@vendoai/vendo 0.4.0

package/dist/wire/doctor.js

@@ -0,0 +1,116 @@
+import { VendoError, principalSchema } from "@vendoai/core";
+import { BASE_PATH, environment, json, prefixRoute, route } from "./shared.js";
+/** The doctor probe surface (CLI `vendo doctor` targets a running dev server):
+    the synthetic credential/actAs round-trip constants and tool descriptors,
+    and the /doctor wire routes. server.ts keeps only the deps.doctor
+    probe-executor wiring (the probes run through a real createActions). */
+const DOCTOR_PRESENT_AUTHORIZATION = "Bearer vendo-doctor-present";
+const DOCTOR_PRESENT_COOKIE = "vendo_doctor_present=1";
+export const DOCTOR_ACT_AS_PRINCIPAL = { kind: "user", subject: "vendo_doctor_act_as" };
+export const DOCTOR_ACT_AS_APP_ID = "app_vendo_doctor";
+export const doctorPresentTool = {
+    name: "vendo_doctor_present",
+    description: "Vendo doctor present credential round-trip",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    risk: "read",
+    binding: { kind: "route", method: "GET", path: `${BASE_PATH}/doctor/present/echo`, argsIn: "query" },
+};
+export const doctorActAsTool = {
+    name: "vendo_doctor_act_as",
+    description: "Vendo doctor actAs mint and verification round-trip",
+    inputSchema: { type: "object", properties: {}, additionalProperties: false },
+    risk: "read",
+    binding: { kind: "route", method: "GET", path: `${BASE_PATH}/doctor/act-as/echo`, argsIn: "query" },
+};
+function doctorProbeOk(outcome) {
+    if (outcome.status !== "ok" || typeof outcome.output !== "object" || outcome.output === null)
+        return false;
+    return "ok" in outcome.output && outcome.output.ok === true;
+}
+/** Doctor targets a running dev server. The prefix gate keeps its synthetic
+    mint/echo routes out of production entirely (and falls through in
+    development); the echo halves expose no credential material — booleans
+    only.
+
+    `/doctor/base-url` (09-vendo §2 install-dx wave 1.1) is listed BEFORE that
+    gate on purpose: unlike the synthetic credential round-trips, it reports a
+    static composition fact (is VENDO_BASE_URL set?) that reveals no secret
+    material, and it is exactly the environment — production — the gate
+    otherwise silences. Placing it first lets it win the route-table scan in
+    every environment, gate included. */
+export const doctorRoutes = [
+    route("GET", "/doctor/base-url", async () => {
+        const missingInProduction = environment("NODE_ENV") === "production" && environment("VENDO_BASE_URL") === undefined;
+        if (missingInProduction) {
+            return json({
+                ok: false,
+                error: {
+                    code: "base-url-not-set-in-production",
+                    message: "VENDO_BASE_URL is not set in production. Present-mode host tool calls that need to forward the caller's credentials fail closed instead of running unauthenticated. Set VENDO_BASE_URL to this deployment's public origin and restart the server.",
+                },
+            }, 409);
+        }
+        return json({ ok: true });
+    }),
+    prefixRoute("*", "/doctor/", async () => {
+        if (environment("NODE_ENV") === "production") {
+            throw new VendoError("not-found", "unknown Vendo route");
+        }
+        return undefined;
+    }),
+    // execution-v2 Lane D — dev-only machine/schedule reporting (sits AFTER the
+    // production gate above, like every probe route). Reporting only: which apps
+    // carry a machine, whether a schedule caller (VENDO_TICK_SECRET) is
+    // configured for the /tick surface, and each schedule's last-fired state.
