@siduri-x/api 1.0.0 → 1.0.1

package/src/app.ts

@@ -1,9 +1,10 @@
 import express, { Express } from 'express';
 import cors from 'cors';
-import { SiduriRuntime } from './runtime';
+import { createCorsOptions } from './cors';
+import { SiduriRuntime, dispatchCompanionChat } from './runtime';
 import { OpenAICompatibleBrain, OpenRouterBrain } from '@siduri-x/brain';
 import { PostgresMemoryOrgan } from '@siduri-x/memory';
-import { VoicevoxAdapter } from '@siduri-x/voice';
+import { VoiceAdapter } from '@siduri-x/voice';
 import { EKnowledgeAdapter } from '@siduri-x/knowledge';
 import { OpenRouterVisionAdapter } from '@siduri-x/vision';
 import { ActiveSelfCompiler } from '@siduri-x/behavior';
@@ -22,7 +23,7 @@ export interface AppInstance {
 
 export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): AppInstance {
   const app: Express = express();
-  app.use(cors());
+  app.use(cors(createCorsOptions()));
   app.use(express.json());
 
   let observationOrgan: FixtureObservationOrgan | undefined;
@@ -48,7 +49,7 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
   function createVoice(config: any) {
     return isDisabled(config)
       ? undefined
-      : new VoicevoxAdapter({ baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
+      : new VoiceAdapter({ provider: config.provider || 'voicevox', baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
   }
 
   function createKnowledge(config: any) {
@@ -113,11 +114,19 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
 
   // STATUS / HEALTH ENDPOINTS
   app.get('/health', (req, res) => res.json({ status: "ok" }));
-  app.get('/version', (req, res) => res.json({ name: "siduri-y-api", version: "0.2.0-y" }));
-  app.get('/ready', (req, res) => res.json({ status: "ready", dependencies: {} }));
-  app.get('/voice/health', (req, res) => res.json({ provider: "voicevox", healthy: true }));
-  app.get('/obs/health', (req, res) => res.json({ connected: true }));
-  app.get('/platforms/status', (req, res) => res.json({ platforms: {} }));
+  app.get('/version', (req, res) => res.json({ name: "siduri-x-api", version: "0.2.0-x" }));
+  app.get('/ready', (req, res) => {
+    const isReady = runtimes.size > 0;
+    res.status(isReady ? 200 : 503).json({
+      status: isReady ? "ready" : "not_ready",
+      companionCount: runtimes.size,
+    });
+  });
+  app.get('/voice/health', (req, res) => {
+    const hasVoice = Array.from(runtimes.values()).some((r) => Boolean(r.voice));
+    res.json({ provider: "siduri-voice", configured: hasVoice });
+  });
+  app.get('/obs/health', (req, res) => res.json({ connected: Boolean(observationOrgan) }));
   app.get('/me', attachIdentity, (req, res) => {
     const identity = (req as any).identity as Identity;
     res.json({
@@ -133,12 +142,20 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
     const { id, message, history } = req.body;
     const identity = (req as any).identity as Identity;
 
+    // Single-owner companion model: /chat defaults to OWNER identity.
+    // Explicit non-owner role in request body or context (e.g. adversarial test suites) is respected.
+    const effectiveRole = req.body?.role === 'VIEWER' || req.body?.context?.actor?.authorizationRole === 'viewer'
+      ? 'VIEWER'
+      : (identity?.role === 'OPERATOR' ? 'OPERATOR' : 'OWNER');
+    const isOwner = effectiveRole === 'OWNER';
+
     // Call context mapper at the API boundary
     const mappingResult = mapRequestContext(
       {
         ...req.body,
         id: id || req.body.companionId,
-        role: req.body.role || identity?.role,
+        role: effectiveRole,
+        authenticated: isOwner,
         generateCorrelationId: true,
       },
       {
@@ -159,15 +176,13 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
     if (!runtime) return res.status(404).json({ error: "Companion not found" });
 
     try {
-      // Map authorization role to legacy memory scope for backwards-compatible runtime call
-      const legacyScope =
-        mappingResult.context!.actor.authorizationRole === 'administrator'
-          ? 'OWNER'
-          : mappingResult.context!.actor.authorizationRole === 'operator'
-          ? 'OPERATOR'
-          : 'VIEWER';
-
-      const response = await runtime.handleUserMessage(message, legacyScope, history);
+      const response = await dispatchCompanionChat(runtime, {
+        id: companionId,
+        companionId,
+        message,
+        context: mappingResult.context,
+        history,
+      });
       res.json(response);
     } catch (e: any) {
       res.status(500).json({ error: e.message });
@@ -228,7 +243,24 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
   });
 
