@vendoai/vendo 0.4.0

package/dist/dev-creds/model.js

@@ -0,0 +1,159 @@
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { resolveCloudBaseUrl } from "../cli/cloud/client.js";
+import { describeDevCredential, resolveDevCredential, } from "./resolve.js";
+const DEFAULT_MODELS = {
+    anthropic: {
+        module: "@ai-sdk/anthropic",
+        factory: "createAnthropic",
+        model: "claude-sonnet-4-6",
+        modelEnv: "VENDO_DEV_ANTHROPIC_MODEL",
+        install: "npm install ai@^6 @ai-sdk/anthropic@^3",
+    },
+    openai: {
+        module: "@ai-sdk/openai",
+        factory: "createOpenAI",
+        model: "gpt-5",
+        modelEnv: "VENDO_DEV_OPENAI_MODEL",
+        install: "npm install ai@^6 @ai-sdk/openai@^3",
+    },
+    google: {
+        module: "@ai-sdk/google",
+        factory: "createGoogleGenerativeAI",
+        model: "gemini-2.5-flash",
+        modelEnv: "VENDO_DEV_GOOGLE_MODEL",
+        install: "npm install ai@^6 @ai-sdk/google@^3",
+    },
+};
+/** The Cloud gateway serves curated model aliases, never raw provider ids:
+ *  `vendo-default` (Sonnet), `vendo-fast` (Haiku), `vendo-strong` (Opus).
+ *  VENDO_CLOUD_MODEL picks among them; the gateway remaps any other value to
+ *  vendo-default (with an `x-vendo-model-remapped` warning header) during the
+ *  grace window, and will hard-reject non-aliases after it. Same module/
+ *  factory/install as anthropic — the gateway speaks the Anthropic Messages
+ *  wire. */
+const CLOUD_MODEL = {
+    module: "@ai-sdk/anthropic",
+    factory: "createAnthropic",
+    model: "vendo-default",
+    modelEnv: "VENDO_CLOUD_MODEL",
+    install: "npm install ai@^6 @ai-sdk/anthropic@^3",
+};
+export const NO_CREDENTIAL_MESSAGE = "Vendo found no model key. Set ANTHROPIC_API_KEY / OPENAI_API_KEY / GOOGLE_GENERATIVE_AI_API_KEY "
+    + "in .env.local (with the matching @ai-sdk provider installed), or run `vendo login` for a "
+    + "free dev key. Production always needs a real server-side key.";
+/** Bundler-proof dynamic import: this module runs inside the host's dev server
+ *  bundle (Next/webpack/turbopack), where a computed `import(...)` becomes a
+ *  runtime stub throwing "expression is too dynamic". Native import first
+ *  (plain Node, test VMs), Function-constructed import as the bundler-blind
+ *  fallback. The Function body is a FIXED literal — the specifier is a
+ *  parameter, never interpolated into code. */
+async function dynamicImport(url) {
+    try {
+        return await import(url);
+    }
+    catch (nativeError) {
+        try {
+            const escaped = new Function("specifier", "return import(specifier)");
+            return await escaped(url);
+        }
+        catch {
+            throw nativeError;
+        }
+    }
+}
+async function importHostModule(root, specifier) {
+    const require = createRequire(join(root, "package.json"));
+    return await dynamicImport(pathToFileURL(require.resolve(specifier)).href);
+}
+export class DevModelController {
+    root;
+    env;
+    importModule;
+    resolution = null;
+    announced = false;
+    constructor(options = {}) {
+        this.root = options.root ?? process.cwd();
+        this.env = options.env ?? process.env;
+        this.importModule = options.importModule ?? importHostModule;
+    }
+    /** Resolve the credential once per process; state it on the server log once.
