@buoy-gg/shared-ui 7.0.35 → 7.0.38

package/lib/module/stores/BaseEventStore.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { getAccountAccess, hasAccountAccess, subscribeAccountAccess } from "../license/licenseModule.js";
 /**
  * BaseEventStore - Abstract base class for event aggregation stores
  *
@@ -65,6 +66,20 @@ export class BaseEventStore extends Subscribable {
     super();
     this.maxEvents = options.maxEvents ?? 500;
     this.storeName = options.storeName;
+    // Defer until subclass fields are initialized before invoking lifecycle hooks.
+    Promise.resolve().then(() => {
+      const reconcile = () => {
+        if (getAccountAccess().status === "locked") {
+          this.stopCapturing();
+          this.events = [];
+          this.notifyArrayListeners();
+        } else if (this.getTotalSubscriberCount() > 0 && !this.captureSuppressed && !this.isCapturing()) {
+          this.startCapturing();
+        }
+      };
+      subscribeAccountAccess(reconcile);
+      reconcile();
+    });
   }
 
   // ===========================================================================
@@ -94,7 +109,7 @@ export class BaseEventStore extends Subscribable {
    * Starts capturing if no one was subscribed.
    */
   onSubscribe() {
-    if (this.getTotalSubscriberCount() === 1 && !this.captureSuppressed) {
+    if (this.getTotalSubscriberCount() === 1 && !this.captureSuppressed && getAccountAccess().status !== "locked") {
       this.startCapturing();
     }
     notifySubscriberCountChange(this.storeName);
@@ -134,7 +149,7 @@ export class BaseEventStore extends Subscribable {
     this.arrayListeners.add(listener);
 
     // Start capturing if this is the first subscriber
-    if (wasEmpty && !this.captureSuppressed) {
+    if (wasEmpty && !this.captureSuppressed && getAccountAccess().status !== "locked") {
       this.startCapturing();
     }
 
@@ -181,11 +196,12 @@ export class BaseEventStore extends Subscribable {
    * @param event - The event to add
    */
   addEvent(event) {
+    if (getAccountAccess().status === "locked") return;
     // Add to beginning (newest first) and limit to maxEvents
     this.events = [event, ...this.events].slice(0, this.maxEvents);
 
     // Notify individual event callbacks (via Subscribable)
-    this.notify(event);
+    if (hasAccountAccess()) this.notify(event);
 
     // Notify array listeners
     this.notifyArrayListeners();
@@ -209,14 +225,14 @@ export class BaseEventStore extends Subscribable {
    * Get all events (newest first)
    */
   getEvents() {
-    return this.events;
+    return hasAccountAccess() ? this.events : [];
   }
 
   /**
    * Get event count
    */
   getEventCount() {
-    return this.events.length;
+    return hasAccountAccess() ? this.events.length : 0;
   }
 
   /**

package/lib/module/stores/createToolStore.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { getAccountAccess, hasAccountAccess, subscribeAccountAccess } from "../license/licenseModule.js";
 /**
  * createToolStore — the one bounded, subscribable buffer every tool used to
  * hand-roll.
@@ -49,6 +50,16 @@ export function createToolStore(options) {
   let nextId = options.firstId ?? 1;
   let lastFlushAt = 0;
   let emitScheduled = false;
+  const empty = [];
+  let observing = false;
+  function observe() {
+    if (observing) return;
+    observing = true;
+    subscribeAccountAccess(() => {
+      if (getAccountAccess().status === "locked") items = [];
+      emit();
+    });
+  }
   const listeners = new Set();
   const clearListeners = new Set();
   function fire() {
@@ -79,19 +90,22 @@ export function createToolStore(options) {
   const store = {
     id,
     subscribe(listener) {
+      observe();
       listeners.add(listener);
       return () => {
         listeners.delete(listener);
       };
     },
     getSnapshot() {
-      return items;
+      observe();
+      return hasAccountAccess() ? items : empty;
     },
     size() {
-      return items.length;
+      return hasAccountAccess() ? items.length : 0;
     },
     add(item) {
-      if (paused) return;
+      observe();
+      if (paused || getAccountAccess().status === "locked") return;
       if (order === "append") {
         items = items.length >= max ? [...items.slice(items.length - max + 1), item] : [...items, item];
       } else {
@@ -100,10 +114,14 @@ export function createToolStore(options) {
       emit();
     },
     set(next) {
+      observe();
+      if (!hasAccountAccess()) return;
       items = trim(next);
       emit();
     },
     update(fn) {
+      observe();
+      if (getAccountAccess().status === "locked") return;
       items = trim(fn(items));
       emit();
     },

