE_GLYPHS).
  *
  * This is one of the four genuinely-duplicated presentation tables named by the
- * W4-R1 renderer/input parity audit (both the TUI and the agent shipped a near-twin
+ * renderer/input parity audit (see CHANGELOG 1.0.0; both the TUI and the agent shipped a near-twin
  * copy). The TUI is the reference: it is the more-complete, more-recently-fixed
  * copy, and per the presentation-contract decision record its `status` group is
  * the one both renderers converge on.

package/dist/platform/presentation/index.d.ts

@@ -2,7 +2,7 @@
  * @pellux/goodvibes-sdk/platform/presentation
  *
  * The presentation contract — the four genuinely-duplicated presentation
- * tables named by the W4-R1 renderer/input parity audit (goodvibes-tui vs
+ * tables named by the renderer/input parity audit (see CHANGELOG 1.0.0; goodvibes-tui vs
  * goodvibes-agent), hoisted into one pure, dependency-free module per Mike's
  * SDK-boundary rule (machinery needed by 2+ surfaces => SDK):
  *
@@ -15,8 +15,8 @@
  * The TUI is the reference for every value here; dark stays byte-identical to
  * today's TUI. See docs/decisions/2026-07-05-presentation-contract-sdk-extraction.md
  * for the full decision record, including the GLYPHS status-group reconciliation
- * ruling and the consumption plan (agent this wave via R4; TUI swap deferred to
- * a Wave-6 coherence pass).
+ * ruling and the consumption plan (the agent picks this up via R4; the TUI swap is
+ * deferred to a future coherence pass).
  *
  * PURE — no fs, no terminal I/O, no process globals. Painting stays
  * renderer-owned; this module owns only tokens and pure wording functions.

package/dist/platform/presentation/index.js

@@ -2,7 +2,7 @@
  * @pellux/goodvibes-sdk/platform/presentation
  *
  * The presentation contract — the four genuinely-duplicated presentation
- * tables named by the W4-R1 renderer/input parity audit (goodvibes-tui vs
+ * tables named by the renderer/input parity audit (see CHANGELOG 1.0.0; goodvibes-tui vs
  * goodvibes-agent), hoisted into one pure, dependency-free module per Mike's
  * SDK-boundary rule (machinery needed by 2+ surfaces => SDK):
  *
@@ -15,8 +15,8 @@
  * The TUI is the reference for every value here; dark stays byte-identical to
  * today's TUI. See docs/decisions/2026-07-05-presentation-contract-sdk-extraction.md
  * for the full decision record, including the GLYPHS status-group reconciliation
- * ruling and the consumption plan (agent this wave via R4; TUI swap deferred to
- * a Wave-6 coherence pass).
+ * ruling and the consumption plan (the agent picks this up via R4; the TUI swap is
+ * deferred to a future coherence pass).
  *
  * PURE — no fs, no terminal I/O, no process globals. Painting stays
  * renderer-owned; this module owns only tokens and pure wording functions.

package/dist/platform/presentation/thinking-phrases.d.ts

@@ -1,7 +1,7 @@
 /**
  * thinking-phrases.ts — the rotating "thinking" phrase pool, hoisted from
  * `goodvibes-tui` src/renderer/ui-factory.ts (THINKING_PHRASES). Verbatim
- * identical to the agent's copy today (per the W4-R1 parity audit) — a pure
+ * identical to the agent's copy today (per the renderer/input parity audit) — a pure
  * move, no reconciliation needed.
  *
  * Vaporwave / good-vibes themed; shown by waitingPhrase()'s 'thinking' case

package/dist/platform/presentation/thinking-phrases.js

@@ -1,7 +1,7 @@
 /**
  * thinking-phrases.ts — the rotating "thinking" phrase pool, hoisted from
  * `goodvibes-tui` src/renderer/ui-factory.ts (THINKING_PHRASES). Verbatim
- * identical to the agent's copy today (per the W4-R1 parity audit) — a pure
+ * identical to the agent's copy today (per the renderer/input parity audit) — a pure
  * move, no reconciliation needed.
  *
  * Vaporwave / good-vibes themed; shown by waitingPhrase()'s 'thinking' case