+     *  An unavailable resolution logs its full instructions HERE — the wire
+     *  deliberately shows clients only a generic error, so the operator's
+     *  terminal is where the honest message must land. */
+    resolve() {
+        this.resolution ??= this.resolveOnce().then((resolution) => {
+            if (resolution.mode === "unavailable")
+                console.error(`[vendo] ${resolution.message}`);
+            return resolution;
+        });
+        return this.resolution;
+    }
+    announce(credential, suffix = "") {
+        if (this.announced)
+            return;
+        this.announced = true;
+        console.log(`[vendo] model: ${describeDevCredential(credential)}${suffix}`);
+    }
+    /** The shared delegate rung: load the provider module (an install failure
+     *  resolves unavailable with the exact install command), pick the model id
+     *  (env override or the spec default), and hand the factory-built model back. */
+    async delegate(credential, spec, keyName, config, announceSuffix) {
+        let loaded;
+        try {
+            loaded = await this.importModule(this.root, spec.module);
+        }
+        catch {
+            const message = `${keyName} is set but ${spec.module} is not installed in this app; install it (\`${spec.install}\`).`;
+            this.announce(credential, ` — but ${spec.module} is missing`);
+            return { mode: "unavailable", credential, message };
+        }
+        const factory = loaded[spec.factory];
+        const modelId = this.env[spec.modelEnv] ?? spec.model;
+        const model = factory(config)(modelId);
+        this.announce(credential, ` → ${modelId}${announceSuffix}`);
+        return { mode: "delegate", credential, model };
+    }
+    async resolveOnce() {
+        const options = { env: this.env };
+        const credential = await resolveDevCredential(options);
+        if (credential.rung === "env-key") {
+            return this.delegate(credential, DEFAULT_MODELS[credential.provider], credential.envVar, { apiKey: this.env[credential.envVar] }, "");
+        }
+        if (credential.rung === "vendo-cloud") {
+            // The gateway speaks the Anthropic Messages wire, so the anthropic
+            // provider serves it — pointed at the console instead of Anthropic.
+            const base = resolveCloudBaseUrl({ env: this.env });
+            const baseURL = base.endsWith("/api/v1") ? base : `${base}/api/v1`;
+            return this.delegate(credential, CLOUD_MODEL, "VENDO_API_KEY", { apiKey: this.env["VENDO_API_KEY"], baseURL }, " via the Cloud gateway");
+        }
+        this.announce(credential);
+        return { mode: "unavailable", credential, message: NO_CREDENTIAL_MESSAGE };
+    }
+    async doGenerate(callOptions) {
+        const resolution = await this.resolve();
+        if (resolution.mode === "delegate")
+            return resolution.model.doGenerate(callOptions);
+        throw new Error(resolution.message);
+    }
+    async doStream(callOptions) {
+        const resolution = await this.resolve();
+        if (resolution.mode === "delegate")
+            return resolution.model.doStream(callOptions);
+        throw new Error(resolution.message);
+    }
+}
+/** The env-resolving model (see module doc). */
+export function devModel(options = {}) {
+    const controller = new DevModelController(options);
+    const model = {
+        specificationVersion: "v3",
+        provider: "vendo-dev",
+        modelId: "dev-env",
+        supportedUrls: {},
+        doGenerate: (callOptions) => controller.doGenerate(callOptions),
+        doStream: (callOptions) => controller.doStream(callOptions),
+    };
+    return model;
+}

package/dist/dev-creds/resolve.d.ts

@@ -0,0 +1,36 @@
+/**
+ * The dev-mode model-credential resolver (install-dx v1, re-derived 2026-07-18).
+ * Runtime model credentials are REAL KEYS ONLY — CLI-session rungs were removed
+ * (a coding-agent login helps at init time only, never serves product turns).
+ * Detection is PURE and read-only — no network, no writes, no key material in
+ * the result (consumers read the env variable themselves). Order (explicit
+ * beats implicit):
+ *
+ *   1. explicit env key (ANTHROPIC / OPENAI / GOOGLE)
+ *   2. VENDO_API_KEY (Vendo Cloud starter allowance / gateway)
+ *   3. none (honest failure with exact instructions)
+ */
+export type EnvKeyProvider = "anthropic" | "openai" | "google";
+export type DevCredential = {
+    rung: "env-key";
+    provider: EnvKeyProvider;
+    envVar: string;
+} | {
+    rung: "vendo-cloud";
+} | {
+    rung: "none";
+};
+export declare const ENV_KEY_VARS: ReadonlyArray<{
+    envVar: string;
+    provider: EnvKeyProvider;
+}>;
+export interface ResolveDevCredentialOptions {
+    env?: Record<string, string | undefined>;
+}
+/** Detect the best available model credential. `VENDO_DEV_CREDENTIAL`
+ *  (env-key:anthropic | vendo-cloud | none) pins the rung explicitly — used by
+ *  E2E rung matrices and escape hatches. Async for seam stability (callers and
+ *  test seams predate the session-rung removal). */
+export declare function resolveDevCredential(options?: ResolveDevCredentialOptions): Promise<DevCredential>;
+/** One human line for the wizard / doctor / runtime log. */
+export declare function describeDevCredential(credential: DevCredential): string;

package/dist/dev-creds/resolve.js

@@ -0,0 +1,57 @@
+/**
+ * The dev-mode model-credential resolver (install-dx v1, re-derived 2026-07-18).
