@vendoai/vendo 0.4.0

package/dist/sync-impact.d.ts

@@ -0,0 +1,14 @@
+import type { VendoStore } from "@vendoai/store";
+export interface ToolImpact {
+    tool: string;
+    apps: {
+        id: string;
+        title: string;
+    }[];
+    automations: {
+        id: string;
+        title: string;
+    }[];
+    grants: number;
+}
+export declare function computeImpact(store: VendoStore, tools: string[]): Promise<ToolImpact[]>;

package/dist/sync-impact.js

@@ -0,0 +1,75 @@
+import { VENDO_TREE_FORMAT_V2 } from "@vendoai/core";
+async function allRecords(store, collection) {
+    const records = [];
+    let cursor;
+    do {
+        const page = await store.records(collection).list({ limit: 1_000, cursor });
+        records.push(...page.records);
+        cursor = page.cursor;
+    } while (cursor !== undefined);
+    return records;
+}
+function collectActions(value, tools) {
+    if (Array.isArray(value)) {
+        for (const item of value)
+            collectActions(item, tools);
+        return;
+    }
+    if (typeof value !== "object" || value === null)
+        return;
+    const record = value;
+    for (const key of ["action", "$action"]) {
+        const reference = record[key];
+        if (typeof reference === "string" && !reference.startsWith("fn:"))
+            tools.add(reference);
+    }
+    for (const nested of Object.values(record))
+        collectActions(nested, tools);
+}
+function referencedTools(doc) {
+    const tools = new Set();
+    if (doc.tree?.formatVersion === VENDO_TREE_FORMAT_V2) {
+        const tree = doc.tree;
+        for (const query of tree.queries ?? []) {
+            if (typeof query.tool === "string" && !query.tool.startsWith("fn:"))
+                tools.add(query.tool);
+        }
+        for (const node of tree.nodes ?? [])
+            collectActions(node.props, tools);
+    }
+    if (doc.trigger?.run.kind === "steps") {
+        for (const step of doc.trigger.run.steps) {
+            if (!step.tool.startsWith("fn:"))
+                tools.add(step.tool);
+        }
+    }
+    return tools;
+}
+function activeGrant(grant, now) {
+    return grant.revokedAt === undefined && (grant.expiresAt === undefined || grant.expiresAt > now);
+}
+export async function computeImpact(store, tools) {
+    const [appRecords, grantRecords] = await Promise.all([
+        allRecords(store, "vendo_apps"),
+        allRecords(store, "vendo_grants"),
+    ]);
+    const apps = appRecords.map((record) => record.data).filter((app) => app.enabled);
+    const now = new Date().toISOString();
+    const grants = grantRecords
+        .map((record) => record.data)
+        .filter((grant) => activeGrant(grant, now));
+    return tools.map((tool) => {
+        const impact = { tool, apps: [], automations: [], grants: 0 };
+        for (const app of apps) {
+            if (!referencedTools(app.doc).has(tool))
+                continue;
+            const reference = { id: app.doc.id, title: app.doc.name };
+            if (app.doc.trigger === undefined)
+                impact.apps.push(reference);
+            else
+                impact.automations.push(reference);
+        }
+        impact.grants = grants.filter((grant) => grant.tool === tool).length;
+        return impact;
+    });
+}

