@av-pi-studio/server 0.0.1

package/dist/agent/timeline-store.js

@@ -0,0 +1,255 @@
+/**
+ * Append-only per-agent timeline store (features/timeline-streaming.md § Timeline model,
+ * § Behavior). Rows persist alongside the agent record in `agents/{cwd}/{id}.json`.
+ *
+ * Key concepts:
+ *  - **Epoch** — each run (`startTurn`) increments the epoch; rows within one epoch are ordered by
+ *    monotonically-increasing `seq`.
+ *  - **Source row** — one `AgentStreamEvent` mapped to one raw storage row (epoch + seq + timestamp
+ *    owned by the daemon, never the provider).
+ *  - **Projected item** — what a client renders. Multi-source events collapse: a tool-call lifecycle
+ *    (status updates, result) is ONE projected item regardless of how many source rows it spans;
+ *    adjacent assistant/reasoning chunks merge into one per run before counting toward the page limit.
+ *  - **Page** — bounded at `DEFAULT_PAGE_SIZE` projected items; supports `direction:"before"|"after"`
+ *    from an opaque cursor (encoded as base-10 `seq` string), with all paging fields.
+ */
+export const DEFAULT_PAGE_SIZE = 200;
+/** Kind used for projection collapsing. */
+function rowKind(event) {
+    if (event.kind === "tool_call")
+        return "tool_call";
+    if (event.kind === "assistant_message" || event.kind === "reasoning")
+        return "assistant";
+    return "other";
+}
+/** Collapse a contiguous slice of rows into projected items. */
+export function projectRows(rows) {
+    const items = [];
+    let i = 0;
+    while (i < rows.length) {
+        const row = rows[i];
+        const kind = rowKind(row.event);
+        if (kind === "tool_call") {
+            // Collect all rows sharing the same callId (or adjacent tool rows if no callId).
+            const callId = row.event.kind === "tool_call" ? row.event.callId : undefined;
+            const group = [row.event];
+            let j = i + 1;
+            while (j < rows.length) {
+                const next = rows[j];
+                if (rowKind(next.event) !== "tool_call")
+                    break;
+                const nextCallId = next.event.kind === "tool_call" ? next.event.callId : undefined;
+                if (callId !== undefined && nextCallId !== undefined && nextCallId !== callId)
+                    break;
+                group.push(next.event);
+                j++;
+            }
+            items.push({
+                kind: "tool_call",
+                callId,
+                sourceSeqStart: row.seq,
+                sourceSeqEnd: rows[j - 1].seq,
+                events: group,
+            });
+            i = j;
+        }
+        else if (kind === "assistant") {
+            // Merge adjacent assistant/reasoning chunks.
+            const group = [row.event];
+            let j = i + 1;
+            while (j < rows.length && rowKind(rows[j].event) === "assistant") {
+                group.push(rows[j].event);
+                j++;
+            }
+            items.push({
+                kind: "assistant",
+                sourceSeqStart: row.seq,
+                sourceSeqEnd: rows[j - 1].seq,
+                events: group,
+            });
+            i = j;
+        }
+        else {
+            items.push({ kind: "other", sourceSeq: row.seq, event: row.event });
+            i++;
+        }
+    }
+    return items;
+}
+// ---------------------------------------------------------------------------
+// Cursor encoding
+// ---------------------------------------------------------------------------
+/** Encode a cursor from a sequence number (opaque string → base-10 decimal). */
+export function encodeCursor(seq) {
+    return String(seq);
+}
+/** Decode a cursor; returns `undefined` for an invalid/absent cursor. */
+export function decodeCursor(cursor) {
+    if (cursor === null || cursor === undefined || cursor === "")
+        return undefined;
+    const n = Number(cursor);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
+// ---------------------------------------------------------------------------
+// AgentTimelineStore
+// ---------------------------------------------------------------------------
+export class AgentTimelineStore {
+    rows = [];
+    epoch = 0;
+    nextSeq = 0;
+    now;
+    constructor(opts = {}) {
+        this.now = opts.now ?? (() => new Date().toISOString());
+        if (opts.initialRows && opts.initialRows.length > 0) {
+            this.rows = [...opts.initialRows];
+            const last = this.rows[this.rows.length - 1];
+            this.epoch = last.epoch;
+            this.nextSeq = last.seq + 1;
+        }
+    }
+    /** Start a new epoch (called when a new run begins). */
+    startEpoch() {
+        this.epoch++;
+        return this.epoch;
+    }
+    /** Append one event, assigning the daemon-owned timestamp + monotonic seq. */
+    append(event) {
+        const row = {
+            epoch: this.epoch,
+            seq: this.nextSeq++,
+            timestamp: this.now(),
+            event,
+        };
+        this.rows.push(row);
+        return row;
+    }
+    currentEpoch() {