+ * Runtime model credentials are REAL KEYS ONLY — CLI-session rungs were removed
+ * (a coding-agent login helps at init time only, never serves product turns).
+ * Detection is PURE and read-only — no network, no writes, no key material in
+ * the result (consumers read the env variable themselves). Order (explicit
+ * beats implicit):
+ *
+ *   1. explicit env key (ANTHROPIC / OPENAI / GOOGLE)
+ *   2. VENDO_API_KEY (Vendo Cloud starter allowance / gateway)
+ *   3. none (honest failure with exact instructions)
+ */
+export const ENV_KEY_VARS = [
+    { envVar: "ANTHROPIC_API_KEY", provider: "anthropic" },
+    { envVar: "OPENAI_API_KEY", provider: "openai" },
+    { envVar: "GOOGLE_GENERATIVE_AI_API_KEY", provider: "google" },
+];
+function present(env, name) {
+    const value = env[name];
+    return typeof value === "string" && value.trim().length > 0;
+}
+/** Detect the best available model credential. `VENDO_DEV_CREDENTIAL`
+ *  (env-key:anthropic | vendo-cloud | none) pins the rung explicitly — used by
+ *  E2E rung matrices and escape hatches. Async for seam stability (callers and
+ *  test seams predate the session-rung removal). */
+export async function resolveDevCredential(options = {}) {
+    const env = options.env ?? process.env;
+    const pinned = env["VENDO_DEV_CREDENTIAL"]?.trim();
+    if (pinned !== undefined && pinned.length > 0) {
+        if (pinned === "vendo-cloud" || pinned === "none")
+            return { rung: pinned };
+        const match = /^env-key:(anthropic|openai|google)$/.exec(pinned);
+        if (match !== null) {
+            const provider = match[1];
+            const envVar = ENV_KEY_VARS.find((entry) => entry.provider === provider).envVar;
+            return present(env, envVar) ? { rung: "env-key", provider, envVar } : { rung: "none" };
+        }
+    }
+    for (const { envVar, provider } of ENV_KEY_VARS) {
+        if (present(env, envVar))
+            return { rung: "env-key", provider, envVar };
+    }
+    if (present(env, "VENDO_API_KEY"))
+        return { rung: "vendo-cloud" };
+    return { rung: "none" };
+}
+/** One human line for the wizard / doctor / runtime log. */
+export function describeDevCredential(credential) {
+    switch (credential.rung) {
+        case "env-key":
+            return `explicit ${credential.envVar} (${credential.provider})`;
+        case "vendo-cloud":
+            return "VENDO_API_KEY (Vendo Cloud)";
+        case "none":
+            return "no model credential found";
+    }
+}

package/dist/hosted-store.d.ts

@@ -0,0 +1,52 @@
+import { type EraseReport, type SubjectMergeReport, type VendoStore } from "@vendoai/store";
+export interface HostedStoreOptions {
+    apiKey: string;
+    /** Defaults to the Vendo console; the composition seam passes VENDO_CLOUD_URL. */
+    baseUrl?: string;
+    /** Per-request abort timeout, in milliseconds. */
+    timeoutMs?: number;
+    fetch?: typeof fetch;
+}
+/** The hosted store handle: a plain StoreAdapter over the console wire, plus
+ * the erase door (02-store §5 — the console cascades exactly like eraseStore;
+ * the host-side TTL sweep is built on this call). `ensureSchema` is a client
+ * no-op (the service owns its migrations), `close` holds no local resources,
+ * and `raw()` fails loudly — there is no local database handle to hand out. */
+export interface HostedStore extends VendoStore {
+    erase: {
+        bySubject(subject: string): Promise<EraseReport>;
+        byApp(appId: string): Promise<EraseReport>;
+    };
+    /** The ephemeral-session doors (02-store §4, hosted): registration == touch
+     * on every ephemeral request, adoption on sign-in, and the list/claim legs
+     * of the HOST-driven TTL sweep — the sweep claims a stale subject, then
+     * finishes through `erase.bySubject` (hosted-store one-pager). Millisecond
+     * clocks ride the wire so an injected session clock stays authoritative. */
+    sessions: {
+        register(subject: string, now?: number): Promise<void>;
+        adopt(from: string, to: string): Promise<SubjectMergeReport | null>;
+        stale(idleMs: number, now?: number): Promise<string[]>;
