@vendoai/vendo 0.4.3 → 0.4.5

package/dist/cli/shared.d.ts

@@ -1,5 +1,5 @@
 import { type Telemetry } from "@vendoai/telemetry";
-export declare const CLI_VERSION = "0.4.3";
+export declare const CLI_VERSION = "0.4.5";
 export interface Output {
     log(message: string): void;
     error(message: string): void;

package/dist/cli/shared.js

@@ -4,7 +4,7 @@ import { dirname, join } from "node:path";
 import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { initTelemetry, repoHost } from "@vendoai/telemetry";
-export const CLI_VERSION = "0.4.3";
+export const CLI_VERSION = "0.4.5";
 export const consoleOutput = {
     log: (message) => console.log(message),
     error: (message) => console.error(message),

package/dist/cli/sync.d.ts

@@ -1,4 +1,4 @@
-import { vendoSync, type SyncReportWithWarnings } from "@vendoai/actions";
+import { vendoSync, type SyncReportWithWarnings } from "@vendoai/actions/sync";
 import type { ToolImpact } from "../sync-impact.js";
 import { type Output, type TelemetryOptions } from "./shared.js";
 export interface SyncReportPayload {

package/dist/cli/sync.js

@@ -1,5 +1,5 @@
 import { join, resolve } from "node:path";
-import { vendoSync } from "@vendoai/actions";
+import { vendoSync } from "@vendoai/actions/sync";
 import { pushSyncReport } from "./cloud/services.js";
 import { syncSemantics } from "./semantics.js";
 import { consoleOutput, withCommandRun } from "./shared.js";

package/dist/cloud-apps.js

@@ -1,5 +1,6 @@
 import { publishRecordSchema, shareSnapshotSchema, } from "@vendoai/apps";
 import { consoleSender, raiseCloudError } from "./cloud-console.js";
+import { defaultFetch } from "@vendoai/core";
 const DEFAULT_TIMEOUT_MS = 30_000;
 /** The console mounts the share/publish surface here. */
 const CONSOLE_APPS_PATH = "/api/v1/apps";
@@ -17,7 +18,7 @@ export function cloudApps(options) {
         mountPath: CONSOLE_APPS_PATH,
         apiKey: options.apiKey,
         timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
-        fetchImpl: options.fetch ?? globalThis.fetch,
+        fetchImpl: options.fetch ?? defaultFetch,
         raise: raiseAppsError,
     });
     const post = async (path, appId, doc, schema) => {

package/dist/cloud-key-fetch.d.ts

@@ -0,0 +1,16 @@
+export interface CloudUrlOptions {
+    apiUrl?: string;
+    env?: Record<string, string | undefined>;
+}
+export declare function resolveCloudBaseUrl(options?: CloudUrlOptions): string;
+export interface CloudKeyFetchOptions extends CloudUrlOptions {
+    apiKey?: string;
+    method?: string;
+    body?: unknown;
+    fetchImpl?: typeof fetch;
+    signal?: AbortSignal;
+}
+/** POST/GET a console API path with VENDO_API_KEY bearer auth. The console's
+ *  shared auth middleware upserts deployment inventory and meters usage from
+ *  the identity headers on real service calls (deployment-identity.ts). */
+export declare function cloudKeyFetch<T = unknown>(path: string, options?: CloudKeyFetchOptions): Promise<T>;