   // MEMORY MUTATIONS - PROPOSALS
-  app.post('/memory/proposals/update', requireRole(['OWNER', 'OPERATOR']), async (req, res) => res.json({ success: true }));
+  app.post('/memory/proposals/update', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory || typeof runtime.memory.updateClaim !== 'function') {
+      return res.status(400).json({ error: "Memory organ does not support updating claims" });
+    }
+    try {
+      const claimId = req.body.id || req.body.claimId;
+      if (!claimId) {
+        return res.status(400).json({ error: "Missing required claim id" });
+      }
+      const updated = await runtime.memory.updateClaim(claimId, req.body.updates || req.body);
+      res.json({ success: true, claim: updated });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
 
   app.post('/memory/proposals/approve', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
     const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
@@ -309,151 +341,156 @@ export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): App
     }
   });
 
-  app.post('/dev/memory/reset', requireRole(['OWNER']), async (req, res) => res.json({ reset: true }));
-
-  // MOCKS / DEV / EVIDENCE / PLATFORMS
-  app.get('/platforms/events', (req, res) => res.json({ events: [] }));
-  app.get('/platforms/actions', (req, res) => res.json({ actions: [] }));
-  app.get('/evidence', (req, res) => res.json({ results: [] }));
-  app.get('/observations', (req, res) => res.json({ observations: observationOrgan?.current() ?? [] }));
+  const isDevMode = process.env.NODE_ENV !== 'production' || process.env.SIDURI_DEV_MODE === 'true';
+  if (isDevMode) {
+    app.post('/dev/memory/reset', requireRole(['OWNER']), async (req, res) => {
+      const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+      const runtime = runtimes.get(id);
+      if (!runtime) return res.status(404).json({ error: "Companion not found" });
+      if (!runtime.memory || typeof runtime.memory.resetMemory !== 'function') {
+        return res.status(400).json({ error: "Memory organ does not support reset" });
+      }
+      try {
+        await runtime.memory.resetMemory();
+        res.json({ reset: true });
+      } catch (e: any) {
+        res.status(500).json({ error: e.message });
+      }
+    });
 
-  app.post('/dev/mock-response', async (req, res) => {
-    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-    const runtime = runtimes.get(companionId);
-    if (!runtime) return res.status(404).json({ accepted: false, error: 'Companion not found' });
-    const staged = runtime.gating.stageResponse({
-      requestContext: {
-        companionId,
-        actor: {
-          actorId: 'operator-a',
-          sessionId: 'sess-op',
-          authorizationRole: 'operator',
-          capabilities: ['chat:public', 'memory:approve'],
-          authenticated: true,
+    app.post('/dev/mock-response', async (req, res) => {
+      const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+      const runtime = runtimes.get(companionId);
+      if (!runtime) return res.status(404).json({ accepted: false, error: 'Companion not found' });
+      const staged = runtime.gating.stageResponse({
+        requestContext: {
+          companionId,
+          actor: {
+            actorId: 'operator-a',
+            sessionId: 'sess-op',
+            authorizationRole: 'operator',
+            capabilities: ['chat:public', 'memory:approve'],
+            authenticated: true,
+          },
+          conversation: {
+            channel: 'public',
+            audienceId: 'audience-public',
+            correlationId: req.body?.correlation_id || `corr-${Date.now()}`,
+          },
         },
-        conversation: {
-          channel: 'public',
-          audienceId: 'audience-public',
-          correlationId: req.body?.correlation_id || `corr-${Date.now()}`,
-        },
-      },
-      candidateSpeech: req.body?.speech || 'Mocked staged response for review',
-      candidateLanguage: req.body?.language || 'en',
-      requiresApproval: req.body?.requiresApproval ?? true,
-    });
-    res.json({
-      accepted: true,
-      staged: true,
-      status: staged.status,
-      response_id: staged.responseId,
-      correlation_id: staged.correlationId,
-      speech: staged.speech,
+        candidateSpeech: req.body?.speech || 'Mocked staged response for review',
+        candidateLanguage: req.body?.language || 'en',
+        requiresApproval: req.body?.requiresApproval ?? true,
+      });
+      res.json({
+        accepted: true,
+        staged: true,
+        status: staged.status,
+        response_id: staged.responseId,
+        correlation_id: staged.correlationId,
+        speech: staged.speech,
+      });
     });
-  });
-
-  app.post('/dev/approve-response', async (req, res) => {
-    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-    const runtime = runtimes.get(companionId);
-    if (!runtime) return res.status(404).json({ approved: false, error: 'Companion not found' });
-
-    let responseId = req.body?.responseId;
-    let correlationId = req.body?.correlation_id;
 
