@kbve/droid 0.0.6 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kbve/droid",
-  "version": "0.0.6",
+  "version": "0.1.2",
   "description": "A manager for web, shared and service workers, aimming to make it as modular and upgradable.",
   "keywords": [
     "workers",
@@ -27,11 +27,15 @@
     },
     "./lib/workers/canvas-worker": "./lib/workers/canvas-worker.js",
     "./lib/workers/db-worker": "./lib/workers/db-worker.js",
-    "./lib/workers/ws-worker": "./lib/workers/ws-worker.js"
+    "./lib/workers/ws-worker": "./lib/workers/ws-worker.js",
+    "./lib/workers/supabase-shared-worker": "./lib/workers/supabase-shared-worker.js",
+    "./lib/workers/supabase-db-worker": "./lib/workers/supabase-db-worker.js"
   },
   "files": [
     "workers/",
     "lib/workers/",
+    "lib/gateway/",
+    "lib/agents/",
     "assets/",
     "src/",
     "comlink*.js",
@@ -45,13 +49,21 @@
     "*.json"
   ],
   "dependencies": {
-    "tslib": "^2.3.0",
     "comlink": "^4.3.1",
-    "@nanostores/persistent": "^0.7.1",
-    "dexie": "^3.2.4",
-    "zod": "^3.22.4",
+    "nanostores": "^1.1.0",
+    "@nanostores/persistent": "^1.3.3",
+    "dexie": "^4.0.9",
+    "zod": "^4.0.0",
     "flatbuffers": "^25.2.10"
   },
+  "peerDependencies": {
+    "@supabase/supabase-js": "^2.95.3"
+  },
+  "peerDependenciesMeta": {
+    "@supabase/supabase-js": {
+      "optional": true
+    }
+  },
   "publishConfig": {
     "access": "public"
   }

package/src/index.ts

@@ -1,21 +1,49 @@
+export type { KBVEGlobal } from './types';
+
 export * from './lib/droid';
 export * from './lib/types/bento';
+export * from './lib/types/event-types';
+export * from './lib/types/panel-types';
+export * from './lib/types/ui-event-types';
+export * from './lib/sw-recovery';
+export * from './lib/workers/events';
 export * from './lib/mod/mod-urls';
+export * from './lib/gateway';
+export * from './lib/state';
+export * from './lib/agents';
+export * from './lib/api';
+
+export type { VirtualNode } from './lib/types/modules';
+
+// Worker-side validation
+export { validateUIMessage } from './lib/workers/validate';
+export type {
+	ValidatedWorkerMessage,
+	UIMessageType,
+} from './lib/workers/validate';
+
+// Canvas UI renderer (for direct worker usage)
+export { CanvasUIRenderer } from './lib/workers/canvas-ui-renderer';
+
+// Vite ?worker&url imports — bundles each worker as JS and returns the URL string
+import canvasWorkerUrl from './lib/workers/canvas-worker?worker&url';
+import dbWorkerUrl from './lib/workers/db-worker?worker&url';
+import wsWorkerUrl from './lib/workers/ws-worker?worker&url';
+import supabaseSharedWorkerUrl from './lib/workers/supabase-shared-worker?worker&url';
+import supabaseDbWorkerUrl from './lib/workers/supabase-db-worker?worker&url';
 
 export const workerURLs = {
-	canvasWorker: new URL(
-		'./lib/workers/canvas-worker.js',
-		import.meta.url,
-	),
-	dbWorker: new URL('./lib/workers/db-worker.js', import.meta.url),
-	wsWorker: new URL('./lib/workers/ws-worker.js', import.meta.url),
+	canvasWorker: canvasWorkerUrl,
+	dbWorker: dbWorkerUrl,
+	wsWorker: wsWorkerUrl,
+	supabaseSharedWorker: supabaseSharedWorkerUrl,
+	supabaseDbWorker: supabaseDbWorkerUrl,
 };
 
