@jungjaehoon/mama-os 0.53.0 → 0.57.0

package/dist/api/viewer-server.js

@@ -0,0 +1,933 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createViewerServer = createViewerServer;
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_http_1 = require("node:http");
+const node_path_1 = require("node:path");
+const auth_middleware_js_1 = require("./auth-middleware.js");
+const cf_access_js_1 = require("./cf-access.js");
+const security_events_js_1 = require("./security-events.js");
+const viewer_request_security_js_1 = require("./viewer-request-security.js");
+const wiki_read_js_1 = require("../wiki/wiki-read.js");
+const viewer_data_js_1 = require("./viewer-data.js");
+const GRAPH_KINDS = new Set([
+    'memory',
+    'case',
+    'report',
+    'edge',
+    'raw',
+    'registry',
+    'observation',
+    'entity',
+]);
+const CONTENT_TYPES = {
+    '.css': 'text/css; charset=utf-8',
+    '.html': 'text/html; charset=utf-8',
+    '.ico': 'image/x-icon',
+    '.js': 'application/javascript; charset=utf-8',
+    '.json': 'application/json; charset=utf-8',
+    '.png': 'image/png',
+    '.svg': 'image/svg+xml',
+};
+class ViewerHttpError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.status = status;
+        this.code = code;
+        this.name = 'ViewerHttpError';
+    }
+}
+function viewerDirectory() {
+    const moduleDirectory = __dirname;
+    const candidates = [
+        process.env.MAMA_VIEWER_DIR,
+        (0, node_path_1.join)(process.cwd(), 'packages', 'standalone', 'public', 'viewer'),
+        (0, node_path_1.resolve)(moduleDirectory, '../../public/viewer'),
+        (0, node_path_1.resolve)(moduleDirectory, '../../../public/viewer'),
+    ].filter((candidate) => typeof candidate === 'string');
+    for (const candidate of candidates) {
+        if ((0, node_fs_1.existsSync)(candidate) && (0, node_fs_1.statSync)(candidate).isDirectory())
+            return candidate;
+    }
+    throw new Error('Viewer assets are not installed');
+}
+function resolveApiPort(value) {
+    if (value === undefined)
+        return 3847;
+    const port = Number(value);
+    if (!Number.isInteger(port) || port < 1024 || port > 65535) {
+        throw new Error(`MAMA_API_PORT must be an integer port between 1024 and 65535, got: ${value}`);
+    }
+    return port;
+}
+function json(res, status, value) {
+    res.writeHead(status, { 'Content-Type': 'application/json; charset=utf-8' });
+    res.end(JSON.stringify(value));
+}
+function requestError(error) {
+    // A ViewerHttpError carries a fixed host message; only unexpected errors are hidden from clients.
+    if (error instanceof ViewerHttpError) {
+        return { status: error.status, code: error.code, message: error.message };
+    }
+    (0, viewer_request_security_js_1.logViewerInternalError)(error);
+    return { status: 500, code: 'VIEWER_INTERNAL_ERROR', message: 'Internal server error' };
+}
+function parseLimit(params, defaultValue, maximum) {
+    const raw = params.get('limit');
+    if (raw === null)
+        return defaultValue;
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value < 1 || value > maximum) {
+        throw new ViewerHttpError(400, 'INVALID_LIMIT', `limit must be an integer from 1 to ${maximum}`);
+    }
+    return value;
+}
+function parseKinds(params) {
+    const raw = params.get('kind');
+    if (raw === null || raw.trim() === '')
+        return [];
+    const values = [
+        ...new Set(raw
+            .split(',')
+            .map((kind) => kind.trim())
+            .filter(Boolean)),
+    ];
+    const unsupported = values.filter((kind) => !GRAPH_KINDS.has(kind));
+    if (unsupported.length > 0) {
+        throw new ViewerHttpError(400, 'INVALID_GRAPH_KIND', `Unsupported graph kind: ${unsupported.join(', ')}`);
+    }
+    return values;
+}
+function actionFailureStatus(result) {
+    if (result.error.kind === 'invalid_input')
+        return 400;
+    if (result.error.kind === 'denied')
+        return 403;
+    if (result.error.kind === 'unknown_action')
+        return 501;
+    return 502;
+}
+function graphRef(value) {
+    const split = value.indexOf(':');
+    if (split < 1 || split === value.length - 1)
+        return null;
+    const kind = value.slice(0, split);
+    if (!GRAPH_KINDS.has(kind))
+        return null;
+    return { kind, id: value.slice(split + 1) };
+}
+const OPEN_WORK_STATUSES = ['pending', 'in_progress', 'review', 'blocked'];
+/** The ledger records "unconfirmed" when no observation points to an assignee. */
+function confirmedAssignee(value) {
+    return (typeof value === 'string' && value.trim() !== '' && value.trim().toLowerCase() !== 'unconfirmed');
+}
