@elizaos/app-core 2.0.0-beta.3 → 2.0.11-beta.6

package/services/tunnel-to-mobile/tunnel-to-mobile-client.js

@@ -0,0 +1,190 @@
+/**
+ * TunnelToMobileClient — Mac-side dialer for an agent hosted on a phone.
+ *
+ * Inverse of the existing phone→Mac device-bridge. The phone in
+ * `tunnel-to-mobile` mode holds an outbound connection to a relay
+ * (Eliza Cloud managed gateway relay by default — see
+ * `eliza/plugins/plugin-elizacloud/src/services/cloud-managed-gateway-relay.ts`).
+ * This client dials the same relay from the user's Mac and lets the
+ * existing `DeviceBridge` machinery treat the phone-hosted agent as if
+ * it were any other device on the LAN.
+ *
+ * Responsibilities:
+ *   - Opens a WebSocket to the relay with the configured pairing
+ *     credentials.
+ *   - Forwards frames into a caller-provided handler (typically the
+ *     same `DeviceBridge.handleConnection` path that an inbound device
+ *     would hit) so the Mac-side agent runtime treats the bridged
+ *     phone as a registered device.
+ *   - Reports state transitions for the UI.
+ */
+/**
+ * Mac-side client. Construct with `TunnelToMobileClient.start(...)` to
+ * get a started instance, or `new TunnelToMobileClient(...)` if you want
+ * to manage the lifecycle yourself.
+ */
+export class TunnelToMobileClient {
+    socket = null;
+    state = "idle";
+    options;
+    ctor;
+    stopped = false;
+    reconnectTimer = null;
+    backoffMs = 800;
+    constructor(options) {
+        this.options = options;
+        const ctor = options.webSocketCtor ?? resolveDefaultWebSocketCtor();
+        if (!ctor) {
+            throw new Error("TunnelToMobileClient requires a WebSocket implementation; none was provided and no global WebSocket is available");
+        }
+        this.ctor = ctor;
+    }
+    static start(options) {
+        const client = new TunnelToMobileClient(options);
+        client.connect();
+        return client;
+    }
+    getState() {
+        return this.state;
+    }
+    connect() {
+        if (this.stopped)
+            return;
+        if (this.socket)
+            return;
+        this.transition("connecting");
+        let url;
+        try {
+            const parsed = new URL(this.options.relayUrl);
+            parsed.searchParams.set("deviceId", this.options.remoteDeviceId);
+            if (this.options.pairingToken) {
+                parsed.searchParams.set("token", this.options.pairingToken);
+            }
+            url = parsed.toString();
+        }
+        catch {
+            this.transition("error", `Invalid relay URL: ${this.options.relayUrl}`);
+            return;
+        }
+        let socket;
+        try {
+            socket = new this.ctor(url);
+        }
+        catch (err) {
+            this.transition("error", err instanceof Error ? err.message : "WebSocket constructor failed");
+            this.scheduleReconnect();
+            return;
+        }
+        this.socket = socket;
+        socket.addEventListener("open", () => {
+            this.backoffMs = 800;
+            this.transition("connected");
+            this.sendRegistration();
+        });
+        socket.addEventListener("message", (event) => {
+            const raw = typeof event.data === "string"
+                ? event.data
+                : event.data instanceof ArrayBuffer
+                    ? new TextDecoder().decode(event.data)
+                    : typeof Buffer !== "undefined" && event.data instanceof Buffer
+                        ? event.data.toString("utf8")
+                        : String(event.data);
+            let frame;
+            try {
+                frame = JSON.parse(raw);
+            }
+            catch {
+                return;
+            }
+            try {
+                this.options.onFrame(frame);
+            }
+            catch {
+                // The caller is responsible for its own errors; swallow so a
+                // bad frame handler does not tear down the tunnel.
+            }
+        });
+        socket.addEventListener("close", (event) => {
+            this.socket = null;
+            if (this.stopped) {
+                this.transition("disconnected", event.reason);
+                return;
+            }
+            this.transition("reconnecting", event.reason);
+            this.scheduleReconnect();
+        });
+        socket.addEventListener("error", (event) => {
+            const detail = event && typeof event === "object" && "message" in event
+                ? String(event.message)
+                : "WebSocket error";
+            this.transition("error", detail);
+        });
+    }
+    stop() {
+        this.stopped = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = null;
+        }
+        if (this.socket) {
+            try {
+                this.socket.close(1000, "Client stop");
+            }
+            catch {
+                /* best effort */
+            }
+            this.socket = null;
+        }
+        this.transition("disconnected", "Client stop");
+    }
+    /**
+     * Send a frame back through the tunnel to the phone. Wrapped in a
+     * helper so the caller doesn't reach into the WebSocket directly.
+     */
+    sendFrame(frame) {
+        if (!this.socket)
+            return false;
+        if (this.socket.readyState !== 1 /* OPEN */)
+            return false;
+        try {
+            this.socket.send(JSON.stringify(frame));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    sendRegistration() {
+        this.sendFrame({
+            type: "tunnel.register",
+            role: "mac-client",
+            remoteDeviceId: this.options.remoteDeviceId,
+        });
+    }
+    scheduleReconnect() {
+        if (this.stopped || this.reconnectTimer)
+            return;
+        const delay = this.backoffMs;
+        this.backoffMs = Math.min(this.backoffMs * 1.7, 15_000);
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = null;
+            this.connect();
+        }, delay);
+    }
+    transition(next, detail) {
+        this.state = next;
+        if (this.options.onStateChange) {
+            try {
+                this.options.onStateChange(next, detail);
+            }
+            catch {
+                /* the caller's state listener is best-effort */
+            }
+        }
+    }
+}
+function resolveDefaultWebSocketCtor() {
+    const globalWebSocket = globalThis
+        .WebSocket;
+    return globalWebSocket ?? null;
+}

