@sponsio/sdk 0.1.0 → 0.2.0-alpha.4

package/dist/core/session-log.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-log.d.ts","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAqEH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAA0B,EACpC,KAAK,GAAE,MAAuB,GAC7B,MAAM,EAAE,CAgEV;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,SAAS,GACT,UAAU,GACV,WAAW,GACX,QAAQ,GACR,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,aAAa,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,gDAAgD;IAChD,GAAG,CAAC,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB;IA8B/D,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;CAcjC"}
+{"version":3,"file":"session-log.d.ts","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAsFH;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,QAAQ,GAAE,MAA0B,EACpC,KAAK,GAAE,MAAuB,GAC7B,MAAM,EAAE,CAgEV;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,aAAa,GACrB,SAAS,GACT,SAAS,GACT,UAAU,GACV,WAAW,GACX,QAAQ,GACR,UAAU,GACV,YAAY,CAAC;AAEjB,MAAM,WAAW,aAAa;IAC5B,wDAAwD;IACxD,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;;OAOG;IACH,QAAQ,EAAE,KAAK,GAAG,KAAK,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE;QACN,MAAM,EAAE,aAAa,CAAC;QACtB,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,gDAAgD;IAChD,GAAG,CAAC,EAAE;QACJ,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,aAAa;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB;IA8B/D,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;CAcjC"}

package/dist/core/session-log.js

@@ -52,7 +52,26 @@ const SAFE_AGENT_ID_RE = /[^A-Za-z0-9._:\-]/g;
 function sanitizeAgentId(agentId) {
     if (!agentId)
         return "_unknown";
-    const cleaned = agentId.replace(SAFE_AGENT_ID_RE, "_").replace(/^[._]+|[._]+$/g, "");
+    // Char-loop strip (ReDoS-free): both anchored ``[._]+`` regex forms
+    // still get flagged by CodeQL js/polynomial-redos because the engine
+    // is conservative about ``+$`` patterns even though they're linear.
+    // Equivalent to Python ``str.strip("._")``.
+    const replaced = agentId.replace(SAFE_AGENT_ID_RE, "_");
+    let start = 0;
+    while (start < replaced.length) {
+        const c = replaced.charCodeAt(start);
+        if (c !== 46 /* . */ && c !== 95 /* _ */)
+            break;
+        start++;
+    }
+    let end = replaced.length;
+    while (end > start) {
+        const c = replaced.charCodeAt(end - 1);
+        if (c !== 46 && c !== 95)
+            break;
+        end--;
+    }
+    const cleaned = replaced.slice(start, end);
     if (!cleaned || cleaned === "." || cleaned === "..")
         return "_unknown";
     return cleaned.slice(0, 128);

package/dist/core/session-log.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-log.js","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAA8C,CAAC,OAAO,CAAC;QAClE,OAAO,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC;IACrF,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAU,IAAI,IAAI,EAAE;IAC1C,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACpB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE;QAC3B,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE;QACtB,GAAG;QACH,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;QACvB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACzB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,WAAmB,iBAAiB,EACpC,QAAgB,cAAc;IAE9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAG/C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,IAAI,MAAM;gBAAE,MAAM;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA+DD;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,UAAgC,EAAE;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,CACZ,IAAI,EACJ,OAAO,CAAC,QAAQ,IAAI,iBAAiB,EACrC,OAAO,CAAC,KAAK,IAAI,cAAc,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"session-log.js","sourceRoot":"","sources":["../../src/core/session-log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EACL,cAAc,EACd,UAAU,EACV,SAAS,EACT,WAAW,EACX,QAAQ,EACR,UAAU,GACX,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;;;;;;GAWG;AACH,SAAS,UAAU;IACjB,IAAI,CAAC;QACH,MAAM,CAAC,GAAI,UAA8C,CAAC,OAAO,CAAC;QAClE,OAAO,OAAO,CAAC,EAAE,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,MAAM,gBAAgB,GAAG,oBAAoB,CAAC;AAE9C,SAAS,eAAe,CAAC,OAAe;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,UAAU,CAAC;IAChC,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACxD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,OAAO,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC,OAAO;YAAE,MAAM;QAChD,KAAK,EAAE,CAAC;IACV,CAAC;IACD,IAAI,GAAG,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC1B,OAAO,GAAG,GAAG,KAAK,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;YAAE,MAAM;QAChC,GAAG,EAAE,CAAC;IACR,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,UAAU,CAAC;IACvE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAU,IAAI,IAAI,EAAE;IAC1C,OAAO,CACL,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE;QACpB,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,EAAE;QAC3B,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE;QACtB,GAAG;QACH,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE;QACvB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE;QACzB,GAAG,IAAI,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,EAAE,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,WAAmB,iBAAiB,EACpC,QAAgB,cAAc;IAE9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,QAAQ,GAAG,GAAG,GAAG,QAAQ,GAAG,KAAK,GAAG,IAAI,CAAC;IAG/C,MAAM,KAAK,GAAe,EAAE,CAAC;IAE7B,IAAI,SAAS,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,IAAI,KAAK,GAAa,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACpC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACvB,IAAI,EAAE,CAAC;YACP,IAAI,CAAC;gBACH,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC;YACzB,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC;oBACH,UAAU,CAAC,CAAC,CAAC,CAAC;oBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS;gBACX,CAAC;gBACD,SAAS;YACX,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,GAAG,IAAI,GAAG,IAAI,CAAC;IACnC,IAAI,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,GAAG,MAAM,EAAE,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;QACxC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,IAAI,MAAM;gBAAE,MAAM;YAC3B,IAAI,CAAC;gBACH,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AA+DD;;;GAGG;AACH,MAAM,OAAO,aAAa;IACf,OAAO,CAAS;IAChB,IAAI,CAAS;IAEtB,YAAY,OAAe,EAAE,UAAgC,EAAE;QAC7D,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;QAEtC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,wDAAwD;QAC1D,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,cAAc,CACZ,IAAI,EACJ,OAAO,CAAC,QAAQ,IAAI,iBAAiB,EACrC,OAAO,CAAC,KAAK,IAAI,cAAc,CAChC,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,IAAI,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,UAAU,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,GAAG,CAAC,MAAqB;QACvB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;YACtD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,0CAA0C;QAC5C,CAAC;IACH,CAAC;CACF"}