package/dist/turn-liveness.d.ts

@@ -0,0 +1,33 @@
+/** ENG-353 — server-side turn liveness: the idle-abort fallback for client
+ * disconnects the runtime never surfaces.
+ *
+ * The fast path is unchanged: `request.signal` cancels the turn the moment the
+ * runtime propagates a fetch abort (wave-5 AGENT-3). But under `next dev` a
+ * real browser's graceful tab-close/navigate-away fires neither the signal nor
+ * a stream cancel, so an abandoned turn runs to completion. The fallback is
+ * liveness by heartbeat: the panel beats `POST /threads/:id/heartbeat` while
+ * it consumes the stream (08 — `withTurnHeartbeat`); the FIRST beat arms the
+ * watchdog, and from then on `IDLE_ABORT_MS` of silence aborts the turn.
+ * Arming is opt-in by construction: consumers that never beat (curl drills,
+ * scripted clients, older panels) keep run-to-completion semantics.
+ *
+ * The registry lives on globalThis (Symbol.for) so HMR copies of this module
+ * under a dev server share one view: a turn registered before an edit is still
+ * beatable after it.
+ */
+/** Track one streaming turn; returns its unregister. Registration alone never
+ *  arms the watchdog — only a first heartbeat does. */
+export declare function registerActiveTurn(turn: {
+    threadId: string;
+    subject: string;
+    abort: () => void;
+}): () => void;
+/** A heartbeat for `threadId` from `subject`. Refreshes (and on first beat
+ *  arms) the idle watchdog of every matching in-flight turn. Foreign or
+ *  unknown ids answer false — no oracle, and a beat can never keep (or end)
+ *  another principal's turn. */
+export declare function touchActiveTurn(threadId: string, subject: string): boolean;
+/** Wrap a turn response so `onSettled` runs exactly once when its stream
+ *  finishes, errors, or is cancelled — the turn's registry entry must not
+ *  outlive the stream. Mirrors the wire's inflight-bracket wrapper. */
+export declare function trackTurnResponse(response: Response, onSettled: () => void): Response;

package/dist/turn-liveness.js

@@ -0,0 +1,105 @@
+/** ENG-353 — server-side turn liveness: the idle-abort fallback for client
+ * disconnects the runtime never surfaces.
+ *
+ * The fast path is unchanged: `request.signal` cancels the turn the moment the
+ * runtime propagates a fetch abort (wave-5 AGENT-3). But under `next dev` a
+ * real browser's graceful tab-close/navigate-away fires neither the signal nor
+ * a stream cancel, so an abandoned turn runs to completion. The fallback is
+ * liveness by heartbeat: the panel beats `POST /threads/:id/heartbeat` while
+ * it consumes the stream (08 — `withTurnHeartbeat`); the FIRST beat arms the
+ * watchdog, and from then on `IDLE_ABORT_MS` of silence aborts the turn.
+ * Arming is opt-in by construction: consumers that never beat (curl drills,
+ * scripted clients, older panels) keep run-to-completion semantics.
+ *
+ * The registry lives on globalThis (Symbol.for) so HMR copies of this module
+ * under a dev server share one view: a turn registered before an edit is still
+ * beatable after it.
+ */
+import { environment } from "./wire/shared.js";
+const IDLE_ABORT_MS = 15_000;
+const ACTIVE_TURNS_KEY = Symbol.for("vendoai.vendo.active-turns@1");
+function activeTurns() {
+    const holder = globalThis;
+    return (holder[ACTIVE_TURNS_KEY] ??= new Set());
+}
+/** Test seam only: the idle window, overridable per call site via env. The
+ *  process-guarded `environment` helper keeps every beat working on
+ *  edge/Worker targets with no `process` global. */
+function idleAbortMs() {
+    const configured = Number(environment("VENDO_TURN_IDLE_ABORT_MS"));
+    return Number.isFinite(configured) && configured > 0 ? configured : IDLE_ABORT_MS;
+}
+/** Track one streaming turn; returns its unregister. Registration alone never
+ *  arms the watchdog — only a first heartbeat does. */
+export function registerActiveTurn(turn) {
+    const entry = { ...turn };
+    activeTurns().add(entry);
+    return () => {
+        if (entry.idleTimer !== undefined)
+            clearTimeout(entry.idleTimer);
+        activeTurns().delete(entry);
+    };
+}
+/** A heartbeat for `threadId` from `subject`. Refreshes (and on first beat
+ *  arms) the idle watchdog of every matching in-flight turn. Foreign or
+ *  unknown ids answer false — no oracle, and a beat can never keep (or end)
+ *  another principal's turn. */
+export function touchActiveTurn(threadId, subject) {
+    let active = false;
+    for (const turn of activeTurns()) {
+        if (turn.threadId !== threadId || turn.subject !== subject)
+            continue;
+        active = true;
+        if (turn.idleTimer !== undefined)
+            clearTimeout(turn.idleTimer);
+        turn.idleTimer = setTimeout(() => {
+            console.warn(`[vendo] turn on thread ${turn.threadId} lost its client heartbeat for ${idleAbortMs()}ms — aborting the abandoned turn.`);
+            // Drop the entry now (idempotent with the stream-settled unregister):
+            // an idle-aborted turn is over, and a late beat must see it inactive
+            // even before the runtime drains the closing stream.
+            activeTurns().delete(turn);
+            turn.abort();
+        }, idleAbortMs());
+        turn.idleTimer.unref?.();
+    }
+    return active;
+}
+/** Wrap a turn response so `onSettled` runs exactly once when its stream
+ *  finishes, errors, or is cancelled — the turn's registry entry must not
+ *  outlive the stream. Mirrors the wire's inflight-bracket wrapper. */
+export function trackTurnResponse(response, onSettled) {
+    if (response.body === null) {
+        onSettled();
+        return response;
+    }
+    let settled = false;
+    const settle = () => {
+        if (settled)
+            return;
+        settled = true;
+        onSettled();
+    };
+    const reader = response.body.getReader();
+    const tracked = new ReadableStream({
+        async pull(controller) {
+            try {
+                const { done, value } = await reader.read();
+                if (done) {
+                    settle();
+                    controller.close();
+                    return;
+                }
+                controller.enqueue(value);
+            }
+            catch (error) {
+                settle();
+                controller.error(error);
+            }
+        },
+        cancel(reason) {
+            settle();
+            return reader.cancel(reason);
+        },
+    });
+    return new Response(tracked, response);
+}