+    route("GET", "/doctor/machines", async ({ deps }) => {
+        return json({
+            scheduleCallerConfigured: environment("VENDO_TICK_SECRET") !== undefined,
+            machines: await deps.apps.schedules.report(),
+        });
+    }),
+    route("GET", "/doctor/present/echo", async ({ request }) => {
+        return json({
+            ok: request.headers.get("authorization") === DOCTOR_PRESENT_AUTHORIZATION
+                && request.headers.get("cookie") === DOCTOR_PRESENT_COOKIE,
+        });
+    }),
+    route("GET", "/doctor/act-as/echo", async ({ request, deps }) => {
+        const resolved = await deps.principal(request);
+        const parsed = principalSchema.safeParse(resolved);
+        const accepted = parsed.success && parsed.data.subject === DOCTOR_ACT_AS_PRINCIPAL.subject;
+        return json({ ok: accepted }, accepted ? 200 : 401);
+    }),
+    route("POST", "/doctor/present", async ({ deps, context }) => {
+        const outcome = await deps.doctor.present(await context("chat"));
+        if (doctorProbeOk(outcome))
+            return json({ ok: true });
+        return json({
+            ok: false,
+            error: {
+                code: "present-credentials-not-forwarded",
+                message: "Present credentials did not reach the host API. Set VENDO_BASE_URL to the running host origin and restart the dev server.",
+            },
+        }, 409);
+    }),
+    route("POST", "/doctor/act-as", async ({ deps }) => {
+        const outcome = await deps.doctor.actAs();
+        if (doctorProbeOk(outcome))
+            return json({ ok: true });
+        if (outcome.status === "error" && outcome.error.code === "not-implemented") {
+            return json({
+                ok: false,
+                error: {
+                    code: "act-as-not-configured",
+                    message: "actAs is not configured; pass createVendo({ actAs }) before enabling away host actions.",
+                },
+            }, 501);
+        }
+        return json({
+            ok: false,
+            error: {
+                code: "act-as-verification-failed",
+                message: "actAs returned no usable AuthMaterial, or the host API did not accept it. Check the matching verifier middleware and principal resolver.",
+            },
+        }, 409);
+    }),
+];

package/dist/wire/misc.d.ts

@@ -0,0 +1,18 @@
+import { type RouteEntry } from "./shared.js";
+/** The development-only injection seams. Each handler guards on its composed
+    dependency and falls through otherwise: production handlers receive no
+    runtimeCapture dependency / no development flag, so these answer the
+    ordinary 404 — there is no guarded-but-mounted production endpoint. */
+export declare const devRoutes: RouteEntry[];
+/** The machine-facing surfaces: webhook ingress, the authenticated scheduler
+    tick, and the dev-only sync impact probe. All match on the RAW path
+    (prefix or exact) ahead of any segment decoding, exactly like the old
+    chain. (The v1 run-token apps proxy mount died with execution-v2 Wave 1.5;
+    the box callback surface at /box/ is its replacement.) */
+export declare const systemRoutes: RouteEntry[];
+/** The decoded first segment matches only /orgs and /orgs/* (any depth, any
+    method), never a lookalike like /organizations; the rest wildcard also
+    covers a trailing-slash `/orgs/`. */
+export declare const orgsRoutes: RouteEntry[];
+export declare const activityRoutes: RouteEntry[];
+export declare const statusRoutes: RouteEntry[];

package/dist/wire/misc.js

@@ -0,0 +1,227 @@
+import { VendoError, inferToolSemantics } from "@vendoai/core";
+import { computeImpact } from "../sync-impact.js";
+import { VERSION, environment, hex, json, orgsCloudRequired, prefixRoute, requestJson, route, string, } from "./shared.js";
+/** Lazily-minted random per-process HMAC key for constant-time secret compares