package/dist/core/sto.d.ts

@@ -1,45 +1,39 @@
 /**
- * OSS↔Cloud schema surface for the sto (stochastic / LLM-judge) pipeline.
+ * Schema surface for the sto (stochastic / LLM-judge) pipeline extension point.
  *
- * The TS SDK is **det-only**, mirroring Sponsio Python's OSS engine.
+ * The TS SDK is **det-only**, mirroring the Python deterministic engine.
  * The managed evaluator catalog (``tone`` / ``relevance`` / ``llm_judge`` /
- * ``hallucination_free`` …), the OpenAI-compatible judge client, and the
- * per-evaluator scoring code are Sponsio Cloud features. They live in
- * the proprietary ``sponsio_cloud.sto.*`` Python package; a Cloud-TS
- * package will mirror them later.
+ * ``hallucination_free`` ...), an OpenAI-compatible judge client, and the
+ * per-evaluator scoring code are not part of this build (the deterministic
+ * engine provides no implementation).
  *
- * What this file ships in OSS:
+ * What this file ships:
  *
- *   - **Type contracts** — ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
+ *   - **Type contracts**, ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
  *     ``StoContract`` / ``JudgeClient`` / ``JudgeConfig`` /
- *     ``StoContextSnapshot``. Cloud subclasses / OSS callers consuming the
- *     schema (session loggers, dashboards) reference these.
- *   - ``CloudFeatureError`` — the exception any Cloud-only code path
- *     raises when reached on the OSS engine.
- *   - ``parseScore`` — a pure utility that converts a 0-1 score from a
+ *     ``StoContextSnapshot``. External callers consuming the schema
+ *     (session loggers, dashboards) reference these.
+ *   - ``CloudFeatureError``, the exception any code path raises when an
+ *     unimplemented sto feature is reached. The class name is kept for
+ *     ABI stability, the message is neutral.
+ *   - ``parseScore``, a pure utility that converts a 0-1 score from a
  *     judge response. Kept because it never contacts an LLM.
  *
- * What this file does NOT ship in OSS (deleted alongside the Python
- * mirrors — ``RetryWithConstraint`` / ``RedirectToSafe`` /
- * ``FeedbackGenerator`` / the per-atom evaluator stubs):
+ * What this file does NOT ship (deleted alongside the Python mirrors,
+ * ``RetryWithConstraint`` / ``RedirectToSafe`` / ``FeedbackGenerator`` /
+ * the per-atom evaluator stubs):
  *
- *   - ``createJudge`` — judge construction
+ *   - ``createJudge``, judge construction
  *   - ``LlmJudgeEvaluator`` / ``ToneEvaluator`` / ``RelevanceEvaluator``
  *     / ``SemanticPiiFreeEvaluator`` / ``HallucinationFreeEvaluator``
  *     / ``ScopeRespectEvaluator`` / ``MetricIntegrityEvaluator``
  *     / ``InjectionFreeEvaluator``
  *
  * The Sponsio constructor rejects yaml-declared sto contracts and any
- * ``judge:`` option at config-load time, so OSS callers never reach a
- * code path that would have built one of these. Cloud installs will
- * supply real implementations of the same Protocol surface.
- *
- * Operators who want the sto pipeline:
- *
- *     pip install sponsio[cloud]
- *
- * or contact your Sponsio account team for managed sto access. See
- * ``docs/oss_scope.md`` for the OSS / Cloud boundary.
+ * ``judge:`` option at config-load time, so callers never reach a code
+ * path that would have built one of these. This file is an extension
+ * point: external builds can supply real implementations of the same
+ * Protocol surface.
  */
 export interface StoInput {
     toolName: string;