package/dist/cloud-key-fetch.js

@@ -0,0 +1,40 @@
+/** Portable key-authenticated console calls for RUNTIME code (capability
+ *  misses today). The CLI's cloudFetch adds user sessions, refresh, and disk
+ *  state on top — Node-only concerns that used to ride into Worker bundles
+ *  whenever runtime code borrowed it. Keep this module free of node builtins
+ *  and CLI imports; the portability gate bundles it. */
+import { defaultFetch } from "@vendoai/core";
+import { deploymentIdentityHeaders } from "./deployment-identity.js";
+import { VERSION } from "./wire/shared.js";
+const DEFAULT_CLOUD_URL = "https://console.vendo.run";
+const processEnv = () => globalThis.process?.env ?? {};
+export function resolveCloudBaseUrl(options = {}) {
+    const value = options.apiUrl ?? (options.env ?? processEnv()).VENDO_CLOUD_URL ?? DEFAULT_CLOUD_URL;
+    return value.replace(/\/+$/, "");
+}
+/** POST/GET a console API path with VENDO_API_KEY bearer auth. The console's
+ *  shared auth middleware upserts deployment inventory and meters usage from
+ *  the identity headers on real service calls (deployment-identity.ts). */
+export async function cloudKeyFetch(path, options = {}) {
+    const token = options.apiKey ?? (options.env ?? processEnv()).VENDO_API_KEY;
+    if (token === undefined || token === "") {
+        throw new Error("Vendo Cloud key call without a key: pass apiKey or set VENDO_API_KEY");
+    }
+    const headers = {
+        accept: "application/json",
+        authorization: `Bearer ${token}`,
+        "user-agent": `vendo-cli/${VERSION}`,
+        ...(options.body === undefined ? {} : { "content-type": "application/json" }),
+        ...(await deploymentIdentityHeaders()),
+    };
+    const response = await (options.fetchImpl ?? defaultFetch)(`${resolveCloudBaseUrl(options)}${path}`, {
+        method: options.method ?? (options.body === undefined ? "GET" : "POST"),
+        headers,
+        body: options.body === undefined ? undefined : JSON.stringify(options.body),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+    });
+    if (!response.ok) {
+        throw new Error(`Vendo Cloud ${path} answered ${response.status}`);
+    }
+    return await response.json();
+}

package/dist/cloud-tools.js

@@ -1,5 +1,6 @@
 import { composioToolRisk, normalizeToolName } from "@vendoai/actions";
 import { deploymentIdentityHeaders } from "./deployment-identity.js";
+import { defaultFetch } from "@vendoai/core";
 function errorOutcome(message) {
     return { status: "error", error: { code: "connector-error", message } };
 }
@@ -8,7 +9,7 @@ function withIdentity(outcome, identity) {
 }
 export function cloudTools(options) {
     const base = (options.baseUrl ?? "https://console.vendo.run").replace(/\/$/, "");
-    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const fetchImpl = options.fetch ?? defaultFetch;
     let normalizedToRaw = new Map();
     async function cloudFetch(path, init) {
         const response = await fetchImpl(`${base}${path}`, {

package/dist/connections.js

@@ -1,4 +1,4 @@
-import { VendoError } from "@vendoai/core";
+import { defaultFetch, VendoError } from "@vendoai/core";
 import { consoleSender, raiseCloudError } from "./cloud-console.js";
 /** Subjects the runtime mints for machine principals (automations webhook
  * triggers today; the reserved `vendo:` namespace going forward). A synthetic
@@ -95,7 +95,7 @@ const raiseConnectionsError = (response) => raiseCloudError(response, "connectio
  * the wire it must serve. */
 export function cloudConnections(options) {
     const base = (options.baseUrl ?? "https://console.vendo.run").replace(/\/$/, "");
-    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const fetchImpl = options.fetch ?? defaultFetch;
     // The key-authed console sender (cloud-console.ts): Bearer auth + deployment
     // identity (the console meters usage from real traffic) + per-request abort
     // timeout, raising through the shared error table on any non-2xx.