+    (WebCrypto only — NO node:crypto — so the module keeps bundling for edge/
+    Worker targets; cf. dotVendoFile). */
+let compareKeyPromise;
+function compareKey() {
+    compareKeyPromise ??= (() => {
+        const raw = new Uint8Array(32);
+        globalThis.crypto.getRandomValues(raw);
+        return globalThis.crypto.subtle.importKey("raw", raw, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    })();
+    return compareKeyPromise;
+}
+/** Length-independent-leak-free digest compare for timingSafeEqual's HMAC
+    digests (always equal-length hex; unequal lengths simply fail). */
+function constantTimeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/** Constant-time string equality via WebCrypto, matching the webhook HMAC path
+    (which leans on crypto.subtle.verify for the same guarantee). HMACs both
+    inputs under a random per-process key so the digests are equal-length 32-byte
+    values regardless of input length — equal digests iff equal inputs (SHA-256
+    collision resistance) — and the byte compare leaks neither length nor content
+    through timing. Replaces the `===` bearer compare, a classic timing oracle. */
+async function timingSafeEqual(a, b) {
+    const key = await compareKey();
+    const encoder = new TextEncoder();
+    const [da, db] = await Promise.all([
+        globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(a)),
+        globalThis.crypto.subtle.sign("HMAC", key, encoder.encode(b)),
+    ]);
+    return constantTimeEqual(hex(da), hex(db));
+}
+async function tickAuthorized(request) {
+    const secret = environment("VENDO_TICK_SECRET");
+    if (secret === undefined)
+        return false;
+    return timingSafeEqual(request.headers.get("authorization") ?? "", `Bearer ${secret}`);
+}
+/** The development-only injection seams. Each handler guards on its composed
+    dependency and falls through otherwise: production handlers receive no
+    runtimeCapture dependency / no development flag, so these answer the
+    ordinary 404 — there is no guarded-but-mounted production endpoint. */
+export const devRoutes = [
+    route("POST", "/dev/remixable-source", async ({ request, deps, context }) => {
+        if (deps.runtimeCapture === undefined)
+            return undefined;
+        const body = await requestJson(request);
+        // Capture writes .vendo/remixable baselines on the developer's disk, so
+        // it requires a HOST-resolved principal — an anonymous visitor's minted
+        // ephemeral session is not enough, even in a development composition.
+        const captureContext = await context("app");
+        if (captureContext.principal.ephemeral === true) {
+            return json({ error: { code: "blocked", message: "runtime capture requires a host-resolved principal" } }, 401);
+        }
+        if (typeof body["exportable"] !== "boolean") {
+            throw new VendoError("validation", "exportable must be a boolean");
+        }
+        return json(await deps.runtimeCapture.capture({
+            slot: string(body["slot"], "slot"),
+            source: string(body["source"], "source"),
+            exportable: body["exportable"],
+        }));
+    }),
+    // 06-apps §9 — the documented LOCAL injection seam for in-client approval
+    // records (demos and dev; Cloud's review console mints these in
+    // production). Development compositions only: production handlers fall
+    // through to the ordinary 404, exactly like /dev/remixable-source, so no
+    // production surface can self-approve an app into the host page.
+    route("POST", "/dev/inclient-approval", async ({ request, deps, context }) => {
+        if (!deps.development)
+            return undefined;
+        const body = await requestJson(request);
+        // Approving a host-page mount is a HOST trust decision — an anonymous
+        // visitor's minted ephemeral session is not enough, even in dev.