package/services/vault-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-bootstrap.d.ts","sourceRoot":"","sources":["../../../../../src/services/vault-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAaH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAK5C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAuLD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAgD/B"}
+{"version":3,"file":"vault-bootstrap.d.ts","sourceRoot":"","sources":["../../../../../src/services/vault-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAgCH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AA4C5C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,UAAU,qBAAqB;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AA4LD,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,qBAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC,CAkE/B"}

package/services/vault-bootstrap.js

@@ -15,10 +15,29 @@
  * only keys not already in the vault get re-attempted. Per-key
  * failures are isolated; if every write fails the function throws.
  */
-import { formatVaultRef, isVaultRef, loadElizaConfig, persistConfigEnv, readConfigEnv, resolveStateDir, saveElizaConfig, } from "@elizaos/agent";
 import { logger } from "@elizaos/core";
-import { loadRegistry } from "../registry";
-import { sharedVault } from "./vault-mirror";
+import { loadRegistry } from "../registry/index.js";
+import { sharedVault } from "./vault-mirror.js";
+var bridgeCache = null;
+async function agentBridge() {
+    if (bridgeCache)
+        return bridgeCache;
+    // Dynamic import defers the agent ↔ app-core edge until after both
+    // modules have fully evaluated. By the time this runs the runVaultBootstrap
+    // call site is already inside an async function body, so the cycle is
+    // long closed.
+    const mod = (await import("@elizaos/agent"));
+    bridgeCache = {
+        formatVaultRef: mod.formatVaultRef,
+        isVaultRef: mod.isVaultRef,
+        loadElizaConfig: mod.loadElizaConfig,
+        persistConfigEnv: mod.persistConfigEnv,
+        readConfigEnv: mod.readConfigEnv,
+        resolveStateDir: mod.resolveStateDir,
+        saveElizaConfig: mod.saveElizaConfig,
+    };
+    return bridgeCache;
+}
 // Inlined helper instead of a `const ENV_VAR_KEY = /.../` module-scope
 // binding because Bun.build (1.3.13) collapses such top-level `const` regex
 // literals into `var ENV_VAR_KEY` declarations whose initialiser sits inside
@@ -53,7 +72,7 @@ function isPlainRecord(value) {
  * pushing sensitive plaintext values to the vault and replacing them with
  * sentinels. Returns the keys we attempted to migrate plus the failures.
  */
-async function migrateElizaJson(config, vault, sensitiveKeys) {
+async function migrateElizaJson(config, vault, sensitiveKeys, bridge) {
     const migrated = [];
     const skipped = [];
     const failed = [];
@@ -62,7 +81,7 @@ async function migrateElizaJson(config, vault, sensitiveKeys) {
         const value = container[key];
         if (typeof value !== "string" || value.length === 0)
             return;
-        if (isVaultRef(value)) {
+        if (bridge.isVaultRef(value)) {
             skipped.push(key);
             return;
         }
@@ -71,7 +90,7 @@ async function migrateElizaJson(config, vault, sensitiveKeys) {
             return;
         try {
             await vault.set(key, value, { sensitive: true });
-            container[key] = formatVaultRef(key);
+            container[key] = bridge.formatVaultRef(key);
             migrated.push(key);
             mutated = true;
         }
@@ -114,15 +133,15 @@ async function migrateElizaJson(config, vault, sensitiveKeys) {
     }
     return { migrated, skipped, failed, mutated };
 }
-async function migrateConfigEnvFile(stateDir, vault, sensitiveKeys) {
+async function migrateConfigEnvFile(stateDir, vault, sensitiveKeys, bridge) {
     const migrated = [];
     const skipped = [];
     const failed = [];
-    const entries = await readConfigEnv(stateDir);
+    const entries = await bridge.readConfigEnv(stateDir);
     for (const [key, value] of Object.entries(entries)) {
         if (typeof value !== "string" || value.length === 0)
             continue;
