@tryvira/opencode 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,17 @@
-# Temporary Holding Version
+# `@tryvira/opencode`
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+OpenCode V2 server plugin for Vira host lifecycle governance.
+
+It resolves Vira behavior on every `context` hook, observes tool results, and in `enforce` mode blocks tool execution unless a host action authorizer returns an exact Vira `ALLOW` receipt. OpenCode V2 does not expose a supported response-before-display hook, so post-model verification is reported as unsupported rather than claimed as enforced.
+
+Configuration is supplied through OpenCode plugin options or environment variables: `VIRA_CONTROL_URL`, `VIRA_API_KEY`, `VIRA_ORGANIZATION_ID`, `VIRA_PROJECT_ID`, `VIRA_ENVIRONMENT_ID`, `VIRA_AI_SYSTEM_ID`, `VIRA_CONNECTION_ID`, and `VIRA_HOST_MODE` (`off`, `observe`, `enforce`).
+
+`enforce` requires a host-provided `authorizeAction` callback that calls the
+server-owned action authorization boundary and returns the exact Vira
+`ALLOW`/`BLOCK`/`ESCALATE` decision with receipt digests. The plugin never
+turns `observe` into enforcement and never grants an action from model text.
+
+When the runtime context hook exposes a server-issued `executionId` and a
+`vira.request-behavior-context.v2`, the plugin can call
+`/v1/runtime/actions/authorize` automatically. If that binding is absent,
+enforce mode blocks the tool instead of guessing an execution or release.

package/dist/index.js

@@ -0,0 +1,1304 @@
+// src/index.ts
+import { createHash as createHash2 } from "node:crypto";
+
+// ../../sdks/js-client.ts
+var ViraApiError = class extends Error {
+  status;
+  body;
+  requestId;
+  constructor(message, status, body, requestId) {
+    super(message);
+    this.name = "ViraApiError";
+    this.status = status;
+    this.body = body;
+    this.requestId = requestId;
+  }
+};
+var required = (value, code) => {
+  if (typeof value !== "string" || !value.trim()) throw new Error(code);
+  return value;
+};
+var normalizeBaseUrl = (value, allowInsecureLocalhost = false) => {
+  let url;
+  try {
+    url = new URL(required(value, "SDK_BASE_URL_REQUIRED"));
+  } catch {
+    throw new Error("SDK_BASE_URL_INVALID");
+  }
+  const hostname = url.hostname.toLowerCase();
+  const loopback = hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+  if (url.username || url.password || url.search || url.hash) throw new Error("SDK_BASE_URL_INVALID");
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback && allowInsecureLocalhost))
+    throw new Error("SDK_HTTPS_REQUIRED");
+  return value.replace(/\/$/, "");
+};
+var canonicalJson = (value) => JSON.stringify(
+  value,
+  (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([left], [right]) => left.localeCompare(right))) : item
+);
+var contentIdempotencyKey = async (operation, request) => {
+  if (!globalThis.crypto?.subtle) throw new Error("SDK_IDEMPOTENCY_CRYPTO_UNAVAILABLE");
+  const bytes = new TextEncoder().encode(canonicalJson(request));
+  const digest3 = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  const hex = [...new Uint8Array(digest3)].map((value) => value.toString(16).padStart(2, "0")).join("");
+  return `${operation}:${hex}`;
+};
+var wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var ViraClient = class {
+  evaluations;
+  teach;
+  packs;
+  baseUrl;
+  apiKey;
+  fetcher;
+  timeoutMs;
+  retries;
+  failureMode;
+  defaultHeaders;
+  boundConnectionId;
+  constructor(options) {
+    this.baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureLocalhost === true);
+    this.apiKey = options.apiKey;
+    this.fetcher = options.fetcher ?? fetch;
+    this.timeoutMs = Math.max(
+      1e3,
+      Math.min(options.timeoutMs ?? 15e3, 12e4)
+    );
+    this.retries = Math.max(0, Math.min(options.retries ?? 2, 5));
+    this.failureMode = options.failureMode ?? "throw";
+    this.defaultHeaders = options.defaultHeaders ?? {};
+    this.boundConnectionId = options.connectionId;
+    this.evaluations = {
+      createPlan: (input, options2 = {}) => this.createEvaluationPlan(input, options2),
+      get: (id) => this.getEvaluation(id),
+      compare: (id) => this.getEvaluationComparison(id),
+      reviewFinding: (evaluationId, findingId, input, options2 = {}) => this.reviewComparativeFinding(evaluationId, findingId, input, options2),
+      proposeImprovement: (id, input, options2 = {}) => this.createImprovementProposal(id, input, options2)
+    };
+    this.teach = {
+      review: (id, action = "request-review", options2 = {}) => this.reviewImprovementProposal(id, action, options2),
+      createCandidate: (input, options2 = {}) => this.createBehaviorRevisionCandidate(input, options2),
+      evaluateCandidate: (id, input, options2 = {}) => this.evaluateBehaviorRevisionCandidate(id, input, options2)
+    };
+    this.packs = {
+      createRevision: (input, options2 = {}) => this.createPackRevision(input, options2),
+      getRevision: (id) => this.getPackRevision(id),
+      diffRevision: (id) => this.getPackRevisionDiff(id),
+      transitionRevision: (id, transition, options2 = {}) => this.transitionPackRevision(id, transition, options2)
+    };
+  }
+  async request(request, options = {}) {
+    const url = new URL(this.baseUrl + request.path);
+    for (const [key, value] of Object.entries(request.query ?? {}))
+      url.searchParams.set(key, value);
+    const headers = {
+      accept: "application/json",
+      ...this.defaultHeaders
+    };
+    if (request.body) headers["content-type"] = "application/json";
+    if (this.apiKey) {
+      headers.authorization = `Bearer ${this.apiKey}`;
+      headers["x-vira-api-key"] = this.apiKey;
+    }
+    if (options.idempotencyKey)
+      headers["idempotency-key"] = options.idempotencyKey;
+    const retryable = request.method === "GET" || Boolean(options.idempotencyKey);
+    const attempts = retryable ? this.retries + 1 : 1;
+    let lastError;
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+      try {
+        const response = await this.fetcher(url, {
+          method: request.method,
+          headers,
+          body: request.body ? JSON.stringify(request.body) : void 0,
+          signal: controller.signal
+        });
+        const raw = await response.text();
+        let body = null;
+        try {
+          body = raw ? JSON.parse(raw) : null;
+        } catch {
+          body = raw;
+        }
+        const requestId = response.headers.get("x-request-id") ?? "";
+        if (!response.ok) {
+          const error = new ViraApiError(
+            `VIRA_API_${response.status}`,
+            response.status,
+            body,
+            requestId
+          );
+          if ((response.status >= 500 || response.status === 429) && attempt + 1 < attempts) {
+            const retryAfter = Number(response.headers.get("retry-after") ?? "");
+            const serverDelay = Number.isFinite(retryAfter) && retryAfter >= 0 ? Math.min(retryAfter * 1e3, 12e4) : 0;
+            const jitter = Math.floor(Math.random() * 25);
+            await wait(Math.max(serverDelay, 25 * 2 ** attempt) + jitter);
+            continue;
+          }
+          if (this.failureMode === "open" && !options.enforcing && response.status >= 500)
+            return null;
+          throw error;
+        }
+        return { status: response.status, body, requestId };
+      } catch (error) {
+        lastError = error;
+        if (error instanceof ViraApiError) throw error;
+        if (attempt + 1 < attempts) {
+          await wait(25 * 2 ** attempt);
+          continue;
+        }
+        if (this.failureMode === "open" && !options.enforcing) return null;
+        throw error;
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+    throw lastError;
+  }
+  connectSystem(input) {
+    const request = buildAISystemRequest(input);
+    return this.request(request, {
+      idempotencyKey: input.idempotencyKey
+    });
+  }
+  listAISystems() {
+    return this.request({ method: "GET", path: "/v1/ai-systems" });
+  }
+  async deleteAISystem(systemId, options = {}) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    const path = `/v1/ai-systems/${encodeURIComponent(systemId)}`, body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:ai-system:${systemId}`, { path, body }) });
+  }