+        const approvalContext = await context("app");
+        if (approvalContext.principal.ephemeral === true) {
+            return json({ error: { code: "blocked", message: "in-client approval injection requires a host-resolved principal" } }, 401);
+        }
+        const approvedBy = body["approvedBy"] === undefined
+            ? "local-dev"
+            : string(body["approvedBy"], "approvedBy");
+        return json(await deps.apps.inClient.approve({
+            appId: string(body["appId"], "appId"),
+            approvedBy,
+        }, approvalContext));
+    }),
+];
+/** The machine-facing surfaces: webhook ingress, the authenticated scheduler
+    tick, and the dev-only sync impact probe. All match on the RAW path
+    (prefix or exact) ahead of any segment decoding, exactly like the old
+    chain. (The v1 run-token apps proxy mount died with execution-v2 Wave 1.5;
+    the box callback surface at /box/ is its replacement.) */
+export const systemRoutes = [
+    prefixRoute("POST", "/webhooks/", async ({ request, deps }) => {
+        return await deps.automations.webhook(request);
+    }),
+    route("POST", "/tick", async ({ request, deps }) => {
+        if (!await tickAuthorized(request)) {
+            return json({ error: { code: "blocked", message: "invalid tick credential" } }, 401);
+        }
+        // execution-v2 Lane D — one authenticated tick drives BOTH schedulers: the
+        // automations engine and the machine-app vendo.json schedules (additive
+        // `schedules` field). Point any external cron here (Vercel cron, GitHub
+        // Actions, crontab); the Cloud broker calls this same surface. The engines
+        // settle independently so one failing can never suppress the other; any
+        // failure still answers 500 so a retrying cron comes back (both engines
+        // are idempotent within their windows).
+        const [runs, schedules] = await Promise.allSettled([
+            deps.automations.tick(),
+            deps.apps.schedules.tick(),
+        ]);
+        const errors = [
+            ...(runs.status === "rejected" ? [`automations: ${runs.reason instanceof Error ? runs.reason.message : "tick failed"}`] : []),
+            ...(schedules.status === "rejected" ? [`schedules: ${schedules.reason instanceof Error ? schedules.reason.message : "tick failed"}`] : []),
+        ];
+        return json({
+            ...(runs.status === "fulfilled" ? { runIds: runs.value } : {}),
+            ...(schedules.status === "fulfilled" ? { schedules: schedules.value } : {}),
+            ...(errors.length === 0 ? {} : { errors }),
+        }, errors.length === 0 ? 200 : 500);
+    }),
+    route("POST", "/sync/impact", async ({ request, deps }) => {
+        if (environment("NODE_ENV") === "production") {
+            throw new VendoError("blocked", "sync impact is only available on a dev server");
+        }
+        const body = await requestJson(request);
+        const tools = body["tools"];
+        if (!Array.isArray(tools) || tools.length > 200 || tools.some((tool) => typeof tool !== "string")) {
+            throw new VendoError("validation", "tools must be an array of at most 200 strings");
+        }
+        return json({ impact: await computeImpact(deps.store, tools) });
+    }),
+    // W3 (v3 spec §Context) — the `vendo sync` semantics seam: sample each
+    // zero-required-input READ tool once (through the guard-bound registry,
+    // with this request's own context — approvals/audit see it like any call)
+    // and return the INFERRED field semantics per tool. Values never leave the
+    // server: only classifications (and enum vocabularies) do. Dev-only, like
+    // /sync/impact.
+    route("POST", "/sync/semantics", async ({ deps, context }) => {
+        if (environment("NODE_ENV") === "production") {
+            throw new VendoError("blocked", "sync semantics is only available on a dev server");
+        }
+        const ctx = await context("chat");
+        const descriptors = await deps.tools.descriptors();
+        const requiresInput = (schema) => {
+            const required = schema?.required;
+            return Array.isArray(required) && required.length > 0;
+        };
+        const tools = {};
+        await Promise.all(descriptors
+            .filter((descriptor) => descriptor.risk === "read" && !requiresInput(descriptor.inputSchema))
+            .map(async (descriptor) => {
+            try {
+                const outcome = await deps.tools.execute({ id: `call_${globalThis.crypto.randomUUID()}`, tool: descriptor.name, args: {} }, ctx);
+                if (outcome.status !== "ok")
+                    return;
+                const inferred = inferToolSemantics([outcome.output]);
+                if (Object.keys(inferred).length > 0)
+                    tools[descriptor.name] = inferred;
+            }
+            catch {
+                // A failing sample leaves that tool without inferred semantics —
+                // the CLI writes what it can; hosts annotate the rest.