+function notAvailable() {
+    return { reason: 'not available in this build' };
+}
+function wikiFrontmatter(raw) {
+    const match = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
+    if (!match)
+        return { frontmatter: {}, content: raw };
+    const frontmatter = {};
+    for (const line of match[1].split('\n')) {
+        const separator = line.indexOf(':');
+        if (separator > 0) {
+            frontmatter[line.slice(0, separator).trim()] = line.slice(separator + 1).trim();
+        }
+    }
+    return { frontmatter, content: match[2] };
+}
+function addWikiPath(root, path) {
+    const parts = path.split('/');
+    let nodes = root;
+    let prefix = '';
+    parts.forEach((name, index) => {
+        prefix = prefix === '' ? name : `${prefix}/${name}`;
+        const type = index === parts.length - 1 ? 'file' : 'directory';
+        let node = nodes.find((candidate) => candidate.name === name && candidate.type === type);
+        if (!node) {
+            node = { name, path: prefix, type };
+            if (type === 'directory')
+                node.children = [];
+            nodes.push(node);
+            nodes.sort((left, right) => left.type === right.type
+                ? left.name.localeCompare(right.name)
+                : left.type === 'directory'
+                    ? -1
+                    : 1);
+        }
+        nodes = node.children ?? [];
+    });
+}
+function wikiTree(root) {
+    const paths = [];
+    let cursor = null;
+    let version;
+    do {
+        const page = (0, wiki_read_js_1.listWikiPages)({
+            root,
+            ...(cursor === null ? {} : { cursor }),
+            ...(version === undefined ? {} : { version }),
+            limit: wiki_read_js_1.WIKI_LIST_MAX_PATHS,
+        });
+        paths.push(...page.paths);
+        cursor = page.nextCursor;
+        version = page.readVersion;
+    } while (cursor !== null);
+    const tree = [];
+    for (const path of paths)
+        addWikiPath(tree, path);
+    return tree;
+}
+function wikiPage(root, path) {
+    const result = (0, wiki_read_js_1.readWikiPages)({
+        root,
+        paths: [path],
+        contentLimit: wiki_read_js_1.WIKI_READ_MAX_PAGE_CHARS,
+    });
+    const page = result.pages[0];
+    if (!page || !page.exists || page.content === null) {
+        throw new ViewerHttpError(404, 'NOT_FOUND', 'Page not found');
+    }
+    const parsed = wikiFrontmatter(page.content);
+    return {
+        path: page.path,
+        frontmatter: parsed.frontmatter,
+        content: parsed.content,
+        raw: page.content,
+    };
+}
+function archiveGraphPage(pages, nextCursor) {
+    const nodes = new Map();
+    const edges = new Map();
+    const last = pages[pages.length - 1];
+    for (const page of pages) {
+        for (const node of page.nodes)
+            nodes.set(graphNodeKey(node), node);
+        for (const edge of page.edges)
+            edges.set(edge.id, edge);
+    }
+    if (!last) {
+        throw new ViewerHttpError(502, 'GRAPH_QUERY_INVALID', 'graph.query returned no page');
+    }
+    return {
+        nodes: [...nodes.values()],
+        edges: [...edges.values()],
+        coverage: last.coverage,
+        snapshot: last.snapshot,
+        nextCursor,
+    };
+}
+function localStamp(ms, timeZone) {
+    return `${new Date(ms).toLocaleString('ko-KR', { timeZone })} (${timeZone})`;
+}
+function edgeLabelSummary(node, timeZone) {
+    if (node.data.kind !== 'memory')
+        return node.label;
+    const at = node.data.recordedAt ? localStamp(node.data.recordedAt, timeZone) : '';
+    return `${at} ${node.data.topic}: ${node.data.summary}`;
+}
+function graphNodeKey(node) {
+    return `${node.ref.kind}:${node.ref.id}`;
+}
+function memoryNode(page, id) {
+    return (page.nodes.find((node) => node.ref.kind === 'memory' && node.ref.id === id && node.data.kind === 'memory') ?? null);
+}
+function observationEvidence(page, revisionRef) {
+    const observations = new Map();
+    for (const node of page.nodes) {
+        if (node.ref.kind === 'observation' && node.data.kind === 'observation') {
+            observations.set(node.ref.id, node.data.connector);
+        }
+    }
+    const evidence = [];
+    const seen = new Set();
+    for (const edge of page.edges) {
+        if (edge.relation !== 'derived_from' ||
+            edge.from.kind !== revisionRef.kind ||
+            edge.from.id !== revisionRef.id ||
+            edge.to.kind !== 'observation' ||
+            seen.has(edge.to.id)) {
+            continue;
+        }
+        const source = observations.get(edge.to.id);
+        if (source === undefined)
+            continue;