+  async deleteAISystemCascade(systemId, options = {}) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    const path = `/v1/ai-systems/${encodeURIComponent(systemId)}/cleanup`, body = { confirm: options.confirm === true, deleteObservations: options.deleteObservations === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:ai-system-cascade:${systemId}`, { path, body }) });
+  }
+  getAISystem(systemId) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/ai-systems/${encodeURIComponent(systemId)}` });
+  }
+  connectAdapter(systemId, input) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    const body = {
+      ...input,
+      capabilities: [...input.capabilities ?? []]
+    };
+    delete body.idempotencyKey;
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/ai-systems/${encodeURIComponent(systemId)}/connections`,
+        body
+      },
+      { idempotencyKey: input.idempotencyKey }
+    );
+  }
+  async connectOnce(input) {
+    const systemResult = await this.connectSystem(input);
+    if (!systemResult) return null;
+    const systemId = String(systemResult.body.system.id ?? "");
+    required(systemId, "SDK_SYSTEM_ID_MISSING");
+    const connectionResult = await this.connectAdapter(systemId, {
+      adapterType: input.adapterType,
+      adapterVersion: input.adapterVersion,
+      capabilities: input.capabilities,
+      config: input.config,
+      idempotencyKey: input.idempotencyKey
+    });
+    if (!connectionResult) return null;
+    const connectedId = String(connectionResult.body.connection?.id ?? "").trim();
+    if (connectedId) this.boundConnectionId = connectedId;
+    return {
+      status: connectionResult.status,
+      requestId: connectionResult.requestId,
+      body: {
+        system: systemResult.body.system,
+        connection: connectionResult.body.connection,
+        handshake: connectionResult.body.handshake
+      }
+    };
+  }
+  observe(event, options = {}) {
+    return this.request(buildObservationRequest(event), {
+      idempotencyKey: options.idempotencyKey ?? event.eventId
+    });
+  }
+  trace(event, options = {}) {
+    return this.observe({ ...event, eventType: "model.response" }, options);
+  }
+  searchRuntimeTraces(query = {}) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) if (value !== void 0) params.set(key, String(value));
+    return this.request({ method: "GET", path: `/v1/runtime/traces/search${params.size ? `?${params.toString()}` : ""}` });
+  }
+  outcome(event, options = {}) {
+    return this.observe({ ...event, eventType: "business.outcome" }, options);
+  }
+  feedback(event, options = {}) {
+    return this.observe({ ...event, eventType: "feedback.user" }, options);
+  }
+  observeBatch(events, options = {}) {
+    if (!Array.isArray(events) || events.length < 1 || events.length > 100)
+      throw new Error("SDK_OBSERVATION_BATCH_INVALID");
+    if (events.some((event) => !event.organizationId?.trim() || !event.projectId?.trim() || !event.environmentId?.trim()))
+      throw new Error("SDK_OBSERVATION_SCOPE_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/observations/batch",
+        body: { events: [...events] }
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  observeSdk(delivery, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/observations/sdk", body: delivery },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  discover(reviewState) {
+    return this.request({
+      method: "GET",
+      path: "/v1/discovery/candidates",
+      query: reviewState ? { reviewState } : void 0
+    });
+  }
+  async createSignalDiscoveryProposal(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/signals/discovery-proposals", body: input }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey("sdk:signal-discovery-proposal", input) });
+  }
+  async reviewSignalDiscoveryProposal(proposalId, decision, options = {}) {
+    required(proposalId, "SDK_SIGNAL_PROPOSAL_ID_REQUIRED");
+    const path = `/v1/signals/discovery-proposals/${encodeURIComponent(proposalId)}/review`, body = { decision };
+    return this.request({ method: "POST", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`signal-review:${proposalId}`, body) });
+  }
+  async materializeSignalDiscovery(proposalId, input = {}, options = {}) {
+    required(proposalId, "SDK_SIGNAL_PROPOSAL_ID_REQUIRED");
+    const path = `/v1/signals/discovery-proposals/${encodeURIComponent(proposalId)}/materialize`;
+    return this.request({ method: "POST", path, body: input }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`signal-materialize:${proposalId}`, input) });
+  }
+  async createSignalMapping(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/signals/mappings", body: input }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey("sdk:signal-mapping", input) });
+  }
+  getSignalMapping(mappingId) {
+    required(mappingId, "SDK_SIGNAL_MAPPING_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/signals/mappings/${encodeURIComponent(mappingId)}` });
+  }
+  async reviewSignalMapping(mappingId, input = {}, options = {}) {
+    required(mappingId, "SDK_SIGNAL_MAPPING_ID_REQUIRED");
+    const path = `/v1/signals/mappings/${encodeURIComponent(mappingId)}/review`;
+    return this.request({ method: "POST", path, body: input }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`signal-mapping-review:${mappingId}`, input) });
+  }
+  connectionHealth(connectionId) {
+    required(connectionId, "SDK_CONNECTION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/connections/${encodeURIComponent(connectionId)}/health`
+    });
+  }
+  getConnection(connectionId) {
+    required(connectionId, "SDK_CONNECTION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/connections/${encodeURIComponent(connectionId)}`
+    });
+  }
+  listSystemConnections(systemId) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/ai-systems/${encodeURIComponent(systemId)}/connections`
+    });
+  }
+  inventory(systemId) {
+    required(systemId, "SDK_SYSTEM_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/ai-systems/${encodeURIComponent(systemId)}/inventory`
+    });
+  }
+  listPacks() {
+    return this.request({
+      method: "GET",
+      path: "/v1/packs"
+    });
+  }
+  async deletePack(packId, options = {}) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    const path = `/v1/packs/${encodeURIComponent(packId)}`;
+    const body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:pack:${packId}`, { path, body }) });
+  }
+  async importPack(input) {
+    if (!input?.manifest && !input?.archiveBase64)
+      throw new Error("SDK_PACK_MANIFEST_OR_ARCHIVE_REQUIRED");
+    if (input.archiveBase64 && !input.fileName)
+      throw new Error("SDK_PACK_FILE_NAME_REQUIRED");
+    const body = {
+      ...input.manifest ? { manifest: input.manifest } : {},
+      objects: input.objects ?? {},
+      ...input.archiveBase64 ? { archiveBase64: input.archiveBase64, fileName: input.fileName } : {}
+    };
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/packs/import",
+        body
+      },
+      { idempotencyKey: input.idempotencyKey ?? await contentIdempotencyKey("sdk:pack:import", body) }
+    );
+  }
+  async installPack(packId, variables = {}) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    const path = `/v1/packs/${encodeURIComponent(packId)}/install`;
+    const body = { variables };
+    return this.request(
+      { method: "POST", path, body },
+      { idempotencyKey: await contentIdempotencyKey(`sdk:pack:install:${packId}`, body) }
+    );
+  }
+  async evaluatePack(packId, input) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    required(input?.evaluationId, "SDK_EVALUATION_ID_REQUIRED");
+    const path = `/v1/packs/${encodeURIComponent(packId)}/evaluate`;
+    const body = { evaluationId: input.evaluationId };
+    return this.request({ method: "POST", path, body }, { idempotencyKey: await contentIdempotencyKey(`sdk:pack:evaluate:${packId}`, body) });
+  }
+  async approvePack(packId, options = {}) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    const body = options.manualApproval ? { manualApproval: true, reason: required(options.reason ?? "", "SDK_MANUAL_PACK_APPROVAL_REASON_REQUIRED") } : {};
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/packs/${encodeURIComponent(packId)}/approve`,
+        body
+      },
+      { idempotencyKey: await contentIdempotencyKey(`sdk:pack:approve:${packId}`, body) }
+    );
+  }