+        return this.epoch;
+    }
+    allRows() {
+        return this.rows;
+    }
+    rowCount() {
+        return this.rows.length;
+    }
+    /**
+     * Truncate the timeline back to just before the user message identified by messageId.
+     * The messageId corresponds to the `messageId` field in user_message stream events.
+     * Returns the ISO timestamp of the last retained row, or undefined if nothing was retained.
+     * (features/rewind.md § Wire contract)
+     */
+    truncateBeforeMessage(messageId) {
+        const idx = this.rows.findIndex((row) => {
+            const event = row.event;
+            return event.kind === "user_message" && event.messageId === messageId;
+        });
+        if (idx <= 0) {
+            // Nothing to truncate or messageId not found — truncate all rows as safe fallback
+            if (idx === 0)
+                this.rows = [];
+            return undefined;
+        }
+        this.rows = this.rows.slice(0, idx);
+        const last = this.rows[this.rows.length - 1];
+        return last?.timestamp;
+    }
+    /**
+     * Return a bounded page of projected items.
+     *
+     * `direction:"after"` from cursor returns rows AFTER that seq (newer); `"before"` returns rows
+     * BEFORE that seq (older). Without a cursor, `"after"` returns from the start; `"before"` from
+     * the tail.
+     */
+    page(opts) {
+        const limit = opts.limit ?? DEFAULT_PAGE_SIZE;
+        const cursorSeq = decodeCursor(opts.cursor);
+        const { direction } = opts;
+        // Select the source-row window.
+        let window;
+        if (direction === "after") {
+            const start = cursorSeq !== undefined ? this.rows.findIndex((r) => r.seq > cursorSeq) : 0;
+            window = start === -1 ? [] : this.rows.slice(start);
+        }
+        else {
+            // "before": rows strictly before cursorSeq, reversed then sliced by projected count.
+            const end = cursorSeq !== undefined ? this.rows.findIndex((r) => r.seq >= cursorSeq) : this.rows.length;
+            window = end === -1 ? [...this.rows] : this.rows.slice(0, end);
+            // For "before" we project from the tail end.
+            window = window.toReversed();
+        }
+        // Project and take at most `limit` items, tracking which source rows we consumed.
+        const projected = [];
+        const usedSeqs = [];
+        // For "before" we reversed, so project then re-reverse at the end.
+        const allProjected = projectRows(direction === "after" ? window : window.toReversed());
+        const pageSlice = direction === "after" ? allProjected.slice(0, limit) : allProjected.slice(-limit);
+        for (const item of pageSlice) {
+            projected.push(item);
+            if (item.kind === "tool_call") {
+                usedSeqs.push(item.sourceSeqStart, item.sourceSeqEnd);
+            }
+            else if (item.kind === "assistant") {
+                usedSeqs.push(item.sourceSeqStart, item.sourceSeqEnd);
+            }
+            else {
+                usedSeqs.push(item.sourceSeq);
+            }
+        }
+        if (projected.length === 0) {
+            return {
+                items: [],
+                seqStart: 0,
+                seqEnd: 0,
+                sourceSeqRanges: [],
+                collapsed: false,
+                hasNewer: false,
+                startCursor: null,
+                endCursor: null,
+            };
+        }
+        const minSeq = Math.min(...usedSeqs);
+        const maxSeq = Math.max(...usedSeqs);
+        // hasNewer: true when there are rows in the store with seq > maxSeq.
+        const hasNewer = this.rows.some((r) => r.seq > maxSeq);
+        // sourceSeqRanges: contiguous runs of source seqs covered by this page.
+        const pageRows = this.rows.filter((r) => r.seq >= minSeq && r.seq <= maxSeq);
+        const sourceSeqRanges = buildSeqRanges(pageRows.map((r) => r.seq));
+        // collapsed: any projected item spans >1 source row.
+        const collapsed = projected.some((item) => item.kind === "tool_call"
+            ? item.sourceSeqStart !== item.sourceSeqEnd
+            : item.kind === "assistant"
+                ? item.sourceSeqStart !== item.sourceSeqEnd
+                : false);
+        return {
+            items: projected,
+            seqStart: minSeq,
+            seqEnd: maxSeq,
+            sourceSeqRanges,
+            collapsed,
+            hasNewer,
+            startCursor: encodeCursor(minSeq),
+            endCursor: encodeCursor(maxSeq),
+        };
+    }
+}
+function buildSeqRanges(sorted) {
+    if (sorted.length === 0)
+        return [];
+    const ranges = [];
+    let start = sorted[0];
+    let end = start;
+    for (let i = 1; i < sorted.length; i++) {
+        const n = sorted[i];
+        if (n === end + 1) {
+            end = n;
+        }
+        else {
+            ranges.push({ start, end });
+            start = n;
+            end = n;
+        }
+    }
+    ranges.push({ start, end });
+    return ranges;
+}
+//# sourceMappingURL=timeline-store.js.map