+        seen.add(edge.to.id);
+        evidence.push({ ref: edge.to, source });
+    }
+    return evidence;
+}
+function sourceReadEvidence(data, source, observationRef) {
+    if (data === null || typeof data !== 'object' || Array.isArray(data)) {
+        throw new ViewerHttpError(502, 'SOURCE_READ_INVALID', `source.read returned no observation for ${observationRef}`);
+    }
+    const row = data;
+    if (typeof row.content !== 'string') {
+        throw new ViewerHttpError(502, 'SOURCE_READ_INVALID', `source.read returned no content for ${observationRef}`);
+    }
+    return {
+        observationRef,
+        source,
+        ...(typeof row.channel === 'string' ? { channel: row.channel } : {}),
+        sourceAt: typeof row.sourceAt === 'number' ? row.sourceAt : null,
+        observedAt: typeof row.observedAt === 'number' ? row.observedAt : null,
+        content: row.content,
+    };
+}
+function readLogTail(logPath, params) {
+    const tailParams = new URLSearchParams(params);
+    if (params.has('tail'))
+        tailParams.set('limit', params.get('tail'));
+    const tail = parseLimit(tailParams, 500, 2_000);
+    if (logPath === undefined || !(0, node_fs_1.existsSync)(logPath)) {
+        return {
+            lines: [],
+            total: 0,
+            totalBytes: 0,
+            fileSize: 0,
+            mtime: 0,
+            truncated: false,
+            ...notAvailable(),
+        };
+    }
+    const fd = (0, node_fs_1.openSync)(logPath, 'r');
+    try {
+        const metadata = (0, node_fs_1.fstatSync)(fd);
+        const sinceRaw = params.get('since');
+        const since = sinceRaw === null ? 0 : Number(sinceRaw);
+        const base = { totalBytes: metadata.size, fileSize: metadata.size, mtime: metadata.mtimeMs };
+        if (Number.isFinite(since) && metadata.mtimeMs <= since) {
+            return { ...base, lines: [], total: null, truncated: false };
+        }
+        // Bound I/O even for a single enormous line. The first partial line is discarded.
+        const maxBytes = 256 * 1024;
+        const chunks = [];
+        let position = metadata.size;
+        let bytesRead = 0;
+        let source = '';
+        let allLines = [];
+        while (position > 0 && bytesRead < maxBytes && allLines.length <= tail) {
+            const length = Math.min(16 * 1024, position, maxBytes - bytesRead);
+            position -= length;
+            const chunk = Buffer.allocUnsafe(length);
+            const count = (0, node_fs_1.readSync)(fd, chunk, 0, length, position);
+            bytesRead += length;
+            const read = chunk.subarray(0, count);
+            chunks.unshift(read);
+            source = Buffer.concat(chunks).toString('utf8');
+            if (position > 0) {
+                const newline = source.indexOf('\n');
+                source = newline === -1 ? '' : source.slice(newline + 1);
+            }
+            allLines = source.split(/\r?\n/).filter((line) => line.length > 0);
+        }
+        const lines = allLines.slice(-tail);
+        return {
+            ...base,
+            lines,
+            // The full-file line count is unknown when only a tail was read.
+            total: position === 0 ? allLines.length : null,
+            truncated: position > 0 || allLines.length > lines.length,
+        };
+    }
+    finally {
+        (0, node_fs_1.closeSync)(fd);
+    }
+}
+function createViewerServer(options) {
+    (0, cf_access_js_1.logCfAccessConfiguration)();
+    const securityEvents = (0, security_events_js_1.createSecurityEventRecorder)({
+        ...options.securityEvents,
+        timeZone: options.timeZone,
+    });
+    const port = options.port ?? resolveApiPort(process.env.MAMA_API_PORT);
+    const host = options.host ?? process.env.MAMA_API_HOST ?? '127.0.0.1';
+    const root = options.viewerDirectory ?? viewerDirectory();
+    let server = null;
+    let actualPort = port;
+    let stopped = false;
+    const reportClients = options.reportSseClients ?? new Set();
+    const callAction = async (action, input) => {
+        const operationId = `viewer:${action}:${(0, node_crypto_1.randomUUID)()}`;
+        const call = { action, input, operationId };
+        const context = { access: options.ownerAccess, operationId };
+        const result = await options.dispatch(call, context);
+        if (result.status === 'completed')
+            return result.data;
+        const status = actionFailureStatus(result);
+        if (status < 500)
+            throw new ViewerHttpError(status, result.error.code, result.error.message);
+        // A server-side action failure may carry internal detail: log it, send the client a fixed message.