 export const workerStrings = {
-	canvasWorker: new URL(
-		'./lib/workers/canvas-worker.js',
-		import.meta.url,
-	).toString(),
-	dbWorker: new URL('./lib/workers/db-worker.js', import.meta.url).toString(),
-	wsWorker: new URL('./lib/workers/ws-worker.js', import.meta.url).toString(),
-};
+	canvasWorker: canvasWorkerUrl,
+	dbWorker: dbWorkerUrl,
+	wsWorker: wsWorkerUrl,
+	supabaseSharedWorker: supabaseSharedWorkerUrl,
+	supabaseDbWorker: supabaseDbWorkerUrl,
+};

package/src/lib/agents/api-types.ts

@@ -0,0 +1,170 @@
+import type { AgentsStore } from './state/atoms';
+import type { TokenServiceValue } from './generated/agents-schema';
+import type {
+	AgentTokenRow,
+	BackfillResult,
+	BotConfigFormDraft,
+	DiscordForumChannel,
+	DiscordshConfig,
+	GithubRepoHook,
+	PatValidation,
+	Result,
+	WebhookInstallResult,
+} from './types';
+
+export interface AgentsMethods {
+	// auth
+	initAuth(force?: boolean): Promise<void>;
+	resyncOwnedGuilds(): Promise<boolean>;
+	signInWithDiscord(): Promise<void>;
+
+	// guilds
+	loadOwnedGuilds(force?: boolean): Promise<void>;
+	selectGuild(guildId: string): void;
+	refreshSelectedGuild(): Promise<void>;
+
+	// tokens
+	loadTokens(guildId: string, force?: boolean): Promise<void>;
+	addToken(input: {
+		tokenName: string;
+		service: TokenServiceValue;
+		tokenValue: string;
+		description?: string | null;
+	}): Promise<Result<{ tokenId: string }>>;
+	deleteToken(tokenId: string): Promise<Result>;
+	peekToken(
+		service: TokenServiceValue,
+	): Promise<Result<{ value: string | null }>>;
+	toggleToken(tokenId: string, isActive: boolean): Promise<Result>;
+	hasService(service: TokenServiceValue): AgentTokenRow | null;
+
+	// repo allowlist
+	getRepoAllowlist(): Promise<
+		Result<{ repos: string[]; raw: string | null }>
+	>;
+	setRepoAllowlist(repos: string[]): Promise<Result>;
+	hydrateRepoAllowlistDraft(guildId: string, repos: string[]): void;
+	patchRepoAllowlistDraft(guildId: string, repos: string[]): void;
+	clearRepoAllowlistDraft(guildId: string): void;
+	ensureRepoAllowlistLoaded(
+		guildId: string,
+		force?: boolean,
+	): Promise<Result>;
+	saveRepoAllowlistDraft(guildId: string): Promise<Result>;
+
+	// bot config
+	getBotConfig(): Promise<Result<{ config: DiscordshConfig }>>;
+	setBotConfig(config: DiscordshConfig): Promise<Result>;
+	hydrateBotConfigDraft(guildId: string, cfg: DiscordshConfig): void;
+	patchBotConfigDraft(
+		guildId: string,
+		patch: Partial<BotConfigFormDraft>,
+	): void;
+	clearBotConfigDraft(guildId: string): void;
+	ensureBotConfigLoaded(guildId: string, force?: boolean): Promise<Result>;
+	saveBotConfigDraft(guildId: string): Promise<Result>;
+
+	// webhook secret drafts
+	setWebhookDraft(guildId: string, secret: string | null): void;
+	clearWebhookError(guildId: string): void;
+	saveWebhookDraft(
+		guildId: string,
+		tokenName: string,
+		description: string,
+	): Promise<Result<{ tokenId: string }>>;
