@siduri-x/api 1.0.5 → 2.0.2

package/dist/boot.d.ts

@@ -0,0 +1,92 @@
+import { OpenAICompatibleBrain } from '@siduri-x/brain';
+import { SqliteMemoryStore } from '@siduri-x/memory';
+import { VoiceAdapter, VoiceConfig } from '@siduri-x/voice';
+import { UnifiedKnowledgeOrgan, UnifiedKnowledgeConfig } from '@siduri-x/knowledge';
+import { OpenRouterVisionAdapter, OpenRouterVisionConfig } from '@siduri-x/vision';
+import { ActiveSelfCompiler, SqliteSelfRepository } from '@siduri-x/self';
+import { Live2DAdapterConfig } from '@siduri-x/body';
+import { FixtureObservationOrgan } from '@siduri-x/observation';
+import { DefaultHandsOrgan, DefaultHandsOrganConfig } from '@siduri-x/hands';
+import { DefaultEarOrgan, EarOrganConfig } from '@siduri-x/ear';
+import { DefaultMouthOrgan, DefaultMouthOrganConfig } from '@siduri-x/mouth';
+import { SiduriRuntime } from './runtime';
+export interface AppBrainConfig {
+    provider?: 'openrouter' | 'openai-compatible' | string;
+    model?: string;
+    apiKey?: string;
+    apiKeyEnv?: string;
+    baseUrl?: string;
+    timeoutMs?: number;
+    [key: string]: unknown;
+}
+export interface AppBehaviorConfig {
+    provider?: 'active_self' | 'none' | string;
+    preset?: string;
+    [key: string]: unknown;
+}
+export interface AppBootCompanionConfig {
+    name: string;
+    id?: string;
+    brain?: AppBrainConfig;
+    voice?: VoiceConfig;
+    memory?: {
+        provider?: string;
+        connectionString?: string;
+        maxConnections?: number;
+        dbPath?: string;
+        [key: string]: unknown;
+    };
+    knowledge?: UnifiedKnowledgeConfig;
+    vision?: OpenRouterVisionConfig;
+    behavior?: AppBehaviorConfig;
+    body?: Live2DAdapterConfig;
+    hands?: DefaultHandsOrganConfig;
+    ear?: EarOrganConfig;
+    mouth?: DefaultMouthOrganConfig;
+    self?: {
+        dbPath?: string;
+        [key: string]: unknown;
+    };
+    organs?: Record<string, any>;
+    [key: string]: unknown;
+}
+export interface BootCompanionOptions {
+    observationOrgan?: FixtureObservationOrgan;
+}
+export declare function isDisabled(config?: {
+    provider?: string;
+}): boolean;
+export declare function createBrain(config?: AppBrainConfig): OpenAICompatibleBrain;
+export declare function createVoice(config?: VoiceConfig): VoiceAdapter | undefined;
+export declare function createKnowledge(config?: UnifiedKnowledgeConfig): UnifiedKnowledgeOrgan | undefined;
+export declare function createVision(config?: OpenRouterVisionConfig & {
+    provider?: string;
+}): OpenRouterVisionAdapter | undefined;
+export declare function createBehavior(config?: AppBehaviorConfig): ActiveSelfCompiler | undefined;
+export declare function createBody(config?: Live2DAdapterConfig & {
+    provider?: string;
+}): import("@siduri-x/body").NeutralBodyOrgan | undefined;
+export declare function createHands(config?: DefaultHandsOrganConfig & {
+    provider?: string;
+}): DefaultHandsOrgan;
+export declare function createEar(config?: EarOrganConfig & {
+    provider?: string;
+}): DefaultEarOrgan;
+export declare function createMouth(config?: DefaultMouthOrganConfig & {
+    provider?: string;
+}, voice?: any): DefaultMouthOrgan;
+export declare function createMemory(config?: {
+    provider?: string;
+    connectionString?: string;
+    maxConnections?: number;
+    dbPath?: string;
+}): SqliteMemoryStore | undefined;
+export declare function createSelf(config?: {
+    dbPath?: string;
+}): SqliteSelfRepository;
+export declare function createObservation(vision?: any): FixtureObservationOrgan;
+/**
+ * Canonical companion bootstrapper.
+ * Wires all 10 organs, runs memory migrations, and initializes the SiduriRuntime.
+ */
+export declare function bootCompanion(id: string, config: AppBootCompanionConfig, options?: BootCompanionOptions): Promise<SiduriRuntime>;

