@siduri-x/api 1.0.0

package/src/app.ts

@@ -0,0 +1,459 @@
+import express, { Express } from 'express';
+import cors from 'cors';
+import { SiduriRuntime } from './runtime';
+import { OpenAICompatibleBrain, OpenRouterBrain } from '@siduri-x/brain';
+import { PostgresMemoryOrgan } from '@siduri-x/memory';
+import { VoicevoxAdapter } from '@siduri-x/voice';
+import { EKnowledgeAdapter } from '@siduri-x/knowledge';
+import { OpenRouterVisionAdapter } from '@siduri-x/vision';
+import { ActiveSelfCompiler } from '@siduri-x/behavior';
+import { Live2DAdapter } from '@siduri-x/body';
+import { FixtureObservationOrgan } from '@siduri-x/observation';
+import { DefaultHandsOrgan } from '@siduri-x/hands';
+import { DefaultEarOrgan } from '@siduri-x/ear';
+import { attachIdentity, requireRole, Identity } from './auth';
+import { mapRequestContext } from './context-mapper';
+
+export interface AppInstance {
+  app: Express;
+  runtimes: Map<string, SiduriRuntime>;
+  setObservationOrgan: (org: FixtureObservationOrgan) => void;
+}
+
+export function createApp(runtimes: Map<string, SiduriRuntime> = new Map()): AppInstance {
+  const app: Express = express();
+  app.use(cors());
+  app.use(express.json());
+
+  let observationOrgan: FixtureObservationOrgan | undefined;
+
+  function createBrain(config: any) {
+    const provider = config.provider || 'openrouter';
+    const defaultKeyEnv = provider === 'openai-compatible' ? 'OPENAI_COMPATIBLE_API_KEY' : 'OPENROUTER_API_KEY';
+    const apiKey = config.apiKey || process.env[config.apiKeyEnv || defaultKeyEnv] || '';
+    if (provider === 'openai-compatible') {
+      return new OpenAICompatibleBrain({
+        apiKey,
+        model: config.model || 'local-model',
+        baseUrl: config.baseUrl || 'http://127.0.0.1:1234/v1',
+      });
+    }
+    return new OpenRouterBrain({ apiKey, model: config.model || 'gpt-4o-mini' });
+  }
+
+  function isDisabled(config: any): boolean {
+    return !config || config.provider === 'none';
+  }
+
+  function createVoice(config: any) {
+    return isDisabled(config)
+      ? undefined
+      : new VoicevoxAdapter({ baseUrl: process.env.VOICEVOX_URL || 'http://localhost:50021', speakerId: config.speakerId || 1 });
+  }
+
+  function createKnowledge(config: any) {
+    return isDisabled(config) ? undefined : new EKnowledgeAdapter(config);
+  }
+
+  function createVision(config: any) {
+    return isDisabled(config)
+      ? undefined
+      : new OpenRouterVisionAdapter({ apiKey: process.env.OPENROUTER_API_KEY || '', model: config.model || 'gpt-4-vision' });
+  }
+
+  function createBehavior(config: any) {
+    return isDisabled(config) ? undefined : new ActiveSelfCompiler();
+  }
+
+  function createBody(config: any) {
+    return isDisabled(config)
+      ? undefined
+      : new Live2DAdapter(config);
+  }
+
+  function createHands(config: any) {
+    return isDisabled(config)
+      ? new DefaultHandsOrgan()
+      : new DefaultHandsOrgan(config);
+  }
+
+  function createEar(config: any) {
+    return isDisabled(config)
+      ? new DefaultEarOrgan()
+      : new DefaultEarOrgan(config);
+  }
+
+  app.post('/boot', requireRole(['OWNER']), async (req, res) => {
+    try {
+      const { id, config } = req.body;
+      if (runtimes.has(id)) {
+        return res.status(400).json({ error: "Already booted" });
+      }
+
+      const brain = createBrain(config.brain);
+      const memory = new PostgresMemoryOrgan({ connectionString: process.env.DATABASE_URL || 'postgresql://postgres:postgres@localhost:5432/siduri' });
+      const voice = createVoice(config.voice);
+      const knowledge = createKnowledge(config.knowledge);
+      const vision = createVision(config.vision);
+      const behavior = createBehavior(config.behavior);
+      const body = createBody(config.body);
+      const hands = createHands(config.hands);
+      const ear = createEar(config.ear);
+
+      const runtime = new SiduriRuntime(id, config, { brain, memory, voice, knowledge, vision, behavior, body, hands, ear });
+      await runtime.initialize();
+
+      runtimes.set(id, runtime);
+
+      res.json({ success: true, id });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // STATUS / HEALTH ENDPOINTS
+  app.get('/health', (req, res) => res.json({ status: "ok" }));
+  app.get('/version', (req, res) => res.json({ name: "siduri-y-api", version: "0.2.0-y" }));
+  app.get('/ready', (req, res) => res.json({ status: "ready", dependencies: {} }));
+  app.get('/voice/health', (req, res) => res.json({ provider: "voicevox", healthy: true }));
+  app.get('/obs/health', (req, res) => res.json({ connected: true }));