+
+	// PAT
+	setPatDraft(guildId: string, pat: string): void;
+	clearPatState(guildId: string): void;
+	validatePatForGuild(guildId: string): Promise<Result>;
+	savePatForGuild(
+		guildId: string,
+		tokenName: string,
+	): Promise<Result<{ tokenId: string }>>;
+	validateGithubPat(pat: string): Promise<Result<PatValidation>>;
+
+	// backfill
+	patchBackfillDraft(
+		guildId: string,
+		partial: Partial<{ owner: string; repo: string }>,
+	): void;
+	clearBackfillResult(guildId: string): void;
+	runBackfillForGuild(guildId: string): Promise<void>;
+	runBackfill(input: {
+		owner: string;
+		repo: string;
+		state?: 'open' | 'closed' | 'all';
+		maxPages?: number;
+		perPage?: number;
+	}): Promise<BackfillResult | { ok: false; error: string }>;
+
+	// webhook install / ping / verify
+	setWebhookInstallSelected(guildId: string, repo: string): void;
+	clearWebhookInstallResult(guildId: string): void;
+	installWebhookForGuild(guildId: string): Promise<void>;
+	pingWebhookForGuild(guildId: string): Promise<void>;
+	verifyWebhookInstall(guildId: string, repoFull: string): Promise<void>;
+	installRepoWebhook(
+		guildId: string,
+		owner: string,
+		repo: string,
+	): Promise<WebhookInstallResult | { ok: false; error: string }>;
+	pingRepoWebhook(
+		guildId: string,
+		owner: string,
+		repo: string,
+	): Promise<
+		| { ok: true; hookId: number; url: string }
+		| { ok: false; error: string; retryAfterMs?: number }
+	>;
+	listRepoWebhooks(
+		guildId: string,
+		owner: string,
+		repo: string,
+	): Promise<Result<{ expectedUrl: string; hooks: GithubRepoHook[] }>>;
+	rotateWebhookForGuild(
+		guildId: string,
+		owner: string,
+		repo: string,
+	): Promise<void>;
+	deleteWebhookForGuild(
+		guildId: string,
+		owner: string,
+		repo: string,
+	): Promise<Result>;
+	loadWebhookDeliveries(
+		guildId: string,
+		owner: string,
+		repo: string,
+		limit?: number,
+	): Promise<void>;
+	webhookUrlFor(guildId: string): string;
+
+	// discord bot / channels
+	ensureGuildChannelsLoaded(guildId: string, force?: boolean): Promise<void>;
+	ensureBotMembershipLoaded(guildId: string, force?: boolean): Promise<void>;
+	invalidateBotMembership(guildId: string): void;
+	isBotMember(
+		guildId: string,
+	): Promise<
+		| { ok: true; isMember: boolean; joinedAt: string | null }
+		| { ok: false; error: string }
+	>;
+	listForumChannels(
+		guildId: string,
+	): Promise<Result<{ channels: DiscordForumChannel[] }>>;
+	botInstallUrl(guildId?: string): string | null;
+	fetchBotInstallUrl(guildId: string): Promise<string | null>;
+
+	// events
+	loadEventStats(guildId: string): Promise<void>;
+	loadFailedEvents(guildId: string, limit?: number): Promise<void>;
+	loadPendingEvents(guildId: string, limit?: number): Promise<void>;
+	requeueEvent(
+		guildId: string,
+		eventId: number,
+		reason?: string,
+	): Promise<Result>;
+}
+
+export type AgentsApi = AgentsStore & AgentsMethods;