+        claim(subject: string, idleMs: number, now?: number): Promise<boolean>;
+    };
+}
+/** vendo-web@7cd0a02 (2026-07-19) deleted the console's ephemeral-session op
+ * family (/api/v1/store/sessions/*) per spec — the removed routes answer
+ * Next.js's BARE 404 page, no error envelope. Typed so the composition layer
+ * (hostedSessionOps in server.ts) can disable the session doors gracefully
+ * instead of failing anonymous traffic; an ENVELOPED 404 is a live console
+ * answering "not-found" and keeps the loud path, same for every other
+ * failure. */
+export declare class HostedSessionDoorsMissingError extends Error {
+    constructor();
+}
+/** The Cloud hosted-store adapter — the OSS side of the hosted-store seam
+ * (docs/superpowers/specs/2026-07-18-hosted-store-onepager.md): a plain
+ * StoreAdapter speaking RPC-over-HTTP to the console's /api/v1/store routes,
+ * method for method. Tenant = the key's org, resolved server-side on every
+ * call; reserved-collection semantics are enforced server-side by the same
+ * engine rules as packages/store's routing. Secrets are excluded by
+ * construction: the wire has no secrets surface, and storeSecrets/secretStore
+ * keep requiring the local store handle. Cloned from cloudSandbox's shape:
+ * behavior comes ONLY from constructor arguments (adapter rule — see
+ * selectStore in server.ts); the adapter never reads the environment. */
+export declare function hostedStore(options: HostedStoreOptions): HostedStore;

package/dist/hosted-store.js

@@ -0,0 +1,322 @@
+import { vendoRecordSchema, } from "@vendoai/core";
+import { DEDICATED_RECORD_COLLECTIONS, RESERVED_COLLECTIONS, } from "@vendoai/store";
+import { consoleSender, raiseCloudError, toArrayBuffer } from "./cloud-console.js";
+import { deploymentIdentityHeaders } from "./deployment-identity.js";
+/** The console mounts the hosted-store surface here
+ * (apps/console/app/api/v1/store/*). */
+const CONSOLE_STORE_PATH = "/api/v1/store";
+/** Store calls are row/blob CRUD, not machine boots: generous enough for a
+ * large blob transfer on a slow link, small enough that a hung console
+ * request can't wedge a chat turn the way cloudSandbox's 300s budget would. */
+const DEFAULT_TIMEOUT_MS = 30_000;
+/** Console garbage on a 2xx is the SERVICE misbehaving, never the caller's
+ * fault — same posture as cloudSandbox's malformed-200 defenses. No VendoError
+ * code fits "your storage backend answered nonsense", so this stays a plain
+ * Error: the wire layer logs it server-side instead of blaming the client. */
+const invalidResponse = (what) => {
+    throw new Error(`Vendo Cloud store returned an ${what} response`);
+};
+/** The console's "unauthorized"/"quota-exhausted" have no VendoError twin;
+ * both ride the shared 402/401 → cloud-required mapping. Anything else
+ * (unknown codes, 5xx, non-JSON bodies) is carried on a plain Error with the
+ * server's code attached — the packages/apps cloud client's posture. */
+const raiseStoreError = (response) => raiseCloudError(response, "store", (code, message) => {
+    throw Object.assign(new Error(message), { code: code ?? "unavailable" });
+});
+/** vendo-web@7cd0a02 (2026-07-19) deleted the console's ephemeral-session op
+ * family (/api/v1/store/sessions/*) per spec — the removed routes answer
+ * Next.js's BARE 404 page, no error envelope. Typed so the composition layer
+ * (hostedSessionOps in server.ts) can disable the session doors gracefully
+ * instead of failing anonymous traffic; an ENVELOPED 404 is a live console
+ * answering "not-found" and keeps the loud path, same for every other
+ * failure. */
+export class HostedSessionDoorsMissingError extends Error {
+    constructor() {
+        super("Vendo Cloud console does not serve /api/v1/store/sessions/* (removed in vendo-web@7cd0a02)");
+        this.name = "HostedSessionDoorsMissingError";
+    }
+}
+/** The session doors' raise: a bare 404 (no envelope) is the one
+ * removed-surface signal; everything else defers to the store mapping. */
+const raiseSessionsError = async (response) => {
+    if (response.status === 404) {
+        let payload;
+        try {
+            payload = JSON.parse(await response.clone().text());