+        (0, viewer_request_security_js_1.logViewerInternalError)(new Error(`${action} failed: ${result.error.code}: ${result.error.message}`));
+        throw new ViewerHttpError(status, 'VIEWER_INTERNAL_ERROR', 'Internal server error');
+    };
+    const listTasks = async (params) => {
+        const limit = parseLimit(params, 50, 50);
+        const status = params.get('status') ?? undefined;
+        const sourceChannel = params.get('source_channel') ?? undefined;
+        const page = await callAction('work.list', {
+            view: 'items',
+            limit,
+            ...(status === undefined ? {} : { status }),
+        });
+        const shaped = (0, viewer_data_js_1.shapeOperatorTasksFromItems)(page, { status: undefined, sourceChannel });
+        return {
+            tasks: shaped.tasks,
+            ...(shaped.nextCursor === null
+                ? {}
+                : { nextCursor: shaped.nextCursor, coverage: shaped.coverage }),
+        };
+    };
+    const legacyTaskList = async (params) => {
+        const page = await callAction('work.list', {
+            view: 'items',
+            limit: parseLimit(params, 50, 50),
+        });
+        return (0, viewer_data_js_1.shapeWorkListItems)(page);
+    };
+    const legacyTaskDetail = async (commitmentId) => {
+        if (commitmentId.trim() === '') {
+            throw new ViewerHttpError(400, 'INVALID_COMMITMENT_ID', 'commitment id must be nonblank');
+        }
+        const detail = await callAction('work.list', {
+            view: 'detail',
+            ids: [commitmentId],
+        });
+        if (detail === null ||
+            typeof detail !== 'object' ||
+            Array.isArray(detail) ||
+            !Array.isArray(detail.tasks)) {
+            throw new ViewerHttpError(502, 'WORK_DETAIL_INVALID', 'work.list returned no detail tasks');
+        }
+        const item = detail.tasks[0];
+        if (item === undefined || item === null || typeof item !== 'object' || Array.isArray(item))
+            throw new ViewerHttpError(404, 'NOT_FOUND', 'work.list returned no detail for the commitment');
+        const history = item.history;
+        if (!Array.isArray(history))
+            throw new ViewerHttpError(502, 'WORK_HISTORY_MISSING', 'work.list detail returned no revision history');
+        const reads = new Map();
+        for (const rawRevision of history) {
+            if (rawRevision === null ||
+                typeof rawRevision !== 'object' ||
+                Array.isArray(rawRevision) ||
+                rawRevision.recordRef === undefined) {
+                throw new ViewerHttpError(502, 'WORK_HISTORY_INVALID', 'work.list detail history is invalid');
+            }
+            const revision = rawRevision;
+            const detail = (await callAction('graph.query', {
+                view: 'detail',
+                seeds: [revision.recordRef],
+                history: 'all',
+            }));
+            const record = memoryNode(detail, revision.recordRef.id);
+            if (!record)
+                throw new ViewerHttpError(502, 'REVISION_RECORD_MISSING', 'graph.query returned no revision record');
+            const neighbors = (await callAction('graph.query', {
+                view: 'neighbors',
+                seeds: [revision.recordRef],
+                direction: 'out',
+                relations: ['derived_from'],
+                history: 'all',
+                maxDepth: 1,
+                limit: 100,
+            }));
+            const evidence = [];
+            for (const candidate of observationEvidence(neighbors, revision.recordRef)) {
+                const source = await callAction('source.read', {
+                    source: candidate.source,
+                    view: 'stored',
+                    detail: 'full',
+                    observationRef: candidate.ref.id,
+                    content_offset: 0,
+                    content_limit: 4_000,
+                });
+                evidence.push(sourceReadEvidence(source, candidate.source, candidate.ref.id));
+            }
+            reads.set(`${revision.recordRef.kind}:${revision.recordRef.id}`, { record, evidence });
+        }
+        return (0, viewer_data_js_1.shapeWorkListDetail)(detail, reads);
+    };
+    const legacyGraph = async (params) => {
+        const page = (await callAction('graph.query', {
+            view: 'browse',
+            history: 'all',
+            limit: parseLimit(params, 300, 2_000),
+            ...(params.get('cursor') === null ? {} : { cursor: params.get('cursor') }),
+        }));
+        return {
+            graph: (0, viewer_data_js_1.shapeGraphPage)(page, parseKinds(params)),
+            missing: [
+                {
+                    kind: 'revision_chain',
+                    message: 'graph.query does not expose revision-to-revision edges; use work.show history all.',
+                },
+            ],
+        };
+    };
+    /** Board header counts, read from the work ledger and the published board. */