+  app.get('/platforms/status', (req, res) => res.json({ platforms: {} }));
+  app.get('/me', attachIdentity, (req, res) => {
+    const identity = (req as any).identity as Identity;
+    res.json({
+      actorId: identity.role === 'OWNER' ? 'owner-user' : 'anonymous-session',
+      role: identity.role,
+      authenticated: identity.role === 'OWNER',
+    });
+  });
+  app.put('/me', requireRole(['OWNER']), (req, res) => res.json({ success: true }));
+
+  // CHAT (API context boundary validation)
+  app.post('/chat', attachIdentity, async (req, res) => {
+    const { id, message, history } = req.body;
+    const identity = (req as any).identity as Identity;
+
+    // Call context mapper at the API boundary
+    const mappingResult = mapRequestContext(
+      {
+        ...req.body,
+        id: id || req.body.companionId,
+        role: req.body.role || identity?.role,
+        generateCorrelationId: true,
+      },
+      {
+        endpointPolicy: 'public',
+        defaultPublicAudience: 'audience-public',
+      }
+    );
+
+    if (!mappingResult.accepted) {
+      return res.status(400).json({
+        accepted: false,
+        error: mappingResult.error,
+      });
+    }
+
+    const companionId = mappingResult.context!.companionId;
+    const runtime = runtimes.get(companionId);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+
+    try {
+      // Map authorization role to legacy memory scope for backwards-compatible runtime call
+      const legacyScope =
+        mappingResult.context!.actor.authorizationRole === 'administrator'
+          ? 'OWNER'
+          : mappingResult.context!.actor.authorizationRole === 'operator'
+          ? 'OPERATOR'
+          : 'VIEWER';
+
+      const response = await runtime.handleUserMessage(message, legacyScope, history);
+      res.json(response);
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // MEMORY GETTERS
+  app.get('/memory/proposals', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.query.id as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.json({ proposals: [] });
+    try {
+      const proposals = await runtime.memory.getPendingClaims();
+      res.json({ proposals });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.get('/memory', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.query.id as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.json({ items: [] });
+    try {
+      const items = await runtime.memory.getClaims();
+      res.json({ items });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.get('/memory/claims', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.query.id as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.json({ claims: [] });
+    try {
+      const claims = await runtime.memory.getClaims();
+      res.json({ claims });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.get('/memory/behavioral', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.query.id as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.json({ directives: [] });
+    try {
+      const directives = await runtime.memory.getDirectives();
+      res.json({ directives });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // MEMORY MUTATIONS - PROPOSALS
+  app.post('/memory/proposals/update', requireRole(['OWNER', 'OPERATOR']), async (req, res) => res.json({ success: true }));
+
+  app.post('/memory/proposals/approve', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.approveClaim(req.body.id);
+      res.json({ approved: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post('/memory/proposals/reject', requireRole(['OWNER', 'OPERATOR']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.rejectClaim(req.body.id);
+      res.json({ rejected: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  // MEMORY MUTATIONS - BEHAVIORAL
+  app.post('/memory/behavioral/approve', requireRole(['OWNER']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.approveDirective(req.body.id);
+      res.json({ approved: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post('/memory/behavioral/reject', requireRole(['OWNER']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.rejectDirective(req.body.id);
+      res.json({ rejected: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post('/memory/behavioral/revoke', requireRole(['OWNER']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.revokeDirective(req.body.id);
+      res.json({ revoked: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post('/memory/behavioral/disable', requireRole(['OWNER']), async (req, res) => {