package/dist/agent/timeline-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"timeline-store.js","sourceRoot":"","sources":["../../src/agent/timeline-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAcrC,2CAA2C;AAC3C,SAAS,OAAO,CAAC,KAAuB;IACtC,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IACnD,IAAI,KAAK,CAAC,IAAI,KAAK,mBAAmB,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,WAAW,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AA6BD,gEAAgE;AAChE,MAAM,UAAU,WAAW,CAAC,IAAmB;IAC7C,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;QACnC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,iFAAiF;YACjF,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,MAAM,KAAK,GAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAgB,CAAC;gBACpC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,WAAW;oBAAE,MAAM;gBAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBACnF,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,MAAM;oBAAE,MAAM;gBACrF,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACvB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,MAAM;gBACN,cAAc,EAAE,GAAG,CAAC,GAAG;gBACvB,YAAY,EAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAiB,CAAC,GAAG;gBAC9C,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;aAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,6CAA6C;YAC7C,MAAM,KAAK,GAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAE,IAAI,CAAC,CAAC,CAAiB,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;gBAClF,KAAK,CAAC,IAAI,CAAE,IAAI,CAAC,CAAC,CAAiB,CAAC,KAAK,CAAC,CAAC;gBAC3C,CAAC,EAAE,CAAC;YACN,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,cAAc,EAAE,GAAG,CAAC,GAAG;gBACvB,YAAY,EAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAiB,CAAC,GAAG;gBAC9C,MAAM,EAAE,KAAK;aACd,CAAC,CAAC;YACH,CAAC,GAAG,CAAC,CAAC;QACR,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC,EAAE,CAAC;QACN,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACrB,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/E,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAsBD,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,OAAO,kBAAkB;IACrB,IAAI,GAAkB,EAAE,CAAC;IACzB,KAAK,GAAG,CAAC,CAAC;IACV,OAAO,GAAG,CAAC,CAAC;IACH,GAAG,CAAe;IAEnC,YAAY,OAA4D,EAAE;QACxE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC;YAClC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAgB,CAAC;YAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,wDAAwD;IACxD,UAAU;QACR,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,KAAuB;QAC5B,MAAM,GAAG,GAAgB;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE;YACnB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,KAAK;SACN,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY;QACV,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;IAC1B,CAAC;IAED;;;;;OAKG;IACH,qBAAqB,CAAC,SAAiB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAgC,CAAC;YACnD,OAAO,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,kFAAkF;YAClF,IAAI,GAAG,KAAK,CAAC;gBAAE,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,OAAO,IAAI,EAAE,SAAS,CAAC;IACzB,CAAC;IAED;;;;;;OAMG;IACH,IAAI,CAAC,IAIJ;QACC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,iBAAiB,CAAC;QAC9C,MAAM,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAE3B,gCAAgC;QAChC,IAAI,MAAqB,CAAC;QAC1B,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,qFAAqF;YACrF,MAAM,GAAG,GACP,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;YAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/D,6CAA6C;YAC7C,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAC/B,CAAC;QAED,kFAAkF;QAClF,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAE9B,mEAAmE;QACnE,MAAM,YAAY,GAAG,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACvF,MAAM,SAAS,GACb,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;QAEpF,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;YAC7B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC9B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,CAAC;iBAAM,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBACrC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;gBACL,KAAK,EAAE,EAAE;gBACT,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,CAAC;gBACT,eAAe,EAAE,EAAE;gBACnB,SAAS,EAAE,KAAK;gBAChB,QAAQ,EAAE,KAAK;gBACf,WAAW,EAAE,IAAI;gBACjB,SAAS,EAAE,IAAI;aAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,CAAC;QAErC,qEAAqE;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,CAAC;QAEvD,wEAAwE;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,CAAC;QAC7E,MAAM,eAAe,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEnE,qDAAqD;QACrD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACxC,IAAI,CAAC,IAAI,KAAK,WAAW;YACvB,CAAC,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,YAAY;YAC3C,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;gBACzB,CAAC,CAAC,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,YAAY;gBAC3C,CAAC,CAAC,KAAK,CACZ,CAAC;QAEF,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,QAAQ,EAAE,MAAM;YAChB,MAAM,EAAE,MAAM;YACd,eAAe;YACf,SAAS;YACT,QAAQ;YACR,WAAW,EAAE,YAAY,CAAC,MAAM,CAAC;YACjC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC;SAChC,CAAC;IACJ,CAAC;CACF;AAED,SAAS,cAAc,CAAC,MAAgB;IACtC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;IAChC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC;YAClB,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;YAC5B,KAAK,GAAG,CAAC,CAAC;YACV,GAAG,GAAG,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./password-auth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,cAAc,oBAAoB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,3 @@
+// Optional shared-secret password auth (bcrypt + bearer / WS subprotocol).
+export * from "./password-auth.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,cAAc,oBAAoB,CAAC"}