+  async releasePack(packId) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/packs/${encodeURIComponent(packId)}/release`,
+        body: {}
+      },
+      { idempotencyKey: await contentIdempotencyKey(`sdk:pack:release:${packId}`, {}) }
+    );
+  }
+  async previewPackUpgrade(packId, incoming) {
+    required(packId, "SDK_PACK_ID_REQUIRED");
+    if (!incoming || typeof incoming !== "object")
+      throw new Error("SDK_PACK_UPGRADE_INPUT_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/packs/${encodeURIComponent(packId)}/upgrade-preview`,
+        body: { incoming }
+      },
+      { idempotencyKey: await contentIdempotencyKey(`sdk:pack:upgrade-preview:${packId}`, { incoming }) }
+    );
+  }
+  executeRuntime(input) {
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/execute",
+        body: buildRuntimeRequest(
+          input
+        )
+      },
+      { idempotencyKey: input.idempotencyKey, enforcing: true }
+    );
+  }
+  resolveRuntime(input) {
+    if (!input.behaviorPoint && !input.executionBoundary && !input.semanticContext)
+      throw new Error("SDK_RUNTIME_ROUTE_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/resolve",
+        body: {
+          ...input.behaviorPoint ? { behaviorPoint: input.behaviorPoint } : {},
+          ...input.executionBoundary ? { executionBoundary: input.executionBoundary } : {},
+          ...input.semanticContext ? { semanticContext: input.semanticContext } : {}
+        }
+      },
+      {
+        idempotencyKey: input.idempotencyKey ?? `sdk:resolve:${input.behaviorPoint ?? "boundary"}`,
+        enforcing: true
+      }
+    );
+  }
+  /** Resolve a runtime route from a governed execution boundary and semantic context. */
+  resolveBoundary(input) {
+    if (!input.executionBoundary || typeof input.executionBoundary !== "object")
+      throw new Error("SDK_EXECUTION_BOUNDARY_REQUIRED");
+    return this.resolveRuntime({
+      executionBoundary: input.executionBoundary,
+      ...input.semanticContext ? { semanticContext: input.semanticContext } : {},
+      idempotencyKey: input.idempotencyKey
+    });
+  }
+  resolveSemantic(input) {
+    required(input.input, "SDK_SEMANTIC_INPUT_REQUIRED");
+    const { idempotencyKey, requestId, ...body } = input;
+    const resolvedRequestId = requestId ?? `sdk-semantic-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/semantic/resolve",
+        body: { ...body, requestId: resolvedRequestId }
+      },
+      { idempotencyKey: idempotencyKey ?? `sdk:semantic:${resolvedRequestId}` }
+    );
+  }
+  async resolveSemanticRuntime(input) {
+    const semantic = await this.resolveSemantic(input);
+    if (!semantic) return null;
+    const body = semantic.body;
+    const receipt = body.receipt && typeof body.receipt === "object" ? body.receipt : {};
+    if (receipt.outcome !== "select" || typeof receipt.taskKey !== "string")
+      return { semantic, runtime: null };
+    const capsules = Array.isArray(body.capsules) ? body.capsules : [];
+    const firstCapsule = capsules[0] && typeof capsules[0] === "object" ? capsules[0] : {};
+    const behaviorPoint = typeof firstCapsule.behaviorKey === "string" && firstCapsule.behaviorKey.trim() ? firstCapsule.behaviorKey : receipt.taskKey;
+    const runtime = input.executionBoundary ? await this.resolveBoundary({
+      executionBoundary: input.executionBoundary,
+      semanticContext: {
+        taskKey: receipt.taskKey,
+        behaviorPoint,
+        capsule: firstCapsule
+      },
+      idempotencyKey: input.idempotencyKey ? `sdk:runtime:${input.idempotencyKey}` : void 0
+    }) : await this.resolveRuntime({
+      semanticContext: { taskKey: receipt.taskKey, behaviorPoint, capsule: firstCapsule },
+      idempotencyKey: input.idempotencyKey ? `sdk:runtime:${input.idempotencyKey}` : void 0
+    });
+    return { semantic, runtime };
+  }
+  async authorizeHostAction(input) {
+    required(input.scope.organizationId, "SDK_ACTION_ORGANIZATION_REQUIRED");
+    required(input.scope.projectId, "SDK_ACTION_PROJECT_REQUIRED");
+    required(input.scope.environmentId, "SDK_ACTION_ENVIRONMENT_REQUIRED");
+    required(input.executionId, "SDK_ACTION_EXECUTION_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: "/v1/runtime/actions/authorize",
+      body: { executionId: input.executionId, scope: input.scope, context: input.context, proposal: input.proposal }
+    });
+  }
+  listBehaviorStrategies() {
+    return this.request({
+      method: "GET",
+      path: "/v1/behavior-strategies"
+    });
+  }
+  async deleteBehaviorStrategy(strategyId, options = {}) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    const path = `/v1/behavior-strategies/${encodeURIComponent(strategyId)}`, body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:strategy:${strategyId}`, { path, body }) });
+  }
+  getBehaviorStrategy(strategyId) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/behavior-strategies/${encodeURIComponent(strategyId)}`
+    });
+  }
+  createBehaviorStrategy(definition, id) {
+    if (!definition) throw new Error("SDK_STRATEGY_DEFINITION_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: "/v1/behavior-strategies",
+      body: { definition, ...id ? { id } : {} }
+    });
+  }
+  listSemanticTasks() {
+    return this.request({ method: "GET", path: "/v1/semantic-tasks" });
+  }
+  async deleteSemanticTask(taskId, options = {}) {
+    required(taskId, "SDK_SEMANTIC_TASK_ID_REQUIRED");
+    const path = `/v1/semantic-tasks/${encodeURIComponent(taskId)}`, body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:semantic-task:${taskId}`, { path, body }) });
+  }
+  async createSemanticTask(task, options = {}) {
+    required(task?.taskKey, "SDK_SEMANTIC_TASK_KEY_REQUIRED");
+    const body = { ...task, ...options.id ? { id: options.id } : {} };
+    return this.request({ method: "POST", path: "/v1/semantic-tasks", body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:semantic-task:${task.taskKey}`, body) });
+  }
+  listBehaviorPoints() {
+    return this.request({ method: "GET", path: "/v1/behavior-points" });
+  }
+  async deleteBehaviorPoint(pointId, options = {}) {
+    required(pointId, "SDK_BEHAVIOR_POINT_ID_REQUIRED");
+    const path = `/v1/behavior-points/${encodeURIComponent(pointId)}`, body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:behavior-point:${pointId}`, { path, body }) });
+  }
+  async createBehaviorPoint(point, options = {}) {
+    required(point?.key, "SDK_BEHAVIOR_POINT_KEY_REQUIRED");
+    if (!point.taskId && !point.taskIds?.length) throw new Error("SDK_BEHAVIOR_POINT_TASK_REQUIRED");
+    const body = { ...point, ...options.id ? { id: options.id } : {} };
+    return this.request({ method: "POST", path: "/v1/behavior-points", body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:behavior-point:${point.key}`, body) });
+  }
+  createBehaviorStrategyVariant(strategyId, variant, options = {}) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    if (!variant || typeof variant !== "object")
+      throw new Error("SDK_STRATEGY_VARIANT_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/behavior-strategies/${encodeURIComponent(strategyId)}/variants`,
+        body: variant
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  validateBehaviorStrategy(strategyId) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: `/v1/behavior-strategies/${encodeURIComponent(strategyId)}/validate`,
+      body: {}
+    });
+  }
+  activateBehaviorStrategy(strategyId) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/behavior-strategies/${encodeURIComponent(strategyId)}/activate`, body: {} });
+  }
+  simulateBehaviorStrategy(strategyId, initialState = {}) {
+    required(strategyId, "SDK_STRATEGY_ID_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: `/v1/behavior-strategies/${encodeURIComponent(strategyId)}/simulate`,
+      body: { initialState }
+    });
+  }
+  startStrategyExecution(input) {
+    required(input.artifactDigest, "SDK_ARTIFACT_DIGEST_REQUIRED");
+    for (const value of [
+      input.organizationId,
+      input.projectId,
+      input.environmentId,
+      input.revisionId,
+      input.idempotencyKey,
+      input.nonce,
+      input.decisionPlanId,
+      input.policy
+    ])
+      required(value, "SDK_STRATEGY_START_FIELD_REQUIRED");
+    if (input.behaviorPoint !== void 0)
+      required(input.behaviorPoint, "SDK_BEHAVIOR_POINT_REQUIRED");