package/src/lib/agents/auth/init.ts

@@ -0,0 +1,200 @@
+import {
+	BOOTSTRAP_COOLDOWN_MS,
+	FORCED_REFRESH_COOLDOWN_MS,
+	INIT_DEDUP_MS,
+} from '../constants';
+import {
+	extractJwtOwnedGuildIds,
+	loadCachedGuilds,
+	parseJwtPayload,
+} from '../cache';
+import type { AgentsCtx } from '../ctx';
+import type { AgentsApi } from '../api-types';
+
+export function makeAuth(ctx: AgentsCtx, api: AgentsApi) {
+	const { store, config, endpoints, runtime } = ctx;
+
+	async function bootstrapDiscord(providerToken: string): Promise<boolean> {
+		const accessToken = store.$accessToken.get();
+		if (!accessToken) return false;
+		const now = Date.now();
+		if (
+			runtime.lastBootstrapOk &&
+			now - runtime.lastBootstrapAt < BOOTSTRAP_COOLDOWN_MS
+		) {
+			return true;
+		}
+		if (runtime.bootstrapInflight) return runtime.bootstrapInflight;
+		runtime.bootstrapInflight = (async () => {
+			try {
+				const resp = await fetch(endpoints.discordBootstrap, {
+					method: 'POST',
+					headers: {
+						'Content-Type': 'application/json',
+						Authorization: `Bearer ${accessToken}`,
+					},
+					body: JSON.stringify({ provider_token: providerToken }),
+				});
+				if (!resp.ok) {
+					if (resp.status === 429) {
+						runtime.lastBootstrapAt = Date.now();
+						runtime.lastBootstrapOk = true;
+					}
+					return false;
+				}
+				runtime.lastBootstrapAt = Date.now();
+				runtime.lastBootstrapOk = true;
+				return true;
+			} catch {
+				return false;
+			} finally {
+				runtime.bootstrapInflight = null;
+			}
+		})();
+		return runtime.bootstrapInflight;
+	}
+
+	async function forceTokenRefresh(): Promise<boolean> {
+		const now = Date.now();
+		if (now - runtime.lastForcedRefreshAt < FORCED_REFRESH_COOLDOWN_MS) {
+			return false;
+		}
+		if (runtime.refreshInflight) return runtime.refreshInflight;
+		runtime.refreshInflight = (async () => {
+			try {
+				const accessToken = await config.refreshSession();
+				if (!accessToken) {
+					console.warn('[agents] refreshSession returned no session');
+					return false;
+				}
+				store.$accessToken.set(accessToken);
+				runtime.lastForcedRefreshAt = Date.now();
+				return true;
+			} catch (e) {
+				console.warn('[agents] refreshSession threw:', e);
+				return false;
+			} finally {
+				runtime.refreshInflight = null;
+			}
+		})();
+		return runtime.refreshInflight;
+	}
+
+	async function resyncOwnedGuilds(): Promise<boolean> {
+		const providerToken = store.$providerToken.get();
+		if (!providerToken) return false;
+		const ok = await bootstrapDiscord(providerToken);
+		if (!ok) return false;
+		return await forceTokenRefresh();
+	}
+
+	async function runInitAuth(): Promise<void> {
+		try {
+			const session = await config.loadSession();
+			const accessToken = session.accessToken;
+
+			if (!accessToken) {
+				store.$authState.set('unauthenticated');
+				return;
+			}
+
+			store.$accessToken.set(accessToken);
+
+			const jwtPayload = parseJwtPayload(accessToken);
+			const userId = (jwtPayload?.['sub'] as string | undefined) ?? null;
+			if (userId) store.$userId.set(userId);
+
+			let providerToken: string | null = session.providerToken;
+			if (!providerToken) {
+				providerToken = config.getDiscordProviderToken();
+			}
+
+			if (providerToken) {
+				store.$providerToken.set(providerToken);
+				store.$authState.set('authenticated');
+				const cachedOwned = userId ? loadCachedGuilds(userId) : null;
+				if (cachedOwned && cachedOwned.length > 0) {
+					store.$guilds.set(cachedOwned);
+					if (cachedOwned.length === 1) {
+						api.selectGuild(cachedOwned[0].id);
+					}
+				}
+				return;
+			}
+
+			const cached = userId ? loadCachedGuilds(userId) : null;
+			const jwtIds = extractJwtOwnedGuildIds(accessToken);
+			const jwtSet = new Set(jwtIds);
+
+			if (cached && cached.length > 0) {
+				const filtered =
+					jwtIds.length > 0
+						? cached.filter((g) => jwtSet.has(g.id))
+						: cached;
+				store.$guilds.set(filtered);
+				store.$guildsStale.set(true);
+				store.$authState.set('authenticated');
+				if (filtered.length === 1) {
+					api.selectGuild(filtered[0].id);
+				}
+				return;
+			}
+
+			if (jwtIds.length > 0) {
+				store.$guilds.set(
+					jwtIds.map((id) => ({
+						id,
+						name: `Guild #${id.slice(-6)}`,
+						icon: null,
+						owner: true,
+						permissions: '0',
+					})),
+				);
+				store.$guildsStale.set(true);
+				store.$authState.set('authenticated');
+				if (jwtIds.length === 1) api.selectGuild(jwtIds[0]);
+				return;
+			}
+
+			store.$authState.set('discord_reauth_required');
+		} catch {
+			store.$authState.set('unauthenticated');
+		} finally {
+			runtime.lastInitAt = Date.now();
+		}
+	}
+
+	async function initAuth(force = false): Promise<void> {
+		if (!force) {
+			if (runtime.initPromise) return runtime.initPromise;
+			if (
+				runtime.lastInitAt > 0 &&
+				Date.now() - runtime.lastInitAt < INIT_DEDUP_MS &&
+				store.$authState.get() !== 'loading'
+			) {
+				return;
+			}
+		}
+		runtime.initPromise = runInitAuth();
+		try {
+			await runtime.initPromise;
+		} finally {
+			runtime.initPromise = null;
+		}
+	}
+
+	async function signInWithDiscord(): Promise<void> {
+		try {
+			await config.signInWithDiscord();
+		} catch (e) {
+			config.notify({
+				message:
+					e instanceof Error ? e.message : 'Discord sign-in failed',
+				severity: 'error',
+				duration: 5000,
+			});
+		}
+	}
+
+	return { initAuth, resyncOwnedGuilds, signInWithDiscord };
+}