-        if (isVaultRef(value)) {
+        if (bridge.isVaultRef(value)) {
             skipped.push(key);
             continue;
         }
@@ -131,7 +150,9 @@ async function migrateConfigEnvFile(stateDir, vault, sensitiveKeys) {
             continue;
         try {
             await vault.set(key, value, { sensitive: true });
-            await persistConfigEnv(key, formatVaultRef(key), { stateDir });
+            await bridge.persistConfigEnv(key, bridge.formatVaultRef(key), {
+                stateDir,
+            });
             migrated.push(key);
         }
         catch (err) {
@@ -141,7 +162,7 @@ async function migrateConfigEnvFile(stateDir, vault, sensitiveKeys) {
     }
     return { migrated, skipped, failed };
 }
-async function mirrorProcessEnvSensitive(vault, sensitiveKeys, seenKeys) {
+async function mirrorProcessEnvSensitive(vault, sensitiveKeys, seenKeys, bridge) {
     const migrated = [];
     const failed = [];
     for (const [key, rawValue] of Object.entries(process.env)) {
@@ -151,7 +172,7 @@ async function mirrorProcessEnvSensitive(vault, sensitiveKeys, seenKeys) {
             continue;
         if (typeof rawValue !== "string" || rawValue.length === 0)
             continue;
-        if (isVaultRef(rawValue))
+        if (bridge.isVaultRef(rawValue))
             continue;
         const isSensitive = sensitiveKeys.has(key) || inferSensitiveByHeuristic(key);
         if (!isSensitive)
@@ -170,15 +191,19 @@ async function mirrorProcessEnvSensitive(vault, sensitiveKeys, seenKeys) {
     return { migrated, failed };
 }
 export async function runVaultBootstrap(opts = {}) {
-    const stateDir = opts.stateDir ?? resolveStateDir();
+    // Resolve the lazy agent bridge ONCE here; everything downstream gets it
+    // injected. Single resolution point also keeps the cycle-breaking dynamic
+    // import a single network/syscall hop instead of one per helper.
+    const bridge = await agentBridge();
+    const stateDir = opts.stateDir ?? bridge.resolveStateDir();
     const vault = opts.vault ?? sharedVault();
     const sensitiveKeys = sensitiveKeysFromRegistry();
-    const config = loadElizaConfig();
-    const json = await migrateElizaJson(config, vault, sensitiveKeys);
+    const config = bridge.loadElizaConfig();
+    const json = await migrateElizaJson(config, vault, sensitiveKeys, bridge);
     if (json.mutated) {
-        saveElizaConfig(config);
+        bridge.saveElizaConfig(config);
     }
-    const env = await migrateConfigEnvFile(stateDir, vault, sensitiveKeys);
+    const env = await migrateConfigEnvFile(stateDir, vault, sensitiveKeys, bridge);
     // Skip keys we already attempted (success or fail) so process.env
     // mirroring doesn't double-count keys that just failed against the json
     // file or the config.env file.
@@ -188,13 +213,15 @@ export async function runVaultBootstrap(opts = {}) {
         ...env.migrated,
         ...env.failed,
     ]);
-    const proc = await mirrorProcessEnvSensitive(vault, sensitiveKeys, seen);
+    const proc = await mirrorProcessEnvSensitive(vault, sensitiveKeys, seen, bridge);
     const migratedKeys = [...json.migrated, ...env.migrated, ...proc.migrated];
     const skippedKeys = [...json.skipped, ...env.skipped];
     const failedKeys = [...json.failed, ...env.failed, ...proc.failed];
-    const attempted = migratedKeys.length + failedKeys.length;
-    if (attempted > 0 && migratedKeys.length === 0) {
-        throw new Error(`[vault-bootstrap] all ${failedKeys.length} secret writes failed; vault unreachable`);
+    const persistentMigratedKeys = [...json.migrated, ...env.migrated];
+    const persistentFailedKeys = [...json.failed, ...env.failed];
+    const persistentAttempted = persistentMigratedKeys.length + persistentFailedKeys.length;
+    if (persistentAttempted > 0 && persistentMigratedKeys.length === 0) {
+        throw new Error(`[vault-bootstrap] all ${persistentFailedKeys.length} persistent secret writes failed; vault unreachable`);
     }
     if (migratedKeys.length > 0 || failedKeys.length > 0) {
         logger.info(`[vault-bootstrap] migrated=${migratedKeys.length} skipped=${skippedKeys.length} failed=${failedKeys.length}`);

