@siduri-x/api 1.0.0 → 1.0.1

package/dist/app.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.createApp = createApp;
 const express_1 = __importDefault(require("express"));
 const cors_1 = __importDefault(require("cors"));
+const cors_2 = require("./cors");
 const runtime_1 = require("./runtime");
 const brain_1 = require("@siduri-x/brain");
 const memory_1 = require("@siduri-x/memory");
@@ -20,7 +21,7 @@ const auth_1 = require("./auth");
 const context_mapper_1 = require("./context-mapper");
 function createApp(runtimes = new Map()) {
     const app = (0, express_1.default)();
-    app.use((0, cors_1.default)());
+    app.use((0, cors_1.default)((0, cors_2.createCorsOptions)()));
     app.use(express_1.default.json());
     let observationOrgan;
     function createBrain(config) {
@@ -42,7 +43,7 @@ function createApp(runtimes = new Map()) {
     function createVoice(config) {
         return isDisabled(config)
             ? undefined
-            : new voice_1.VoicevoxAdapter({ baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
+            : new voice_1.VoiceAdapter({ provider: config.provider || 'voicevox', baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
     }
     function createKnowledge(config) {
         return isDisabled(config) ? undefined : new knowledge_1.EKnowledgeAdapter(config);
@@ -96,11 +97,19 @@ function createApp(runtimes = new Map()) {
     });
     // STATUS / HEALTH ENDPOINTS
     app.get('/health', (req, res) => res.json({ status: "ok" }));
-    app.get('/version', (req, res) => res.json({ name: "siduri-y-api", version: "0.2.0-y" }));
-    app.get('/ready', (req, res) => res.json({ status: "ready", dependencies: {} }));
-    app.get('/voice/health', (req, res) => res.json({ provider: "voicevox", healthy: true }));
-    app.get('/obs/health', (req, res) => res.json({ connected: true }));
-    app.get('/platforms/status', (req, res) => res.json({ platforms: {} }));
+    app.get('/version', (req, res) => res.json({ name: "siduri-x-api", version: "0.2.0-x" }));
+    app.get('/ready', (req, res) => {
+        const isReady = runtimes.size > 0;
+        res.status(isReady ? 200 : 503).json({
+            status: isReady ? "ready" : "not_ready",
+            companionCount: runtimes.size,
+        });
+    });
+    app.get('/voice/health', (req, res) => {
+        const hasVoice = Array.from(runtimes.values()).some((r) => Boolean(r.voice));
+        res.json({ provider: "siduri-voice", configured: hasVoice });
+    });
+    app.get('/obs/health', (req, res) => res.json({ connected: Boolean(observationOrgan) }));
     app.get('/me', auth_1.attachIdentity, (req, res) => {
         const identity = req.identity;
         res.json({
@@ -114,11 +123,18 @@ function createApp(runtimes = new Map()) {
     app.post('/chat', auth_1.attachIdentity, async (req, res) => {
         const { id, message, history } = req.body;
         const identity = req.identity;
+        // Single-owner companion model: /chat defaults to OWNER identity.
+        // Explicit non-owner role in request body or context (e.g. adversarial test suites) is respected.
+        const effectiveRole = req.body?.role === 'VIEWER' || req.body?.context?.actor?.authorizationRole === 'viewer'
+            ? 'VIEWER'
+            : (identity?.role === 'OPERATOR' ? 'OPERATOR' : 'OWNER');
+        const isOwner = effectiveRole === 'OWNER';
         // Call context mapper at the API boundary
         const mappingResult = (0, context_mapper_1.mapRequestContext)({
             ...req.body,
             id: id || req.body.companionId,
-            role: req.body.role || identity?.role,
+            role: effectiveRole,
+            authenticated: isOwner,
             generateCorrelationId: true,
         }, {
             endpointPolicy: 'public',
@@ -135,13 +151,13 @@ function createApp(runtimes = new Map()) {
         if (!runtime)
             return res.status(404).json({ error: "Companion not found" });
         try {
-            // Map authorization role to legacy memory scope for backwards-compatible runtime call
-            const legacyScope = mappingResult.context.actor.authorizationRole === 'administrator'
-                ? 'OWNER'
-                : mappingResult.context.actor.authorizationRole === 'operator'
-                    ? 'OPERATOR'
-                    : 'VIEWER';
-            const response = await runtime.handleUserMessage(message, legacyScope, history);
+            const response = await (0, runtime_1.dispatchCompanionChat)(runtime, {
+                id: companionId,
+                companionId,
+                message,
+                context: mappingResult.context,
+                history,
+            });