+    if (!Array.isArray(input.candidates) || input.candidates.length === 0)
+      throw new Error("SDK_STRATEGY_CANDIDATES_REQUIRED");
+    if (!Number.isFinite(input.expiresAt))
+      throw new Error("SDK_EXPIRY_REQUIRED");
+    const body = {
+      ...buildRuntimeRequest(input),
+      artifactDigest: input.artifactDigest,
+      ...input.behaviorPoint ? { behaviorPoint: input.behaviorPoint } : {},
+      ...input.executionBoundary ? { executionBoundary: input.executionBoundary } : {},
+      ...input.traceId ? { traceId: input.traceId } : {},
+      ...input.executionId ? { executionId: input.executionId } : {},
+      ...input.state ? { state: input.state } : {}
+    };
+    return this.request(
+      { method: "POST", path: "/v1/runtime/strategy-executions", body },
+      { idempotencyKey: input.idempotencyKey }
+    );
+  }
+  getStrategyExecution(executionId) {
+    required(executionId, "SDK_EXECUTION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/runtime/strategy-executions/${encodeURIComponent(executionId)}`
+    });
+  }
+  getStrategyExecutionTrace(executionId) {
+    required(executionId, "SDK_EXECUTION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/runtime/strategy-executions/${encodeURIComponent(executionId)}/trace`
+    });
+  }
+  continueStrategyExecution(executionId, continuation) {
+    required(executionId, "SDK_EXECUTION_ID_REQUIRED");
+    const input = typeof continuation === "string" ? { authorityDigest: continuation } : continuation ?? {};
+    return this.request({
+      method: "POST",
+      path: `/v1/runtime/strategy-executions/${encodeURIComponent(executionId)}/continue`,
+      body: {
+        ...input.authorityDigest ? { authorityDigest: input.authorityDigest } : {},
+        ...input.state ? { state: input.state } : {},
+        ...input.references ? { references: input.references } : {}
+      }
+    });
+  }
+  cancelStrategyExecution(executionId) {
+    required(executionId, "SDK_EXECUTION_ID_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: `/v1/runtime/strategy-executions/${encodeURIComponent(executionId)}/cancel`,
+      body: {}
+    });
+  }
+  resolveTaskRun(input) {
+    required(input.input, "SDK_TASKRUN_INPUT_REQUIRED");
+    if (input.requestedMode) required(input.requestedMode, "SDK_TASKRUN_MODE_REQUIRED");
+    const connectionId = input.connectionId ?? this.boundConnectionId;
+    return this.request({ method: "POST", path: "/v1/task-runs/resolve", body: { ...input, ...connectionId ? { connectionId } : {} } }, { idempotencyKey: `sdk:task-run:resolve:${input.input}` });
+  }
+  startTaskRun(input, options = {}) {
+    for (const value of [input.taskRunId, input.requestId]) required(value, "SDK_TASKRUN_ADMISSION_FIELD_REQUIRED");
+    if (input.input === void 0 || input.input === null) throw new Error("SDK_TASKRUN_INPUT_REQUIRED");
+    const body = { ...input, ...input.ownerActorRef ? { ownerActorRef: input.ownerActorRef } : {}, ...input.requestedMode ? { requestedMode: input.requestedMode } : {}, ...!input.connectionId && this.boundConnectionId ? { connectionId: this.boundConnectionId } : {} };
+    return this.request({ method: "POST", path: "/v1/task-runs", body }, { idempotencyKey: options.idempotencyKey ?? `sdk:task-run:start:${input.requestId}` });
+  }
+  startTaskRunFromPrompt(input, options = {}) {
+    if (input.input === void 0 || input.input === null) throw new Error("SDK_TASKRUN_INPUT_REQUIRED");
+    const id = () => globalThis.crypto?.randomUUID?.() ?? `${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    const requestId = input.requestId ?? `sdk-task-run-${id()}`;
+    return this.startTaskRun({ taskRunId: input.taskRunId ?? `task-run-${id()}`, requestId, input: input.input, ...input.conversationId ? { conversationId: input.conversationId } : {}, ...input.episodeId ? { episodeId: input.episodeId } : {}, ...input.traceRootRef ? { traceRootRef: input.traceRootRef } : {}, ...input.budget ? { budget: input.budget } : {}, ...input.connectionId ? { connectionId: input.connectionId } : {} }, options);
+  }
+  getTaskRun(taskRunId) {
+    required(taskRunId, "SDK_TASKRUN_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/task-runs/${encodeURIComponent(taskRunId)}` });
+  }
+  listTaskRunEvents(taskRunId) {
+    required(taskRunId, "SDK_TASKRUN_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/task-runs/${encodeURIComponent(taskRunId)}/events` });
+  }
+  continueTaskRun(taskRunId, expectedVersion, options = {}) {
+    required(taskRunId, "SDK_TASKRUN_ID_REQUIRED");
+    if (!Number.isInteger(expectedVersion) || expectedVersion < 0) throw new Error("SDK_TASKRUN_STATE_VERSION_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/task-runs/${encodeURIComponent(taskRunId)}/continue`, body: { expectedVersion, ...options.cursor ? { cursor: options.cursor } : {} } }, { idempotencyKey: options.idempotencyKey ?? `sdk:task-run:continue:${taskRunId}:${expectedVersion}` });
+  }
+  cancelTaskRun(taskRunId, expectedVersion, options = {}) {
+    required(taskRunId, "SDK_TASKRUN_ID_REQUIRED");
+    if (!Number.isInteger(expectedVersion) || expectedVersion < 0) throw new Error("SDK_TASKRUN_STATE_VERSION_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/task-runs/${encodeURIComponent(taskRunId)}/cancel`, body: { expectedVersion } }, { idempotencyKey: options.idempotencyKey ?? `sdk:task-run:cancel:${taskRunId}:${expectedVersion}` });
+  }
+  retryTaskRun(taskRunId, expectedVersion, options = {}) {
+    required(taskRunId, "SDK_TASKRUN_ID_REQUIRED");
+    if (!Number.isInteger(expectedVersion) || expectedVersion < 0) throw new Error("SDK_TASKRUN_STATE_VERSION_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/task-runs/${encodeURIComponent(taskRunId)}/retry`, body: { expectedVersion } }, { idempotencyKey: options.idempotencyKey ?? `sdk:task-run:retry:${taskRunId}:${expectedVersion}` });
+  }
+  listBehaviorPrograms() {
+    return this.request({
+      method: "GET",
+      path: "/v1/behavior-programs"
+    });
+  }
+  listCapabilities(options = {}) {
+    const query = options.surface ? `?surface=${encodeURIComponent(options.surface)}` : "";
+    return this.request({ method: "GET", path: `/v1/capabilities${query}` });
+  }
+  getBehaviorProgram(programId) {
+    required(programId, "SDK_PROGRAM_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/behavior-programs/${encodeURIComponent(programId)}`
+    });
+  }
+  async deleteBehaviorProgram(programId, options = {}) {
+    required(programId, "SDK_PROGRAM_ID_REQUIRED");
+    const path = `/v1/behavior-programs/${encodeURIComponent(programId)}`, body = { confirm: options.confirm === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:behavior-program:${programId}`, { path, body }) });
+  }
+  async deleteBehaviorProgramCascade(programId, options = {}) {
+    required(programId, "SDK_PROGRAM_ID_REQUIRED");
+    const path = `/v1/behavior-programs/${encodeURIComponent(programId)}/cascade`, body = { confirm: options.confirm === true, purgeRuntime: options.purgeRuntime === true };
+    return this.request({ method: "DELETE", path, body }, { idempotencyKey: options.idempotencyKey ?? await contentIdempotencyKey(`sdk:delete:behavior-program-cascade:${programId}`, { path, body }) });
+  }
+  createBehaviorProgram(program, options = {}) {
+    if (!program || typeof program !== "object")
+      throw new Error("SDK_PROGRAM_REQUIRED");
+    return this.request(
+      { method: "POST", path: "/v1/behavior-programs", body: program },
+      {
+        idempotencyKey: options.idempotencyKey ?? `sdk:program:${String(program.id ?? "")}`
+      }
+    );
+  }
+  attestCapabilities(attestation, options = {}) {
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/capabilities/attest",
+        body: attestation
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  resolveCapabilities(attestationId, request, options = {}) {
+    required(attestationId, "SDK_ATTESTATION_ID_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/capabilities/resolve",
+        body: { attestationId, request }
+      },
+      { idempotencyKey: options.idempotencyKey, enforcing: true }
+    );
+  }
+  recordCapabilityTrace(decisionDigest, trace, options = {}) {
+    required(decisionDigest, "SDK_DECISION_DIGEST_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/capabilities/traces",
+        body: { decisionDigest, trace }