package/dist/wire/approvals.d.ts

@@ -0,0 +1,10 @@
+import { type RouteEntry } from "./shared.js";
+/** 05-guard / 09 §3 — the approvals wire area. Org-scoped approvals
+    (`?org=<id>` / body `org`) were a Vendo Cloud capability (block-actions
+    design §C); orgs are cut from OSS (kill-list A5), so a request carrying an
+    org param here now gets the same cloud-required error the /orgs routes
+    answer, rather than silently ignoring it. */
+export declare const approvalRoutes: RouteEntry[];
+/** Same cloud-required `?org=` scoping as approvals: standing grants scoping
+    to an org is a Vendo Cloud capability. */
+export declare const grantRoutes: RouteEntry[];

package/dist/wire/approvals.js

@@ -0,0 +1,59 @@
+import { VendoError, approvalDecisionSchema } from "@vendoai/core";
+import { json, orgsCloudRequired, requestJson, route, string } from "./shared.js";
+/** 05-guard / 09 §3 — the approvals wire area. Org-scoped approvals
+    (`?org=<id>` / body `org`) were a Vendo Cloud capability (block-actions
+    design §C); orgs are cut from OSS (kill-list A5), so a request carrying an
+    org param here now gets the same cloud-required error the /orgs routes
+    answer, rather than silently ignoring it. */
+export const approvalRoutes = [
+    route("GET", "/approvals", async ({ url, deps, context }) => {
+        const ctx = await context("chat");
+        if (url.searchParams.get("org") !== null)
+            orgsCloudRequired();
+        return json(await deps.guard.approvals.pending(ctx.principal));
+    }),
+    // Existing-agents Lane B — the read `<VendoApprovalEmbed>` polls for a
+    // parked BYO guarded call: the frozen VendoApprovalEmbedState vocabulary,
+    // carrying the full request while pending (the consent card shows real
+    // inputs) and the resumed call's outcome once executed. Owner-scoped;
+    // unknown and foreign ids both answer not-found. Registered before the
+    // decide route only textually — decide's exact-path POST never collides
+    // with this GET segment pattern.
+    route("GET", "/approvals/:id", async ({ url, deps, context, params }) => {
+        const ctx = await context("chat");
+        if (url.searchParams.get("org") !== null)
+            orgsCloudRequired();
+        return json(await deps.byoApprovals.read(string(params["id"], "approval id"), ctx.principal));
+    }),
+    route("POST", "/approvals/decide", async ({ request, deps, context }) => {
+        const body = await requestJson(request);
+        const ids = Array.isArray(body["ids"]) ? body["ids"].map((id) => string(id, "approval id")) : [];
+        if (ids.length === 0)
+            throw new VendoError("validation", "ids must contain at least one approval id");
+        const decision = approvalDecisionSchema.safeParse(body["decision"]);
+        if (!decision.success)
+            throw new VendoError("validation", "decision is invalid");
+        const ctx = await context("chat");
+        if (body["org"] !== undefined)
+            orgsCloudRequired();
+        await deps.guard.approvals.decide(ids, decision.data, ctx.principal);
+        return json({});
+    }),
+];
+/** Same cloud-required `?org=` scoping as approvals: standing grants scoping
+    to an org is a Vendo Cloud capability. */
+export const grantRoutes = [
+    route("GET", "/grants", async ({ url, deps, context }) => {
+        const ctx = await context("chat");
+        if (url.searchParams.get("org") !== null)
+            orgsCloudRequired();
+        return json(await deps.guard.grants.list(ctx.principal));
+    }),
+    route("DELETE", "/grants/:id", async ({ url, deps, context, params }) => {
+        const ctx = await context("chat");
+        if (url.searchParams.get("org") !== null)
+            orgsCloudRequired();
+        await deps.guard.grants.revoke(string(params["id"], "grant id"), ctx.principal);
+        return json({});
+    }),
+];