             res.json(response);
         }
         catch (e) {
@@ -210,7 +226,26 @@ function createApp(runtimes = new Map()) {
         }
     });
     // MEMORY MUTATIONS - PROPOSALS
-    app.post('/memory/proposals/update', (0, auth_1.requireRole)(['OWNER', 'OPERATOR']), async (req, res) => res.json({ success: true }));
+    app.post('/memory/proposals/update', (0, auth_1.requireRole)(['OWNER', 'OPERATOR']), async (req, res) => {
+        const id = req.body.companionId || Array.from(runtimes.keys())[0];
+        const runtime = runtimes.get(id);
+        if (!runtime)
+            return res.status(404).json({ error: "Companion not found" });
+        if (!runtime.memory || typeof runtime.memory.updateClaim !== 'function') {
+            return res.status(400).json({ error: "Memory organ does not support updating claims" });
+        }
+        try {
+            const claimId = req.body.id || req.body.claimId;
+            if (!claimId) {
+                return res.status(400).json({ error: "Missing required claim id" });
+            }
+            const updated = await runtime.memory.updateClaim(claimId, req.body.updates || req.body);
+            res.json({ success: true, claim: updated });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
     app.post('/memory/proposals/approve', (0, auth_1.requireRole)(['OWNER', 'OPERATOR']), async (req, res) => {
         const id = req.body.companionId || Array.from(runtimes.keys())[0];
         const runtime = runtimes.get(id);
@@ -302,135 +337,144 @@ function createApp(runtimes = new Map()) {
             res.status(500).json({ error: e.message });
         }
     });
-    app.post('/dev/memory/reset', (0, auth_1.requireRole)(['OWNER']), async (req, res) => res.json({ reset: true }));
-    // MOCKS / DEV / EVIDENCE / PLATFORMS
-    app.get('/platforms/events', (req, res) => res.json({ events: [] }));
-    app.get('/platforms/actions', (req, res) => res.json({ actions: [] }));
-    app.get('/evidence', (req, res) => res.json({ results: [] }));
-    app.get('/observations', (req, res) => res.json({ observations: observationOrgan?.current() ?? [] }));
-    app.post('/dev/mock-response', async (req, res) => {
-        const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-        const runtime = runtimes.get(companionId);
-        if (!runtime)
-            return res.status(404).json({ accepted: false, error: 'Companion not found' });
-        const staged = runtime.gating.stageResponse({
-            requestContext: {
-                companionId,
-                actor: {
-                    actorId: 'operator-a',
-                    sessionId: 'sess-op',
-                    authorizationRole: 'operator',
-                    capabilities: ['chat:public', 'memory:approve'],
-                    authenticated: true,
-                },
-                conversation: {
-                    channel: 'public',
-                    audienceId: 'audience-public',
-                    correlationId: req.body?.correlation_id || `corr-${Date.now()}`,
-                },
-            },
-            candidateSpeech: req.body?.speech || 'Mocked staged response for review',
-            candidateLanguage: req.body?.language || 'en',
-            requiresApproval: req.body?.requiresApproval ?? true,
+    const isDevMode = process.env.NODE_ENV !== 'production' || process.env.SIDURI_DEV_MODE === 'true';
+    if (isDevMode) {
+        app.post('/dev/memory/reset', (0, auth_1.requireRole)(['OWNER']), async (req, res) => {
+            const id = req.body.companionId || Array.from(runtimes.keys())[0];
+            const runtime = runtimes.get(id);
+            if (!runtime)
+                return res.status(404).json({ error: "Companion not found" });
+            if (!runtime.memory || typeof runtime.memory.resetMemory !== 'function') {
+                return res.status(400).json({ error: "Memory organ does not support reset" });
+            }
+            try {
+                await runtime.memory.resetMemory();
+                res.json({ reset: true });
+            }
+            catch (e) {
+                res.status(500).json({ error: e.message });
+            }
         });
-        res.json({
-            accepted: true,
-            staged: true,
-            status: staged.status,
-            response_id: staged.responseId,
-            correlation_id: staged.correlationId,
-            speech: staged.speech,
+        app.post('/dev/mock-response', async (req, res) => {
+            const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+            const runtime = runtimes.get(companionId);
+            if (!runtime)
+                return res.status(404).json({ accepted: false, error: 'Companion not found' });