package/src/lib/agents/cache.ts

@@ -0,0 +1,127 @@
+import {
+	GUILDS_CACHE_KEY,
+	GUILDS_CACHE_TTL_MS,
+	TOKENS_CACHE_KEY,
+	TOKENS_CACHE_TTL_MS,
+} from './constants';
+import type { AgentTokenRow, DiscordGuild } from './types';
+
+export function parseJwtPayload(jwt: string): Record<string, unknown> | null {
+	try {
+		const parts = jwt.split('.');
+		if (parts.length < 2) return null;
+		const b64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+		const padded = b64 + '==='.slice((b64.length + 3) % 4);
+		const json = atob(padded);
+		return JSON.parse(json) as Record<string, unknown>;
+	} catch {
+		return null;
+	}
+}
+
+export function extractJwtOwnedGuildIds(jwt: string): string[] {
+	const payload = parseJwtPayload(jwt);
+	if (!payload || !Array.isArray(payload['owned_guilds'])) return [];
+	return payload['owned_guilds'].filter(
+		(g): g is string => typeof g === 'string' && /^[0-9]{17,20}$/.test(g),
+	);
+}
+
+interface CachedGuildsBlob {
+	user_id: string;
+	guilds: DiscordGuild[];
+	cached_at: number;
+}
+
+export function loadCachedGuilds(userId: string): DiscordGuild[] | null {
+	try {
+		const raw = localStorage.getItem(GUILDS_CACHE_KEY);
+		if (!raw) return null;
+		const blob = JSON.parse(raw) as CachedGuildsBlob;
+		if (blob.user_id !== userId) return null;
+		if (Date.now() - blob.cached_at > GUILDS_CACHE_TTL_MS) return null;
+		if (!Array.isArray(blob.guilds)) return null;
+		return blob.guilds;
+	} catch {
+		return null;
+	}
+}
+
+export function saveCachedGuilds(userId: string, guilds: DiscordGuild[]): void {
+	try {
+		const blob: CachedGuildsBlob = {
+			user_id: userId,
+			guilds,
+			cached_at: Date.now(),
+		};
+		localStorage.setItem(GUILDS_CACHE_KEY, JSON.stringify(blob));
+	} catch {
+		/* non-fatal */
+	}
+}
+
+interface CachedTokensBlob {
+	user_id: string;
+	tokens_by_guild: Record<
+		string,
+		{ tokens: AgentTokenRow[]; cached_at: number }
+	>;
+}
+
+export function loadCachedTokens(
+	userId: string,
+	guildId: string,
+): AgentTokenRow[] | null {
+	try {
+		const raw = localStorage.getItem(TOKENS_CACHE_KEY);
+		if (!raw) return null;
+		const blob = JSON.parse(raw) as CachedTokensBlob;
+		if (blob.user_id !== userId) return null;
+		const entry = blob.tokens_by_guild?.[guildId];
+		if (!entry) return null;
+		if (Date.now() - entry.cached_at > TOKENS_CACHE_TTL_MS) return null;
+		return entry.tokens;
+	} catch {
+		return null;
+	}
+}
+
+export function saveCachedTokens(
+	userId: string,
+	guildId: string,
+	tokens: AgentTokenRow[],
+): void {
+	try {
+		const raw = localStorage.getItem(TOKENS_CACHE_KEY);
+		let blob: CachedTokensBlob;
+		try {
+			blob = raw
+				? (JSON.parse(raw) as CachedTokensBlob)
+				: { user_id: userId, tokens_by_guild: {} };
+		} catch {
+			blob = { user_id: userId, tokens_by_guild: {} };
+		}
+		if (blob.user_id !== userId) {
+			blob = { user_id: userId, tokens_by_guild: {} };
+		}
+		blob.tokens_by_guild[guildId] = { tokens, cached_at: Date.now() };
+		localStorage.setItem(TOKENS_CACHE_KEY, JSON.stringify(blob));
+	} catch {
+		/* non-fatal */
+	}
+}
+
+export function invalidateCachedTokens(userId: string, guildId: string): void {
+	try {
+		const raw = localStorage.getItem(TOKENS_CACHE_KEY);
+		if (!raw) return;
+		const blob = JSON.parse(raw) as CachedTokensBlob;
+		if (blob.user_id !== userId) return;
+		if (blob.tokens_by_guild?.[guildId]) {
+			delete blob.tokens_by_guild[guildId];
+			localStorage.setItem(TOKENS_CACHE_KEY, JSON.stringify(blob));
+		}
+	} catch {
+		/* non-fatal */
+	}
+}