+            }
+        }));
+        return json({ tools });
+    }),
+];
+/** The decoded first segment matches only /orgs and /orgs/* (any depth, any
+    method), never a lookalike like /organizations; the rest wildcard also
+    covers a trailing-slash `/orgs/`. */
+export const orgsRoutes = [
+    route("*", "/orgs/*", async () => orgsCloudRequired()),
+];
+export const activityRoutes = [
+    route("GET", "/activity", async ({ url, deps, context }) => {
+        const ctx = await context("chat");
+        const limitValue = url.searchParams.get("limit");
+        const limit = limitValue === null ? undefined : Number(limitValue);
+        if (limit !== undefined && (!Number.isInteger(limit) || limit <= 0)) {
+            throw new VendoError("validation", "activity limit must be a positive integer");
+        }
+        const activity = await deps.guard.audit.query({
+            principal: ctx.principal,
+            ...(url.searchParams.get("cursor") === null ? {} : { cursor: url.searchParams.get("cursor") }),
+            ...(limit === undefined ? {} : { limit }),
+        });
+        // 09 §3: the wire returns AuditEvent[] — the block's {events,cursor}
+        // envelope stays internal (the client pages by last event id).
+        return json(activity.events);
+    }),
+];
+export const statusRoutes = [
+    route("GET", "/status", async ({ deps, context }) => {
+        await context("chat");
+        return json({
+            posture: deps.guard.status().posture,
+            version: VERSION,
+            blocks: {
+                store: true,
+                agent: true,
+                actions: true,
+                guard: true,
+                apps: true,
+                automations: true,
+                sandbox: deps.sandbox,
+                // Inference seam (cloud definition 2026-07-17): "custom" (host-passed
+                // model) or "ladder" (the composed devModel env default).
+                model: deps.model,
+                // 10-mcp §1 — the door is off by default; true only when
+                // createVendo({ mcp: true }) opened it.
+                mcp: deps.mcp,
+                // 04-actions §3 — how per-user connected accounts are brokered:
+                // "byo" (host's own Composio key), "cloud" (VENDO_API_KEY), or off.
+                connections: deps.connections.posture,
+            },
+        });
+    }),
+];

package/dist/wire/shared.d.ts

@@ -0,0 +1,158 @@
+import type { AppsRuntime, AppTokens } from "@vendoai/apps";
+import type { AutomationsEngine } from "@vendoai/automations";
+import { VendoError, type Principal, type RunContext, type ToolOutcome, type ToolRegistry } from "@vendoai/core";
+import type { VendoGuard } from "@vendoai/guard";
+import type { McpDoor } from "@vendoai/mcp";
+import type { SubjectMergeReport, VendoStore } from "@vendoai/store";
+import type { Telemetry } from "@vendoai/telemetry";
+import type { VendoAgent } from "@vendoai/agent";
+import type { ByoApprovalResolution } from "../byo-approvals.js";
+import type { ConnectionsService } from "../connections.js";
+import type { RuntimeCaptureHandler } from "../runtime-capture.js";
+/** The shared wire toolkit (kill-list B4): the route-table types and matcher,
+    the JSON/error envelope helpers, and the param validators every wire area
+    shares. The anonymous-session + RunContext resolution lives in
+    wire/context.ts; server.ts assembles the table from the per-area modules
+    under src/wire/. */
+export declare const VERSION = "0.4.0";
+export declare const BASE_PATH = "/api/vendo";
+export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
+/** How inference is served: "custom" (a host-passed model) or "ladder" (the
+    composed devModel default — provider env key, then VENDO_API_KEY via the
+    Cloud model gateway, then the honest keyless failure; the ladder resolves
+    lazily, so /status cannot name the rung without forcing a resolution). */
+export type ModelVenue = "custom" | "ladder";
+export interface WireDeps {
+    principal: (req: Request) => Promise<Principal | null>;
+    ready: Promise<void>;
+    /** VENDO_BASE_URL is https → TLS terminates upstream; see secureRequest. */
+    trustedBaseIsHttps: boolean;
+    sessionId: string;
+    store: VendoStore;
+    telemetry?: Telemetry;
+    agent: VendoAgent;
+    guard: VendoGuard;
+    apps: AppsRuntime;
+    /** execution-v2 Lane C — the guard-bound registry (the SAME binding chat and
+        automations execute through); the /box tools callback rides it so