package/dist/boot.js

@@ -0,0 +1,146 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDisabled = isDisabled;
+exports.createBrain = createBrain;
+exports.createVoice = createVoice;
+exports.createKnowledge = createKnowledge;
+exports.createVision = createVision;
+exports.createBehavior = createBehavior;
+exports.createBody = createBody;
+exports.createHands = createHands;
+exports.createEar = createEar;
+exports.createMouth = createMouth;
+exports.createMemory = createMemory;
+exports.createSelf = createSelf;
+exports.createObservation = createObservation;
+exports.bootCompanion = bootCompanion;
+const brain_1 = require("@siduri-x/brain");
+const memory_1 = require("@siduri-x/memory");
+const voice_1 = require("@siduri-x/voice");
+const knowledge_1 = require("@siduri-x/knowledge");
+const vision_1 = require("@siduri-x/vision");
+const self_1 = require("@siduri-x/self");
+const body_1 = require("@siduri-x/body");
+const observation_1 = require("@siduri-x/observation");
+const hands_1 = require("@siduri-x/hands");
+const ear_1 = require("@siduri-x/ear");
+const mouth_1 = require("@siduri-x/mouth");
+const runtime_1 = require("./runtime");
+function isDisabled(config) {
+    return !config || config.provider === 'none';
+}
+function createBrain(config) {
+    const provider = config?.provider || 'openrouter';
+    const defaultKeyEnv = provider === 'openai-compatible' ? 'OPENAI_COMPATIBLE_API_KEY' : 'OPENROUTER_API_KEY';
+    const apiKey = config?.apiKey || process.env[config?.apiKeyEnv || defaultKeyEnv] || '';
+    if (provider === 'openai-compatible') {
+        return new brain_1.OpenAICompatibleBrain({
+            apiKey,
+            model: config?.model || 'local-model',
+            baseUrl: config?.baseUrl || 'http://127.0.0.1:1234/v1',
+        });
+    }
+    return new brain_1.OpenRouterBrain({ apiKey, model: config?.model || 'gpt-4o-mini' });
+}
+function createVoice(config) {
+    return isDisabled(config)
+        ? undefined
+        : new voice_1.VoiceAdapter({
+            provider: config?.provider || 'voicevox',
+            baseUrl: config?.baseUrl || process.env.VOICEVOX_URL || 'http://localhost:50021',
+            speakerId: config?.speakerId || 1,
+            ...config,
+        });
+}
+function createKnowledge(config) {
+    if (isDisabled(config))
+        return undefined;
+    const dbPath = config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite';
+    return new knowledge_1.UnifiedKnowledgeOrgan({
+        ...config,
+        dbPath,
+        lifeDatabase: config?.lifeDatabase ?? true,
+    });
+}
+function createVision(config) {
+    return isDisabled(config)
+        ? undefined
+        : new vision_1.OpenRouterVisionAdapter({
+            apiKey: config?.apiKey || process.env.OPENROUTER_API_KEY || '',
+            model: config?.model || 'gpt-4-vision',
+            ...config,