package/lib/module/stores/floatingToolStore.js

@@ -0,0 +1,61 @@
+"use strict";
+
+let entries = [];
+let revision = 0;
+const listeners = new Set();
+const notify = () => listeners.forEach(listener => listener());
+export const getFloatingTools = () => entries;
+export const subscribeFloatingTools = listener => {
+  listeners.add(listener);
+  return () => {
+    listeners.delete(listener);
+  };
+};
+
+/** Open or restore one tool. Mount FloatingToolHost once at the application root. */
+export function openFloatingTool(tool) {
+  if (!tool.id.trim()) throw new Error("Floating tools need a non-empty id");
+  const entry = {
+    ...tool,
+    revealToken: ++revision
+  };
+  entries = entries.some(value => value.id === tool.id) ? entries.map(value => value.id === tool.id ? entry : value) : [...entries, entry];
+  notify();
+}
+
+/** Removes the UI only. Tool actions such as Stop belong to the tool's own controller. */
+export function dismissFloatingTool(id) {
+  if (!entries.some(entry => entry.id === id)) return;
+  entries = entries.filter(entry => entry.id !== id);
+  notify();
+}
+
+/** Register at app startup to restore an open tool using its existing position storage. */
+export function registerPersistentFloatingTool(tool, storage) {
+  if (!tool.id.trim()) throw new Error("Floating tools need a non-empty id");
+  const key = `@buoy/floating-tool/${tool.id}/open`;
+  let disposed = false;
+  let changed = false;
+  let wasOpen = entries.some(entry => entry.id === tool.id);
+  let writes = Promise.resolve();
+  const unsubscribe = subscribeFloatingTools(() => {
+    const isOpen = entries.some(entry => entry.id === tool.id);
+    if (isOpen === wasOpen) return;
+    wasOpen = isOpen;
+    changed = true;
+    writes = writes.then(() => storage.setItem(key, isOpen ? "1" : "0")).then(() => {}, () => {});
+  });
+  void storage.getItem(key).then(saved => {
+    if (disposed || changed || wasOpen || saved !== "1") return;
+    // Zero restores the saved hidden state; explicit opens still reveal the tool.
+    entries = [...entries, {
+      ...tool,
+      revealToken: 0
+    }];
+    notify();
+  }).catch(() => {});
+  return () => {
+    disposed = true;
+    unsubscribe();
+  };
+}