+    const operatorSummary = async () => {
+        const overview = (await callAction('work.list', { view: 'overview' }));
+        let unassigned = 0;
+        let cursor = null;
+        do {
+            const page = (await callAction('work.list', {
+                view: 'items',
+                status: [...OPEN_WORK_STATUSES],
+                limit: 50,
+                ...(cursor === null ? {} : { cursor }),
+            }));
+            unassigned += page.tasks.filter((task) => !confirmedAssignee(task.assignee)).length;
+            cursor = page.nextCursor;
+        } while (cursor !== null);
+        const slots = options.reportStore?.getAllSorted() ?? [];
+        const actionSlot = slots.find((slot) => slot.slotId === 'action_required');
+        return {
+            report: {
+                actionRequired: actionSlot
+                    ? [
+                        ...actionSlot.html.matchAll(/\bclass\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s>]+))/g),
+                    ].filter((match) => (match[1] ?? match[2] ?? match[3] ?? '').split(/\s+/).includes('report-card')).length
+                    : 0,
+                updatedAt: slots.length === 0 ? null : Math.max(...slots.map((slot) => slot.updatedAt)),
+            },
+            work: {
+                open: OPEN_WORK_STATUSES.reduce((sum, status) => sum + (overview.status[status] ?? 0), 0),
+                review: overview.status.review ?? 0,
+                overdue: overview.due.overdue,
+                unassigned,
+            },
+        };
+    };
+    const graph = async (params) => {
+        const started = Date.now();
+        const limit = parseLimit(params, 300, 2_000);
+        const history = params.get('history') === 'current' ? 'current' : 'all';
+        const pages = [];
+        const nodes = new Set();
+        let cursor = params.get('cursor');
+        let pageCount = 0;
+        do {
+            const input = {
+                view: 'browse',
+                history,
+                limit: Math.min(500, Math.max(1, limit - nodes.size)),
+            };
+            if (cursor !== null)
+                input.cursor = cursor;
+            const page = (await callAction('graph.query', input));
+            pages.push(page);
+            for (const node of page.nodes)
+                nodes.add(graphNodeKey(node));
+            cursor = page.nextCursor;
+            pageCount += 1;
+        } while (cursor !== null && nodes.size < limit && pageCount < 20);
+        return (0, viewer_data_js_1.shapeArchiveGraph)(archiveGraphPage(pages, cursor), Date.now() - started, parseKinds(params), options.timeZone.get());
+    };
+    const graphDetail = async (params) => {
+        const id = params.get('id');
+        if (!id)
+            throw new ViewerHttpError(400, 'MISSING_ID', 'Missing required parameter: id');
+        const ref = graphRef(id);
+        if (!ref)
+            throw new ViewerHttpError(400, 'INVALID_ID', 'id must be a graph reference');
+        const page = (await callAction('graph.query', {
+            view: 'detail',
+            seeds: [ref],
+            history: 'all',
+        }));
+        const node = page.nodes.find((candidate) => graphNodeKey(candidate) === id);
+        if (!node)
+            throw new ViewerHttpError(404, 'NOT_FOUND', 'Decision not found');
+        const timeZone = options.timeZone.get();
+        const mapped = (0, viewer_data_js_1.mapArchiveGraphNode)(node, timeZone);
+        // The graph carries references only; the detail reads what they point at through the
+        // same owner actions the agent uses, so a fact's history is readable, not just its ids.
+        if (node.data.kind === 'observation') {
+            const read = (await callAction('source.read', {
+                source: node.data.connector,
+                observationRef: node.ref.id,
+            }));
+            const when = typeof read.sourceAt === 'number' ? localStamp(read.sourceAt, timeZone) : '';
+            return {
+                node: {
+                    ...mapped,
+                    topic: read.channel ?? mapped.topic,
+                    decision: `**${when} · ${read.channel ?? ''} · ${read.author ?? ''}**\n\n${read.content ?? ''}`,
+                },
+            };
+        }
+        if (node.data.kind === 'memory') {
+            const provenance = (await callAction('memory.read:provenance', {
+                memory_id: node.ref.id,
+            }));
+            const earlier = page.edges
+                .filter((edge) => `${edge.resolvedFrom.kind}:${edge.resolvedFrom.id}` === id &&
+                edge.resolvedTo.kind === 'memory')
+                .map((edge) => page.nodes.find((candidate) => graphNodeKey(candidate) === `${edge.resolvedTo.kind}:${edge.resolvedTo.id}`))
+                .filter((candidate) => candidate !== undefined && candidate.data.kind === 'memory')
+                .map((candidate) => `- ${edgeLabelSummary(candidate, options.timeZone.get())}`);