-    if (!responseId && correlationId) {
-      const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
-      if (found) {
-        responseId = found.responseId;
+    app.post('/dev/approve-response', async (req, res) => {
+      const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+      const runtime = runtimes.get(companionId);
+      if (!runtime) return res.status(404).json({ approved: false, error: 'Companion not found' });
+
+      let responseId = req.body?.responseId;
+      let correlationId = req.body?.correlation_id;
+
+      if (!responseId && correlationId) {
+        const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+        if (found) {
+          responseId = found.responseId;
+        }
+      } else if (responseId && !correlationId) {
+        const found = runtime.gating.getStagedPlan(responseId);
+        if (found) {
+          correlationId = found.correlationId;
+        }
       }
-    } else if (responseId && !correlationId) {
-      const found = runtime.gating.getStagedPlan(responseId);
-      if (found) {
-        correlationId = found.correlationId;
-      }
-    }
 
-    if (!responseId) {
-      return res.status(400).json({ approved: false, error: 'UNKNOWN_APPROVAL_ID' });
-    }
+      if (!responseId) {
+        return res.status(400).json({ approved: false, error: 'UNKNOWN_APPROVAL_ID' });
+      }
 
-    const result = runtime.gating.approveResponse({
-      responseId,
-      companionId,
-      correlationId: correlationId || '',
-      audienceId: req.body?.audienceId,
-    });
+      const result = runtime.gating.approveResponse({
+        responseId,
+        companionId,
+        correlationId: correlationId || '',
+        audienceId: req.body?.audienceId,
+      });
 
-    if (!result.success) {
-      return res.status(400).json({ approved: false, error: result.reason });
-    }
+      if (!result.success) {
+        return res.status(400).json({ approved: false, error: result.reason });
+      }
 
-    // Now evaluated as approved
-    const evaluation = runtime.gating.evaluateGate(result.plan!);
-    res.json({
-      approved: true,
-      status: evaluation.disposition,
-      response_id: result.plan!.responseId,
-      speech: result.plan!.speech,
-      language: result.plan!.language,
+      // Now evaluated as approved
+      const evaluation = runtime.gating.evaluateGate(result.plan!);
+      res.json({
+        approved: true,
+        status: evaluation.disposition,
+        response_id: result.plan!.responseId,
+        speech: result.plan!.speech,
+        language: result.plan!.language,
+      });
     });
-  });
 
-  app.post('/dev/reject-response', async (req, res) => {
-    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
-    const runtime = runtimes.get(companionId);
-    if (!runtime) return res.status(404).json({ rejected: false, error: 'Companion not found' });
-
-    let responseId = req.body?.responseId;
-    let correlationId = req.body?.correlation_id;
-
-    if (!responseId && correlationId) {
-      const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
-      if (found) {
-        responseId = found.responseId;
-      }
-    } else if (responseId && !correlationId) {
-      const found = runtime.gating.getStagedPlan(responseId);
-      if (found) {
-        correlationId = found.correlationId;
+    app.post('/dev/reject-response', async (req, res) => {
+      const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+      const runtime = runtimes.get(companionId);
+      if (!runtime) return res.status(404).json({ rejected: false, error: 'Companion not found' });
+
+      let responseId = req.body?.responseId;
+      let correlationId = req.body?.correlation_id;
+
+      if (!responseId && correlationId) {
+        const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+        if (found) {
+          responseId = found.responseId;
+        }
+      } else if (responseId && !correlationId) {
+        const found = runtime.gating.getStagedPlan(responseId);
+        if (found) {
+          correlationId = found.correlationId;
+        }
       }
-    }
 
-    if (!responseId) {
-      return res.status(400).json({ rejected: false, error: 'UNKNOWN_APPROVAL_ID' });
-    }
+      if (!responseId) {
+        return res.status(400).json({ rejected: false, error: 'UNKNOWN_APPROVAL_ID' });
+      }
 
-    const result = runtime.gating.rejectResponse({
-      responseId,
-      companionId,
-      correlationId: correlationId || '',
-      reason: req.body?.reason,
-    });
+      const result = runtime.gating.rejectResponse({
+        responseId,
+        companionId,
+        correlationId: correlationId || '',
+        reason: req.body?.reason,
+      });
 
-    if (!result.success) {
-      return res.status(400).json({ rejected: false, error: result.reason });
-    }
+      if (!result.success) {
+        return res.status(400).json({ rejected: false, error: result.reason });
+      }
 
-    res.json({
-      rejected: true,
-      status: result.plan!.status,
-      response_id: result.plan!.responseId,
+      res.json({
+        rejected: true,
+        status: result.plan!.status,
+        response_id: result.plan!.responseId,
+      });
     });
-  });
-
-  app.post('/dev/mock-observation', async (req, res) => {
-    if (!observationOrgan) return res.status(503).json({ accepted: false, reason: 'observation_unavailable' });
-    const result = await observationOrgan.ingest(
-      new Uint8Array([115, 121, 110, 116, 104, 101, 116, 105, 99]),
-      'fixture-observation',
-      'configured-vision',
-    );
-    if (!result.observation) return res.status(result.duplicate ? 200 : 409).json({ accepted: false, ...result });
-    res.status(202).json({ accepted: true, observation: result.observation });
-  });
 