package/lib/module/stores/floatingToolStore.test.js

@@ -0,0 +1,111 @@
+"use strict";
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { dismissFloatingTool, getFloatingTools, openFloatingTool, subscribeFloatingTools } from "./floatingToolStore.js";
+afterEach(() => getFloatingTools().forEach(tool => dismissFloatingTool(tool.id)));
+describe("floating tool registry", () => {
+  it("restores an existing id and keeps other tools intact", () => {
+    openFloatingTool({
+      id: "network",
+      render: () => null
+    });
+    openFloatingTool({
+      id: "recorder",
+      render: () => null
+    });
+    const first = getFloatingTools()[0].revealToken;
+    const other = getFloatingTools()[1];
+    openFloatingTool({
+      id: "network",
+      render: () => "updated"
+    });
+    expect(getFloatingTools()).toHaveLength(2);
+    expect(getFloatingTools()[0].revealToken).toBeGreaterThan(first);
+    expect(getFloatingTools()[1]).toBe(other);
+  });
+  it("publishes stable snapshots and isolates dismissal", () => {
+    const listener = vi.fn();
+    const unsubscribe = subscribeFloatingTools(listener);
+    openFloatingTool({
+      id: "one",
+      render: () => null
+    });
+    const snapshot = getFloatingTools();
+    expect(getFloatingTools()).toBe(snapshot);
+    dismissFloatingTool("missing");
+    expect(listener).toHaveBeenCalledTimes(1);
+    openFloatingTool({
+      id: "two",
+      render: () => null
+    });
+    dismissFloatingTool("one");
+    expect(getFloatingTools().map(tool => tool.id)).toEqual(["two"]);
+    unsubscribe();
+    dismissFloatingTool("two");
+    expect(listener).toHaveBeenCalledTimes(3);
+  });
+  it("rejects missing tool identities", () => {
+    expect(() => openFloatingTool({
+      id: "  ",
+      render: () => null
+    })).toThrow("non-empty id");
+    expect(getFloatingTools()).toHaveLength(0);
+  });
+});
+describe("persistent floating tools", () => {
+  it("restores after a fresh registry loads and remembers dismissal", async () => {
+    const values = new Map();
+    const storage = {
+      getItem: vi.fn(async key => values.get(key) ?? null),
+      setItem: vi.fn(async (key, value) => {
+        values.set(key, value);
+      })
+    };
+    const tool = {
+      id: "persisted",
+      render: () => null
+    };
+    vi.resetModules();
+    const first = await import("./floatingToolStore");
+    const disposeFirst = first.registerPersistentFloatingTool(tool, storage);
+    first.openFloatingTool(tool);
+    await vi.waitFor(() => expect(values.get("@buoy/floating-tool/persisted/open")).toBe("1"));
+    disposeFirst();
+    vi.resetModules();
+    const second = await import("./floatingToolStore");
+    const disposeSecond = second.registerPersistentFloatingTool(tool, storage);
+    await vi.waitFor(() => expect(second.getFloatingTools()).toHaveLength(1));
+    expect(second.getFloatingTools()[0].revealToken).toBe(0);
+    second.dismissFloatingTool(tool.id);
+    await vi.waitFor(() => expect(values.get("@buoy/floating-tool/persisted/open")).toBe("0"));
+    disposeSecond();
+    vi.resetModules();
+    const third = await import("./floatingToolStore");
+    const disposeThird = third.registerPersistentFloatingTool(tool, storage);
+    await Promise.resolve();
+    expect(third.getFloatingTools()).toHaveLength(0);
+    disposeThird();
+  });
+  it("does not reopen a tool closed while its saved state was loading", async () => {
+    vi.resetModules();
+    const registry = await import("./floatingToolStore");
+    let resolve;
+    const storage = {
+      getItem: () => new Promise(done => {
+        resolve = done;
+      }),
+      setItem: vi.fn(async () => {})
+    };
+    const tool = {
+      id: "race",
+      render: () => null
+    };
+    const dispose = registry.registerPersistentFloatingTool(tool, storage);
+    registry.openFloatingTool(tool);
+    registry.dismissFloatingTool(tool.id);
+    resolve("1");
+    await vi.waitFor(() => expect(storage.setItem).toHaveBeenLastCalledWith("@buoy/floating-tool/race/open", "0"));
+    expect(registry.getFloatingTools()).toHaveLength(0);
+    dispose();
+  });
+});