package/dist/core/sto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sto.d.ts","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,YAAY,CAAC;CACzB;AAUD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,WAAW,EAAE,MAAM;CAIhC;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAmB9C"}
+{"version":3,"file":"sto.d.ts","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAIH,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC/C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC1C;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,YAAY,CAAC;CACzB;AAUD,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,WAAW,EAAE,MAAM;CAIhC;AAID;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsB9C"}

package/dist/core/sto.js

@@ -1,54 +1,48 @@
 /**
- * OSS↔Cloud schema surface for the sto (stochastic / LLM-judge) pipeline.
+ * Schema surface for the sto (stochastic / LLM-judge) pipeline extension point.
  *
- * The TS SDK is **det-only**, mirroring Sponsio Python's OSS engine.
+ * The TS SDK is **det-only**, mirroring the Python deterministic engine.
  * The managed evaluator catalog (``tone`` / ``relevance`` / ``llm_judge`` /
- * ``hallucination_free`` …), the OpenAI-compatible judge client, and the
- * per-evaluator scoring code are Sponsio Cloud features. They live in
- * the proprietary ``sponsio_cloud.sto.*`` Python package; a Cloud-TS
- * package will mirror them later.
+ * ``hallucination_free`` ...), an OpenAI-compatible judge client, and the
+ * per-evaluator scoring code are not part of this build (the deterministic
+ * engine provides no implementation).
  *
- * What this file ships in OSS:
+ * What this file ships:
  *
- *   - **Type contracts** — ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
+ *   - **Type contracts**, ``StoEvaluator`` / ``StoResult`` / ``StoInput`` /
  *     ``StoContract`` / ``JudgeClient`` / ``JudgeConfig`` /
- *     ``StoContextSnapshot``. Cloud subclasses / OSS callers consuming the
- *     schema (session loggers, dashboards) reference these.
- *   - ``CloudFeatureError`` — the exception any Cloud-only code path
- *     raises when reached on the OSS engine.
- *   - ``parseScore`` — a pure utility that converts a 0-1 score from a
+ *     ``StoContextSnapshot``. External callers consuming the schema
+ *     (session loggers, dashboards) reference these.
+ *   - ``CloudFeatureError``, the exception any code path raises when an
+ *     unimplemented sto feature is reached. The class name is kept for
+ *     ABI stability, the message is neutral.
+ *   - ``parseScore``, a pure utility that converts a 0-1 score from a
  *     judge response. Kept because it never contacts an LLM.
  *
- * What this file does NOT ship in OSS (deleted alongside the Python
- * mirrors — ``RetryWithConstraint`` / ``RedirectToSafe`` /
- * ``FeedbackGenerator`` / the per-atom evaluator stubs):
+ * What this file does NOT ship (deleted alongside the Python mirrors,
+ * ``RetryWithConstraint`` / ``RedirectToSafe`` / ``FeedbackGenerator`` /
+ * the per-atom evaluator stubs):
  *
- *   - ``createJudge`` — judge construction
+ *   - ``createJudge``, judge construction
  *   - ``LlmJudgeEvaluator`` / ``ToneEvaluator`` / ``RelevanceEvaluator``
  *     / ``SemanticPiiFreeEvaluator`` / ``HallucinationFreeEvaluator``
  *     / ``ScopeRespectEvaluator`` / ``MetricIntegrityEvaluator``
  *     / ``InjectionFreeEvaluator``
  *
  * The Sponsio constructor rejects yaml-declared sto contracts and any
- * ``judge:`` option at config-load time, so OSS callers never reach a
- * code path that would have built one of these. Cloud installs will
- * supply real implementations of the same Protocol surface.
- *
- * Operators who want the sto pipeline:
- *
- *     pip install sponsio[cloud]
- *
- * or contact your Sponsio account team for managed sto access. See
- * ``docs/oss_scope.md`` for the OSS / Cloud boundary.
+ * ``judge:`` option at config-load time, so callers never reach a code
+ * path that would have built one of these. This file is an extension
+ * point: external builds can supply real implementations of the same
+ * Protocol surface.
  */
 // ----- CloudFeatureError ---------------------------------------------
-const CLOUD_HINT = "Sponsio's sto (LLM-judge) pipeline is a Cloud feature, not bundled " +
-    "with the OSS engine. Install `sponsio[cloud]` (Python) or contact " +
-    "your Sponsio account team for managed sto access. See " +
-    "https://github.com/SponsioLabs/Sponsio/blob/main/docs/oss_scope.md.";
+const CLOUD_HINT = "Sponsio's sto (LLM-judge) pipeline is not supported in this build " +
+    "(the engine is deterministic-only). The schema types remain as an " +
+    "extension point so external implementations can supply real " +
+    "evaluators behind the same Protocol surface.";
 export class CloudFeatureError extends Error {
     constructor(featureName) {
-        super(`[sponsio] ${featureName} is not available in OSS. ${CLOUD_HINT}`);
+        super(`[sponsio] ${featureName} is not supported in this build. ${CLOUD_HINT}`);
         this.name = "CloudFeatureError";
     }
 }
@@ -70,7 +64,10 @@ export function parseScore(raw) {
             /* fall through */
         }
     }
-    const m = trimmed.match(/([01](?:\.\d+)?|0?\.\d+)/);
+    // Anchored + non-overlapping alternatives: prevents the polynomial
+    // backtracking CodeQL flags when ``[01](?:\.\d+)?`` and ``0?\.\d+``
+    // could both match prefixes like ``0`` or ``0.5``.
+    const m = trimmed.match(/^([01](?:\.\d+)?|\.\d+)/);
     if (!m) {
         throw new Error(`unparseable score: ${JSON.stringify(trimmed.slice(0, 80))}`);
     }