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  resolveModelServing(request, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/model-serving/resolve", body: request },
+      { idempotencyKey: options.idempotencyKey, enforcing: true }
+    );
+  }
+  recordModelServingTrace(trace, selection, options = {}) {
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/model-serving/traces",
+        body: { trace, selection }
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  submitTeachEvidence(evidence, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/teach/evidence", body: evidence },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  listConversationArchive(input = {}) {
+    return this.request({ method: "GET", path: "/v1/teach/conversations", query: { ...input.limit === void 0 ? {} : { limit: String(input.limit) }, ...input.cursor ? { cursor: input.cursor } : {} } });
+  }
+  importConversationArchive(conversations, options = {}) {
+    if (!Array.isArray(conversations) || !conversations.length) throw new Error("SDK_CONVERSATION_IMPORT_REQUIRED");
+    return this.request({ method: "POST", path: "/v1/teach/conversations/import", body: { conversations: [...conversations] } }, { idempotencyKey: options.idempotencyKey });
+  }
+  revokeConversation(evidenceId, reason, options = {}) {
+    required(evidenceId, "SDK_CONVERSATION_ID_REQUIRED");
+    required(reason, "SDK_CONVERSATION_REVOCATION_REASON_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/conversations/${encodeURIComponent(evidenceId)}/revoke`, body: { reason } }, { idempotencyKey: options.idempotencyKey });
+  }
+  createTeachAnalysis(evidenceIds, options = {}) {
+    if (!Array.isArray(evidenceIds) || evidenceIds.length < 1) throw new Error("SDK_TEACH_ANALYSIS_EVIDENCE_REQUIRED");
+    const body = { evidenceIds: [...evidenceIds] };
+    if (options.analysisId) body.analysisId = options.analysisId;
+    if (options.controlPointId) body.controlPointId = options.controlPointId;
+    if (options.summary) body.summary = options.summary;
+    const requestKey = JSON.stringify([evidenceIds, options.analysisId ?? "", options.controlPointId ?? "", options.summary ?? ""]);
+    return this.request({ method: "POST", path: "/v1/teach/analyses", body }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:analysis:${requestKey}` });
+  }
+  getTeachAnalysis(analysisId) {
+    required(analysisId, "SDK_TEACH_ANALYSIS_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/teach/analyses/${encodeURIComponent(analysisId)}` });
+  }
+  createCrossConversationTeachAnalysis(input, options = {}) {
+    if (!Array.isArray(input.conversationRefs) || input.conversationRefs.length < 2) throw new Error("SDK_TEACH_CROSS_CONVERSATION_REFS_REQUIRED");
+    const body = { conversationRefs: input.conversationRefs };
+    if (input.analysisId) body.analysisId = input.analysisId;
+    if (input.controlPointId) body.controlPointId = input.controlPointId;
+    if (input.objective) body.objective = input.objective;
+    return this.request({ method: "POST", path: "/v1/teach/cross-conversation-analyses", body }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:cross-conversation:${JSON.stringify(body)}` });
+  }
+  createTeachProposal(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/teach/proposals", body: input }, { idempotencyKey: options.idempotencyKey });
+  }
+  getTeachRunBehaviorSet(teachRunId) {
+    required(teachRunId, "SDK_TEACH_RUN_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/teach/runs/${encodeURIComponent(teachRunId)}/behavior-set` });
+  }
+  listTeachRuns(input = {}) {
+    return this.request({ method: "GET", path: "/v1/teach/runs", query: { ...input.limit === void 0 ? {} : { limit: String(input.limit) }, ...input.cursor ? { cursor: input.cursor } : {}, ...input.status ? { status: input.status } : {} } });
+  }
+  getTeachRunRecommendation(teachRunId) {
+    required(teachRunId, "SDK_TEACH_RUN_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/teach/runs/${encodeURIComponent(teachRunId)}/recommendation` });
+  }
+  acceptTeachRecommendation(teachRunId, actorId, options = {}) {
+    required(teachRunId, "SDK_TEACH_RUN_ID_REQUIRED");
+    required(actorId, "SDK_TEACH_RECOMMENDATION_ACTOR_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/runs/${encodeURIComponent(teachRunId)}/recommendation/accept`, body: { actorId } }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:recommendation:accept:${teachRunId}` });
+  }
+  rejectTeachRecommendation(teachRunId, reason, options = {}) {
+    required(teachRunId, "SDK_TEACH_RUN_ID_REQUIRED");
+    required(reason, "SDK_TEACH_RECOMMENDATION_REASON_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/runs/${encodeURIComponent(teachRunId)}/recommendation/reject`, body: { reason } }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:recommendation:reject:${teachRunId}` });
+  }
+  editTeachRecommendation(teachRunId, input, options = {}) {
+    required(teachRunId, "SDK_TEACH_RUN_ID_REQUIRED");
+    required(input?.revisionId, "SDK_TEACH_RECOMMENDATION_REVISION_ID_REQUIRED");
+    required(input?.reason, "SDK_TEACH_RECOMMENDATION_REASON_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/runs/${encodeURIComponent(teachRunId)}/recommendation/edit`, body: input }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:recommendation:edit:${input.revisionId}` });
+  }
+  transitionTeachProposal(proposalId, transition, input = {}, options = {}) {
+    required(proposalId, "SDK_TEACH_PROPOSAL_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/proposals/${encodeURIComponent(proposalId)}/${transition}`, body: input }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:${transition}:${proposalId}` });
+  }
+  requestTeachProposalChanges(proposalId, feedback, options = {}) {
+    required(proposalId, "SDK_TEACH_PROPOSAL_ID_REQUIRED");
+    required(feedback, "SDK_TEACH_REQUEST_CHANGES_FEEDBACK_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/teach/proposals/${encodeURIComponent(proposalId)}/request-changes`, body: { feedback } }, { idempotencyKey: options.idempotencyKey ?? `sdk:teach:request-changes:${proposalId}:${feedback}` });
+  }
+  startEvaluation(input, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/evaluations", body: input },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  /** Request a server-executed OFF/current-ON/candidate-ON comparison.
+   * The server owns arm execution and receipts; callers cannot submit outputs.
+   */
+  startComparativeEvaluation(input, options = {}) {
+    if (!input.comparisonPlan || typeof input.comparisonPlan !== "object")
+      throw new Error("SDK_COMPARISON_PLAN_REQUIRED");
+    return this.startEvaluation(input, options);
+  }
+  evaluateQuality(input, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/quality/evaluate", body: input },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  getEvaluation(evaluationId) {
+    required(evaluationId, "SDK_EVALUATION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/evaluations/${encodeURIComponent(evaluationId)}`
+    });
+  }
+  getEvaluationComparison(evaluationId) {
+    required(evaluationId, "SDK_EVALUATION_ID_REQUIRED");
+    return this.request({
+      method: "GET",
+      path: `/v1/evaluations/${encodeURIComponent(evaluationId)}/comparison`
+    });
+  }
+  reviewComparativeFinding(evaluationId, findingId, input, options = {}) {
+    required(evaluationId, "SDK_EVALUATION_ID_REQUIRED");
+    required(findingId, "SDK_COMPARATIVE_FINDING_ID_REQUIRED");
+    if (!["ACCEPT", "REJECT", "EDIT", "MORE_EVIDENCE"].includes(input?.decision)) throw new Error("SDK_COMPARATIVE_FINDING_DECISION_INVALID");
+    return this.request({ method: "POST", path: `/v1/evaluations/${encodeURIComponent(evaluationId)}/comparison/findings/${encodeURIComponent(findingId)}/review`, body: { ...input } }, { idempotencyKey: options.idempotencyKey ?? `sdk:comparison:finding:${evaluationId}:${findingId}` });
+  }
+  createEvaluationPlan(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/evaluation-plans", body: input }, { idempotencyKey: options.idempotencyKey });
+  }
+  getEvaluationPlan(planId) {
+    required(planId, "SDK_EVALUATION_PLAN_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/evaluation-plans/${encodeURIComponent(planId)}` });
+  }
+  sealEvaluationPlan(planId, options = {}) {