package/dist/dev-creds/model-edge.d.ts

@@ -0,0 +1,21 @@
+/** Web-standard-runtime build of the dev credential ladder, selected by the
+ *  package's `worker`/`workerd`/`edge-light`/`browser` import conditions
+ *  (see `#dev-creds/model` in package.json).
+ *
+ *  The real ladder is Node by design: it resolves the host's own @ai-sdk
+ *  provider install via createRequire from the project root, reads `vendo
+ *  login` sessions off disk, and anchors on process.cwd(). None of that
+ *  exists inside a Worker bundle — Mohamed's field report had the ladder
+ *  dying on runtime require.resolve under Wrangler even with VENDO_API_KEY
+ *  set. On these runtimes the model seam is explicit by contract: the host
+ *  wiring constructs the provider (init generates it; the Cloud gateway is
+ *  the stock Anthropic provider pointed at the console). The ladder's edge
+ *  build therefore resolves to honest guidance instead of half-working
+ *  magic. Keep this module free of node builtins and CLI imports; the
+ *  portability gate bundles it. */
+import type { LanguageModel } from "ai";
+import type { DevModelOptions } from "./model.js";
+export type { DevModelOptions };
+/** Same seam as the Node build; announces its unavailability once on first
+ *  use through the server log, like the Node ladder's unavailable rung. */
+export declare function devModel(_options?: DevModelOptions): LanguageModel;

package/dist/dev-creds/model-edge.js

@@ -0,0 +1,24 @@
+const EDGE_MESSAGE = "the dev model ladder needs Node (it resolves the host's provider install and dev credentials from disk); "
+    + "on this runtime pass `model:` to createVendo explicitly — with a Vendo Cloud key that is the stock Anthropic "
+    + "provider pointed at the console gateway: createAnthropic({ apiKey: VENDO_API_KEY, baseURL: `${VENDO_CLOUD_URL ?? \"https://console.vendo.run\"}/api/v1` })(\"vendo-default\")";
+/** Same seam as the Node build; announces its unavailability once on first
+ *  use through the server log, like the Node ladder's unavailable rung. */
+export function devModel(_options = {}) {
+    let announced = false;
+    const refuse = () => {
+        if (!announced) {
+            announced = true;
+            console.error(`[vendo] model: ${EDGE_MESSAGE}`);
+        }
+        throw new Error(EDGE_MESSAGE);
+    };
+    const model = {
+        specificationVersion: "v3",
+        provider: "vendo-dev",
+        modelId: "dev-env",
+        supportedUrls: {},
+        doGenerate: () => Promise.resolve().then(refuse),
+        doStream: () => Promise.resolve().then(refuse),
+    };
+    return model;
+}

package/dist/hosted-store.js

@@ -2,6 +2,7 @@ import { vendoRecordSchema, } from "@vendoai/core";
 import { DEDICATED_RECORD_COLLECTIONS, RESERVED_COLLECTIONS, } from "@vendoai/store";
 import { consoleSender, raiseCloudError, toArrayBuffer } from "./cloud-console.js";
 import { deploymentIdentityHeaders } from "./deployment-identity.js";
+import { defaultFetch } from "@vendoai/core";
 /** The console mounts the hosted-store surface here
  * (apps/console/app/api/v1/store/*). */
 const CONSOLE_STORE_PATH = "/api/v1/store";
@@ -77,7 +78,7 @@ function parseNullableRecord(value) {
 export function hostedStore(options) {
     const base = (options.baseUrl ?? "https://console.vendo.run").replace(/\/$/, "");
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const fetchImpl = options.fetch ?? defaultFetch;
     const send = consoleSender({
         base,
         mountPath: CONSOLE_STORE_PATH,

package/dist/refine.js

@@ -4,6 +4,7 @@ import { validateCapabilities, capabilitiesFileSchema, overridesFileSchema, tool
 import { TOOL_NAME_PATTERN, VENDO_CAPABILITIES_FORMAT, VENDO_OVERRIDES_FORMAT, capabilityMissEventSchema, } from "@vendoai/core";
 import { generateObject } from "ai";
 import { z } from "zod";
+import { defaultFetch } from "@vendoai/core";
 /**
  * The refine engine (ENG-250, extraction spec §3). One engine, two surfaces:
  * the `vendo refine` CLI command and the end-of-init offer — both call
@@ -496,7 +497,7 @@ const stringify = (value) => `${JSON.stringify(value, null, 2)}\n`;
 // ---------------------------------------------------------------------------
 export async function runRefine(options) {
     const root = resolve(options.root);
-    const fetchImpl = options.fetchImpl ?? fetch;
+    const fetchImpl = options.fetchImpl ?? defaultFetch;
     const interview = options.interview ?? [];
     const startedAt = new Date().toISOString();
     const inputs = await loadInputs(root, options);