package/dist/core/sto.js.map

@@ -1 +1 @@
-{"version":3,"file":"sto.js","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAgDH,wEAAwE;AAExE,MAAM,UAAU,GACd,qEAAqE;IACrE,oEAAoE;IACpE,wDAAwD;IACxD,qEAAqE,CAAC;AAExE,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,WAAW,6BAA6B,UAAU,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;IACpD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC"}
+{"version":3,"file":"sto.js","sourceRoot":"","sources":["../../src/core/sto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAgDH,wEAAwE;AAExE,MAAM,UAAU,GACd,oEAAoE;IACpE,oEAAoE;IACpE,8DAA8D;IAC9D,8CAA8C,CAAC;AAEjD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,WAAmB;QAC7B,KAAK,CAAC,aAAa,WAAW,oCAAoC,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;IAClC,CAAC;CACF;AAED,wEAAwE;AAExE;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;YACvD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IACD,mEAAmE;IACnE,oEAAoE;IACpE,mDAAmD;IACnD,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACnD,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sBAAsB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAC7D,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACtE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACxB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/index.d.ts

@@ -98,12 +98,13 @@ export interface CheckResult {
      */
     detViolations: DetViolation[];
     /**
-     * Sto-pipeline violations — Sponsio Cloud only. Always ``[]`` on
-     * the OSS TS SDK (the ctor rejects yaml sto contracts at load time
-     * and never builds a judge). Cloud subclasses populate this with
-     * results from stochastic contracts (``tone`` / ``llm_judge`` /
-     * ``injection_free`` / …). Kept on the schema so dashboards /
-     * session loggers branch consistently across both surfaces.
+     * Sto-pipeline violations. Not part of this build (the engine is
+     * deterministic-only). Always ``[]`` on the TS SDK (the ctor
+     * rejects yaml sto contracts at load time and never builds a
+     * judge). External subclasses can populate this with results from
+     * stochastic contracts (``tone`` / ``llm_judge`` / ``injection_free``
+     * / ...). Kept on the schema so dashboards / session loggers branch
+     * consistently across both surfaces.
      */
     stoViolations: DetViolation[];
 }
@@ -130,7 +131,11 @@ export interface SponsoOptions {
     /**
      * Runtime mode. Precedence (matches the Python SDK):
      *
-     *     SPONSIO_MODE env  >  ctor arg  >  yaml runtime.mode  >  "observe"
+     *     SPONSIO_MODE env  >  ctor arg  >  yaml runtime.mode
+     *       >  yaml defaults.mode  >  yaml top-level mode:  >  "observe"
+     *
+     * A contract may also carry its own `mode:` in yaml, which overrides
+     * whatever the global resolution lands on — for that contract alone.
      *
      * ``observe`` (the default) logs every would-have-blocked decision
      * to ``~/.sponsio/sessions/<agent_id>/*.jsonl`` without actually
@@ -148,13 +153,13 @@ export interface SponsoOptions {
     /** Override session log base dir (tests / alternative layouts). */
     sessionLogBaseDir?: string;
     /**
-     * Judge config for the sto pipeline. **Sponsio Cloud only.**
-     * Either a plain config object (provider / model / apiKey /
-     * baseUrl / fallbackMode) or a pre-built ``JudgeClient``. The OSS
-     * TS SDK accepts the option for shared-yaml compatibility but
-     * never constructs a judge — passing this without Cloud
-     * installed surfaces a warning via the skipped-items path and