+    const id = req.body.companionId as string || Array.from(runtimes.keys())[0];
+    const runtime = runtimes.get(id);
+    if (!runtime) return res.status(404).json({ error: "Companion not found" });
+    if (!runtime.memory) return res.status(400).json({ error: "Memory organ not configured" });
+    try {
+      await runtime.memory.disableDirective(req.body.id);
+      res.json({ disabled: true });
+    } catch (e: any) {
+      res.status(500).json({ error: e.message });
+    }
+  });
+
+  app.post('/dev/memory/reset', requireRole(['OWNER']), async (req, res) => res.json({ reset: true }));
+
+  // MOCKS / DEV / EVIDENCE / PLATFORMS
+  app.get('/platforms/events', (req, res) => res.json({ events: [] }));
+  app.get('/platforms/actions', (req, res) => res.json({ actions: [] }));
+  app.get('/evidence', (req, res) => res.json({ results: [] }));
+  app.get('/observations', (req, res) => res.json({ observations: observationOrgan?.current() ?? [] }));
+
+  app.post('/dev/mock-response', async (req, res) => {
+    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+    const runtime = runtimes.get(companionId);
+    if (!runtime) return res.status(404).json({ accepted: false, error: 'Companion not found' });
+    const staged = runtime.gating.stageResponse({
+      requestContext: {
+        companionId,
+        actor: {
+          actorId: 'operator-a',
+          sessionId: 'sess-op',
+          authorizationRole: 'operator',
+          capabilities: ['chat:public', 'memory:approve'],
+          authenticated: true,
+        },
+        conversation: {
+          channel: 'public',
+          audienceId: 'audience-public',
+          correlationId: req.body?.correlation_id || `corr-${Date.now()}`,
+        },
+      },
+      candidateSpeech: req.body?.speech || 'Mocked staged response for review',
+      candidateLanguage: req.body?.language || 'en',
+      requiresApproval: req.body?.requiresApproval ?? true,
+    });
+    res.json({
+      accepted: true,
+      staged: true,
+      status: staged.status,
+      response_id: staged.responseId,
+      correlation_id: staged.correlationId,
+      speech: staged.speech,
+    });
+  });
+
+  app.post('/dev/approve-response', async (req, res) => {
+    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+    const runtime = runtimes.get(companionId);
+    if (!runtime) return res.status(404).json({ approved: false, error: 'Companion not found' });
+
+    let responseId = req.body?.responseId;
+    let correlationId = req.body?.correlation_id;
+
+    if (!responseId && correlationId) {
+      const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+      if (found) {
+        responseId = found.responseId;
+      }
+    } else if (responseId && !correlationId) {
+      const found = runtime.gating.getStagedPlan(responseId);
+      if (found) {
+        correlationId = found.correlationId;
+      }
+    }
+
+    if (!responseId) {
+      return res.status(400).json({ approved: false, error: 'UNKNOWN_APPROVAL_ID' });
+    }
+
+    const result = runtime.gating.approveResponse({
+      responseId,
+      companionId,
+      correlationId: correlationId || '',
+      audienceId: req.body?.audienceId,
+    });
+
+    if (!result.success) {
+      return res.status(400).json({ approved: false, error: result.reason });
+    }
+
+    // Now evaluated as approved
+    const evaluation = runtime.gating.evaluateGate(result.plan!);
+    res.json({
+      approved: true,
+      status: evaluation.disposition,
+      response_id: result.plan!.responseId,
+      speech: result.plan!.speech,
+      language: result.plan!.language,
+    });
+  });
+
+  app.post('/dev/reject-response', async (req, res) => {
+    const companionId = req.body?.companionId || Array.from(runtimes.keys())[0] || 'default';
+    const runtime = runtimes.get(companionId);
+    if (!runtime) return res.status(404).json({ rejected: false, error: 'Companion not found' });
+
+    let responseId = req.body?.responseId;
+    let correlationId = req.body?.correlation_id;
+
+    if (!responseId && correlationId) {
+      const found = runtime.gating.findStagedPlanByCorrelation(companionId, correlationId);
+      if (found) {
+        responseId = found.responseId;
+      }
+    } else if (responseId && !correlationId) {
+      const found = runtime.gating.getStagedPlan(responseId);
+      if (found) {
+        correlationId = found.correlationId;
+      }
+    }
+
+    if (!responseId) {
+      return res.status(400).json({ rejected: false, error: 'UNKNOWN_APPROVAL_ID' });
+    }
+
+    const result = runtime.gating.rejectResponse({
+      responseId,