+    required(planId, "SDK_EVALUATION_PLAN_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/evaluation-plans/${encodeURIComponent(planId)}/seal`, body: {} }, { idempotencyKey: options.idempotencyKey ?? `sdk:evaluation-plan:seal:${planId}` });
+  }
+  createImprovementProposal(evaluationId, input, options = {}) {
+    required(evaluationId, "SDK_EVALUATION_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/evaluations/${encodeURIComponent(evaluationId)}/improvement-proposal`, body: input }, { idempotencyKey: options.idempotencyKey });
+  }
+  getImprovementProposal(proposalId) {
+    required(proposalId, "SDK_IMPROVEMENT_PROPOSAL_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/behavior-improvement-proposals/${encodeURIComponent(proposalId)}` });
+  }
+  reviewImprovementProposal(proposalId, action = "request-review", options = {}) {
+    required(proposalId, "SDK_IMPROVEMENT_PROPOSAL_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/behavior-improvement-proposals/${encodeURIComponent(proposalId)}`, body: { action } }, { idempotencyKey: options.idempotencyKey ?? `sdk:improvement-proposal:${action}:${proposalId}` });
+  }
+  editImprovementProposalAsNew(proposalId, input, options = {}) {
+    required(proposalId, "SDK_IMPROVEMENT_PROPOSAL_ID_REQUIRED");
+    required(input?.id, "SDK_IMPROVEMENT_EDIT_ID_REQUIRED");
+    required(input?.reason, "SDK_IMPROVEMENT_EDIT_REASON_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/behavior-improvement-proposals/${encodeURIComponent(proposalId)}`, body: { ...input, action: "edit" } }, { idempotencyKey: options.idempotencyKey ?? `sdk:improvement-proposal:edit:${input.id}` });
+  }
+  createBehaviorRevisionCandidate(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/behavior-revision-candidates", body: input }, { idempotencyKey: options.idempotencyKey });
+  }
+  evaluateBehaviorRevisionCandidate(candidateId, input, options = {}) {
+    required(candidateId, "SDK_BEHAVIOR_CANDIDATE_ID_REQUIRED");
+    if (!Array.isArray(input.dataset) || input.dataset.length === 0) throw new Error("SDK_CANDIDATE_EVALUATION_DATASET_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/behavior-revision-candidates/${encodeURIComponent(candidateId)}/evaluate`, body: input }, { idempotencyKey: options.idempotencyKey ?? `sdk:behavior-candidate:evaluate:${candidateId}` });
+  }
+  transitionBehaviorRevisionCandidate(candidateId, transition, input = {}, options = {}) {
+    required(candidateId, "SDK_BEHAVIOR_CANDIDATE_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/behavior-revision-candidates/${encodeURIComponent(candidateId)}/${transition}`, body: input }, { idempotencyKey: options.idempotencyKey ?? `sdk:behavior-candidate:${transition}:${candidateId}` });
+  }
+  createPackRevision(input, options = {}) {
+    return this.request({ method: "POST", path: "/v1/pack-revisions", body: input }, { idempotencyKey: options.idempotencyKey });
+  }
+  getPackRevision(revisionId) {
+    required(revisionId, "SDK_PACK_REVISION_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/pack-revisions/${encodeURIComponent(revisionId)}` });
+  }
+  getPackRevisionDiff(revisionId) {
+    required(revisionId, "SDK_PACK_REVISION_ID_REQUIRED");
+    return this.request({ method: "GET", path: `/v1/pack-revisions/${encodeURIComponent(revisionId)}/diff` });
+  }
+  transitionPackRevision(revisionId, transition, options = {}) {
+    required(revisionId, "SDK_PACK_REVISION_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/pack-revisions/${encodeURIComponent(revisionId)}/${transition}`, body: {} }, { idempotencyKey: options.idempotencyKey ?? `sdk:pack-revision:${transition}:${revisionId}` });
+  }
+  materializePackRevision(revisionId, input, options = {}) {
+    required(revisionId, "SDK_PACK_REVISION_ID_REQUIRED");
+    return this.request({ method: "POST", path: `/v1/pack-revisions/${encodeURIComponent(revisionId)}/materialize`, body: input }, { idempotencyKey: options.idempotencyKey ?? `sdk:pack-revision:materialize:${revisionId}` });
+  }
+  createRelease(input, options = {}) {
+    return this.request(
+      { method: "POST", path: "/v1/releases", body: input },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  createManualRelease(input, options = {}) {
+    if (!input || typeof input !== "object" || !input.manualApproval) throw new Error("SDK_MANUAL_RELEASE_APPROVAL_REQUIRED");
+    return this.createRelease(input, { idempotencyKey: options.idempotencyKey });
+  }
+  releaseProgramManually(input, options = {}) {
+    required(input?.programId, "SDK_MANUAL_RELEASE_PROGRAM_REQUIRED");
+    required(input?.reason, "SDK_MANUAL_RELEASE_REASON_REQUIRED");
+    return this.request({ method: "POST", path: "/v1/releases/manual-program", body: { programId: input.programId, reason: input.reason } }, { idempotencyKey: options.idempotencyKey ?? `sdk:manual-release:${input.programId}` });
+  }
+  recordDeploymentComparison(deploymentId, comparison, options = {}) {
+    required(deploymentId, "SDK_DEPLOYMENT_ID_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/deployments/${encodeURIComponent(deploymentId)}/comparisons`,
+        body: comparison
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  recordDeploymentHealth(deploymentId, health, options = {}) {
+    required(deploymentId, "SDK_DEPLOYMENT_ID_REQUIRED");
+    return this.request(
+      {
+        method: "POST",
+        path: `/v1/deployments/${encodeURIComponent(deploymentId)}/authoritative-health`,
+        body: health
+      },
+      { idempotencyKey: options.idempotencyKey }
+    );
+  }
+  async compileBehaviorCapsule(input) {
+    required(input.programId, "SDK_PROGRAM_ID_REQUIRED");
+    required(input.input, "SDK_RUNTIME_INPUT_REQUIRED");
+    const body = { ...input };
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/behavior-capsule",
+        body
+      },
+      {
+        idempotencyKey: input.idempotencyKey ?? await contentIdempotencyKey(`sdk:capsule:${input.programId}`, body),
+        enforcing: true
+      }
+    );
+  }
+  async serveBehaviorProjection(input) {
+    required(input.input, "SDK_RUNTIME_INPUT_REQUIRED");
+    required(input.provider, "SDK_PROVIDER_REQUIRED");
+    const body = { ...input };
+    return this.request(
+      {
+        method: "POST",
+        path: "/v1/runtime/behavior-projection",
+        body
+      },
+      {
+        idempotencyKey: input.idempotencyKey ?? await contentIdempotencyKey(`sdk:projection:${input.programId ?? "active"}`, body),
+        enforcing: true
+      }
+    );
+  }
+  async testConnection(connectionId) {
+    required(connectionId, "SDK_CONNECTION_ID_REQUIRED");
+    return this.request({
+      method: "POST",
+      path: `/v1/connections/${encodeURIComponent(connectionId)}/test`,
+      body: {}
+    });
+  }
+};
+function buildRuntimeRequest(input) {
+  const {
+    organizationId,
+    projectId,
+    environmentId,
+    revisionId,
+    idempotencyKey,
+    nonce,
+    expiresAt,
+    decisionPlanId,
+    calibrationId,
+    candidates,
+    allowedIds,
+    policy,
+    postModelJudge,
+    shadow
+  } = input;
+  for (const value of [
+    organizationId,
+    projectId,
+    environmentId,
+    revisionId,
+    idempotencyKey,
+    nonce
+  ])
+    if (typeof value !== "string" || !value.trim())
+      throw new Error("SDK_REQUEST_FIELD_REQUIRED");
+  if (!Number.isFinite(expiresAt)) throw new Error("SDK_EXPIRY_REQUIRED");
+  const boundary = {
+    ...typeof decisionPlanId === "string" ? { decisionPlanId } : {},
+    ...typeof calibrationId === "string" ? { calibrationId } : {},
+    ...Array.isArray(candidates) ? { candidates } : {},
+    ...Array.isArray(allowedIds) ? { allowedIds } : {},
+    ...typeof policy === "string" ? { policy } : {},
+    ...postModelJudge !== void 0 ? { postModelJudge } : {},
+    ...shadow !== void 0 ? { shadow } : {}
+  };
+  return Object.freeze({
+    organizationId,
+    projectId,
+    environmentId,
+    revisionId,
+    idempotencyKey,
+    nonce,
+    expiresAt,
+    ...boundary
+  });
+}
+function buildAISystemRequest(input) {
+  const { name, systemType, organizationId, projectId, environmentId } = input;
+  for (const value of [
+    name,
+    systemType,
+    organizationId,
+    projectId,
+    environmentId
+  ])
+    if (typeof value !== "string" || !value.trim())
+      throw new Error("SDK_AI_SYSTEM_FIELD_REQUIRED");
+  return Object.freeze({
+    method: "POST",
+    path: "/v1/ai-systems",