+        });
+}
+function createBehavior(config) {
+    return isDisabled(config) ? undefined : new self_1.ActiveSelfCompiler();
+}
+function createBody(config) {
+    return isDisabled(config)
+        ? undefined
+        : new body_1.Live2DAdapter(config);
+}
+function createHands(config) {
+    return isDisabled(config)
+        ? new hands_1.DefaultHandsOrgan()
+        : new hands_1.DefaultHandsOrgan(config);
+}
+function createEar(config) {
+    return isDisabled(config)
+        ? new ear_1.DefaultEarOrgan()
+        : new ear_1.DefaultEarOrgan(config);
+}
+function createMouth(config, voice) {
+    return isDisabled(config)
+        ? new mouth_1.DefaultMouthOrgan({ voice })
+        : new mouth_1.DefaultMouthOrgan({ ...config, voice });
+}
+function createMemory(config) {
+    if (isDisabled(config))
+        return undefined;
+    return new memory_1.SqliteMemoryStore({ dbPath: config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
+}
+function createSelf(config) {
+    return new self_1.SqliteSelfRepository({ dbPath: config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite' });
+}
+function createObservation(vision) {
+    return new observation_1.FixtureObservationOrgan(vision ?? { analyze: async () => JSON.stringify({ readings: [] }) });
+}
+/**
+ * Canonical companion bootstrapper.
+ * Wires all 10 organs, runs memory migrations, and initializes the SiduriRuntime.
+ */
+async function bootCompanion(id, config, options) {
+    const organs = config?.organs || {};
+    const brain = createBrain(organs.brain || config?.brain);
+    const memory = createMemory(organs.memory || config?.memory);
+    const selfRepo = createSelf(organs.self || config?.self);
+    const voice = createVoice(organs.voice || config?.voice);
+    const knowledge = createKnowledge(organs.knowledge || config?.knowledge);
+    const vision = createVision(organs.vision || config?.vision);
+    const behavior = createBehavior(organs.behavior || config?.behavior);
+    const body = createBody(organs.body || config?.body);
+    const hands = createHands(organs.hands || config?.hands);
+    const ear = createEar(organs.ear || config?.ear);
+    const mouth = createMouth(organs.mouth || config?.mouth, voice);
+    const observation = options?.observationOrgan;
+    if (memory && typeof memory.runMigrations === 'function') {
+        await memory.runMigrations().catch((e) => console.warn("Migrations warning:", e.message));
+    }
+    const runtime = new runtime_1.SiduriRuntime(id, config, {
+        brain,
+        memory,
+        voice,
+        knowledge,
+        vision,
+        behavior,
+        body,
+        hands,
+        ear,
+        mouth,
+        observation,
+        self: selfRepo,
+        externalKnowledge: knowledge?.eAdapter ?? knowledge,
+    });
+    await runtime.initialize();
+    return runtime;
+}