package/lib/module/sync/keyedArrays.js

@@ -0,0 +1,204 @@
+"use strict";
+
+/**
+ * Id-addressed list edits — one implementation, shared by every adapter that
+ * takes a merge patch.
+ *
+ * WHY. Resending a whole array is correct only when the caller has SEEN the
+ * whole array, and reads are capped. Measured with a 20-item list truncated to
+ * 5 (`pnpm ai:array --truncate=5`): the whole-array form scored 0/9 across three
+ * models — two refused outright, and one silently sent back only the 5 items it
+ * had been shown, destroying the other 15. Addressed edits scored 9/9.
+ *
+ * It also makes mass deletion impossible BY OMISSION: an addressed edit can only
+ * remove ids it names. Sending a real array still replaces the list, which is
+ * how a caller deliberately empties one.
+ *
+ * This lives here rather than in one adapter because react-query, zustand and
+ * network all take merge patches, and a second copy of a data-destroying safety
+ * rule is a copy that drifts.
+ */
+const isPlainObject = v => typeof v === "object" && v !== null && !Array.isArray(v);
+
+/** Fields we will treat as an item's stable identity, best first. */
+const ID_FIELDS = ["id", "lineId", "key", "uuid", "_id", "slug", "name"];
+
+/**
+ * The field that identifies items in this list, or undefined if there isn't one.
+ *
+ * Every item must carry it, and every value must be a distinct string/number —
+ * a duplicated id would make an addressed edit ambiguous, and silently picking
+ * the first match is exactly the kind of "helpful" guess that loses data.
+ */
+export function identityField(items) {
+  if (!items.length || !items.every(isPlainObject)) return undefined;
+  const first = items[0];
+  for (const f of ID_FIELDS) {
+    if (!(f in first)) continue;
+    const values = items.map(it => it[f]);
+    const usable = values.every(v => typeof v === "string" || typeof v === "number");
+    if (!usable) continue;
+    if (new Set(values.map(String)).size !== values.length) continue;
+    return f;
+  }
+  return undefined;
+}
+
+/**
+ * The identity an ADDED item should carry.
+ *
+ * `Object.entries` hands back STRING keys, so `{"9901": {id: 9901, …}}` was
+ * written as `{id: "9901"}` — the caller's own numeric id replaced by text, and
+ * then refused by the typed-edit guard as `[2].id: number → string`. The caller
+ * recovers by resending the WHOLE array, which is exactly the truncation-unsafe
+ * move this module exists to prevent. Measured on a live QA run: one added
+ * offer cost a refusal, a full-list retransmission and 35 seconds.
+ *
+ * So the id the caller WROTE wins. With no id in the body, the key is coerced
+ * to the type the existing items use, and only when the text round-trips
+ * exactly: "007" is not 7, and inventing that identity is worse than a refusal
+ * the caller can read.
+ */
+function identityForAdd(current, idField, key, edit) {
+  const supplied = edit[idField];
+  if (typeof supplied === "string" || typeof supplied === "number") {
+    // An item whose id disagrees with the address it was sent under is
+    // ambiguous — either could be the one the caller meant. Say so rather than
+    // silently picking one and writing an item nobody asked for.
+    if (String(supplied) !== key) {
+      return {
+        ok: false,
+        error: `The new item is addressed as \`${key}\` but carries \`${idField}\`: ${JSON.stringify(supplied)}. Use the same value for both — address it by the id it carries.`
+      };
+    }
+    return {
+      ok: true,
+      value: supplied
+    };
+  }
+  const numericList = current.every(it => typeof it[idField] === "number");
+  if (numericList && key.trim() !== "" && String(Number(key)) === key) {
+    return {
+      ok: true,
+      value: Number(key)
+    };
+  }
+  return {
+    ok: true,
+    value: key
+  };
+}
+