package/dist/wire/apps.d.ts

@@ -0,0 +1,5 @@
+import { type RouteEntry } from "./shared.js";
+/** 06-apps / 09 §3 — the /apps wire area: CRUD, open/call/edit, history,
+    ship-diff, pin drift/rebase, the gesture fork (fork-pin), export/import,
+    fork (whole-app copy — a different feature from fork-pin). */
+export declare const appRoutes: RouteEntry[];

package/dist/wire/apps.js

@@ -0,0 +1,155 @@
+import { VendoError } from "@vendoai/core";
+import { json, requestJson, route, string } from "./shared.js";
+/** 06-apps / 09 §3 — the /apps wire area: CRUD, open/call/edit, history,
+    ship-diff, pin drift/rebase, the gesture fork (fork-pin), export/import,
+    fork (whole-app copy — a different feature from fork-pin). */
+export const appRoutes = [
+    // Grouped like the old if-chain arm: ANY method on /apps resolves context
+    // first; an unhandled method falls through to the table's not-found.
+    route("*", "/apps", async ({ request, deps, context }) => {
+        const ctx = await context("app");
+        if (request.method === "GET") {
+            return json(await deps.apps.list(ctx));
+        }
+        if (request.method === "POST") {
+            const body = await requestJson(request);
+            return json(await deps.apps.create({ prompt: string(body["prompt"], "prompt") }, ctx));
+        }
+        return undefined;
+    }),
+    // 06-apps §8 — gesture-owned forking (2026-07-21): the deterministic fork
+    // the user's Remix gesture on an EMPTY slot invokes. The engine mints a
+    // minimal app, copies the captured baseline, and records the pin — no model
+    // call. An optional instruction then rides the ordinary edit path, already
+    // scoped to the forked component. The model never decides to fork.
+    // ORDER IS LOAD-BEARING: this entry (and /apps/import below) must stay
+    // ahead of the "/apps/:appId/*" catch-all, whose rest pattern would
+    // otherwise capture appId="fork-pin".
+    route("POST", "/apps/fork-pin", async ({ request, deps, context }) => {
+        const ctx = await context("app");
+        const body = await requestJson(request);
+        return json(await deps.apps.pins.fork({
+            slot: string(body["slot"], "slot"),
+            ...(body["instruction"] === undefined ? {} : { instruction: string(body["instruction"], "instruction") }),
+        }, ctx));
+    }),
+    route("POST", "/apps/import", async ({ request, deps, context }) => {
+        // The CSRF floor exempts import (binary body), so it must instead require
+        // a non-CORS-safelisted media type — forcing a cross-origin preflight so
+        // a simple credentialed form/text POST cannot silently import (09 §3).
+        const contentType = request.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+        if (contentType !== "application/octet-stream" && contentType !== "application/vnd.vendo.app") {
+            throw new VendoError("validation", "import requires Content-Type: application/octet-stream");
+        }
+        const ctx = await context("app");
+        return json(await deps.apps.importApp(new Uint8Array(await request.arrayBuffer()), ctx));
+    }),
+    // The old `head === "apps" && segments.length >= 2` grouped arm, verbatim:
+    // context resolves for ANY /apps/:appId[/...] request before the method and
+    // operation checks, and an unmatched combination falls through to not-found.
+    route("*", "/apps/:appId/*", async (wire) => {
+        const { request, deps, params, segments } = wire;
+        const appId = string(params["appId"], "app id");
+        const ctx = await wire.context("app");
+        const operation = segments[2];
+        if (segments.length === 2) {
+            if (request.method === "GET") {
+                const app = await deps.apps.get(appId, ctx);
+                if (app === null)
+                    throw new VendoError("not-found", `app not found: ${appId}`);
+                return json(app);
+            }
+            if (request.method === "DELETE") {
+                await deps.apps.delete(appId, ctx);
+                return json({});
+            }
+        }
+        if (request.method === "GET" && operation === "open" && segments.length === 3) {
+            // Existing-agents polish — the embed's build-window poll. The app record
+            // lands only at build completion, so until then open() (and the meta
+            // route alike) answers not-found, and every 1.2s poll logged a browser
+            // console 404. Under the additive ?pending=1 flag, ONLY that expected
+            // pre-servable miss becomes a quiet 200 {kind:"pending"}; unflagged