package/services/vault-mirror.d.ts

@@ -1,7 +1,7 @@
 /**
  * Write-through mirror to @elizaos/vault for plugin sensitive fields.
  *
- * Extracted from plugins-compat-routes.ts so unit tests can exercise the
+ * Extracted from plugins-routes.ts so unit tests can exercise the
  * mirror logic without dragging in the entire @elizaos/agent runtime.
  *
  * Concurrency: the vault PUT path is hit concurrently when the UI saves

package/services/vault-mirror.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault-mirror.d.ts","sourceRoot":"","sources":["../../../../../src/services/vault-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAIhF,wBAAgB,oBAAoB,IAAI,cAAc,CAGrD;AAED,wBAAgB,WAAW,IAAI,KAAK,CAEnC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,KAAK,GAAG,IAAW,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAE,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,EAClE,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgCjC"}
+{"version":3,"file":"vault-mirror.d.ts","sourceRoot":"","sources":["../../../../../src/services/vault-mirror.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAiBhF,wBAAgB,oBAAoB,IAAI,cAAc,CAarD;AAED,wBAAgB,WAAW,IAAI,KAAK,CAEnC;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,GAAE,KAAK,GAAG,IAAW,GAAG,IAAI,CAE3E;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,4BAA4B,CAChD,MAAM,EAAE;IAAE,UAAU,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,EAClE,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAgCjC"}