+            const evidence = (provenance.events ?? []).map((event) => `- ${event.observedAt ?? ''} ${event.channel ?? ''}: ${event.excerpt}`);
+            const sections = [
+                mapped.reasoning ?? '',
+                evidence.length > 0 ? `**Evidence**\n${evidence.join('\n')}` : '',
+                earlier.length > 0 ? `**Earlier records**\n${earlier.join('\n')}` : '',
+            ].filter((section) => section !== '');
+            return { node: { ...mapped, reasoning: sections.join('\n\n') } };
+        }
+        return { node: mapped };
+    };
+    const graphSimilar = async (params) => {
+        const id = params.get('id');
+        if (!id)
+            throw new ViewerHttpError(400, 'MISSING_ID', 'Missing required parameter: id');
+        const ref = graphRef(id);
+        if (!ref)
+            throw new ViewerHttpError(400, 'INVALID_ID', 'id must be a graph reference');
+        const page = (await callAction('graph.query', {
+            view: 'detail',
+            seeds: [ref],
+            history: 'all',
+        }));
+        const node = page.nodes.find((candidate) => graphNodeKey(candidate) === id);
+        if (!node || node.data.kind !== 'memory') {
+            return { id, similar: [], count: 0, ...notAvailable() };
+        }
+        const query = `${node.data.topic} ${node.data.summary.slice(0, 400)}`.trim();
+        const searched = (await callAction('memory.search', { query, limit: 6 }));
+        const similar = Array.isArray(searched.results)
+            ? searched.results
+                .filter((candidate) => {
+                if (candidate === null || typeof candidate !== 'object' || Array.isArray(candidate)) {
+                    return false;
+                }
+                const candidateId = String(candidate.id ?? '');
+                return candidateId !== ref.id && candidateId !== id;
+            })
+                .slice(0, 5)
+                .map((candidate) => ({
+                id: String(candidate.id ?? ''),
+                topic: typeof candidate.topic === 'string' ? candidate.topic : '',
+                decision: typeof candidate.decision === 'string'
+                    ? candidate.decision
+                    : typeof candidate.summary === 'string'
+                        ? candidate.summary
+                        : '',
+                similarity: typeof candidate.similarity === 'number'
+                    ? candidate.similarity
+                    : typeof candidate.final_score === 'number'
+                        ? candidate.final_score
+                        : 0,
+                outcome: typeof candidate.outcome === 'string' ? candidate.outcome : null,
+            }))
+            : [];
+        return { id, similar, count: similar.length };
+    };
+    const memorySearch = async (params) => {
+        const query = params.get('q');
+        const input = { limit: parseLimit(params, 20, 200) };
+        if (query !== null && query.trim() !== '')
+            input.query = query;
+        return (0, viewer_data_js_1.shapeMemorySearch)(await callAction('memory.search', input));
+    };
+    const checkpoints = async () => {
+        return callAction('memory.checkpoint.list', { limit: 50 });
+    };
+    const handleReportEvents = (req, res) => {
+        if (!options.reportStore) {
+            json(res, 503, { error: true, code: 'NOT_AVAILABLE', message: 'Report store is not wired' });
+            return;
+        }
+        res.writeHead(200, {
+            'Content-Type': 'text/event-stream; charset=utf-8',
+            'Cache-Control': 'no-cache',
+            Connection: 'keep-alive',
+        });
+        reportClients.add(res);
+        res.write(`event: report-update\ndata: ${JSON.stringify({ slots: options.reportStore.getAllSorted() })}\n\n`);
+        const keepAlive = setInterval(() => res.write(': keep-alive\n\n'), 15_000);
+        req.on('close', () => {
+            clearInterval(keepAlive);
+            reportClients.delete(res);
+        });
+    };
+    const serveStatic = (pathname, req, res) => {
+        if (pathname === '/') {
+            res.writeHead(302, { Location: '/viewer' });
+            res.end();
+            return true;
+        }
+        let filePath = null;
+        if (pathname === '/favicon.ico') {
+            filePath = (0, node_path_1.resolve)(root, '..', 'favicon.ico');
+        }
+        else if (pathname === '/viewer' || pathname === '/viewer/') {
+            filePath = (0, node_path_1.resolve)(root, 'viewer.html');
+        }
+        else if (pathname.startsWith('/viewer/')) {
+            filePath = (0, node_path_1.resolve)(root, pathname.slice('/viewer/'.length));
+        }
+        if (filePath === null || (req.method !== 'GET' && req.method !== 'HEAD'))
+            return false;
+        const rel = (0, node_path_1.relative)(root, filePath);
+        if (pathname === '/favicon.ico') {
+            if ((0, node_path_1.relative)((0, node_path_1.resolve)(root, '..'), filePath).startsWith('..'))