+            const staged = runtime.gating.stageResponse({
+                requestContext: {
+                    companionId,
+                    actor: {
+                        actorId: 'operator-a',
+                        sessionId: 'sess-op',
+                        authorizationRole: 'operator',
+                        capabilities: ['chat:public', 'memory:approve'],
+                        authenticated: true,
+                    },
+                    conversation: {
+                        channel: 'public',
+                        audienceId: 'audience-public',
+                        correlationId: req.body?.correlation_id || `corr-${Date.now()}`,
+                    },
+                },
+                candidateSpeech: req.body?.speech || 'Mocked staged response for review',
+                candidateLanguage: req.body?.language || 'en',
+                requiresApproval: req.body?.requiresApproval ?? true,
+            });
+            res.json({
+                accepted: true,
+                staged: true,
+                status: staged.status,
+                response_id: staged.responseId,
+                correlation_id: staged.correlationId,
+                speech: staged.speech,
+            });
         });
-    });
-    app.post('/dev/approve-response', async (req, res) => {
-        const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-        const runtime = runtimes.get(companionId);
-        if (!runtime)
-            return res.status(404).json({ approved: false, error: 'Companion not found' });
-        let responseId = req.body?.responseId;
-        let correlationId = req.body?.correlation_id;
-        if (!responseId && correlationId) {
-            const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
-            if (found) {
-                responseId = found.responseId;
+        app.post('/dev/approve-response', async (req, res) => {
+            const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+            const runtime = runtimes.get(companionId);
+            if (!runtime)
+                return res.status(404).json({ approved: false, error: 'Companion not found' });
+            let responseId = req.body?.responseId;
+            let correlationId = req.body?.correlation_id;
+            if (!responseId && correlationId) {
+                const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+                if (found) {
+                    responseId = found.responseId;
+                }
             }
-        }
-        else if (responseId && !correlationId) {
-            const found = runtime.gating.getStagedPlan(responseId);
-            if (found) {
-                correlationId = found.correlationId;
+            else if (responseId && !correlationId) {
+                const found = runtime.gating.getStagedPlan(responseId);
+                if (found) {
+                    correlationId = found.correlationId;
+                }
             }
-        }
-        if (!responseId) {
-            return res.status(400).json({ approved: false, error: 'UNKNOWN_APPROVAL_ID' });
-        }
-        const result = runtime.gating.approveResponse({
-            responseId,
-            companionId,
-            correlationId: correlationId || '',
-            audienceId: req.body?.audienceId,
-        });
-        if (!result.success) {
-            return res.status(400).json({ approved: false, error: result.reason });
-        }
-        // Now evaluated as approved
-        const evaluation = runtime.gating.evaluateGate(result.plan);
-        res.json({
-            approved: true,
-            status: evaluation.disposition,
-            response_id: result.plan.responseId,
-            speech: result.plan.speech,
-            language: result.plan.language,
+            if (!responseId) {
+                return res.status(400).json({ approved: false, error: 'UNKNOWN_APPROVAL_ID' });
+            }
+            const result = runtime.gating.approveResponse({
+                responseId,
+                companionId,
+                correlationId: correlationId || '',
+                audienceId: req.body?.audienceId,
+            });
+            if (!result.success) {
+                return res.status(400).json({ approved: false, error: result.reason });
+            }
+            // Now evaluated as approved
+            const evaluation = runtime.gating.evaluateGate(result.plan);
+            res.json({
+                approved: true,
+                status: evaluation.disposition,
+                response_id: result.plan.responseId,
+                speech: result.plan.speech,
+                language: result.plan.language,