package/services/vault-mirror.js

@@ -1,7 +1,7 @@
 /**
  * Write-through mirror to @elizaos/vault for plugin sensitive fields.
  *
- * Extracted from plugins-compat-routes.ts so unit tests can exercise the
+ * Extracted from plugins-routes.ts so unit tests can exercise the
  * mirror logic without dragging in the entire @elizaos/agent runtime.
  *
  * Concurrency: the vault PUT path is hit concurrently when the UI saves
@@ -12,11 +12,34 @@
 import { logger } from "@elizaos/core";
 import { asRecord } from "@elizaos/shared";
 import { createManager } from "@elizaos/vault";
-let cachedManager = null;
+// Cache for the lazily-created process-wide SecretsManager facade.
+//
+// TDZ-hardening: this module sits in a circular-import chain that runs through
+// vault-bootstrap.ts → loadRegistry (../registry) → … → back into app-core,
+// which on Bun's strict ESM evaluator can re-enter `sharedSecretsManager()`
+// before the top-level initializer of `vault-mirror.ts` finishes running. A
+// bare `let cachedManager = null` would be in the temporal dead zone at that
+// moment and throw `Cannot access 'cachedManager' before initialization`,
+// which surfaced at boot as `[vault-bootstrap]` failing and the agent never
+// binding to port 31337 (live-USB symptom). A module-level `let` of a
+// container object dodges TDZ because the container is hoisted with its
+// `undefined` initializer in the var-environment phase, and the only access
+// path goes through `state.manager` which is just an object property read.
+var state = { manager: null };
 export function sharedSecretsManager() {
-    if (!cachedManager)
-        cachedManager = createManager();
-    return cachedManager;
+    // Self-heal: if a circular import re-entered us before the module-top
+    // `var state = {…}` initializer line ran, hoisted `state` is still
+    // `undefined`. Lazily initialize the container so we never throw and
+    // downstream callers see a stable `{ manager: null }` after first access.
+    // Defensive: the primary fix is breaking the cycle (see
+    // `vault-bootstrap.ts` agent-bridge lazy import), but this guard keeps
+    // cycle regressions from silently bricking boot.
+    if (!state) {
+        state = { manager: null };
+    }
+    if (!state.manager)
+        state.manager = createManager();
+    return state.manager;
 }
 export function sharedVault() {
     return sharedSecretsManager().vault;
@@ -27,7 +50,7 @@ export function sharedVault() {
  * Also lets tests inject a test vault built via `createTestVault`.
  */
 export function _resetSharedVaultForTesting(next = null) {
-    cachedManager = next ? createManager({ vault: next }) : null;
+    state.manager = next ? createManager({ vault: next }) : null;
 }
 /**
  * Write-through mirror to @elizaos/vault. Iterates the plugin's

package/services/voice-profiles/diarization-pipeline.d.ts

@@ -0,0 +1,6 @@
+import type { DiarizationSegment } from "./types.ts";
+export interface DiarizationPipeline {
+    diarize(audioRef: string): Promise<DiarizationSegment[]>;
+}
+export declare const MOCK_DIARIZATION_PIPELINE: DiarizationPipeline;
+//# sourceMappingURL=diarization-pipeline.d.ts.map

package/services/voice-profiles/diarization-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diarization-pipeline.d.ts","sourceRoot":"","sources":["../../../../../../src/services/voice-profiles/diarization-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAErD,MAAM,WAAW,mBAAmB;IAClC,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAAC;CAC1D;AAED,eAAO,MAAM,yBAAyB,EAAE,mBAkBvC,CAAC"}

package/services/voice-profiles/diarization-pipeline.js

@@ -0,0 +1,20 @@
+export const MOCK_DIARIZATION_PIPELINE = {
+    async diarize(audioRef) {
+        if (audioRef.length === 0)
+            return [];
+        return [
+            {
+                startMs: 0,
+                endMs: 1_000,
+                profileId: "mock-speaker-a",
+                confidence: 0.8,
+            },
+            {
+                startMs: 1_000,
+                endMs: 2_000,
+                profileId: "mock-speaker-b",
+                confidence: 0.7,
+            },
+        ];
+    },
+};