+/**
+ * Let a caller address list items by their own id instead of resending the list.
+ *
+ *   { lines: { "seed-1": { qty: 5 } } }   change one field of one item
+ *   { lines: { "seed-2": null } }         remove that item
+ *   { lines: { "new-1": { …all fields… } } }  append (id not already present)
+ *
+ * WHY THIS EXISTS. Resending the whole array is correct only when the caller has
+ * SEEN the whole array, and reads are capped — so on a long list the honest
+ * agents refuse and the careless ones send back only the items they were shown,
+ * silently destroying the rest. Measured: with a 20-item bag truncated to 5, the
+ * whole-array form scored 0/9 across three models and one of them deleted 15
+ * lines without a word. Addressed edits scored 9/9. (`pnpm ai:array`.)
+ *
+ * It also makes mass deletion impossible BY OMISSION: `lines: []` empties a bag,
+ * but a keyed edit can only remove ids it names.
+ *
+ * Returns the patch with keyed objects expanded into real arrays, so everything
+ * downstream — the typed-edit guard, the receipt, the store write — is unchanged
+ * and keeps all of its protections.
+ */
+export function expandKeyedArrays(current, patch, path = "", notes = []) {
+  if (Array.isArray(current) && isPlainObject(patch)) {
+    const idField = identityField(current);
+    if (!idField) {
+      // No stable identity: leave it alone and let the normal guard report the
+      // object-vs-array type change, which says something truer than we could.
+      return {
+        patch,
+        notes
+      };
+    }
+    const byId = new Map(current.map(it => [String(it[idField]), it]));
+    const next = current.slice();
+    let removed = 0;
+    let changed = 0;
+    let added = 0;
+    for (const [id, edit] of Object.entries(patch)) {
+      const i = next.findIndex(it => String(it[idField]) === id);
+      if (edit === null) {
+        if (i === -1) return {
+          patch,
+          notes
+        };
+        next.splice(i, 1);
+        removed++;
+      } else if (i === -1) {
+        if (!isPlainObject(edit)) return {
+          patch,
+          notes
+        };
+        const identity = identityForAdd(current, idField, id, edit);
+        if (!identity.ok) {
+          return {
+            patch,
+            notes,
+            error: identity.error
+          };
+        }
+        next.push({
+          ...edit,
+          [idField]: identity.value
+        });
+        added++;
+      } else {
+        const merged = expandKeyedArrays(byId.get(id), edit, `${path}[${id}]`, notes);
+        if (merged.error) return {
+          patch,
+          notes,
+          error: merged.error
+        };
+        const base = next[i];
+        next[i] = isPlainObject(base) && isPlainObject(merged.patch) ? {
+          ...base,
+          ...merged.patch
+        } : merged.patch;
+        changed++;
+      }
+    }
+    notes.push(`${path || "(root)"}: addressed by \`${idField}\` — ${changed} changed, ${added} added, ${removed} removed, ${next.length} item(s) remain`);
+    return {
+      patch: next,
+      notes
+    };
+  }
+  if (isPlainObject(current) && isPlainObject(patch)) {
+    const outPatch = {};
+    for (const [k, v] of Object.entries(patch)) {
+      const p = path ? `${path}.${k}` : k;
+      if (!(k in current)) {
+        outPatch[k] = v;
+        continue;
+      }
+      const inner = expandKeyedArrays(current[k], v, p, notes);
+      // A refusal deep in the tree is the whole patch's refusal: writing the
+      // rest of it would apply half of what the caller asked for.
+      if (inner.error) return {
+        patch,
+        notes,
+        error: inner.error
+      };
+      outPatch[k] = inner.patch;
+    }
+    return {
+      patch: outPatch,
+      notes
+    };
+  }
+  return {
+    patch,
+    notes
+  };
+}