package/dist/auth/password-auth.d.ts

@@ -0,0 +1,44 @@
+import type { IncomingMessage } from "node:http";
+/**
+ * Optional shared-secret password auth (architecture/auth-security.md § Password auth, § Behavior).
+ *
+ * The password is sourced from `daemon.auth.password` (config) or `PI_STUDIO_PASSWORD` (env) and is
+ * **stored bcrypt-hashed**. When configured, every HTTP request needs `Authorization: Bearer
+ * <password>` and every WS upgrade needs subprotocol `pi-studio.bearer.<password>` (browsers cannot
+ * set custom WS headers). `GET /api/health` and CORS preflight are exempt (handled by the HTTP
+ * pipeline before `authenticate` runs).
+ *
+ * The daemon never stores or transmits provider API keys — there is nothing here to persist beyond
+ * the password hash.
+ */
+export declare const WS_BEARER_SUBPROTOCOL_PREFIX = "pi-studio.bearer.";
+/** True if `value` is already a bcrypt hash (`$2a$` / `$2b$` / `$2y$`). */
+export declare function isBcryptHash(value: string): boolean;
+/**
+ * Resolve the stored bcrypt hash from config/env (env wins). A plaintext secret is hashed; an
+ * already-hashed value is used as-is. Returns `undefined` when no password is configured.
+ */
+export declare function resolvePasswordHash(opts: {
+    configPassword?: string;
+    envPassword?: string;
+}): string | undefined;
+/** Extract a bearer token from an `Authorization: Bearer <token>` header. */
+export declare function bearerFromAuthHeader(header: string | undefined): string | undefined;
+/**
+ * Extract the password from a `Sec-WebSocket-Protocol` header carrying
+ * `pi-studio.bearer.<password>` (the header is a comma-separated list of offered subprotocols).
+ */
+export declare function bearerFromSubprotocol(header: string | undefined): string | undefined;
+export interface PasswordAuth {
+    /** Whether a password is configured. When false, all requests are allowed. */
+    readonly enabled: boolean;
+    /** Verify a presented plaintext token against the stored hash. */
+    verify(token: string | undefined): boolean;
+    /** Authenticate an HTTP request via the Authorization bearer header. */
+    authenticateHttp(req: Pick<IncomingMessage, "headers">): boolean;
+    /** Authenticate a WS upgrade via the `pi-studio.bearer.<password>` subprotocol. */
+    authenticateUpgrade(req: Pick<IncomingMessage, "headers">): boolean;
+}
+/** Build a {@link PasswordAuth} from a (possibly undefined) stored bcrypt hash. */
+export declare function createPasswordAuth(passwordHash: string | undefined): PasswordAuth;
+//# sourceMappingURL=password-auth.d.ts.map

package/dist/auth/password-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-auth.d.ts","sourceRoot":"","sources":["../../src/auth/password-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAIjD;;;;;;;;;;;GAWG;AAEH,eAAO,MAAM,4BAA4B,sBAAsB,CAAC;AAEhE,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE;IACxC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,GAAG,SAAS,CAIrB;AAED,6EAA6E;AAC7E,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAInF;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CASpF;AAED,MAAM,WAAW,YAAY;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,kEAAkE;IAClE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC;IAC3C,wEAAwE;IACxE,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC;IACjE,mFAAmF;IACnF,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,CAAC,GAAG,OAAO,CAAC;CACrE;AAED,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CAuBjF"}