package/dist/sandbox.js

@@ -1,4 +1,4 @@
-import { VendoError } from "@vendoai/core";
+import { defaultFetch, VendoError } from "@vendoai/core";
 import { deploymentIdentityHeaders } from "./deployment-identity.js";
 import { CLOUD_BOX_PORT, CLOUD_SANDBOX_PATH, CLOUD_SNAPSHOT_REF_PREFIX, CLOUD_SNAPSHOTS_SUBPATH, CONSOLE_SNAPSHOT_REF_PREFIX, } from "./sandbox-wire.js";
 /** Console error codes forwarded as-is when they are wire-legal VendoError
@@ -142,7 +142,7 @@ const isGone = (error) => error instanceof VendoError && error.code === "not-fou
 export function cloudSandbox(options) {
     const base = (options.baseUrl ?? "https://console.vendo.run").replace(/\/$/, "");
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const fetchImpl = options.fetch ?? globalThis.fetch;
+    const fetchImpl = options.fetch ?? defaultFetch;
     const send = async (path, init = {}) => {
         const response = await fetchImpl(`${base}${CLOUD_SANDBOX_PATH}${path}`, {
             ...init,

package/dist/server.d.ts

@@ -11,7 +11,7 @@ export { createStore, envSecrets, secretStore, storeSecrets } from "@vendoai/sto
 export { hostAuthPresetConformance, type HostAuthPreset, type HostAuthPresetConformanceOptions, type HostAuthPresetOptions, type HostAuthPresetUser, type HostAuthPresetUserResolver, type SupabaseHostAuthPresetOptions, } from "./auth-presets/index.js";
 import type { HostAuthPreset } from "./auth-presets/index.js";
 import type { LanguageModel } from "ai";
-export { devModel, type DevModelOptions } from "./dev-creds/model.js";
+export { devModel, type DevModelOptions } from "#dev-creds/model";
 import { type ConnectionsService } from "./connections.js";
 export { byoConnections, cloudConnections, unconfiguredConnections, type CloudConnectionsOptions, type ConnectionsService, } from "./connections.js";
 export { cloudSandbox, type CloudSandboxOptions } from "./sandbox.js";