+        }
+        catch {
+            payload = undefined;
+        }
+        const enveloped = typeof payload === "object" && payload !== null && "error" in payload;
+        if (!enveloped)
+            throw new HostedSessionDoorsMissingError();
+    }
+    return raiseStoreError(response);
+};
+function parseRecord(value) {
+    const parsed = vendoRecordSchema.safeParse(value);
+    if (!parsed.success)
+        invalidResponse("invalid record");
+    return parsed.data;
+}
+function parseNullableRecord(value) {
+    if (value === null)
+        return null;
+    return parseRecord(value);
+}
+/** The Cloud hosted-store adapter — the OSS side of the hosted-store seam
+ * (docs/superpowers/specs/2026-07-18-hosted-store-onepager.md): a plain
+ * StoreAdapter speaking RPC-over-HTTP to the console's /api/v1/store routes,
+ * method for method. Tenant = the key's org, resolved server-side on every
+ * call; reserved-collection semantics are enforced server-side by the same
+ * engine rules as packages/store's routing. Secrets are excluded by
+ * construction: the wire has no secrets surface, and storeSecrets/secretStore
+ * keep requiring the local store handle. Cloned from cloudSandbox's shape:
+ * behavior comes ONLY from constructor arguments (adapter rule — see
+ * selectStore in server.ts); the adapter never reads the environment. */
+export function hostedStore(options) {
+    const base = (options.baseUrl ?? "https://console.vendo.run").replace(/\/$/, "");
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const send = consoleSender({
+        base,
+        mountPath: CONSOLE_STORE_PATH,
+        apiKey: options.apiKey,
+        timeoutMs,
+        fetchImpl,
+        raise: raiseStoreError,
+    });
+    // Same wire, sessions-only raise — the doors are the one surface the prod
+    // console may legitimately not serve (vendo-web@7cd0a02).
+    const sendSessions = consoleSender({
+        base,
+        mountPath: CONSOLE_STORE_PATH,
+        apiKey: options.apiKey,
+        timeoutMs,
+        fetchImpl,
+        raise: raiseSessionsError,
+    });
+    const postJson = (sender) => async (path, body) => {
+        const response = await sender(path, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        try {
+            return await response.json();
+        }
+        catch {
+            return {};
+        }
+    };
+    const sendJson = postJson(send);
+    const sendSessionsJson = postJson(sendSessions);
+    const records = (collection) => {
+        const prefix = `/records/${encodeURIComponent(collection)}`;
+        const store = {
+            async get(id) {
+                const payload = await sendJson(`${prefix}/get`, { id });
+                if (payload.record === undefined)
+                    invalidResponse("invalid record");
+                return parseNullableRecord(payload.record);
+            },
+            async put(record) {
+                const payload = await sendJson(`${prefix}/put`, { record });
+                if (payload.record === undefined || payload.record === null)
+                    invalidResponse("invalid record");
+                return parseRecord(payload.record);
+            },
+            async delete(id) {
+                await sendJson(`${prefix}/delete`, { id });
+            },
+            async list(query) {
+                const payload = await sendJson(`${prefix}/list`, { query: query ?? {} });
+                if (!Array.isArray(payload.records))
+                    invalidResponse("invalid list");
+                return {
+                    records: payload.records.map(parseRecord),
+                    ...(typeof payload.cursor === "string" ? { cursor: payload.cursor } : {}),
+                };
+            },
+        };
+        // Capability mirror of the store engine's routing (02-store §2): routed
+        // reserved collections expose no claim; atomic rides generic collections
+        // and vendo_threads' revision counter only. Mirroring the shape here keeps
+        // feature detection (`records.atomic !== undefined`) identical on both
+        // sides of the wire.