+    body: Object.freeze({
+      name,
+      systemType,
+      organizationId,
+      projectId,
+      environmentId
+    })
+  });
+}
+function buildObservationRequest(event) {
+  if (!event?.organizationId?.trim() || !event?.projectId?.trim() || !event?.environmentId?.trim())
+    throw new Error("SDK_OBSERVATION_SCOPE_REQUIRED");
+  if (!event?.eventId || !event.eventType || !event.aiSystemId || !event.connectionId)
+    throw new Error("SDK_OBSERVATION_FIELD_REQUIRED");
+  return Object.freeze({
+    method: "POST",
+    path: "/v1/observations",
+    body: Object.freeze({ ...event })
+  });
+}
+
+// ../../sdks/host-lifecycle.ts
+import { createHash } from "node:crypto";
+var nonEmpty = (value, code) => {
+  if (typeof value !== "string" || !value.trim()) throw new Error(code);
+  return value.trim();
+};
+var bounded = (value, fallback) => {
+  const parsed = Number(value ?? fallback);
+  if (!Number.isFinite(parsed) || parsed < 256) throw new Error("SDK_HOST_PROJECTION_BUDGET_INVALID");
+  return Math.min(Math.floor(parsed), 64e3);
+};
+var lifecycleTimeout = (value) => {
+  const parsed = Number(value ?? 15e3);
+  if (!Number.isFinite(parsed) || parsed < 250) throw new Error("SDK_HOST_TIMEOUT_INVALID");
+  return Math.min(Math.floor(parsed), 12e4);
+};
+var withTimeout = async (operation, timeoutMs, code) => {
+  let timer;
+  try {
+    return await Promise.race([operation, new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error(code)), timeoutMs);
+    })]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+};
+var bodyOf = (response) => {
+  if (response && typeof response === "object" && "body" in response) {
+    const body = response.body;
+    return body && typeof body === "object" && !Array.isArray(body) ? body : {};
+  }
+  return response && typeof response === "object" && !Array.isArray(response) ? response : {};
+};
+var isAllow = (decision) => decision.decision === "ALLOW" && Boolean(decision.authorityReceiptDigest && decision.decisionDigest);
+var canonical = (value) => Array.isArray(value) ? `[${value.map(canonical).join(",")}]` : value && typeof value === "object" ? `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => `${JSON.stringify(key)}:${canonical(child)}`).join(",")}}` : JSON.stringify(value);
+var digest = (value) => createHash("sha256").update(canonical(value), "utf8").digest("hex");
+function createViraHostRuntime(client, config) {
+  if (!client) throw new Error("SDK_HOST_CLIENT_REQUIRED");
+  const mode = config.mode ?? "off";
+  if (!["off", "observe", "enforce"].includes(mode)) throw new Error("SDK_HOST_MODE_INVALID");
+  const capabilities = config.capabilities;
+  if (!capabilities || typeof capabilities !== "object") throw new Error("SDK_HOST_CAPABILITIES_REQUIRED");
+  const maxBytes = bounded(config.projectionMaxBytes, 8e3);
+  const timeoutMs = lifecycleTimeout(config.timeoutMs);
+  if (mode === "enforce" && (!capabilities.canInterceptToolBefore || !capabilities.canPreventSideEffect)) throw new Error("SDK_HOST_ENFORCE_CAPABILITY_REQUIRED");
+  if (mode === "enforce" && typeof config.authorizeAction !== "function") throw new Error("SDK_HOST_ACTION_AUTHORIZER_REQUIRED");
+  let connected = null;
+  const projections = /* @__PURE__ */ new Map();
+  const connectOnce = async () => {
+    if (mode === "off" || !config.connect) return null;
+    if (!connected) connected = withTimeout(client.connectOnce(config.connect), timeoutMs, "SDK_HOST_CONNECT_TIMEOUT");
+    return connected;
+  };
+  const sessionKey = (request) => `${request.organizationId}:${request.projectId}:${request.environmentId}:${request.conversationId}`;
+  const beforeModel = async (request) => {
+    nonEmpty(request.input, "SDK_HOST_MODEL_INPUT_REQUIRED");
+    if (mode === "off") return { status: "off" };
+    if (!capabilities.canInjectContext) return { status: "unavailable", reasonCode: "HOST_CONTEXT_INJECTION_UNSUPPORTED" };
+    await connectOnce();
+    const semantic = await withTimeout(client.resolveSemanticRuntime({ input: request.input, sessionId: request.sessionId ?? request.conversationId, requestId: request.requestId }), timeoutMs, "SDK_HOST_RESOLVE_TIMEOUT");
+    if (!semantic) return { status: "unavailable", reasonCode: "VIRA_SEMANTIC_UNAVAILABLE" };
+    const semanticBody = bodyOf(semantic.semantic);
+    const receipt = semanticBody.receipt && typeof semanticBody.receipt === "object" ? semanticBody.receipt : {};
+    if (receipt.outcome !== "select" || typeof receipt.taskKey !== "string" || !semantic.runtime) {
+      const result2 = { status: "abstain", taskKey: typeof receipt.taskKey === "string" ? receipt.taskKey : void 0, reasonCode: String(receipt.abstainReason ?? receipt.clarifyReason ?? "NO_BEHAVIOR_MATCH") };
+      projections.set(sessionKey(request), result2);
+      return result2;
+    }
+    const runtimeBody = bodyOf(semantic.runtime);
+    const projection = runtimeBody.behaviorProjection && typeof runtimeBody.behaviorProjection === "object" ? runtimeBody.behaviorProjection : {};
+    const rendered = typeof projection.rendered === "string" ? projection.rendered : "";
+    if (!rendered.trim()) return { status: "abstain", taskKey: String(receipt.taskKey), reasonCode: "EMPTY_BEHAVIOR_PROJECTION" };
+    if (Buffer.byteLength(rendered, "utf8") > maxBytes) return { status: "unavailable", taskKey: String(receipt.taskKey), reasonCode: "BEHAVIOR_PROJECTION_BUDGET_EXCEEDED" };
+    const result = { status: "applied", response: semantic.runtime, projection: rendered, projectionDigest: typeof projection.projectionDigest === "string" ? projection.projectionDigest : void 0, taskKey: String(receipt.taskKey), behaviorPoint: typeof runtimeBody.behaviorPoint === "string" ? runtimeBody.behaviorPoint : void 0 };
+    projections.set(sessionKey(request), result);
+    return result;
+  };
+  const beforeTool = async (proposal) => {
+    nonEmpty(proposal.callId, "SDK_HOST_TOOL_CALL_ID_REQUIRED");
+    nonEmpty(proposal.toolName, "SDK_HOST_TOOL_NAME_REQUIRED");
+    if (mode !== "enforce") return { decision: "ABSTAIN", reasonCode: mode === "off" ? "HOST_MODE_OFF" : "OBSERVE_ONLY" };
+    let decision;
+    try {
+      decision = await withTimeout(Promise.resolve(config.authorizeAction(proposal)), timeoutMs, "SDK_HOST_ACTION_AUTHORIZATION_TIMEOUT");
+    } catch {
+      return { decision: "ERROR", reasonCode: "VIRA_ACTION_AUTHORIZATION_TIMEOUT" };
+    }
+    if (!decision || !["ALLOW", "BLOCK", "ESCALATE", "ABSTAIN", "ERROR"].includes(decision.decision)) throw new Error("SDK_HOST_ACTION_DECISION_INVALID");
+    if (decision.decision === "ALLOW" && !isAllow(decision)) throw new Error("SDK_HOST_ALLOW_RECEIPT_INVALID");
+    return decision;
+  };
+  const afterTool = async (result) => {
+    nonEmpty(result.callId, "SDK_HOST_TOOL_CALL_ID_REQUIRED");
+    if (mode === "off" || !capabilities.canInspectToolAfter) return { status: "off" };
+    const observedResult = result.ok ? result.result : { errorCode: result.errorCode ?? "HOST_TOOL_FAILED" };
+    const evidence = { abi: "vira.host-tool-evidence.v1", eventId: result.callId, callId: result.callId, toolName: result.toolName, argumentsDigest: digest(result.args), resultDigest: result.resultDigest ?? digest(observedResult), outcome: result.ok ? "success" : "failure", requestId: result.requestId, conversationId: result.conversationId, ...result.sessionId ? { sessionId: result.sessionId } : {}, ...result.turnId ? { turnId: result.turnId } : {} };
+    return withTimeout(client.observe({ eventId: result.callId, eventType: result.ok ? "tool.result" : "tool.failed", aiSystemId: result.aiSystemId, connectionId: result.connectionId, organizationId: result.organizationId, projectId: result.projectId, environmentId: result.environmentId, conversationId: result.conversationId, requestId: result.requestId, traceId: result.traceId, payload: { result: observedResult, evidence }, resultDigest: evidence.resultDigest }), timeoutMs, "SDK_HOST_OBSERVE_TIMEOUT");
+  };
+  const endSession = (identity) => {
+    projections.delete(sessionKey({ ...identity, requestId: "session-end", input: "" }));
+  };
+  return Object.freeze({ mode, capabilities, connectOnce, beforeModel, beforeTool, afterTool, endSession, getProjection: (identity) => projections.get(sessionKey({ ...identity, requestId: "projection", input: "" })), supportsPostModelVerification: capabilities.canInterceptResponseBeforeDisplay });