-     * the field is otherwise ignored.
+     * Judge config for the sto pipeline. **Not supported in this build**
+     * (the engine is deterministic-only). Either a plain config object
+     * (provider / model / apiKey / baseUrl / fallbackMode) or a pre-built
+     * ``JudgeClient``. The TS SDK accepts the option for shared-yaml
+     * compatibility but never constructs a judge: passing this surfaces
+     * a warning via the skipped-items path and the field is otherwise
+     * ignored.
      */
     judge?: JudgeConfig | JudgeClient;
 }
@@ -255,18 +260,18 @@ export declare class Sponsio {
     /**
      * Record tool output after execution.
      *
-     * The OSS engine ships **no sto pipeline** — Cloud's stochastic
-     * (LLM-judged) atoms are what populate ``stoViolations``. With no
-     * Cloud installed and no sto contracts loaded (sto entries in yaml
-     * are rejected at config load), ``stoViolations`` is always
-     * ``[]`` and ``allowed: true``.
+     * This build ships **no sto pipeline** (the engine is deterministic-only).
+     * Stochastic (LLM-judged) atoms are the extension point that would
+     * populate ``stoViolations``; with no external implementation and no
+     * sto contracts loaded (sto entries in yaml are rejected at config
+     * load), ``stoViolations`` is always ``[]`` and ``allowed: true``.
      *
-     * The method stays ``async`` for API parity with Cloud's override —
-     * a Cloud-side subclass / wrapper can run the judge pipeline and
-     * surface real ``stoViolations`` without changing the call site.
-     * In **enforce mode** Cloud subclasses flip ``blocked: true`` on
-     * the first sto violation; the tool output has already executed,
-     * so the caller is responsible for routing the result (retry with
+     * The method stays ``async`` for API parity: an external subclass
+     * or wrapper can run the judge pipeline and surface real
+     * ``stoViolations`` without changing the call site. In **enforce
+     * mode** such subclasses can flip ``blocked: true`` on the first
+     * sto violation; the tool output has already executed, so the
+     * caller is responsible for routing the result (retry with
      * feedback, redirect to safe, etc.).
      */
     guardAfter(_toolName: string, _output?: string): Promise<CheckResult>;
@@ -279,13 +284,13 @@ export declare class Sponsio {
     /**
      * Stash per-turn context for the sto pipeline.
      *
-     * Sponsio Cloud only — atoms that need grounding (``relevance`` →
-     * ``query``, ``hallucination_free`` → ``source``, ``scope_respect``
-     * → ``scope`` override, ``metric_integrity`` → ``history``) read
-     * from this snapshot on the next ``guardAfter`` call. The OSS
-     * engine accepts the call as a no-op so shared agent code can
-     * stay framework-neutral; without Cloud, the snapshot is never
-     * consumed.
+     * Not supported in this build (the engine is deterministic-only).
+     * Atoms that need grounding (``relevance`` -> ``query``,
+     * ``hallucination_free`` -> ``source``, ``scope_respect`` ->
+     * ``scope`` override, ``metric_integrity`` -> ``history``) would
+     * read from this snapshot on the next ``guardAfter`` call. This
+     * build accepts the call as a no-op so shared agent code can stay
+     * framework-neutral; the snapshot is never consumed.
      *
      * Merges with any previously-set context; pass ``{ query: undefined }``
      * to explicitly clear a field. ``reset()`` clears the whole snapshot.