+                return false;
+        }
+        else if (rel.startsWith('..') || rel.includes('..' + '/') || rel.includes('\\')) {
+            return false;
+        }
+        try {
+            if (!(0, node_fs_1.statSync)(filePath).isFile())
+                return false;
+            const content = (0, node_fs_1.readFileSync)(filePath);
+            res.writeHead(200, {
+                'Content-Type': CONTENT_TYPES[(0, node_path_1.extname)(filePath)] ?? 'application/octet-stream',
+                'Cache-Control': 'no-cache',
+            });
+            res.end(req.method === 'HEAD' ? undefined : content);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const apiPath = (pathname) => pathname.startsWith('/api/') ||
+        pathname === '/graph' ||
+        pathname === '/graph/detail' ||
+        pathname === '/graph/similar' ||
+        pathname === '/checkpoints' ||
+        pathname === '/graph/update';
+    const handle = async (req, res) => {
+        const audit = (0, viewer_request_security_js_1.viewerRequestAudit)(req, res, securityEvents.record);
+        if (!(0, viewer_request_security_js_1.isAllowedViewerHost)(req)) {
+            json(res, 421, { error: true, code: 'MISDIRECTED_REQUEST', message: 'Host is not allowed' });
+            return;
+        }
+        const url = new URL(req.url ?? '/', 'http://localhost');
+        if ((0, auth_middleware_js_1.isTunnelRequest)(req) || apiPath(url.pathname))
+            audit.identity = await (0, auth_middleware_js_1.authenticateViewerRequest)(req, audit);
+        res.setHeader('X-Content-Type-Options', 'nosniff');
+        res.setHeader('X-Frame-Options', 'DENY');
+        if (req.method === 'OPTIONS') {
+            res.writeHead(204);
+            res.end();
+            return;
+        }
+        if (url.pathname === '/health' && req.method === 'GET') {
+            json(res, 200, { status: 'ok' });
+            return;
+        }
+        if (apiPath(url.pathname)) {
+            if (req.method !== 'GET') {
+                json(res, 405, {
+                    error: true,
+                    code: 'METHOD_NOT_ALLOWED',
+                    message: 'read-only viewer: GET is required',
+                });
+                return;
+            }
+            if (!(await (0, auth_middleware_js_1.requireViewerAuth)(req, res, audit.identity)))
+                return;
+            if (url.pathname === '/api/report/events') {
+                handleReportEvents(req, res);
+                audit.log();
+                return;
+            }
+            let result;
+            if (url.pathname === '/graph' || url.pathname === '/api/graph') {
+                result = await graph(url.searchParams);
+            }
+            else if (url.pathname === '/graph/detail' || url.pathname === '/api/graph/detail') {
+                result = await graphDetail(url.searchParams);
+            }
+            else if (url.pathname === '/graph/similar' || url.pathname === '/api/graph/similar') {
+                result = await graphSimilar(url.searchParams);
+            }
+            else if (url.pathname === '/checkpoints' || url.pathname === '/api/checkpoints') {
+                result = await checkpoints();
+            }
+            else if (url.pathname === '/api/mama/search')
+                result = await memorySearch(url.searchParams);
+            else if (url.pathname === '/api/viewer/tasks')
+                result = await legacyTaskList(url.searchParams);
+            else if (url.pathname.startsWith('/api/viewer/tasks/')) {
+                result = await legacyTaskDetail(decodeURIComponent(url.pathname.slice('/api/viewer/tasks/'.length)));
+            }
+            else if (url.pathname === '/api/viewer/graph')
+                result = await legacyGraph(url.searchParams);
+            else if (url.pathname === '/api/viewer/memory/search')
+                result = await memorySearch(url.searchParams);
+            else if (url.pathname === '/api/operator/tasks')
+                result = await listTasks(url.searchParams);
+            else if (url.pathname === '/api/operator/summary')
+                result = await operatorSummary();
+            else if (url.pathname === '/api/report') {
+                if (!options.reportStore) {
+                    throw new ViewerHttpError(503, 'NOT_AVAILABLE', 'Report store is not wired');
+                }
+                result = { slots: options.reportStore.getAllSorted() };
+            }
+            else if (url.pathname === '/api/wiki/tree') {
+                if (!options.wikiRoot) {
+                    throw new ViewerHttpError(503, 'NOT_AVAILABLE', 'Wiki root is not configured');
+                }
+                result = { tree: wikiTree(options.wikiRoot) };
+            }
+            else if (url.pathname === '/api/wiki/page') {
+                if (!options.wikiRoot) {
+                    throw new ViewerHttpError(503, 'NOT_AVAILABLE', 'Wiki root is not configured');
+                }
+                const path = url.searchParams.get('path');
+                if (!path)
+                    throw new ViewerHttpError(400, 'MISSING_PATH', 'path query param is required');
+                result = wikiPage(options.wikiRoot, path);
+            }
+            else if (url.pathname === '/api/runtime/status') {
+                if (!options.getRuntimeStatus) {
+                    throw new ViewerHttpError(503, 'NOT_AVAILABLE', 'not available in this build');
+                }
+                result = await options.getRuntimeStatus();
+            }
+            else if (url.pathname === '/api/connectors/status') {
+                if (!options.getConnectorStatus) {
+                    result = { connectors: [], ...notAvailable() };
+                }
+                else {
+                    result = { connectors: await options.getConnectorStatus() };