package/dist/boot.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/boot.test.js

@@ -0,0 +1,84 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const boot_1 = require("./boot");
+const observation_1 = require("@siduri-x/observation");
+describe('Canonical bootCompanion & Organ Factory Suite', () => {
+    const originalEnv = process.env;
+    beforeEach(() => {
+        process.env = { ...originalEnv };
+    });
+    afterAll(() => {
+        process.env = originalEnv;
+    });
+    test('isDisabled correctly identifies undefined or none provider', () => {
+        expect((0, boot_1.isDisabled)(undefined)).toBe(true);
+        expect((0, boot_1.isDisabled)({ provider: 'none' })).toBe(true);
+        expect((0, boot_1.isDisabled)({ provider: 'openrouter' })).toBe(false);
+        expect((0, boot_1.isDisabled)({ provider: 'sqlite' })).toBe(false);
+    });
+    test('creates all standard organs with fallback configurations', () => {
+        const brain = (0, boot_1.createBrain)({ provider: 'openai-compatible', baseUrl: 'http://localhost:11434/v1', apiKey: 'test' });
+        expect(brain).toBeDefined();
+        const voice = (0, boot_1.createVoice)({ provider: 'none' });
+        expect(voice).toBeUndefined();
+        const memory = (0, boot_1.createMemory)({ provider: 'sqlite', dbPath: ':memory:' });
+        expect(memory).toBeDefined();
+        const selfRepo = (0, boot_1.createSelf)({ dbPath: ':memory:' });
+        expect(selfRepo).toBeDefined();
+        const vision = (0, boot_1.createVision)({ provider: 'none' });
+        expect(vision).toBeUndefined();
+        const behavior = (0, boot_1.createBehavior)({ provider: 'active_self' });
+        expect(behavior).toBeDefined();
+        const body = (0, boot_1.createBody)({ provider: 'none' });
+        expect(body).toBeUndefined();
+        const hands = (0, boot_1.createHands)();
+        expect(hands).toBeDefined();
+        const ear = (0, boot_1.createEar)();
+        expect(ear).toBeDefined();
+        const mouth = (0, boot_1.createMouth)(undefined, voice);
+        expect(mouth).toBeDefined();
+        const observation = (0, boot_1.createObservation)();
+        expect(observation).toBeInstanceOf(observation_1.FixtureObservationOrgan);
+    });
+    test('bootCompanion wires all organs and runs migrations', async () => {
+        let migrationsRun = false;
+        const testConfig = {
+            name: 'Test Companion',
+            brain: { provider: 'openrouter', apiKey: 'mock-key', model: 'mock-model' },
+            memory: { provider: 'none' }, // will use custom mock
+            voice: { provider: 'none' },
+            vision: { provider: 'none' },
+            behavior: { provider: 'none' },
+            body: { provider: 'none' },
+            hands: { provider: 'none' },
+            ear: { provider: 'none' },
+            mouth: { provider: 'none' },
+            knowledge: { provider: 'none' },
+        };
+        const mockObservation = new observation_1.FixtureObservationOrgan({ analyze: async () => JSON.stringify({ readings: [] }) });
+        const runtime = await (0, boot_1.bootCompanion)('test-comp-1', testConfig, {
+            observationOrgan: mockObservation,
+        });
+        expect(runtime).toBeDefined();
+        expect(runtime.id).toBe('test-comp-1');
+        expect(runtime.observation).toBe(mockObservation);
+        expect(runtime.hands).toBeDefined();
+        expect(runtime.ear).toBeDefined();
+        expect(runtime.mouth).toBeDefined();
+    });
+    test('bootCompanion handles nested organs configuration structure', async () => {
+        const nestedConfig = {
+            name: 'Nested Companion',
+            organs: {
+                brain: { provider: 'openrouter', apiKey: 'mock' },
+                memory: { provider: 'none' },
+                knowledge: { provider: 'none' },
+                voice: { provider: 'none' },
+            },
+        };
+        const runtime = await (0, boot_1.bootCompanion)('nested-comp', nestedConfig);
+        expect(runtime).toBeDefined();
+        expect(runtime.id).toBe('nested-comp');
+        expect(runtime.brain).toBeDefined();
+    });
+});

package/dist/context-mapper.d.ts

@@ -12,7 +12,9 @@ export interface MapRequestContextResult {
 /**
  * Maps incoming HTTP requests to a canonical RequestContext.
  * In a single-owner, single-machine model:
- * - Security is enforced at the external boundary, not internally between roles.
+ * - Security is enforced at the external machine boundary, NOT internally between roles.
  * - No internal audience or viewer/operator/owner role hierarchies.
+ * - Authenticated callers are the single owner with full companion access.
+ * - Unauthenticated callers are bounded to public chat.
  */
 export declare function mapRequestContext(input: any, options?: ContextMapperOptions): MapRequestContextResult;