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAkBH,OAAO,EACL,aAAa,EAKd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EAEX,kBAAkB,EAEnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtE,YAAY,EACV,aAAa,EACb,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC9D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,YAAY,EAAE,EAC1B,QAAQ,GAAE,MAA6B,GACtC,MAAM,CAUR;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;;;OAOG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAEpC;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;CACnC;AAED,qBAAa,OAAO;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,OAAO,CAAC,UAAU,CAAe;IAIjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,WAAW,CAAW;IAC9B,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,GAAE,aAAkB;IAmFvC;;;;;;;;;;;;OAYG;IACH,0EAA0E;IAC1E,aAAa,IAAI,MAAM,EAAE;IAIzB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,WAAW;IAyG9E;;;;;;OAMG;IACH,SAAS,IAAI,aAAa,EAAE;IAI5B,oEAAoE;IACpE,YAAY,IAAI,IAAI;IAIpB;;;;;OAKG;IACH,aAAa,CAAC,IAAI,GAAE;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACf,GAAG,IAAI;IAUb,6EAA6E;IAC7E,OAAO,CAAC,cAAc;IAetB;;;;;;;;;OASG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAUlD;;;;;OAKG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI;IAUR;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,WAAW;IAkE9E,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,SAAS;IAYjB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,MAAW,GACnB,OAAO,CAAC,WAAW,CAAC;IAMvB;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAUb;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,EAAE,CAEzB;IAED;;;OAGG;IACH,OAAO,IAAI,MAAM;IAKjB;;;;;;OAMG;IACH,YAAY,IAAI,IAAI;CAGrB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAkBH,OAAO,EACL,aAAa,EAKd,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EAEX,kBAAkB,EAEnB,MAAM,eAAe,CAAC;AAGvB,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,cAAc,mBAAmB,CAAC;AAClC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACtE,YAAY,EACV,aAAa,EACb,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC1D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC9D,YAAY,EACV,YAAY,EACZ,WAAW,EACX,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,WAAW,EACX,WAAW,GACZ,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,YAAY,EAAE,EAC1B,QAAQ,GAAE,MAA6B,GACtC,MAAM,CAUR;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B;;;;;;;;OAQG;IACH,aAAa,EAAE,YAAY,EAAE,CAAC;CAC/B;AAED,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oFAAoF;IACpF,SAAS,CAAC,EAAE,CAAC,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC;IAEpC;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;;;;;;;;;;;OAYG;IACH,IAAI,CAAC,EAAE,UAAU,CAAC;IAElB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B;;;;;;;;OAQG;IACH,KAAK,CAAC,EAAE,WAAW,GAAG,WAAW,CAAC;CACnC;AAED,qBAAa,OAAO;IAClB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,OAAO,CAAC,UAAU,CAAe;IAIjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,WAAW,CAAqB;IACxC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,aAAa,CAA8B;IACnD,OAAO,CAAC,WAAW,CAAW;IAC9B,OAAO,CAAC,OAAO,CAAuB;IACtC,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,GAAE,aAAkB;IAoFvC;;;;;;;;;;;;OAYG;IACH,0EAA0E;IAC1E,aAAa,IAAI,MAAM,EAAE;IAIzB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,WAAW;IA8G9E;;;;;;OAMG;IACH,SAAS,IAAI,aAAa,EAAE;IAI5B,oEAAoE;IACpE,YAAY,IAAI,IAAI;IAIpB;;;;;OAKG;IACH,aAAa,CAAC,IAAI,GAAE;QAClB,GAAG,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;QAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;KACf,GAAG,IAAI;IAUb,6EAA6E;IAC7E,OAAO,CAAC,cAAc;IAetB;;;;;;;;;OASG;IACH,cAAc,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAUlD;;;;;OAKG;IACH,eAAe,CAAC,IAAI,EAAE;QACpB,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;QAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,IAAI;IAUR;;;;;;;;;OASG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,WAAW;IAqE9E,OAAO,CAAC,cAAc;IAoBtB,OAAO,CAAC,SAAS;IAYjB;;;;;;;;;;;;;;;;OAgBG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,OAAO,GAAE,MAAW,GACnB,OAAO,CAAC,WAAW,CAAC;IAOvB;;;;OAIG;IACH,KAAK,IAAI,IAAI;IAUb;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,IAAI;IAIlD;;OAEG;IACH,IAAI,UAAU,IAAI,MAAM,EAAE,CAEzB;IAED;;;OAGG;IACH,OAAO,IAAI,MAAM;IAKjB;;;;;;OAMG;IACH,YAAY,IAAI,IAAI;CAGrB"}