+            // callers keep the contracted 404, and every other failure keeps its
+            // envelope and status either way.
+            if (wire.url.searchParams.get("pending") === "1") {
+                try {
+                    return json(await deps.apps.open(appId, ctx));
+                }
+                catch (reason) {
+                    if (reason instanceof VendoError && reason.code === "not-found") {
+                        return json({ kind: "pending" });
+                    }
+                    throw reason;
+                }
+            }
+            return json(await deps.apps.open(appId, ctx));
+        }
+        if (request.method === "POST" && operation === "call" && segments.length === 3) {
+            const body = await requestJson(request);
+            return json(await deps.apps.call(appId, string(body["ref"], "ref"), body["args"], ctx));
+        }
+        if (request.method === "POST" && operation === "edit" && segments.length === 3) {
+            const body = await requestJson(request);
+            return json(await deps.apps.edit(appId, string(body["instruction"], "instruction"), ctx));
+        }
+        if (operation === "history" && segments.length === 3) {
+            if (await deps.apps.get(appId, ctx) === null)
+                throw new VendoError("not-found", `app not found: ${appId}`);
+            if (request.method === "GET")
+                return json(await deps.apps.history(appId).list());
+            if (request.method === "POST") {
+                const body = await requestJson(request);
+                if (body["op"] !== "undo")
+                    throw new VendoError("validation", "history op must be undo");
+                return json(await deps.apps.history(appId).undo());
+            }
+        }
+        // 06-apps §8–§9 — additive: the reviewable diff of what this app ships
+        // relative to the captured host baselines, hash-pinned to the version
+        // an in-client approval would cover. Owner-scoped like every app route.
+        if (request.method === "GET" && operation === "ship-diff" && segments.length === 3) {
+            return json(await deps.apps.inClient.shipDiff(appId, ctx));
+        }
+        // 06-apps §8 — additive drift→rebase surface, owner-scoped like every
+        // app route. A rebase rewrites content, so it is only ever invoked
+        // explicitly here or via the vendo_apps_rebase_pin agent tool — drift
+        // detection never auto-rebases.
+        if (request.method === "GET" && operation === "pin-drift" && segments.length === 3) {
+            return json(await deps.apps.pins.drift(appId, ctx));
+        }
+        if (request.method === "POST" && operation === "rebase-pin" && segments.length === 3) {
+            const body = await requestJson(request);
+            return json(await deps.apps.pins.rebase({ appId, slot: string(body["slot"], "slot") }, ctx));
+        }
+        // 06-apps §8 — the same gesture fork landing in an EXISTING app (the
+        // filled-slot / driver surface). Owner-scoped like every app route.
+        if (request.method === "POST" && operation === "fork-pin" && segments.length === 3) {
+            const body = await requestJson(request);
+            return json(await deps.apps.pins.fork({
+                appId,
+                slot: string(body["slot"], "slot"),
+                ...(body["instruction"] === undefined ? {} : { instruction: string(body["instruction"], "instruction") }),
+            }, ctx));
+        }
+        // Wave 7 H2 — the embed surface's keepalive: user activity on an embedded
+        // served app rides one host-proxied HEAD through the machine (re-arming
+        // the idle timer); "woke" tells the embed its URL is stale — re-open.
+        if (request.method === "POST" && operation === "machine" && segments[3] === "ping" && segments.length === 4) {
+            return json(await deps.apps.machine.ping(appId, ctx));
+        }
+        if (request.method === "GET" && operation === "export" && segments.length === 3) {
+            const bytes = await deps.apps.exportApp(appId, ctx);
+            return new Response(bytes, {
+                headers: {
+                    "content-type": "application/octet-stream",
+                    "content-disposition": `attachment; filename="${appId}.vendoapp"`,
+                },
+            });
+        }
+        if (request.method === "POST" && operation === "fork" && segments.length === 3) {
+            return json(await deps.apps.fork(appId, ctx));
+        }
+        return undefined;
+    }),
+];