package/dist/context-mapper.js

@@ -5,8 +5,10 @@ const core_1 = require("@siduri-x/core");
 /**
  * Maps incoming HTTP requests to a canonical RequestContext.
  * In a single-owner, single-machine model:
- * - Security is enforced at the external boundary, not internally between roles.
+ * - Security is enforced at the external machine boundary, NOT internally between roles.
  * - No internal audience or viewer/operator/owner role hierarchies.
+ * - Authenticated callers are the single owner with full companion access.
+ * - Unauthenticated callers are bounded to public chat.
  */
 function mapRequestContext(input, options = {}) {
     const diagnostics = [];
@@ -23,7 +25,9 @@ function mapRequestContext(input, options = {}) {
     if (input.context && typeof input.context === 'object') {
         const rawCtx = input.context;
         const companionId = input.companionId || rawCtx.companionId || input.id;
-        const correlationId = rawCtx.conversation?.correlationId || input.correlationId;
+        const correlationId = rawCtx.conversation?.correlationId ||
+            input.correlationId ||
+            (input.generateCorrelationId ? `corr-${Date.now()}` : undefined);
         if (!companionId) {
             return {
                 accepted: false,
@@ -57,15 +61,51 @@ function mapRequestContext(input, options = {}) {
                 },
             };
         }
+        const isViewerRequested = (typeof input.role === 'string' && input.role.toLowerCase() === 'viewer') ||
+            (typeof input.serverRole === 'string' && input.serverRole.toLowerCase() === 'viewer') ||
+            (typeof actor.authorizationRole === 'string' && actor.authorizationRole.toLowerCase() === 'viewer') ||
+            (typeof actor.role === 'string' && actor.role.toLowerCase() === 'viewer');
+        // Determine server-enforced authentication status at the machine boundary
+        const isAuthenticated = input.authenticated !== undefined
+            ? Boolean(input.authenticated)
+            : (actor.authenticated !== undefined ? Boolean(actor.authenticated) : true);
+        const isViewer = !isAuthenticated || isViewerRequested;
+        const CANONICAL_CAPABILITIES = new Set(['chat', 'memory:approve', 'action:execute', 'system']);
+        const DEFAULT_OWNER_CAPABILITIES = ['chat', 'memory:approve', 'action:execute', 'system'];
+        let safeCapabilities;
+        let authorizationRole;
+        if (isViewer) {
+            safeCapabilities = ['chat'];
+            authorizationRole = 'viewer';
+            if (Array.isArray(actor.capabilities) && actor.capabilities.some((c) => c !== 'chat' && c !== 'chat:public')) {
+                diagnostics.push('capability_escalation_attempt_suppressed');
+            }
+            if (actor.authorizationRole && actor.authorizationRole.toLowerCase() !== 'viewer') {
+                diagnostics.push('role_escalation_attempt_suppressed');
+            }
+        }
+        else {
+            authorizationRole = 'administrator';
+            if (Array.isArray(actor.capabilities) && actor.capabilities.length > 0) {
+                const filtered = actor.capabilities.filter((c) => CANONICAL_CAPABILITIES.has(c));
+                if (filtered.length < actor.capabilities.length) {
+                    diagnostics.push('capability_escalation_attempt_suppressed');
+                }
+                safeCapabilities = filtered.length > 0 ? filtered : [...DEFAULT_OWNER_CAPABILITIES];
+            }
+            else {
+                safeCapabilities = [...DEFAULT_OWNER_CAPABILITIES];
+            }
+        }
         const constructed = {
             companionId,
             actor: {
+                ...actor,
                 actorId: actor.actorId,
                 sessionId: actor.sessionId,
-                capabilities: Array.isArray(actor.capabilities) ? actor.capabilities : ['chat'],
-                authenticated: actor.authenticated !== undefined ? Boolean(actor.authenticated) : true,