package/dist/index.js

@@ -58,9 +58,9 @@ export class Sponsio {
     agentId;
     mode;
     _contracts;
-    // Sto state. Always empty/null in OSS — the constructor rejects yaml
-    // sto contracts and inline `judge:` at config load. Kept as
-    // schema-stable surface for Cloud-side composition / wrapping.
+    // Sto state. Always empty/null in this build, the constructor
+    // rejects yaml sto contracts and inline `judge:` at config load.
+    // Kept as schema-stable surface for external composition / wrapping.
     _stoContracts;
     _stoContext;
     _trace;
@@ -111,29 +111,30 @@ export class Sponsio {
                 this._contracts.push(c);
             }
         }
-        // ── Sto pipeline is a Sponsio Cloud feature ──────────────────────
+        // ── Sto pipeline is not part of this build ──────────────────────
         // The managed LLM-judge catalog (`tone` / `relevance` / `llm_judge`
-        // …) and the judge client live in the proprietary `sponsio_cloud`
-        // package. The OSS engine logs-and-skips any yaml sto contracts
-        // and any inline `judge:` option, never constructs an evaluator,
-        // never contacts an LLM. The API surface (`guardAfter`,
-        // `setContext`, `judge` ctor option) is preserved so a shared yaml
-        // between Cloud and OSS-TS doesn't refuse to load.
+        // ...) and the judge client are not part of this build (the
+        // deterministic engine provides no implementation). The engine
+        // logs-and-skips any yaml sto contracts and any inline `judge:`
+        // option, never constructs an evaluator, never contacts an LLM.
+        // The API surface (`guardAfter`, `setContext`, `judge` ctor
+        // option) is preserved so a shared yaml between deterministic
+        // builds and external sto implementations doesn't refuse to load.
         for (const spec of yamlStoSpecs) {
             yamlSkipped.push({
                 kind: "sto-contract",
-                detail: `${spec.desc} (sto pipeline is a Sponsio Cloud feature; pip install sponsio[cloud])`,
+                detail: `${spec.desc} (sto pipeline is not supported in this build)`,
             });
         }
         if (options.judge) {
             yamlSkipped.push({
                 kind: "sto-contract",
-                detail: "`judge:` option ignored (sto pipeline is a Sponsio Cloud feature; pip install sponsio[cloud])",
+                detail: "`judge:` option ignored (sto pipeline is not supported in this build)",
             });
         }
-        // Reference yamlJudge so unused-var lints don't fire — the field
-        // is parsed by the loader for shared-yaml compatibility but the
-        // OSS engine never builds a judge from it.
+        // Reference yamlJudge so unused-var lints don't fire: the field
+        // is parsed by the loader for shared-yaml compatibility but this
+        // build never constructs a judge from it.
         void yamlJudge;
         // ── Warn once about yaml features the TS runtime can't handle ───
         warnOnceAboutSkipped(yamlSkipped);
@@ -173,6 +174,7 @@ export class Sponsio {
         const violations = [];
         const violatedDescs = [];
         const detViolations = [];
+        let anyBlocking = false;
         for (const contract of this._contracts) {
             const checkSpan = new ContractCheckSpan(contract.desc, "hard");
             collector.push(checkSpan);
@@ -198,7 +200,12 @@ export class Sponsio {
             const guaranteeSpan = new GuaranteeSpan(contract.desc, result);
             collector.add(guaranteeSpan, result ? "ok" : "violated");
             if (!result) {
-                const verb = this.mode === "observe" ? "WOULD-BLOCK" : "BLOCKED";
+                // Per-contract `mode:` overrides the global mode for this one
+                // verdict — same routing as Python's RuntimeMonitor.
+                const effMode = contract.mode ?? this.mode;
+                if (effMode === "enforce")
+                    anyBlocking = true;
+                const verb = effMode === "observe" ? "WOULD-BLOCK" : "BLOCKED";
                 const msg = `${verb}: ${this.agentId}.${toolName} — det constraint violated: ${contract.desc}`;
                 violations.push(msg);
                 violatedDescs.push(contract.desc);
@@ -212,14 +219,14 @@ export class Sponsio {
                 });
                 // Nest violation + enforcement spans under the failed
                 // guarantee so the renderer can pick up the verdict word.
-                const enforce = new EnforcementSpan("DetBlock", this.mode === "enforce" ? "blocked" : "observed");
+                const enforce = new EnforcementSpan("DetBlock", effMode === "enforce" ? "blocked" : "observed");
                 guaranteeSpan.children.push(enforce);
                 enforce.finish("violated");
             }
             collector.pop(result ? "ok" : "violated");
         }
         const hasViolations = violations.length > 0;
-        const blocked = hasViolations && this.mode === "enforce";
+        const blocked = anyBlocking;
         this._turnSpans.push(collector.finishRoot(blocked, this._contracts.length, violations.length));
         if (blocked) {
             this._trace.pop();
@@ -361,10 +368,14 @@ export class Sponsio {
         const violations = [];
         const violatedDescs = [];
         const detViolations = [];
+        let anyBlocking = false;