-  app.post('/platforms/actions/suggest', (req, res) => res.json({ suggested: true }));
-  app.post('/platforms/actions/approve', (req, res) => res.json({ approved: true }));
-  app.post('/platforms/actions/reject', (req, res) => res.json({ rejected: true }));
-  app.post('/platforms/actions/send', (req, res) => res.json({ sent: true }));
+    app.post('/dev/mock-observation', async (req, res) => {
+      if (!observationOrgan) return res.status(503).json({ accepted: false, reason: 'observation_unavailable' });
+      const result = await observationOrgan.ingest(
+        new Uint8Array([115, 121, 110, 116, 104, 101, 116, 105, 99]),
+        'fixture-observation',
+        'configured-vision',
+      );
+      if (!result.observation) return res.status(result.duplicate ? 200 : 409).json({ accepted: false, ...result });
+      res.status(202).json({ accepted: true, observation: result.observation });
+    });
+  }
 
   return { app, runtimes, setObservationOrgan: (org: FixtureObservationOrgan) => { observationOrgan = org; } };
 }

package/src/b0-b6.test.ts

@@ -87,7 +87,7 @@ describe('T0 B0 & B6 Runtime Proof Suite', () => {
       expect(mockBrain.generatePlan).toHaveBeenCalledWith(
         expect.objectContaining({
           contextPrompt: '',
-          recipient: 'VIEWER',
+          recipient: 'OWNER',
         })
       );
     });

package/src/cors.ts

@@ -0,0 +1,44 @@
+import cors from 'cors';
+
+export function getAllowedOrigins(): Set<string> {
+  const allowed = new Set<string>([
+    'http://localhost:3000',
+    'http://127.0.0.1:3000',
+    'http://localhost:3001',
+    'http://127.0.0.1:3001',
+  ]);
+
+  if (process.env.PORT) {
+    allowed.add(`http://localhost:${process.env.PORT}`);
+    allowed.add(`http://127.0.0.1:${process.env.PORT}`);
+  }
+
+  const envOrigins = process.env.ALLOWED_ORIGINS;
+  if (envOrigins) {
+    for (const origin of envOrigins.split(',')) {
+      const trimmed = origin.trim();
+      if (trimmed) {
+        allowed.add(trimmed);
+      }
+    }
+  }
+
+  return allowed;
+}
+
+export function createCorsOptions(): cors.CorsOptions {
+  return {
+    origin: (origin, callback) => {
+      // Allow non-browser requests with no origin header (e.g., native tools, curl)
+      if (!origin) {
+        return callback(null, true);
+      }
+      const allowedOrigins = getAllowedOrigins();
+      if (allowedOrigins.has(origin)) {
+        return callback(null, true);
+      }
+      return callback(null, false);
+    },
+    credentials: true,
+  };
+}

package/src/index.test.ts

@@ -31,7 +31,7 @@ describe('API Boundary Context Validation (P2 Route Integration)', () => {
     expect(res.status).toBe(200);
     expect(fakeRuntime.handleUserMessage).toHaveBeenCalledWith(
       'Hello neutral world',
-      'VIEWER',
+      'OWNER',
       []
     );
   });

package/src/index.ts

@@ -5,7 +5,7 @@ import { createApp, AppInstance } from './app';
 import { SiduriRuntime } from './runtime';
 import { OpenAICompatibleBrain, OpenRouterBrain } from '@siduri-x/brain';
 import { PostgresMemoryOrgan } from '@siduri-x/memory';
-import { VoicevoxAdapter } from '@siduri-x/voice';
+import { VoiceAdapter } from '@siduri-x/voice';
 import { EKnowledgeAdapter } from '@siduri-x/knowledge';
 import { OpenRouterVisionAdapter } from '@siduri-x/vision';
 import { ActiveSelfCompiler } from '@siduri-x/behavior';
@@ -41,7 +41,7 @@ function isDisabled(config: any): boolean {
 function createVoice(config: any) {
   return isDisabled(config)
     ? undefined
-    : new VoicevoxAdapter({ baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
+    : new VoiceAdapter({ provider: config.provider || 'voicevox', baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
 }
 
 function createKnowledge(config: any) {
@@ -151,8 +151,8 @@ async function bootDefaultCompanion() {
 
 if (process.env.NODE_ENV !== 'test') {
   bootDefaultCompanion().then(() => {
-    app.listen(PORT, () => {
-      console.log(`Siduri-Y API running on port ${PORT}`);
+    app.listen(Number(PORT), '127.0.0.1', () => {
+      console.log(`Siduri-X API running on port ${PORT} (127.0.0.1)`);
     });
   }).catch(e => {
     console.error("Failed to boot default companion:", e);