+        approvals and audit see box-originated calls like any other. */
+    tools: ToolRegistry;
+    /** execution-v2 Lane C — verify a presented per-app box bearer
+        (createAppTokens over the composed store; mint lives with provision). */
+    appTokens: Pick<AppTokens, "verify">;
+    automations: AutomationsEngine;
+    /** Existing-agents Lane B — the per-approval state read `<VendoApprovalEmbed>`
+        polls: pending (with the full request for the consent card), executed
+        (with the resumed call's outcome), declined, or expired. */
+    byoApprovals: {
+        read(approvalId: string, principal: Principal): Promise<ByoApprovalResolution>;
+    };
+    connections: ConnectionsService;
+    sandbox: SandboxVenue;
+    model: ModelVenue;
+    doctor: {
+        present(ctx: RunContext): Promise<ToolOutcome>;
+        actAs(): Promise<ToolOutcome>;
+    };
+    mcp: boolean;
+    door?: McpDoor;
+    /** True only in a development composition — gates the local injection seams. */
+    development: boolean;
+    runtimeCapture?: RuntimeCaptureHandler;
+    onRequestOrigin?: (origin: string) => void;
+    /** 02-store §4 (kill-list B3) ephemeral-session policy. `now` reads the
+        (possibly injected) session clock; `sweep` runs the store TTL sweep and
+        cascades swept subjects into the agent. */
+    sessions: {
+        ttlMs: number;
+        sweepIntervalMs: number;
+        now: () => number;
+    };
+    /** True when any sweep leg is active (session TTL, parked-approval TTL) —
+        gates the amortized on-request sweep; each leg still no-ops itself. */
+    sweepEnabled: boolean;
+    /** The session doors bound to the composed store (selectStore): the local
+        engine's SQL registry, or the hosted store's wire doors. */
+    sessionStore: {
+        register(subject: string, now: number): Promise<void>;
+        adopt(from: string, to: string): Promise<SubjectMergeReport | null>;
+    };
+    sweep: () => Promise<void>;
+}
+/** The per-request view a route handler receives: the raw request, its parsed
+    URL, the wire-relative path, lazily decoded segments, the matched entry's
+    `:param` captures, the anon-session-aware RunContext resolver, and the
+    composed deps. */
+export interface WireContext {
+    request: Request;
+    url: URL;
+    /** Wire-relative raw path (output of the server's relativePath). */
+    path: string;
+    /** Decoded path segments — computed lazily on first access so raw-matched
+        routes (exact/prefix) never decode; malformed encoding throws the same
+        validation error the old eager routeSegments call threw. */
+    readonly segments: string[];
+    /** `:param` captures from the matched pattern (decoded segment values). */
+    params: Record<string, string>;
+    /** Resolve this request's RunContext for a venue. */
+    context(venue: RunContext["venue"]): Promise<RunContext>;
+    deps: WireDeps;
+}
+/** A handler answers with a Response, or returns undefined to FALL THROUGH to
+    the next entry — mirroring the old if-chain, where a matched-path block
+    whose method/operation checks all missed simply fell out the bottom (any
+    side effects it ran, e.g. context resolution, stand). */
+export type RouteHandler = (wire: WireContext) => Promise<Response | undefined>;
+type RoutePattern = 
+/** Raw-path equality — no decoding, matching the old `path === "/x"` arms. */
+{
+    kind: "exact";
+    path: string;
+}
+/** Raw-path prefix — matching the old `path.startsWith("/x/")` arms. */
+ | {
+    kind: "prefix";
+    prefix: string;
+}
+/** Decoded-segment match: literals compare against decoded values, `:name`
+    captures, a trailing rest wildcard allows ZERO or more extra segments —
+    matching the old `head === "x" && segments.length >= n` arms. */
+ | {
+    kind: "segments";
+    parts: string[];
+    rest: boolean;
+};
+export interface RouteEntry {
+    /** Exact method, or "*" for grouped handlers that dispatch methods inside. */
+    method: string;
+    pattern: RoutePattern;
+    handler: RouteHandler;
+}
+/** Table entry from a pattern string: no `:param` and no trailing `/*` means
+    raw-path equality; otherwise decoded-segment matching (trailing `/*` = rest
+    wildcard, zero or more segments). */
+export declare function route(method: string, pattern: string, handler: RouteHandler): RouteEntry;
+/** Table entry matching on a raw path prefix (webhooks, proxy, the doctor
+    production gate) — never decodes, exactly like the old startsWith arms.