package/dist/platform/presentation/waiting-wording.d.ts

@@ -11,7 +11,7 @@
  * TUI's precedence order — approval beats reconnect beats pre-first-token
  * beats stalled beats thinking) and calls waitingPhrase(state, ctx) for the
  * exact wording. Neither renderer should carry its own copy of these five
- * strings/rotation — that duplication is exactly what the W4-R1 audit found
+ * strings/rotation — that duplication is exactly what the renderer/input parity audit found
  * (the agent's ui-factory.ts:308-313 was rotating-only, with no honest
  * stall/reconnect/approval split at all).
  *

package/dist/platform/presentation/waiting-wording.js

@@ -11,7 +11,7 @@
  * TUI's precedence order — approval beats reconnect beats pre-first-token
  * beats stalled beats thinking) and calls waitingPhrase(state, ctx) for the
  * exact wording. Neither renderer should carry its own copy of these five
- * strings/rotation — that duplication is exactly what the W4-R1 audit found
+ * strings/rotation — that duplication is exactly what the renderer/input parity audit found
  * (the agent's ui-factory.ts:308-313 was rotating-only, with no honest
  * stall/reconnect/approval split at all).
  *

package/dist/platform/push/delivery.d.ts

@@ -0,0 +1,48 @@
+/**
+ * push/delivery.ts
+ *
+ * The single place a push message is actually encrypted and sent. Every send —
+ * a `push.subscriptions.verify` test, or an approval/completion fan-out — flows
+ * through `deliverToSubscription`, so the honesty rules live in one spot:
+ *
+ *  - A push service that answers 404/410 means the browser subscription is gone;
+ *    the record is pruned and the receipt says `pruned`, never a fake success.
+ *  - Any other non-2xx (or a transport error) is reported as `failed` with the
+ *    status/reason, never swallowed into a success.
+ *  - The request carries the RFC 8188 `Content-Encoding: aes128gcm` body plus
+ *    the `TTL`, `Urgency`, and VAPID `Authorization` headers a push service
+ *    requires.
+ *
+ * The endpoint is whatever the browser registered. In tests that is a local
+ * HTTP sink; in production it is the browser vendor's push service. This module
+ * never contacts a hard-coded external service of its own.
+ */
+import type { VapidManager } from './vapid.js';
+import type { PushSubscriptionStore } from './subscription-store.js';
+import type { PushDeliveryReceipt, PushMessage, StoredPushSubscription } from './types.js';
+/** The `fetch` slice used to POST an encrypted payload. Injectable for tests. */
+export type PushTransport = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: Buffer;
+}) => Promise<{
+    status: number;
+}>;
+export interface DeliveryDeps {
+    readonly vapid: VapidManager;
+    readonly store: PushSubscriptionStore;
+    readonly transport?: PushTransport | undefined;
+}
+/**
+ * Encrypt and send one message to one subscription, prune-on-gone, and return
+ * an honest receipt. The subscription's `lastOutcome` is stamped either way.
+ */
+export declare function deliverToSubscription(subscription: StoredPushSubscription, message: PushMessage, deps: DeliveryDeps): Promise<PushDeliveryReceipt>;
+/**
+ * Fan one message out to every stored subscription, delivering (and pruning) in
+ * sequence. Returns one receipt per subscription — an empty array when there
+ * are no subscriptions at all (the honest "nobody to notify" result, not a
+ * silent success).
+ */
+export declare function deliverToAll(message: PushMessage, deps: DeliveryDeps): Promise<PushDeliveryReceipt[]>;
+//# sourceMappingURL=delivery.d.ts.map

package/dist/platform/push/delivery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delivery.d.ts","sourceRoot":"","sources":["../../../src/platform/push/delivery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,KAAK,EACV,mBAAmB,EACnB,WAAW,EACX,sBAAsB,EACvB,MAAM,YAAY,CAAC;AAEpB,iFAAiF;AACjF,MAAM,MAAM,aAAa,GAAG,CAC1B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAgCjC,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,qBAAqB,CAAC;IACtC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAChD;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,sBAAsB,EACpC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,mBAAmB,CAAC,CAyD9B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAOhC"}