+            });
         });
-    });
-    app.post('/dev/reject-response', async (req, res) => {
-        const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-        const runtime = runtimes.get(companionId);
-        if (!runtime)
-            return res.status(404).json({ rejected: false, error: 'Companion not found' });
-        let responseId = req.body?.responseId;
-        let correlationId = req.body?.correlation_id;
-        if (!responseId && correlationId) {
-            const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
-            if (found) {
-                responseId = found.responseId;
+        app.post('/dev/reject-response', async (req, res) => {
+            const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+            const runtime = runtimes.get(companionId);
+            if (!runtime)
+                return res.status(404).json({ rejected: false, error: 'Companion not found' });
+            let responseId = req.body?.responseId;
+            let correlationId = req.body?.correlation_id;
+            if (!responseId && correlationId) {
+                const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+                if (found) {
+                    responseId = found.responseId;
+                }
             }
-        }
-        else if (responseId && !correlationId) {
-            const found = runtime.gating.getStagedPlan(responseId);
-            if (found) {
-                correlationId = found.correlationId;
+            else if (responseId && !correlationId) {
+                const found = runtime.gating.getStagedPlan(responseId);
+                if (found) {
+                    correlationId = found.correlationId;
+                }
             }
-        }
-        if (!responseId) {
-            return res.status(400).json({ rejected: false, error: 'UNKNOWN_APPROVAL_ID' });
-        }
-        const result = runtime.gating.rejectResponse({
-            responseId,
-            companionId,
-            correlationId: correlationId || '',
-            reason: req.body?.reason,
+            if (!responseId) {
+                return res.status(400).json({ rejected: false, error: 'UNKNOWN_APPROVAL_ID' });
+            }
+            const result = runtime.gating.rejectResponse({
+                responseId,
+                companionId,
+                correlationId: correlationId || '',
+                reason: req.body?.reason,
+            });
+            if (!result.success) {
+                return res.status(400).json({ rejected: false, error: result.reason });
+            }
+            res.json({
+                rejected: true,
+                status: result.plan.status,
+                response_id: result.plan.responseId,
+            });
         });
-        if (!result.success) {
-            return res.status(400).json({ rejected: false, error: result.reason });
-        }
-        res.json({
-            rejected: true,
-            status: result.plan.status,
-            response_id: result.plan.responseId,
+        app.post('/dev/mock-observation', async (req, res) => {
+            if (!observationOrgan)
+                return res.status(503).json({ accepted: false, reason: 'observation_unavailable' });
+            const result = await observationOrgan.ingest(new Uint8Array([115, 121, 110, 116, 104, 101, 116, 105, 99]), 'fixture-observation', 'configured-vision');
+            if (!result.observation)
+                return res.status(result.duplicate ? 200 : 409).json({ accepted: false, ...result });
+            res.status(202).json({ accepted: true, observation: result.observation });
         });
-    });
-    app.post('/dev/mock-observation', async (req, res) => {
-        if (!observationOrgan)
-            return res.status(503).json({ accepted: false, reason: 'observation_unavailable' });
-        const result = await observationOrgan.ingest(new Uint8Array([115, 121, 110, 116, 104, 101, 116, 105, 99]), 'fixture-observation', 'configured-vision');
-        if (!result.observation)
-            return res.status(result.duplicate ? 200 : 409).json({ accepted: false, ...result });
-        res.status(202).json({ accepted: true, observation: result.observation });
-    });
-    app.post('/platforms/actions/suggest', (req, res) => res.json({ suggested: true }));
-    app.post('/platforms/actions/approve', (req, res) => res.json({ approved: true }));
-    app.post('/platforms/actions/reject', (req, res) => res.json({ rejected: true }));
-    app.post('/platforms/actions/send', (req, res) => res.json({ sent: true }));
+    }
     return { app, runtimes, setObservationOrgan: (org) => { observationOrgan = org; } };
 }