package/dist/wire/automations.d.ts

@@ -0,0 +1,5 @@
+import { type RouteEntry } from "./shared.js";
+/** 07-automations / 09 §3 — the /automations wire area. */
+export declare const automationRoutes: RouteEntry[];
+/** 07-automations / 09 §3 — the /runs wire area. */
+export declare const runRoutes: RouteEntry[];

package/dist/wire/automations.js

@@ -0,0 +1,57 @@
+import { VendoError } from "@vendoai/core";
+import { json, route, string } from "./shared.js";
+/** 07-automations / 09 §3 — the /automations wire area. */
+export const automationRoutes = [
+    route("GET", "/automations", async ({ deps, context }) => {
+        return json(await deps.automations.list(await context("automation")));
+    }),
+    // Grouped like the old if-chain arm (`segments.length === 3 && POST`):
+    // context resolves before the operation check, and an unknown operation
+    // falls through to the table's not-found.
+    route("POST", "/automations/:appId/:op", async ({ deps, context, params, segments }) => {
+        const appId = string(params["appId"], "app id");
+        const ctx = await context("automation");
+        if (segments[2] === "enable")
+            return json(await deps.automations.enable(appId, ctx));
+        if (segments[2] === "disable") {
+            await deps.automations.disable(appId, ctx);
+            return json({});
+        }
+        if (segments[2] === "dry-run")
+            return json(await deps.automations.dryRun(appId, ctx));
+        return undefined;
+    }),
+];
+/** 07-automations / 09 §3 — the /runs wire area. */
+export const runRoutes = [
+    route("GET", "/runs", async ({ url, deps, context }) => {
+        const status = url.searchParams.get("status") ?? undefined;
+        const allowed = ["running", "ok", "error", "stopped", "pending-approval"];
+        if (status !== undefined && !allowed.includes(status)) {
+            throw new VendoError("validation", "run status is invalid");
+        }
+        const filter = {
+            ...(url.searchParams.get("appId") === null ? {} : { appId: url.searchParams.get("appId") }),
+            ...(status === undefined ? {} : { status: status }),
+            ...(url.searchParams.get("cursor") === null ? {} : { cursor: url.searchParams.get("cursor") }),
+        };
+        return json(await deps.automations.runs.list(filter, await context("automation")));
+    }),
+    // Grouped like the old `head === "runs" && segments.length >= 2` arm: ANY
+    // method/depth resolves context first; unmatched shapes fall through.
+    route("*", "/runs/:runId/*", async ({ request, deps, context, params, segments }) => {
+        const ctx = await context("automation");
+        const runId = string(params["runId"], "run id");
+        if (request.method === "GET" && segments.length === 2) {
+            const run = await deps.automations.runs.get(runId, ctx);
+            if (run === null)
+                throw new VendoError("not-found", `run not found: ${runId}`);
+            return json(run);
+        }
+        if (request.method === "POST" && segments[2] === "stop" && segments.length === 3) {
+            await deps.automations.runs.stop(runId, ctx);
+            return json({});
+        }
+        return undefined;
+    }),
+];

package/dist/wire/box.d.ts

@@ -0,0 +1,3 @@
+import { type RouteEntry } from "./shared.js";
+export declare const fnProxyRoutes: RouteEntry[];
+export declare const boxRoutes: RouteEntry[];