+    Raw string match, no segment boundary — include the trailing slash. */
+export declare function prefixRoute(method: string, prefix: string, handler: RouteHandler): RouteEntry;
+/** Scan the table in order; a handler returning undefined keeps scanning
+    (fall-through). No match → undefined; the caller answers not-found. */
+export declare function dispatchRoutes(routes: readonly RouteEntry[], wire: WireContext): Promise<Response | undefined>;
+export declare function json(body: unknown, status?: number): Response;
+export declare function errorResponse(error: VendoError): Response;
+export declare function internalError(): Response;
+/** Orgs are a Vendo Cloud capability, not an OSS one (kill-list A5): every
+    /orgs route and every org-scoped param on /approvals and /grants answers
+    this, unconditionally — there is no key-gated activation path left in the
+    OSS wire (contrast the old block-actions design §C org machinery, which
+    this seam replaces). */
+export declare function orgsCloudRequired(): never;
+export declare function string(value: unknown, label: string): string;
+export declare function requestJson(request: Request): Promise<Record<string, unknown>>;
+export declare function environment(name: string): string | undefined;
+export declare function routeSegments(path: string): string[];
+/** Bytes → lowercase hex. Used by wire/context.ts's session-id mint and
+    wire/misc.ts's timing-safe digest compare. */
+export declare function hex(bytes: ArrayBuffer | Uint8Array): string;
+export {};

package/dist/wire/shared.js

@@ -0,0 +1,134 @@
+import { VendoError, } from "@vendoai/core";
+/** The shared wire toolkit (kill-list B4): the route-table types and matcher,
+    the JSON/error envelope helpers, and the param validators every wire area
+    shares. The anonymous-session + RunContext resolution lives in
+    wire/context.ts; server.ts assembles the table from the per-area modules
+    under src/wire/. */
+export const VERSION = "0.4.0";
+export const BASE_PATH = "/api/vendo";
+const STATUS_BY_CODE = {
+    validation: 400,
+    "not-found": 404,
+    blocked: 403,
+    conflict: 409,
+    "cloud-required": 402,
+    "sandbox-unavailable": 501,
+    "not-implemented": 501,
+};
+/** Table entry from a pattern string: no `:param` and no trailing `/*` means
+    raw-path equality; otherwise decoded-segment matching (trailing `/*` = rest
+    wildcard, zero or more segments). */
+export function route(method, pattern, handler) {
+    if (!pattern.includes(":") && !pattern.endsWith("/*")) {
+        return { method, pattern: { kind: "exact", path: pattern }, handler };
+    }
+    const rest = pattern.endsWith("/*");
+    const parts = (rest ? pattern.slice(0, -2) : pattern).split("/").filter(Boolean);
+    return { method, pattern: { kind: "segments", parts, rest }, handler };
+}
+/** Table entry matching on a raw path prefix (webhooks, proxy, the doctor
+    production gate) — never decodes, exactly like the old startsWith arms.