+}
+
+// src/index.ts
+var Plugin = { define: (plugin) => plugin };
+var text = (value) => typeof value === "string" ? value : "";
+var required2 = (value, code) => {
+  const result = text(value).trim();
+  if (!result) throw new Error(code);
+  return result;
+};
+var asRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : {};
+var canonical2 = (value) => Array.isArray(value) ? "[" + value.map(canonical2).join(",") + "]" : value && typeof value === "object" ? "{" + Object.entries(value).filter(([, child]) => child !== void 0).sort(([a], [b]) => a.localeCompare(b)).map(([key, child]) => JSON.stringify(key) + ":" + canonical2(child)).join(",") + "}" : JSON.stringify(value);
+var digest2 = (value) => createHash2("sha256").update(canonical2(value), "utf8").digest("hex");
+var lastUserText = (event) => {
+  const messages = Array.isArray(event.messages) ? event.messages : [];
+  for (let index = messages.length - 1; index >= 0; index -= 1) {
+    const message = asRecord(messages[index]);
+    if (message.role === "user") return text(message.content ?? message.text);
+  }
+  return text(event.input ?? event.prompt);
+};
+var ViraOpenCodeActionError = class extends Error {
+  decision;
+  constructor(decision, reason) {
+    super(`VIRA_ACTION_${decision}:${reason}`);
+    this.name = "ViraOpenCodeActionError";
+    this.decision = decision;
+  }
+};
+var index_default = Plugin.define({
+  id: "vira",
+  async setup(rawContext) {
+    const ctx = rawContext;
+    const options = ctx.options ?? {};
+    const env = (name) => typeof process !== "undefined" ? process.env[name] : void 0;
+    const mode = options.mode ?? env("VIRA_HOST_MODE") ?? "off";
+    if (mode === "off") return;
+    const apiUrl = options.apiUrl ?? env("VIRA_CONTROL_URL") ?? env("VIRA_API_URL");
+    const apiKey = options.apiKey ?? env("VIRA_API_KEY");
+    const scope = { organizationId: required2(options.organizationId ?? env("VIRA_ORGANIZATION_ID"), "VIRA_HOST_ORGANIZATION_REQUIRED"), projectId: required2(options.projectId ?? env("VIRA_PROJECT_ID"), "VIRA_HOST_PROJECT_REQUIRED"), environmentId: required2(options.environmentId ?? env("VIRA_ENVIRONMENT_ID"), "VIRA_HOST_ENVIRONMENT_REQUIRED") };
+    const client = new ViraClient({ baseUrl: required2(apiUrl, "VIRA_HOST_API_URL_REQUIRED"), apiKey });
+    const capabilities = { canObserveModel: true, canInjectContext: true, canInterceptToolBefore: true, canInspectToolAfter: true, canPreventSideEffect: mode === "enforce", canInterceptResponseBeforeDisplay: false, ...options.capabilities ?? {} };
+    const actionContexts = /* @__PURE__ */ new Map();
+    const runtime = createViraHostRuntime(client, { mode, capabilities, authorizeAction: options.authorizeAction ?? (async (proposal) => {
+      const contextKey = proposal.organizationId + ":" + proposal.projectId + ":" + proposal.environmentId + ":" + proposal.conversationId;
+      const bound = actionContexts.get(contextKey);
+      if (!bound) return { decision: "BLOCK", reasonCode: "RUNTIME_ACTION_CONTEXT_UNAVAILABLE" };
+      try {
+        const response = await client.authorizeHostAction({ executionId: bound.executionId, scope, context: bound.context, proposal: { proposal_id: proposal.conversationId + ":" + proposal.callId, tool_key: proposal.toolName, arguments: proposal.args, arguments_digest: digest2(proposal.args), request_context_digest: digest2(bound.context), schema_digest: String(asRecord(asRecord(bound.context).tools).schema_digest ?? "") } });
+        const body = asRecord(response?.body);
+        return body.allowed === true ? { decision: "ALLOW", authorityReceiptDigest: text(body.authority_receipt_digest), decisionDigest: text(body.decision_digest) } : { decision: "BLOCK", reasonCode: text(body.reason_code) || "POLICY_DENIED", authorityReceiptDigest: text(body.authority_receipt_digest) };
+      } catch (error) {
+        return { decision: "ERROR", reasonCode: error instanceof Error ? error.message : "RUNTIME_ACTION_AUTHORIZATION_FAILED" };
+      }
+    }), connect: { ...scope, name: "OpenCode", systemType: "agent", adapterType: "opencode", adapterVersion: options.hostVersion ?? ctx.app?.version ?? "unknown", idempotencyKey: "opencode:vira:connect" } });
+    const registrations = [];
+    const sessionIdentity = (event) => ({ ...scope, hostName: options.hostName ?? "opencode", hostVersion: options.hostVersion ?? ctx.app?.version ?? "unknown", aiSystemId: required2(options.aiSystemId ?? env("VIRA_AI_SYSTEM_ID"), "VIRA_HOST_AI_SYSTEM_REQUIRED"), connectionId: required2(options.connectionId ?? env("VIRA_CONNECTION_ID"), "VIRA_HOST_CONNECTION_REQUIRED"), conversationId: required2(event.sessionID ?? event.conversationId, "VIRA_HOST_SESSION_REQUIRED") });
+    registrations.push(await ctx.session.hook("context", async (event) => {
+      const identity = sessionIdentity(event);
+      const result = await runtime.beforeModel({ ...identity, requestId: text(event.messageID ?? event.requestId) || `opencode:${Date.now()}`, input: required2(lastUserText(event), "VIRA_HOST_MODEL_INPUT_REQUIRED"), traceId: text(event.traceID), turnId: text(event.turnID) });
+      const responseBody = asRecord(result.response?.body);
+      const runtimeContext = asRecord(event.viraRuntimeContext ?? responseBody.requestContext ?? responseBody.context);
+      const executionId = text(event.executionId ?? responseBody.executionId);
+      if (executionId && runtimeContext.abi === "vira.request-behavior-context.v2") actionContexts.set(identity.organizationId + ":" + identity.projectId + ":" + identity.environmentId + ":" + identity.conversationId, { executionId, context: runtimeContext });
+      if (result.status === "applied" && result.projection) {
+        const system = Array.isArray(event.system) ? event.system : event.system = [];
+        if (!system.some((item) => text(asRecord(item).text) === result.projection)) system.push({ type: "text", text: result.projection });
+      }
+    }));
+    registrations.push(await ctx.tool.hook("execute.before", async (event) => {
+      const identity = sessionIdentity(event);
+      const decision = await runtime.beforeTool({ ...identity, requestId: text(event.messageID ?? event.requestId) || `opencode:${Date.now()}`, callId: required2(event.callID ?? event.id, "VIRA_HOST_TOOL_CALL_REQUIRED"), toolName: required2(event.tool ?? event.name, "VIRA_HOST_TOOL_NAME_REQUIRED"), args: asRecord(event.input ?? event.args), traceId: text(event.traceID), turnId: text(event.turnID) });
+      if (decision.decision !== "ALLOW") throw new ViraOpenCodeActionError(decision.decision, text(decision.reasonCode) || "VIRA_ACTION_NOT_ALLOWED");
+    }));
+    registrations.push(await ctx.tool.hook("execute.after", async (event) => {
+      const identity = sessionIdentity(event);
+      await runtime.afterTool({ ...identity, requestId: text(event.messageID ?? event.requestId) || `opencode:${Date.now()}`, callId: required2(event.callID ?? event.id, "VIRA_HOST_TOOL_CALL_REQUIRED"), toolName: required2(event.tool ?? event.name, "VIRA_HOST_TOOL_NAME_REQUIRED"), args: asRecord(event.input ?? event.args), ok: event.status === "completed", result: event.result, errorCode: text(asRecord(event.error).code), traceId: text(event.traceID), turnId: text(event.turnID) });
+    }));
+    registrations.push(await ctx.session.hook("fork", (event) => runtime.endSession({ ...scope, hostName: "opencode", hostVersion: ctx.app?.version ?? "unknown", aiSystemId: options.aiSystemId ?? "", connectionId: options.connectionId ?? "", conversationId: text(event.sessionID) })));
+    return async () => {
+      actionContexts.clear();
+      for (const registration of registrations) await registration.dispose?.();
+    };
+  }
+});
+export {
+  ViraOpenCodeActionError,
+  index_default as default
+};

package/package.json

@@ -1,6 +1,14 @@
 {
   "name": "@tryvira/opencode",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "OpenCode V2 host lifecycle integration for Vira",
+  "type": "module",
+  "main": "./dist/index.js",
+  "exports": {".": "./dist/index.js"},
+  "files": ["dist", "README.md"],
+  "scripts": {"build": "node ../../scripts/build-opencode-plugin.mjs", "pack:check": "npm run build && npm pack --dry-run"},
+  "dependencies": {"@tryvira/sdk": "0.1.46"},
+  "peerDependencies": {"effect": "^4.0.0"},
+  "engines": {"node": ">=20"},
+  "license": "MIT"
+}