package/dist/server.js

@@ -28,11 +28,11 @@ import { createByoApprovals } from "./byo-approvals.js";
 import { initTelemetry } from "@vendoai/telemetry";
 import { capabilitySurfaceSnapshot, createCapabilityMissCapture, } from "./capability-misses.js";
 import { catalogThemeSummary, mergeRuntimeCatalog, normalizeCatalogConfig, runtimeCatalogFromJson } from "./catalog.js";
-import { devModel } from "./dev-creds/model.js";
+import { devModel } from "#dev-creds/model";
 // install-dx v1 — `devModel()` is the env-resolving model createVendo composes
 // when the host passes none; the resolver is shared by init and doctor (one
 // credential story, real keys only).
-export { devModel } from "./dev-creds/model.js";
+export { devModel } from "#dev-creds/model";
 import { byoConnections, cloudConnections, hasConnections, unconfiguredConnections, } from "./connections.js";
 // The shipped connections adapters ride the server surface so a host can pass
 // one explicitly via createVendo({ connections }) — see selectConnections.
@@ -594,7 +594,7 @@ function createWireHandler(deps) {
                 // addressing a real Vendo WIRE route may (04 §4), and the door's paths are
                 // the door's, not wire routes.
                 if (deps.door !== undefined && isDoorPath(url.pathname)) {
-                    await deps.ready;
+                    await deps.ready();
                     return await deps.door.handler(request);
                 }
                 const path = relativePath(url);
@@ -606,7 +606,7 @@ function createWireHandler(deps) {
                 if (jsonMutationRequired(request, path) && !isJsonRequest(request)) {
                     throw new VendoError("validation", "content-type must be application/json");
                 }
-                await deps.ready;
+                await deps.ready();
                 // The per-request view the route table dispatches on (kill-list B4).
                 // Segments decode lazily so raw-matched pre-routes (proxy, webhooks,
                 // doctor) never decode — preserving the old chain's decode timing.
@@ -688,10 +688,23 @@ export function createVendo(config) {
     // Inference, selected by the adapter rule at this composition seam
     // (selectModel above) — the one model the agent and apps blocks consume.
     const inference = selectModel(config.model);
-    const ready = store.ensureSchema();
-    // Keep eager schema readiness for hosts that reach into composed blocks,
-    // while preventing an unhandled rejection before the first handler/emit awaits it.
-    void ready.catch(() => undefined);
+    // Construction stays PURE — no I/O, no timers — because the common edge
+    // wiring calls createVendo() at module init, where Workers forbids both
+    // (Mohamed's field report: "Disallowed operation called within global
+    // scope"). The first handler/emit touch starts schema readiness and the
+    // background sweep together through this once-latch; on Node the first
+    // request pays the same cost the old eager kick merely front-loaded.
+    let startBackgroundSweep = () => undefined;
+    let readyState;
+    const ready = () => {
+        if (readyState === undefined) {
+            readyState = store.ensureSchema();
+            // No unhandled rejection before a handler/emit awaits the latch.
+            void readyState.catch(() => undefined);
+            startBackgroundSweep();
+        }
+        return readyState;
+    };
     let resolveAppToolRisk;
     const guard = createGuard({
         store,
@@ -1101,16 +1114,21 @@ export function createVendo(config) {
     // engine pattern) so an idle process still reclaims sessions with no traffic;
     // unref'd means it never keeps the event loop alive. Torn down with the store.
     if (sweepEnabled) {
-        const sweepTimer = setInterval(() => {
-            runSweep().catch((error) => {
-                console.warn(`[vendo] session sweep failed; will retry next interval: ${error instanceof Error ? error.message : String(error)}`);
-            });
-        }, sessionsConfig.sweepIntervalMs);
-        sweepTimer.unref?.();
-        const closeStore = store.close.bind(store);
-        store.close = async () => {
-            clearInterval(sweepTimer);
-            await closeStore();
+        // Armed by the ready() latch above, NOT at construction: timers are
+        // illegal in Workers global scope, and a process that never serves a
+        // request has nothing to sweep.
+        startBackgroundSweep = () => {
+            const sweepTimer = setInterval(() => {
+                runSweep().catch((error) => {
+                    console.warn(`[vendo] session sweep failed; will retry next interval: ${error instanceof Error ? error.message : String(error)}`);
+                });
+            }, sessionsConfig.sweepIntervalMs);
+            sweepTimer.unref?.();
+            const closeStore = store.close.bind(store);
+            store.close = async () => {
+                clearInterval(sweepTimer);
+                await closeStore();
+            };
         };
     }
     // Wave 2 (Cloud auto): a keyed deployment's schedule- and external-triggered
@@ -1196,7 +1214,11 @@ export function createVendo(config) {
             ...(theme === undefined ? {} : { theme }),
         });
     }
-    const sessionId = `session_${globalThis.crypto.randomUUID()}`;
+    // Minted on first request via the deps getter below — Workers forbids
+    // generating random values in global scope, and createVendo runs at module
+    // init in the edge wiring. Still one fallback id per process.
+    let processSessionId;
+    const sessionId = () => (processSessionId ??= `session_${globalThis.crypto.randomUUID()}`);
     // Anonymous principals are minted per-CLIENT in the handler (opaque cookie
     // pointer; the store's vendo_sessions row is the authority — kill-list B3).
     // An https VENDO_BASE_URL means TLS terminates at a trusted proxy and requests
@@ -1220,7 +1242,7 @@ export function createVendo(config) {
         principal: resolvePrincipal,
         ready,
         trustedBaseIsHttps,
-        sessionId,
+        get sessionId() { return sessionId(); },
         store,
         telemetry: telemetryClient(config.telemetry),
         agent,
@@ -1267,12 +1289,24 @@ export function createVendo(config) {
     return {
         handler,
         async emit(event, payload, principal) {
-            await ready;
+            await ready();
             return automations.emit(event, payload, principal);
         },
         agent,
         guard,
-        guardedTools: byoApprovals.registry,
+        // The BYO seam (ai-sdk.ts / mastra.ts tool packs) reaches the store
+        // without ever touching handler/emit, so its execute leg arms the same
+        // ready() latch — the composed-block head start the old eager kick gave
+        // such hosts, without the construction-time I/O Workers forbids. Direct
+        // vendo.store/automations reach-ins still own their readiness (await
+        // store.ensureSchema(), as the mastra example and defer tests do).
+        guardedTools: {
+            ...byoApprovals.registry,
+            execute: async (call, ctx) => {
+                await ready();
+                return byoApprovals.registry.execute(call, ctx);
+            },
+        },
         apps,
         automations,
         actions,