package/dist/auth/password-auth.js

@@ -0,0 +1,78 @@
+import bcrypt from "bcryptjs";
+/**
+ * Optional shared-secret password auth (architecture/auth-security.md § Password auth, § Behavior).
+ *
+ * The password is sourced from `daemon.auth.password` (config) or `PI_STUDIO_PASSWORD` (env) and is
+ * **stored bcrypt-hashed**. When configured, every HTTP request needs `Authorization: Bearer
+ * <password>` and every WS upgrade needs subprotocol `pi-studio.bearer.<password>` (browsers cannot
+ * set custom WS headers). `GET /api/health` and CORS preflight are exempt (handled by the HTTP
+ * pipeline before `authenticate` runs).
+ *
+ * The daemon never stores or transmits provider API keys — there is nothing here to persist beyond
+ * the password hash.
+ */
+export const WS_BEARER_SUBPROTOCOL_PREFIX = "pi-studio.bearer.";
+/** True if `value` is already a bcrypt hash (`$2a$` / `$2b$` / `$2y$`). */
+export function isBcryptHash(value) {
+    return /^\$2[aby]\$\d{2}\$/.test(value);
+}
+/**
+ * Resolve the stored bcrypt hash from config/env (env wins). A plaintext secret is hashed; an
+ * already-hashed value is used as-is. Returns `undefined` when no password is configured.
+ */
+export function resolvePasswordHash(opts) {
+    const raw = opts.envPassword?.trim() || opts.configPassword?.trim();
+    if (!raw)
+        return undefined;
+    return isBcryptHash(raw) ? raw : bcrypt.hashSync(raw, 10);
+}
+/** Extract a bearer token from an `Authorization: Bearer <token>` header. */
+export function bearerFromAuthHeader(header) {
+    if (!header)
+        return undefined;
+    const match = header.match(/^Bearer\s+(.+)$/i);
+    return match ? match[1].trim() : undefined;
+}
+/**
+ * Extract the password from a `Sec-WebSocket-Protocol` header carrying
+ * `pi-studio.bearer.<password>` (the header is a comma-separated list of offered subprotocols).
+ */
+export function bearerFromSubprotocol(header) {
+    if (!header)
+        return undefined;
+    for (const entry of header.split(",")) {
+        const proto = entry.trim();
+        if (proto.startsWith(WS_BEARER_SUBPROTOCOL_PREFIX)) {
+            return proto.slice(WS_BEARER_SUBPROTOCOL_PREFIX.length);
+        }
+    }
+    return undefined;
+}
+/** Build a {@link PasswordAuth} from a (possibly undefined) stored bcrypt hash. */
+export function createPasswordAuth(passwordHash) {
+    const enabled = passwordHash !== undefined;
+    const verify = (token) => {
+        if (!enabled)
+            return true;
+        if (!token)
+            return false;
+        return bcrypt.compareSync(token, passwordHash);
+    };
+    return {
+        enabled,
+        verify,
+        authenticateHttp(req) {
+            if (!enabled)
+                return true;
+            return verify(bearerFromAuthHeader(req.headers.authorization));
+        },
+        authenticateUpgrade(req) {
+            if (!enabled)
+                return true;
+            const header = req.headers["sec-websocket-protocol"];
+            const value = Array.isArray(header) ? header.join(",") : header;
+            return verify(bearerFromSubprotocol(value));
+        },
+    };
+}
+//# sourceMappingURL=password-auth.js.map

package/dist/auth/password-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-auth.js","sourceRoot":"","sources":["../../src/auth/password-auth.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B;;;;;;;;;;;GAWG;AAEH,MAAM,CAAC,MAAM,4BAA4B,GAAG,mBAAmB,CAAC;AAEhE,2EAA2E;AAC3E,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAGnC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACpE,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oBAAoB,CAAC,MAA0B;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAA0B;IAC9D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,CAAC;YACnD,OAAO,KAAK,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAaD,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,YAAgC;IACjE,MAAM,OAAO,GAAG,YAAY,KAAK,SAAS,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,KAAyB,EAAW,EAAE;QACpD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,YAAsB,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,OAAO;QACL,OAAO;QACP,MAAM;QACN,gBAAgB,CAAC,GAAG;YAClB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;QACjE,CAAC;QACD,mBAAmB,CAAC,GAAG;YACrB,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;YACrD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChE,OAAO,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9C,CAAC;KACF,CAAC;AACJ,CAAC"}