+        const reserved = RESERVED_COLLECTIONS.includes(collection);
+        const dedicated = DEDICATED_RECORD_COLLECTIONS.includes(collection);
+        if (!reserved) {
+            store.claim = async (expected, replacement) => {
+                const payload = await sendJson(`${prefix}/claim`, {
+                    expected,
+                    ...(replacement === undefined ? {} : { replacement }),
+                });
+                if (typeof payload.claimed !== "boolean")
+                    invalidResponse("invalid claim");
+                return payload.claimed;
+            };
+        }
+        if ((!reserved && !dedicated) || collection === "vendo_threads") {
+            store.atomic = {
+                async insertIfAbsent(record) {
+                    const payload = await sendJson(`${prefix}/atomic/insert-if-absent`, { record });
+                    if (payload.record === undefined)
+                        invalidResponse("invalid record");
+                    return parseNullableRecord(payload.record);
+                },
+                async compareAndSwap(record, expectedRevision) {
+                    const payload = await sendJson(`${prefix}/atomic/compare-and-swap`, {
+                        record,
+                        expectedRevision,
+                    });
+                    if (payload.record === undefined)
+                        invalidResponse("invalid record");
+                    return parseNullableRecord(payload.record);
+                },
+            };
+        }
+        return store;
+    };
+    const blobs = (namespace) => {
+        const prefix = `/blobs/${encodeURIComponent(namespace)}`;
+        // Blob keys are paths ("images/a.png"); encode per segment so the key's
+        // own separators survive as URL structure while each segment stays safe.
+        const keyPath = (key) => `${prefix}/${key.split("/").map(encodeURIComponent).join("/")}`;
+        return {
+            async put(key, bytes, meta) {
+                await send(keyPath(key), {
+                    method: "PUT",
+                    ...(meta?.contentType === undefined ? {} : { headers: { "content-type": meta.contentType } }),
+                    body: toArrayBuffer(bytes),
+                });
+            },
+            async get(key) {
+                const response = await fetchImpl(`${base}${CONSOLE_STORE_PATH}${keyPath(key)}`, {
+                    headers: {
+                        authorization: `Bearer ${options.apiKey}`,
+                        ...(await deploymentIdentityHeaders()),
+                    },
+                    signal: AbortSignal.timeout(timeoutMs),
+                });
+                // A missing blob is null at the seam (01-core §12) — but ONLY the
+                // console's enveloped not-found says "missing blob". A bare 404 (no
+                // envelope) is some other server answering — a misdeployed base URL
+                // must fail loudly, not read as an empty blob store forever.