         for (const contract of this._contracts) {
             const result = evaluate(contract.formula, this._trace);
             if (!result) {
-                const verb = this.mode === "observe" ? "WOULD-BLOCK" : "BLOCKED";
+                const effMode = contract.mode ?? this.mode;
+                if (effMode === "enforce")
+                    anyBlocking = true;
+                const verb = effMode === "observe" ? "WOULD-BLOCK" : "BLOCKED";
                 const msg = `${verb}: ${this.agentId}.<llm_response> — det constraint violated: ${contract.desc}`;
                 violations.push(msg);
                 violatedDescs.push(contract.desc);
@@ -378,7 +389,7 @@ export class Sponsio {
             }
         }
         const hasViolations = violations.length > 0;
-        const blocked = hasViolations && this.mode === "enforce";
+        const blocked = anyBlocking;
         if (blocked) {
             this._trace.pop();
             this._state = snapshot;
@@ -436,23 +447,24 @@ export class Sponsio {
     /**
      * Record tool output after execution.
      *
-     * The OSS engine ships **no sto pipeline** — Cloud's stochastic
-     * (LLM-judged) atoms are what populate ``stoViolations``. With no
-     * Cloud installed and no sto contracts loaded (sto entries in yaml
-     * are rejected at config load), ``stoViolations`` is always
-     * ``[]`` and ``allowed: true``.
+     * This build ships **no sto pipeline** (the engine is deterministic-only).
+     * Stochastic (LLM-judged) atoms are the extension point that would
+     * populate ``stoViolations``; with no external implementation and no
+     * sto contracts loaded (sto entries in yaml are rejected at config
+     * load), ``stoViolations`` is always ``[]`` and ``allowed: true``.
      *
-     * The method stays ``async`` for API parity with Cloud's override —
-     * a Cloud-side subclass / wrapper can run the judge pipeline and
-     * surface real ``stoViolations`` without changing the call site.
-     * In **enforce mode** Cloud subclasses flip ``blocked: true`` on
-     * the first sto violation; the tool output has already executed,
-     * so the caller is responsible for routing the result (retry with
+     * The method stays ``async`` for API parity: an external subclass
+     * or wrapper can run the judge pipeline and surface real
+     * ``stoViolations`` without changing the call site. In **enforce
+     * mode** such subclasses can flip ``blocked: true`` on the first
+     * sto violation; the tool output has already executed, so the
+     * caller is responsible for routing the result (retry with
      * feedback, redirect to safe, etc.).
      */
     async guardAfter(_toolName, _output = "") {
-        // OSS is det-only — sto pipeline lives in Sponsio Cloud. Always
-        // return clean-pass; Cloud subclasses override.
+        // This build is deterministic-only, the sto pipeline is not
+        // implemented. Always return clean-pass; external subclasses can
+        // override.
         return emptyAllow();
     }
     /**
@@ -470,13 +482,13 @@ export class Sponsio {
     /**
      * Stash per-turn context for the sto pipeline.
      *
-     * Sponsio Cloud only — atoms that need grounding (``relevance`` →
-     * ``query``, ``hallucination_free`` → ``source``, ``scope_respect``
-     * → ``scope`` override, ``metric_integrity`` → ``history``) read
-     * from this snapshot on the next ``guardAfter`` call. The OSS
-     * engine accepts the call as a no-op so shared agent code can
-     * stay framework-neutral; without Cloud, the snapshot is never
-     * consumed.
+     * Not supported in this build (the engine is deterministic-only).
+     * Atoms that need grounding (``relevance`` -> ``query``,
+     * ``hallucination_free`` -> ``source``, ``scope_respect`` ->
+     * ``scope`` override, ``metric_integrity`` -> ``history``) would
+     * read from this snapshot on the next ``guardAfter`` call. This
+     * build accepts the call as a no-op so shared agent code can stay
+     * framework-neutral; the snapshot is never consumed.
      *
      * Merges with any previously-set context; pass ``{ query: undefined }``
      * to explicitly clear a field. ``reset()`` clears the whole snapshot.
@@ -534,9 +546,10 @@ function resolveMode(ctorMode, yamlMode) {
 }
 let _skippedWarned = false;
 // Note: ``resolveJudge`` / ``buildStoContract`` / ``isJudgeClient``
-// helpers were removed when the sto pipeline became Sponsio Cloud-only.
-// The OSS engine never constructs a judge or evaluator; yaml sto
-// specs flow through the ``yamlSkipped`` warning path in the ctor.
+// helpers were removed when the sto pipeline became an external
+// extension point. This build never constructs a judge or evaluator;
+// yaml sto specs flow through the ``yamlSkipped`` warning path in
+// the ctor.
 function emptyAllow() {
     return {
         blocked: false,
@@ -569,7 +582,7 @@ function warnOnceAboutSkipped(skipped) {
         bits.push(`${unknown} unrecognised contract entr${unknown === 1 ? "y" : "ies"}`);
     }
     const stoNote = sto > 0
-        ? " Sto (LLM-judge) contracts are part of Sponsio Cloud — install `sponsio[cloud]` for the managed pipeline."
+        ? " Sto (LLM-judge) contracts are not supported in this build (the engine is deterministic-only)."
         : "";
     console.warn("[sponsio] skipped unsupported yaml items: " +
         bits.join("; ") +