package/services/voice-profiles/index.d.ts

@@ -0,0 +1,12 @@
+export type { DiarizationPipeline } from "./diarization-pipeline.ts";
+export { MOCK_DIARIZATION_PIPELINE } from "./diarization-pipeline.ts";
+export type { NicknameEvaluator, NicknameProposal, } from "./nickname-evaluator.ts";
+export { NAIVE_NICKNAME_EVALUATOR } from "./nickname-evaluator.ts";
+export type { OwnerConfidenceInput } from "./owner-confidence.ts";
+export { scoreOwnerConfidence } from "./owner-confidence.ts";
+export type { ChallengeService, InMemoryChallengeServiceOptions, } from "./private-challenge.ts";
+export { InMemoryChallengeService } from "./private-challenge.ts";
+export type { VoiceProfileSearchHit, VoiceProfileStore } from "./store.ts";
+export { InMemoryVoiceProfileStore } from "./store.ts";
+export type { DiarizationSegment, OwnerChallenge, OwnerConfidence, VoiceEmbeddingSummary, VoiceProfile, VoiceProfileQuality, } from "./types.ts";
+//# sourceMappingURL=index.d.ts.map

package/services/voice-profiles/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../src/services/voice-profiles/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,YAAY,EACV,iBAAiB,EACjB,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,YAAY,EACV,gBAAgB,EAChB,+BAA+B,GAChC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,YAAY,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AACvD,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/services/voice-profiles/index.js

@@ -0,0 +1,5 @@
+export { MOCK_DIARIZATION_PIPELINE } from "./diarization-pipeline.js";
+export { NAIVE_NICKNAME_EVALUATOR } from "./nickname-evaluator.js";
+export { scoreOwnerConfidence } from "./owner-confidence.js";
+export { InMemoryChallengeService } from "./private-challenge.js";
+export { InMemoryVoiceProfileStore } from "./store.js";

package/services/voice-profiles/nickname-evaluator.d.ts

@@ -0,0 +1,14 @@
+export interface NicknameProposal {
+    nickname: string;
+    subject: "owner" | "household";
+    confidence: number;
+    supportingTranscriptId: string;
+}
+export interface NicknameEvaluator {
+    evaluate(transcript: {
+        id: string;
+        text: string;
+    }[]): Promise<NicknameProposal[]>;
+}
+export declare const NAIVE_NICKNAME_EVALUATOR: NicknameEvaluator;
+//# sourceMappingURL=nickname-evaluator.d.ts.map

package/services/voice-profiles/nickname-evaluator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nickname-evaluator.d.ts","sourceRoot":"","sources":["../../../../../../src/services/voice-profiles/nickname-evaluator.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,GAAG,WAAW,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CACN,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,GACzC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;CAChC;AAgCD,eAAO,MAAM,wBAAwB,EAAE,iBAuBtC,CAAC"}

package/services/voice-profiles/nickname-evaluator.js

@@ -0,0 +1,46 @@
+const NAME_TOKEN = "[A-Z][a-zA-Z'\\-]{0,30}";
+const PATTERNS = [
+    {
+        regex: new RegExp(`\\bcall me (${NAME_TOKEN})\\b`),
+        subject: "owner",
+        confidence: 0.85,
+    },
+    {
+        regex: new RegExp(`\\bmy name is (${NAME_TOKEN})\\b`),
+        subject: "owner",
+        confidence: 0.95,
+    },
+    {
+        regex: new RegExp(`\\bI go by (${NAME_TOKEN})\\b`),
+        subject: "owner",
+        confidence: 0.8,
+    },
+];
+function trimNickname(raw) {
+    return raw.replace(/[\s.,!?;:]+$/, "").trim();
+}
+export const NAIVE_NICKNAME_EVALUATOR = {
+    async evaluate(transcript) {
+        const out = [];
+        for (const entry of transcript) {
+            for (const pattern of PATTERNS) {
+                const m = pattern.regex.exec(entry.text);
+                if (m === null)
+                    continue;
+                const captured = m[1];
+                if (captured === undefined)
+                    continue;
+                const nickname = trimNickname(captured);
+                if (nickname.length === 0)
+                    continue;
+                out.push({
+                    nickname,
+                    subject: pattern.subject,
+                    confidence: pattern.confidence,
+                    supportingTranscriptId: entry.id,
+                });
+            }
+        }
+        return out;
+    },
+};