+                }
+            }
+            else if (url.pathname === '/api/connectors/activity') {
+                result = { connectors: [], ...notAvailable() };
+            }
+            else if (url.pathname.startsWith('/api/connectors/') && url.pathname.endsWith('/feed')) {
+                const connector = decodeURIComponent(url.pathname.slice('/api/connectors/'.length, -'/feed'.length));
+                result = { connector, feed: [], itemCount: 0, ...notAvailable() };
+            }
+            else if (url.pathname === '/api/metrics/health') {
+                result = {
+                    score: null,
+                    status: 'unavailable',
+                    components: [],
+                    checks: [],
+                    summary: null,
+                    ...notAvailable(),
+                };
+            }
+            else if (url.pathname === '/api/dashboard/status') {
+                if (!options.getMemoryStats) {
+                    throw new ViewerHttpError(503, 'NOT_AVAILABLE', 'Viewer memory database is not configured');
+                }
+                result = { memory: await options.getMemoryStats() };
+            }
+            else if (url.pathname === '/api/logs/daemon') {
+                result = readLogTail(options.logPath, url.searchParams);
+            }
+            else if (url.pathname === '/api/security/events') {
+                const params = new URLSearchParams({
+                    limit: String(parseLimit(url.searchParams, 50, 2_000)),
+                });
+                const { lines, ...metadata } = readLogTail(securityEvents.path, params);
+                result = { ...metadata, events: lines.map((line) => JSON.parse(line)) };
+            }
+            else if (url.pathname === '/api/cron') {
+                result = { jobs: [], ...notAvailable() };
+            }
+            else if (url.pathname.startsWith('/api/cron/')) {
+                result = { logs: [], ...notAvailable() };
+            }
+            else if (url.pathname === '/api/tokens/summary') {
+                result = { today: {}, week: {}, month: {}, ...notAvailable() };
+            }
+            else if (url.pathname === '/api/tokens/by-agent') {
+                result = { agents: [], ...notAvailable() };
+            }
+            else if (url.pathname === '/api/tokens/daily') {
+                result = { days: [], ...notAvailable() };
+            }
+            else if (url.pathname === '/api/skills' ||
+                url.pathname === '/api/skills/catalog' ||
+                url.pathname === '/api/skills/search') {
+                result = { skills: [], ...notAvailable() };
+            }
+            else if (url.pathname.startsWith('/api/intelligence/')) {
+                const key = url.pathname.slice('/api/intelligence/'.length);
+                result =
+                    key === 'activity'
+                        ? { activity: [], limit: 0, ...notAvailable() }
+                        : key === 'summary'
+                            ? { text: '', generatedAt: null, ...notAvailable() }
+                            : key === 'projects' || key === 'pipeline'
+                                ? { [key]: [], ...notAvailable() }
+                                : key === 'notices'
+                                    ? { notices: [], ...notAvailable() }
+                                    : { alerts: [], ...notAvailable() };
+            }
+            else {
+                throw new ViewerHttpError(404, 'NOT_FOUND', 'Viewer endpoint not found');
+            }
+            json(res, 200, result);
+            return;
+        }
+        if (serveStatic(url.pathname, req, res))
+            return;
+        json(res, 404, { error: true, code: 'NOT_FOUND', message: 'Not found' });
+    };
+    return {
+        get server() {
+            return server;
+        },
+        get port() {
+            return actualPort;
+        },
+        async start() {
+            if (server !== null)
+                return;
+            if (stopped)
+                throw new Error('Viewer server cannot restart after stop');
+            const candidate = (0, node_http_1.createServer)((req, res) => {
+                void handle(req, res).catch((error) => {
+                    const failure = requestError(error);
+                    if (!res.headersSent) {
+                        json(res, failure.status, {
+                            error: true,
+                            code: failure.code,
+                            message: failure.message,
+                        });
+                    }
+                    else {
+                        res.end();
+                    }
+                });
+            });
+            await new Promise((resolveListen, rejectListen) => {
+                candidate.once('error', rejectListen);
+                candidate.listen({ port, host, exclusive: false }, () => resolveListen());
+            });
+            server = candidate;
+            const address = candidate.address();
+            if (!address || typeof address === 'string')
+                throw new Error('Viewer server did not expose a port');
+            actualPort = address.port;
+        },
+        async stop() {
+            if (server === null) {
+                stopped = true;
+                return;
+            }
+            const current = server;
+            server = null;
+            stopped = true;
+            for (const client of reportClients)
+                client.end();
+            reportClients.clear();
+            await new Promise((resolveClose, rejectClose) => {
+                current.close((error) => (error ? rejectClose(error) : resolveClose()));
+            });
+        },
+    };
+}
+//# sourceMappingURL=viewer-server.js.map