-                authorizationRole: actor.authorizationRole,
-                ...actor,
+                capabilities: safeCapabilities,
+                authenticated: isAuthenticated,
+                authorizationRole,
             },
             conversation: {
                 correlationId,
@@ -73,7 +113,7 @@ function mapRequestContext(input, options = {}) {
                 isLive: rawCtx.conversation?.isLive,
                 ...rawCtx.conversation,
             },
-            source: input.source || rawCtx.source || 'local',
+            source: input.source || rawCtx.source || (isAuthenticated ? 'local' : 'external'),
             subject: rawCtx.subject,
         };
         const validated = (0, core_1.validateRequestContext)(constructed);
@@ -122,30 +162,61 @@ function mapRequestContext(input, options = {}) {
             },
         };
     }
-    const actorId = input.actorId || input.actor?.actorId || 'local-user';
+    const isViewerRequested = (typeof input.role === 'string' && input.role.toLowerCase() === 'viewer') ||
+        (typeof input.serverRole === 'string' && input.serverRole.toLowerCase() === 'viewer');
+    const isAuthenticated = input.authenticated !== undefined ? Boolean(input.authenticated) : true;
+    const isViewer = !isAuthenticated || isViewerRequested;
+    const actorId = input.actorId || input.actor?.actorId || (isAuthenticated && !isViewer ? 'local-user' : 'anonymous-session');
     const sessionId = input.sessionId || input.actor?.sessionId || `session-${Date.now()}`;
     if (!input.actorId && !input.actor?.actorId) {
         diagnostics.push('anonymous_session_generated');
     }
-    const capabilities = Array.isArray(input.capabilities)
+    const CANONICAL_CAPABILITIES = new Set(['chat', 'memory:approve', 'action:execute', 'system']);
+    const DEFAULT_OWNER_CAPABILITIES = ['chat', 'memory:approve', 'action:execute', 'system'];
+    const rawCaps = Array.isArray(input.capabilities)
         ? input.capabilities
         : Array.isArray(input.actor?.capabilities)
             ? input.actor.capabilities
-            : ['chat', 'system'];
+            : undefined;
+    let capabilities;
+    let authorizationRole;
+    if (isViewer) {
+        capabilities = ['chat'];
+        authorizationRole = 'viewer';
+        if (rawCaps && rawCaps.some((c) => c !== 'chat' && c !== 'chat:public')) {
+            diagnostics.push('capability_escalation_attempt_suppressed');
+        }
+        if (input.role && input.role.toLowerCase() !== 'viewer') {
+            diagnostics.push('role_escalation_attempt_suppressed');
+        }
+    }
+    else {
+        authorizationRole = 'administrator';
+        if (rawCaps && rawCaps.length > 0) {
+            const filtered = rawCaps.filter((c) => CANONICAL_CAPABILITIES.has(c));
+            if (filtered.length < rawCaps.length) {
+                diagnostics.push('capability_escalation_attempt_suppressed');
+            }
+            capabilities = filtered.length > 0 ? filtered : [...DEFAULT_OWNER_CAPABILITIES];
+        }
+        else {
+            capabilities = [...DEFAULT_OWNER_CAPABILITIES];
+        }
+    }
     const mappedContext = {
         companionId,
         actor: {
             actorId,
             sessionId,
             capabilities,
-            authenticated: input.authenticated !== undefined ? Boolean(input.authenticated) : true,
-            authorizationRole: input.role ? (input.role.toLowerCase() === 'viewer' ? 'viewer' : 'administrator') : undefined,
+            authenticated: isAuthenticated,
+            authorizationRole,
         },
         conversation: {
             channel: input.channel || input.conversation?.channel || 'direct',
             correlationId,
         },
-        source: input.source || 'local',
+        source: input.source || (isAuthenticated ? 'local' : 'external'),
         subject: input.subject,
     };
     const validated = (0, core_1.validateRequestContext)(mappedContext);