+                if (response.status === 404) {
+                    let payload;
+                    try {
+                        payload = JSON.parse(await response.text());
+                    }
+                    catch {
+                        payload = undefined;
+                    }
+                    const code = typeof payload === "object" && payload !== null && "error" in payload
+                        ? payload.error?.code
+                        : undefined;
+                    if (code === "not-found")
+                        return null;
+                    throw new Error("Vendo Cloud store request failed with a bare 404 (no error envelope) — is the base URL a Vendo console?");
+                }
+                if (!response.ok)
+                    await raiseStoreError(response);
+                const contentType = response.headers.get("content-type");
+                return {
+                    bytes: new Uint8Array(await response.arrayBuffer()),
+                    ...(contentType === null ? {} : { contentType }),
+                };
+            },
+            async delete(key) {
+                await send(keyPath(key), { method: "DELETE" });
+            },
+            async list(prefixFilter) {
+                const query = prefixFilter === undefined || prefixFilter === ""
+                    ? ""
+                    : `?prefix=${encodeURIComponent(prefixFilter)}`;
+                const response = await send(`${prefix}${query}`);
+                let payload;
+                try {
+                    payload = await response.json();
+                }
+                catch {
+                    payload = {};
+                }
+                if (!Array.isArray(payload.keys) || !payload.keys.every((key) => typeof key === "string")) {
+                    invalidResponse("invalid blob list");
+                }
+                return payload.keys;
+            },
+        };
+    };
+    const parseReport = (payload) => {
+        const report = typeof payload === "object" && payload !== null && "report" in payload
+            ? payload.report
+            : undefined;
+        if (typeof report !== "object" || report === null || Array.isArray(report)
+            || !Object.values(report).every((count) => typeof count === "number")) {
+            invalidResponse("invalid erase");
+        }
+        return report;
+    };
+    const parseMergeReport = (payload) => {
+        const report = typeof payload === "object" && payload !== null && "report" in payload
+            ? payload.report
+            : undefined;
+        if (report === null)
+            return null;
+        if (typeof report !== "object" || report === undefined || Array.isArray(report)
+            || !Object.values(report).every((count) => typeof count === "number")) {
+            invalidResponse("invalid adopt");
+        }
+        return report;
+    };
+    return {
+        records,
+        blobs,
+        sessions: {
+            async register(subject, now) {
+                await sendSessionsJson("/sessions/register", { subject, ...(now === undefined ? {} : { now }) });
+            },
+            async adopt(from, to) {
+                return parseMergeReport(await sendSessionsJson("/sessions/adopt", { from, to }));
+            },
+            async stale(idleMs, now) {
+                const payload = await sendSessionsJson("/sessions/stale", {
+                    idleMs,
+                    ...(now === undefined ? {} : { now }),
+                });
+                if (!Array.isArray(payload.subjects) || !payload.subjects.every((subject) => typeof subject === "string")) {
+                    invalidResponse("invalid stale");
+                }
+                return payload.subjects;
+            },
+            async claim(subject, idleMs, now) {
+                const payload = await sendSessionsJson("/sessions/claim", {
+                    subject,
+                    idleMs,
+                    ...(now === undefined ? {} : { now }),
+                });
+                if (typeof payload.claimed !== "boolean")
+                    invalidResponse("invalid claim");
+                return payload.claimed;
+            },
+        },
+        // 02-store §5 — the subject/app cascade runs server-side with eraseStore
+        // parity; the host-side ephemeral TTL sweep is built on bySubject.
+        erase: {
+            async bySubject(subject) {
+                return parseReport(await sendJson("/erase", { subject }));
+            },
+            async byApp(appId) {
+                return parseReport(await sendJson("/erase", { appId }));
+            },
+        },
+        // The service owns its migrations; there is nothing to migrate from here.
+        async ensureSchema() { },
+        // No local pool, no PGlite handle — nothing to release.
+        async close() { },
+        raw() {
+            throw new Error("[vendo] hostedStore has no local database handle — raw() requires a local createStore store");
+        },
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,13 @@
+/** @vendoai/vendo — root contract types (09-vendo §1). */
+export type * from "@vendoai/core";
+export type { VendoStore } from "@vendoai/store";
+export type { Thread, ThreadSummary, VendoAgent } from "@vendoai/agent";
+export type { ActionsRegistry, Connector, ConnectorAccount, ConnectorConnections, ExtractedTool, SyncReport, } from "@vendoai/actions";
+export type { ConnectionsService, InitiatedConnection, InitiateOptions } from "./connections.js";
+export type { Judge, PolicyConfig, PolicyFile, PolicyFn, PolicyRule, VendoGuard, } from "@vendoai/guard";
+export type { AppsRuntime, EditResult, InClientApproval, InClientVerdict, OpenSurface, PinDrift, PinRebaseResult, SandboxAdapter, SandboxMachine, ShipDiff, VersionEntry, } from "@vendoai/apps";
+export type { AutomationsEngine, RunPlan, RunRecord, RunStatus, } from "@vendoai/automations";
+export type { VendoClient, VendoClientConfig } from "@vendoai/ui";
+export type { HostOAuthAdapter } from "@vendoai/mcp";
+export { remixable, type RemixableRegistration, type RemixableReportOptions } from "./remixable.js";
+export type { ByoApprovalResolution } from "./byo-approvals.js";

package/dist/index.js

@@ -0,0 +1 @@
+export { remixable } from "./remixable.js";