QitQore

QitQore is an independent Node.js library for the shared parts of communicating with Qortex: bounded HTTP transport, response/error evidence, incremental SSE decoding, request-status lookup, and explicitly authorized retry execution.

It is not a CLI, agent runtime, authentication store, policy engine, scheduler, or billing/settlement system. Importing the package creates no directories, reads credentials, changes process settings, or makes network requests.

Development

• Requires Node.js 24 or newer.
• In this monorepo, pnpm --dir products/qitqore install --ignore-workspace installs the build-only TypeScript dependency. In a standalone checkout, use pnpm install.
• pnpm test compiles the package and runs deterministic node:test coverage.
• npm pack --dry-run checks the independent package contents. npm pack builds and tests first.

The package has no runtime dependencies. Its sole public entry point is the compiled ESM export at ..

Host responsibilities

Create a client with an explicit base URL and optional fetch implementation. Provide credentials and other headers per request; QitQore never reads a credential store. Hosts continue to own authorization, grants, leases, budgets, operation persistence, tool execution, and settlement.

requestJson returns response data with status and request-ID evidence. openStream returns the response body as a cancellable byte stream. Its request timeout remains active until the body is consumed, cancelled, or errors. Use SseDecoder or iterateSse when the response uses SSE.

runWithRecovery never retries based only on an error classifier. The host must supply both a retry classifier and an authorization callback for the same stable operation ID. It receives whether the prior attempt was accepted, produced partial output, or started a side effect. Acceptance, partial output, and side effects block replay. Unknown outcomes require affirmative host evidence and authorization; an idempotency header alone is not evidence.

Errors expose bounded, redacted diagnostic fields and request IDs, not raw response bodies or request credentials. Hosts may retain their existing product-specific error mappings around these shared primitives.