package/services/voice-profiles/owner-confidence.d.ts

@@ -0,0 +1,10 @@
+import type { OwnerConfidence } from "./types.ts";
+export interface OwnerConfidenceInput {
+    voiceSimilarityToOwnerProfile: number;
+    deviceTrustLevel: "low" | "medium" | "high";
+    recentlyAuthenticated: boolean;
+    contextExpectsOwner: boolean;
+    challengeRecentlyPassed: boolean;
+}
+export declare function scoreOwnerConfidence(input: OwnerConfidenceInput): OwnerConfidence;
+//# sourceMappingURL=owner-confidence.d.ts.map

package/services/voice-profiles/owner-confidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner-confidence.d.ts","sourceRoot":"","sources":["../../../../../../src/services/voice-profiles/owner-confidence.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,6BAA6B,EAAE,MAAM,CAAC;IACtC,gBAAgB,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC5C,qBAAqB,EAAE,OAAO,CAAC;IAC/B,mBAAmB,EAAE,OAAO,CAAC;IAC7B,uBAAuB,EAAE,OAAO,CAAC;CAClC;AAaD,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,GAC1B,eAAe,CAoCjB"}

package/services/voice-profiles/owner-confidence.js

@@ -0,0 +1,38 @@
+const DEVICE_TRUST_WEIGHT = {
+    low: 0.0,
+    medium: 0.1,
+    high: 0.2,
+};
+const CHALLENGE_WEIGHT = 0.45;
+const RECENT_AUTH_WEIGHT = 0.35;
+const VOICE_WEIGHT_CAP = 0.25;
+const CONTEXT_WEIGHT = 0.1;
+export function scoreOwnerConfidence(input) {
+    const reasons = [];
+    let score = 0;
+    if (input.challengeRecentlyPassed) {
+        score += CHALLENGE_WEIGHT;
+        reasons.push("challenge-recently-passed");
+    }
+    if (input.recentlyAuthenticated) {
+        score += RECENT_AUTH_WEIGHT;
+        reasons.push("recently-authenticated");
+    }
+    const clampedVoice = Math.max(0, Math.min(1, input.voiceSimilarityToOwnerProfile));
+    if (clampedVoice > 0) {
+        const voiceContribution = clampedVoice * VOICE_WEIGHT_CAP;
+        score += voiceContribution;
+        reasons.push(`voice-similarity:${clampedVoice.toFixed(2)}`);
+    }
+    const trust = DEVICE_TRUST_WEIGHT[input.deviceTrustLevel];
+    if (trust > 0) {
+        score += trust;
+        reasons.push(`device-trust:${input.deviceTrustLevel}`);
+    }
+    if (input.contextExpectsOwner) {
+        score += CONTEXT_WEIGHT;
+        reasons.push("context-expects-owner");
+    }
+    const clamped = Math.max(0, Math.min(1, score));
+    return { score: clamped, reasons };
+}

package/services/voice-profiles/private-challenge.d.ts

@@ -0,0 +1,20 @@
+import type { OwnerChallenge } from "./types.ts";
+export interface ChallengeService {
+    issue(seed?: string): Promise<OwnerChallenge>;
+    verify(id: string, answer: string): Promise<boolean>;
+}
+export interface InMemoryChallengeServiceOptions {
+    now?: () => number;
+    ttlMs?: number;
+    expectedAnswer?: string;
+}
+export declare class InMemoryChallengeService implements ChallengeService {
+    private readonly now;
+    private readonly ttlMs;
+    private readonly expectedAnswer;
+    private readonly active;
+    constructor(options?: InMemoryChallengeServiceOptions);
+    issue(seed?: string): Promise<OwnerChallenge>;
+    verify(id: string, answer: string): Promise<boolean>;
+}
+//# sourceMappingURL=private-challenge.d.ts.map

package/services/voice-profiles/private-challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"private-challenge.d.ts","sourceRoot":"","sources":["../../../../../../src/services/voice-profiles/private-challenge.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,+BAA+B;IAC9C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAQD,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;gBAEhD,OAAO,GAAE,+BAAoC;IAMnD,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAW3D"}