+      companionId,
+      correlationId: correlationId || '',
+      reason: req.body?.reason,
+    });
+
+    if (!result.success) {
+      return res.status(400).json({ rejected: false, error: result.reason });
+    }
+
+    res.json({
+      rejected: true,
+      status: result.plan!.status,
+      response_id: result.plan!.responseId,
+    });
+  });
+
+  app.post('/dev/mock-observation', async (req, res) => {
+    if (!observationOrgan) return res.status(503).json({ accepted: false, reason: 'observation_unavailable' });
+    const result = await observationOrgan.ingest(
+      new Uint8Array([115, 121, 110, 116, 104, 101, 116, 105, 99]),
+      'fixture-observation',
+      'configured-vision',
+    );
+    if (!result.observation) return res.status(result.duplicate ? 200 : 409).json({ accepted: false, ...result });
+    res.status(202).json({ accepted: true, observation: result.observation });
+  });
+
+  app.post('/platforms/actions/suggest', (req, res) => res.json({ suggested: true }));
+  app.post('/platforms/actions/approve', (req, res) => res.json({ approved: true }));
+  app.post('/platforms/actions/reject', (req, res) => res.json({ rejected: true }));
+  app.post('/platforms/actions/send', (req, res) => res.json({ sent: true }));
+
+  return { app, runtimes, setObservationOrgan: (org: FixtureObservationOrgan) => { observationOrgan = org; } };
+}

package/src/auth.test.ts

@@ -0,0 +1,57 @@
+import { resolveIdentity } from './auth';
+
+describe('Auth Identity Resolution', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...originalEnv };
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  const mockReq = (token?: string) => ({
+    headers: {
+      authorization: token ? `Bearer ${token}` : undefined
+    }
+  } as any);
+
+  test('resolves explicit owner token', () => {
+    process.env.OWNER_TOKEN = 'owner-secret';
+    process.env.OPERATOR_TOKEN = 'operator-secret';
+    process.env.NODE_ENV = 'production';
+
+    const ownerId = resolveIdentity(mockReq('owner-secret'));
+    expect(ownerId.role).toBe('OWNER');
+  });
+
+  test('resolves explicit operator token', () => {
+    process.env.OWNER_TOKEN = 'owner-secret';
+    process.env.OPERATOR_TOKEN = 'operator-secret';
+    process.env.NODE_ENV = 'production';
+
+    const opId = resolveIdentity(mockReq('operator-secret'));
+    expect(opId.role).toBe('OPERATOR');
+  });
+
+  test('defaults to viewer when no token is present in production', () => {
+    process.env.NODE_ENV = 'production';
+    const viewerId = resolveIdentity(mockReq());
+    expect(viewerId.role).toBe('VIEWER');
+  });
+
+  test('defaults to viewer for invalid token in production', () => {
+    process.env.NODE_ENV = 'production';
+    const invalidId = resolveIdentity(mockReq('invalid-token'));
+    expect(invalidId.role).toBe('VIEWER');
+  });
+
+  test('resolves development fallback role', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.DEV_LOCAL_AUTH_ROLE = 'OWNER';
+    const devId = resolveIdentity(mockReq());
+    expect(devId.role).toBe('OWNER');
+  });
+});

package/src/auth.ts

@@ -0,0 +1,49 @@
+import { Request, Response, NextFunction } from 'express';
+
+export type Role = 'OWNER' | 'OPERATOR' | 'VIEWER';
+
+export interface Identity {
+  role: Role;
+}
+
+export function resolveIdentity(req: Request): Identity {
+  const authHeader = req.headers.authorization;
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.split(' ')[1] : undefined;
+
+  // 1. Explicit token matches
+  if (process.env.OWNER_TOKEN && token === process.env.OWNER_TOKEN) {
+    return { role: 'OWNER' };
+  }
+  if (process.env.OPERATOR_TOKEN && token === process.env.OPERATOR_TOKEN) {
+    return { role: 'OPERATOR' };
+  }
+
+  // 2. Development fallback
+  const isDev = process.env.NODE_ENV !== 'production';
+  if (isDev && process.env.DEV_LOCAL_AUTH_ROLE) {
+    const fallbackRole = process.env.DEV_LOCAL_AUTH_ROLE.toUpperCase() as Role;
+    if (['OWNER', 'OPERATOR', 'VIEWER'].includes(fallbackRole)) {
+      return { role: fallbackRole };
+    }
+  }
+
+  // Default
+  return { role: 'VIEWER' };
+}
+
+export function requireRole(allowedRoles: Role[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const identity = resolveIdentity(req);
+    (req as any).identity = identity;
+    
+    if (!allowedRoles.includes(identity.role)) {
+      return res.status(403).json({ error: `Forbidden: requires one of ${allowedRoles.join(', ')}` });
+    }
+    next();
+  };
+}
+
+export function attachIdentity(req: Request, res: Response, next: NextFunction) {
+  (req as any).identity = resolveIdentity(req);
+  next();
+}