package/dist/context-mapper.test.js

@@ -133,4 +133,120 @@ describe('API Request Context Mapper (Single-Owner, Single-Machine)', () => {
         expect(result.accepted).toBe(true);
         expect(result.context?.conversation.correlationId).toMatch(/^corr-/);
     });
+    test('Overrides forged client actor authentication and caps capabilities on unauthenticated requests', () => {
+        const forgedInput = {
+            companionId: 'companion-a',
+            authenticated: false, // Server detected unauthenticated request
+            source: 'external',
+            context: {
+                actor: {
+                    actorId: 'attacker',
+                    sessionId: 'session-att',
+                    authenticated: true, // Forged
+                    capabilities: ['system:exec', 'bash', 'chat'], // Forged elevated capabilities
+                    authorizationRole: 'OWNER', // Forged role
+                },
+                conversation: {
+                    correlationId: 'corr-forged-1',
+                },
+            },
+        };
+        const result = (0, context_mapper_1.mapRequestContext)(forgedInput);
+        expect(result.accepted).toBe(true);
+        expect(result.context?.actor.authenticated).toBe(false);
+        expect(result.context?.actor.capabilities).toEqual(['chat']);
+        expect(result.context?.actor.authorizationRole).toBe('viewer');
+        expect(result.context?.source).toBe('external');
+        expect(result.diagnostics).toContain('role_escalation_attempt_suppressed');
+        expect(result.diagnostics).toContain('capability_escalation_attempt_suppressed');
+    });
+    test('Prevents attenuated caller from escalating to administrator role or forging elevated capabilities', () => {
+        const attenuatedPayload = {
+            companionId: 'companion-a',
+            authenticated: true,
+            role: 'VIEWER',
+            source: 'external',
+            context: {
+                actor: {
+                    actorId: 'visitor-bob',
+                    sessionId: 'session-vis-1',
+                    authorizationRole: 'administrator', // Forged owner/admin role
+                    capabilities: ['chat', 'system', 'root:manage', 'action:execute'], // Forged system/root capabilities
+                },
+                conversation: {
+                    correlationId: 'corr-att-escalate',
+                },
+            },
+        };
+        const result = (0, context_mapper_1.mapRequestContext)(attenuatedPayload);
+        expect(result.accepted).toBe(true);
+        expect(result.context?.actor.authenticated).toBe(true);
+        expect(result.context?.actor.authorizationRole).toBe('viewer');
+        expect(result.context?.actor.capabilities).toEqual(['chat']);
+        expect(result.diagnostics).toContain('role_escalation_attempt_suppressed');
+        expect(result.diagnostics).toContain('capability_escalation_attempt_suppressed');
+    });
+    test('Strips unknown capabilities for authenticated owner while preserving canonical companion capabilities', () => {
+        const ownerPayload = {
+            companionId: 'companion-a',
+            authenticated: true,
+            source: 'local',
+            context: {
+                actor: {
+                    actorId: 'owner-user',
+                    sessionId: 'session-owner-1',
+                    capabilities: ['chat', 'system', 'root:unauthorized', 'arbitrary:hack'],
+                },
+                conversation: {
+                    correlationId: 'corr-owner-caps',
+                },
+            },
+        };
+        const result = (0, context_mapper_1.mapRequestContext)(ownerPayload);
+        expect(result.accepted).toBe(true);
+        expect(result.context?.actor.authorizationRole).toBe('administrator');
+        expect(result.context?.actor.capabilities).toEqual(['chat', 'system']);
+        expect(result.diagnostics).toContain('capability_escalation_attempt_suppressed');
+    });
+    test('Flat envelope: suppresses role and capability escalation when serverRole is VIEWER', () => {
+        const viewerPayload = {
+            companionId: 'companion-a',
+            authenticated: false,
+            serverRole: 'VIEWER',
+            role: 'OWNER', // Forged in flat envelope
+            capabilities: ['chat', 'system', 'action:execute'],
+            generateCorrelationId: true,
+        };
+        const result = (0, context_mapper_1.mapRequestContext)(viewerPayload);
+        expect(result.accepted).toBe(true);
+        expect(result.context?.actor.authorizationRole).toBe('viewer');
+        expect(result.context?.actor.capabilities).toEqual(['chat']);
+        expect(result.diagnostics).toContain('role_escalation_attempt_suppressed');
+    });
+    test('Authenticated owner receives canonical administrator role and capabilities, and can safely attenuate to viewer', () => {
+        const ownerPayload = {
+            companionId: 'companion-a',
+            authenticated: true,
+            serverRole: 'OWNER',
+            generateCorrelationId: true,
+        };
+        const ownerResult = (0, context_mapper_1.mapRequestContext)(ownerPayload);
+        expect(ownerResult.accepted).toBe(true);
+        expect(ownerResult.context?.actor.authorizationRole).toBe('administrator');
+        expect(ownerResult.context?.actor.capabilities).toEqual([
+            'chat',
+            'memory:approve',
+            'action:execute',
+            'system',
+        ]);
+        // Attenuation to viewer
+        const attenuatedPayload = {
+            ...ownerPayload,
+            role: 'VIEWER',
+        };
+        const attenuatedResult = (0, context_mapper_1.mapRequestContext)(attenuatedPayload);
+        expect(attenuatedResult.accepted).toBe(true);
+        expect(attenuatedResult.context?.actor.authorizationRole).toBe('viewer');
+        expect(attenuatedResult.diagnostics).not.toContain('role_escalation_attempt_suppressed');
+    });
 });

package/dist/index.d.ts

@@ -2,5 +2,6 @@ import { Express } from 'express';
 import { createApp, AppInstance } from './app';
 export { createApp, AppInstance };
 export * from './context-mapper';
+export * from './boot';
 export declare const app: Express;
 export default app;