+    Raw string match, no segment boundary — include the trailing slash. */
+export function prefixRoute(method, prefix, handler) {
+    return { method, pattern: { kind: "prefix", prefix }, handler };
+}
+function matchRoute(entry, wire) {
+    if (entry.method !== "*" && entry.method !== wire.request.method)
+        return null;
+    const pattern = entry.pattern;
+    if (pattern.kind === "exact")
+        return pattern.path === wire.path ? {} : null;
+    if (pattern.kind === "prefix")
+        return wire.path.startsWith(pattern.prefix) ? {} : null;
+    // Segment access may throw the invalid-encoding validation error — only ever
+    // reached after every raw pre-route entry has had its chance, preserving the
+    // old chain's ordering (prefix routes served /proxy/%zz; /threads/%zz threw).
+    const segments = wire.segments;
+    if (pattern.rest ? segments.length < pattern.parts.length : segments.length !== pattern.parts.length) {
+        return null;
+    }
+    const params = {};
+    for (let i = 0; i < pattern.parts.length; i++) {
+        const part = pattern.parts[i];
+        if (part.startsWith(":"))
+            params[part.slice(1)] = segments[i];
+        else if (part !== segments[i])
+            return null;
+    }
+    return params;
+}
+/** Scan the table in order; a handler returning undefined keeps scanning
+    (fall-through). No match → undefined; the caller answers not-found. */
+export async function dispatchRoutes(routes, wire) {
+    for (const entry of routes) {
+        const params = matchRoute(entry, wire);
+        if (params === null)
+            continue;
+        wire.params = params;
+        const response = await entry.handler(wire);
+        if (response !== undefined)
+            return response;
+    }
+    return undefined;
+}
+export function json(body, status = 200) {
+    return Response.json(body, { status });
+}
+export function errorResponse(error) {
+    return json({ error: { code: error.code, message: error.message } }, STATUS_BY_CODE[error.code]);
+}
+export function internalError() {
+    return errorResponse(new VendoError("not-implemented", "Internal Vendo error"));
+}
+/** Orgs are a Vendo Cloud capability, not an OSS one (kill-list A5): every
+    /orgs route and every org-scoped param on /approvals and /grants answers
+    this, unconditionally — there is no key-gated activation path left in the
+    OSS wire (contrast the old block-actions design §C org machinery, which
+    this seam replaces). */
+export function orgsCloudRequired() {
+    throw new VendoError("cloud-required", "orgs are a Vendo Cloud capability");
+}
+function object(value, label) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw new VendoError("validation", `${label} must be an object`);
+    }
+    return value;
+}
+export function string(value, label) {
+    if (typeof value !== "string" || value.length === 0) {
+        throw new VendoError("validation", `${label} must be a non-empty string`);
+    }
+    return value;
+}
+export async function requestJson(request) {
+    try {
+        return object(await request.json(), "request body");
+    }
+    catch (error) {
+        if (error instanceof VendoError)
+            throw error;
+        throw new VendoError("validation", "request body must be valid JSON");
+    }
+}
+export function environment(name) {
+    if (typeof process === "undefined")
+        return undefined;
+    const value = process.env[name];
+    return typeof value === "string" && value.length > 0 ? value : undefined;
+}
+export function routeSegments(path) {
+    try {
+        return path.split("/").filter(Boolean).map(decodeURIComponent);
+    }
+    catch {
+        throw new VendoError("validation", "route contains invalid URL encoding");
+    }
+}
+/** Bytes → lowercase hex. Used by wire/context.ts's session-id mint and
+    wire/misc.ts's timing-safe digest compare. */
+export function hex(bytes) {
+    let out = "";
+    for (const b of bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes))
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}

package/dist/wire/threads.d.ts

@@ -0,0 +1,3 @@
+import { type RouteEntry } from "./shared.js";
+/** 09 §3 — the /threads wire area: chat streaming plus thread list/get/delete. */
+export declare const threadRoutes: RouteEntry[];