package/dist/wire/shared.d.ts

@@ -14,7 +14,7 @@ import type { RuntimeCaptureHandler } from "../runtime-capture.js";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export declare const VERSION = "0.4.3";
+export declare const VERSION = "0.4.5";
 export declare const BASE_PATH = "/api/vendo";
 export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 /** How inference is served: "custom" (a host-passed model) or "ladder" (the
@@ -24,7 +24,7 @@ export type SandboxVenue = "e2b" | "cloud" | "custom" | false;
 export type ModelVenue = "custom" | "ladder";
 export interface WireDeps {
     principal: (req: Request) => Promise<Principal | null>;
-    ready: Promise<void>;
+    ready: () => Promise<void>;
     /** VENDO_BASE_URL is https → TLS terminates upstream; see secureRequest. */
     trustedBaseIsHttps: boolean;
     sessionId: string;

package/dist/wire/shared.js

@@ -4,7 +4,7 @@ import { VendoError, } from "@vendoai/core";
     shares. The anonymous-session + RunContext resolution lives in
     wire/context.ts; server.ts assembles the table from the per-area modules
     under src/wire/. */
-export const VERSION = "0.4.3";
+export const VERSION = "0.4.5";
 export const BASE_PATH = "/api/vendo";
 const STATUS_BY_CODE = {
     validation: 400,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vendoai/vendo",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "The Vendo umbrella: default composition, public wire routes, React provider, and the vendo CLI.",
   "keywords": [
     "ai",
@@ -86,16 +86,16 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^3.25.0",
-    "@vendoai/actions": "0.4.3",
-    "@vendoai/apps": "0.4.3",
-    "@vendoai/automations": "0.4.3",
-    "@vendoai/agent": "0.4.3",
-    "@vendoai/core": "0.4.3",
-    "@vendoai/guard": "0.4.3",
-    "@vendoai/telemetry": "0.3.1",
-    "@vendoai/ui": "0.4.3",
-    "@vendoai/mcp": "0.4.3",
-    "@vendoai/store": "0.4.3"
+    "@vendoai/apps": "0.4.5",
+    "@vendoai/automations": "0.4.5",
+    "@vendoai/guard": "0.4.5",
+    "@vendoai/agent": "0.4.5",
+    "@vendoai/mcp": "0.4.5",
+    "@vendoai/store": "0.4.5",
+    "@vendoai/telemetry": "0.3.2",
+    "@vendoai/core": "0.4.5",
+    "@vendoai/ui": "0.4.5",
+    "@vendoai/actions": "0.4.5"
   },
   "peerDependencies": {
     "@auth/core": "^0.34.3",
@@ -137,6 +137,15 @@
     "vite": "^6.0.0",
     "vitest": "^2.1.0"
   },
+  "imports": {
+    "#dev-creds/model": {
+      "workerd": "./dist/dev-creds/model-edge.js",
+      "worker": "./dist/dev-creds/model-edge.js",
+      "edge-light": "./dist/dev-creds/model-edge.js",
+      "browser": "./dist/dev-creds/model-edge.js",
+      "default": "./dist/dev-creds/model.js"
+    }
+  },
   "scripts": {
     "build:playground": "node scripts/build-playground.mjs",
     "prebuild": "pnpm run build:playground",