package/dist/b0-b6.test.js

@@ -79,7 +79,7 @@ describe('T0 B0 & B6 Runtime Proof Suite', () => {
             expect(mockKnowledge.search).not.toHaveBeenCalled();
             expect(mockBrain.generatePlan).toHaveBeenCalledWith(expect.objectContaining({
                 contextPrompt: '',
-                recipient: 'VIEWER',
+                recipient: 'OWNER',
             }));
         });
     });

package/dist/cors.d.ts

@@ -0,0 +1,3 @@
+import cors from 'cors';
+export declare function getAllowedOrigins(): Set<string>;
+export declare function createCorsOptions(): cors.CorsOptions;

package/dist/cors.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAllowedOrigins = getAllowedOrigins;
+exports.createCorsOptions = createCorsOptions;
+function getAllowedOrigins() {
+    const allowed = new Set([
+        'http://localhost:3000',
+        'http://127.0.0.1:3000',
+        'http://localhost:3001',
+        'http://127.0.0.1:3001',
+    ]);
+    if (process.env.PORT) {
+        allowed.add(`http://localhost:${process.env.PORT}`);
+        allowed.add(`http://127.0.0.1:${process.env.PORT}`);
+    }
+    const envOrigins = process.env.ALLOWED_ORIGINS;
+    if (envOrigins) {
+        for (const origin of envOrigins.split(',')) {
+            const trimmed = origin.trim();
+            if (trimmed) {
+                allowed.add(trimmed);
+            }
+        }
+    }
+    return allowed;
+}
+function createCorsOptions() {
+    return {
+        origin: (origin, callback) => {
+            // Allow non-browser requests with no origin header (e.g., native tools, curl)
+            if (!origin) {
+                return callback(null, true);
+            }
+            const allowedOrigins = getAllowedOrigins();
+            if (allowedOrigins.has(origin)) {
+                return callback(null, true);
+            }
+            return callback(null, false);
+        },
+        credentials: true,
+    };
+}

package/dist/index.js

@@ -55,7 +55,7 @@ function isDisabled(config) {
 function createVoice(config) {
     return isDisabled(config)
         ? undefined
-        : new voice_1.VoicevoxAdapter({ baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
+        : new voice_1.VoiceAdapter({ provider: config.provider || 'voicevox', baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
 }
 function createKnowledge(config) {
     if (isDisabled(config))
@@ -157,8 +157,8 @@ async function bootDefaultCompanion() {
 }
 if (process.env.NODE_ENV !== 'test') {
     bootDefaultCompanion().then(() => {
-        exports.app.listen(PORT, () => {
-            console.log(`Siduri-Y API running on port ${PORT}`);
+        exports.app.listen(Number(PORT), '127.0.0.1', () => {
+            console.log(`Siduri-X API running on port ${PORT} (127.0.0.1)`);
         });
     }).catch(e => {
         console.error("Failed to boot default companion:", e);

package/dist/index.test.js

@@ -29,7 +29,7 @@ describe('API Boundary Context Validation (P2 Route Integration)', () => {
             history: [],
         });
         expect(res.status).toBe(200);
-        expect(fakeRuntime.handleUserMessage).toHaveBeenCalledWith('Hello neutral world', 'VIEWER', []);
+        expect(fakeRuntime.handleUserMessage).toHaveBeenCalledWith('Hello neutral world', 'OWNER', []);
     });
     test('accepts neutral context chat envelope at /chat route', async () => {
         const res = await (0, supertest_1.default)(app)