package/src/lib/agents/client/callGuildVault.ts

@@ -0,0 +1,71 @@
+import type { AgentsCtx, CallGuildVault } from '../ctx';
+
+export function makeCallGuildVault(ctx: AgentsCtx): CallGuildVault {
+	return async function callGuildVault(
+		command: string,
+		accessToken: string,
+		extra: Record<string, unknown>,
+		opts: { retriedAfterResync?: boolean } = {},
+	) {
+		try {
+			const resp = await fetch(ctx.endpoints.guildVault, {
+				method: 'POST',
+				headers: {
+					'Content-Type': 'application/json',
+					Authorization: `Bearer ${accessToken}`,
+				},
+				body: JSON.stringify({ command, ...extra }),
+			});
+			const text = await resp.text();
+			let body: unknown;
+			try {
+				body = JSON.parse(text);
+			} catch {
+				return {
+					ok: false,
+					error: `HTTP ${resp.status}: ${text.slice(0, 200)}`,
+				};
+			}
+			if (!resp.ok) {
+				const b = body as {
+					error?: string;
+					sqlstate?: string | null;
+					hint?: string | null;
+					context?: string | null;
+				} | null;
+				const errMsg = b?.error ?? '';
+				const looksStale =
+					resp.status === 403 &&
+					/owned_guilds/i.test(errMsg) &&
+					!opts.retriedAfterResync;
+				if (looksStale) {
+					const resynced = await ctx.resyncOwnedGuilds();
+					if (resynced) {
+						const newToken = ctx.store.$accessToken.get();
+						if (newToken) {
+							return ctx.callGuildVault(
+								command,
+								newToken,
+								extra,
+								{
+									retriedAfterResync: true,
+								},
+							);
+						}
+					}
+				}
+				const parts: string[] = [errMsg || `HTTP ${resp.status}`];
+				if (b?.sqlstate) parts.push(`sqlstate=${b.sqlstate}`);
+				if (b?.hint) parts.push(`hint=${b.hint}`);
+				if (b?.context) parts.push(`context=${b.context}`);
+				return { ok: false, error: parts.join(' · ') };
+			}
+			return { ok: true, body };
+		} catch (e) {
+			return {
+				ok: false,
+				error: e instanceof Error ? e.message : 'Network error',
+			};
+		}
+	};
+}