package/lib/module/sync/toolActionRegistry.js

@@ -1,5 +1,6 @@
 "use strict";
 
+import { assertAccountAccess, hasAccountAccess, subscribeAccountAccess } from "../license/licenseModule.js";
 /**
  * toolActionRegistry — the on-device twin of the broker's action dispatch.
  *
@@ -56,13 +57,45 @@ function sources() {
 export function registerToolAdapters(getTools) {
   const set = sources();
   set.add(getTools);
+  let disposed = false;
+  const dispose = () => {
+    if (disposed) return;
+    disposed = true;
+    const raw = getTools();
+    // Private inverse operations only. No credential bypass reaches public dispatch.
+    const cleanup = async (toolId, action, params) => {
+      if (!(toolId === "network" && action === "deleteOverrideRule" || toolId === "impersonate" && action === "stopImpersonation")) {
+        throw new Error("Unsupported account-lock cleanup operation");
+      }
+      if (toolId === "impersonate") return raw[toolId]?.dispose?.(cleanup);
+      const fn = raw[toolId]?.actions?.[action];
+      if (!fn) throw new Error(`Cleanup unavailable for ${toolId}`);
+      return fn(params);
+    };
+    for (const adapter of Object.values(raw)) {
+      try {
+        Promise.resolve(adapter.dispose?.(cleanup)).catch(error => console.warn("[Buoy] Tool cleanup failed", error));
+      } catch (error) {
+        console.warn("[Buoy] Tool cleanup failed", error);
+      }
+    }
+  };
+  const off = subscribeAccountAccess(() => {
+    if (!hasAccountAccess()) dispose();else disposed = false;
+  });
   return () => {
+    off();
     set.delete(getTools);
+    // A second provider still owns these adapters during Strict Mode/remount.
+    Promise.resolve().then(() => {
+      if (set.size === 0) dispose();
+    });
   };
 }
 
 /** The merged adapter map across every live source. */
 export function getToolAdapters() {
+  if (!hasAccountAccess()) return {};
   const merged = {};
   for (const get of sources()) {
     try {
@@ -71,7 +104,7 @@ export function getToolAdapters() {
       // A source that throws must not take the whole registry down.
     }
   }
-  return merged;
+  return Object.fromEntries(Object.entries(merged).map(([id, adapter]) => [id, guardToolAdapter(adapter)]));
 }
 
 /** Tool ids currently dispatchable. */
@@ -111,6 +144,7 @@ export function listSnapshotToolIds() {
  * an adapter is free to make this a promise later without breaking them.
  */
 export async function readToolSnapshot(toolId) {
+  assertAccountAccess();
   const tools = getToolAdapters();
   const adapter = tools[toolId];
   if (!adapter) throw new Error(`Unknown tool "${toolId}"`);
@@ -120,7 +154,7 @@ export async function readToolSnapshot(toolId) {
   return await adapter.getSnapshot();
 }
 export function isToolRegistryReady() {
-  return sources().size > 0;
+  return hasAccountAccess() && sources().size > 0;
 }
 
 /**
@@ -129,6 +163,7 @@ export function isToolRegistryReady() {
  * surface as plain messages rather than objects nobody can read on a phone.
  */
 export async function dispatchToolAction(toolId, action, params) {
+  assertAccountAccess();
   const tools = getToolAdapters();
   const tool = tools[toolId];
   const fn = tool?.actions?.[action];
@@ -151,4 +186,51 @@ export async function waitForToolRegistry(timeoutMs = 2000) {
     if (isToolRegistryReady()) return true;
   }
   return false;
+}
+
+/** Guard retained references too, and discard results completed after revocation. */
+export function guardToolAdapter(adapter) {
+  const guard = fn => (...args) => {
+    assertAccountAccess();
+    let revoked = false;
+    const off = subscribeAccountAccess(() => {
+      if (!hasAccountAccess()) revoked = true;
+    });
+    const check = () => {
+      if (revoked) throw new Error("Buoy account access ended while the operation was pending.");
+      assertAccountAccess();
+    };
+    try {
+      const result = fn.apply(adapter, args);
+      if (result && typeof result.then === "function") {
+        return Promise.resolve(result).then(value => {
+          check();
+          return value;
+        }).finally(off);
+      }
+      check();
+      off();
+      return result;
+    } catch (error) {
+      off();
+      throw error;
+    }
+  };
+  return {
+    ...adapter,
+    ...(adapter.getSnapshot ? {
+      getSnapshot: guard(adapter.getSnapshot)
+    } : {}),
+    ...(adapter.actions ? {
+      actions: Object.fromEntries(Object.entries(adapter.actions).map(([name, action]) => [name, guard(action)]))
+    } : {}),
+    ...(adapter.subscribe ? {
+      subscribe: listener => {
+        assertAccountAccess();
+        return adapter.subscribe(() => {
+          if (hasAccountAccess()) listener();
+        });
+      }
+    } : {})
+  };
 }