@sidurijs/api 1.0.0

package/src/auth.test.ts

@@ -0,0 +1,90 @@
+import { resolveIdentity, requireAuth } from './auth';
+
+describe('Auth Identity Resolution (Single-Owner External Boundary)', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    jest.resetModules();
+    process.env = { ...originalEnv };
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  const mockReq = (token?: string, ip: string = '192.168.1.50') => ({
+    headers: {
+      authorization: token ? `Bearer ${token}` : undefined,
+    },
+    ip,
+    socket: { remoteAddress: ip },
+  } as any);
+
+  test('authenticates external request when token matches configured AUTH_TOKEN', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
+    process.env.NODE_ENV = 'production';
+
+    const identity = resolveIdentity(mockReq('secret-auth-key'));
+    expect(identity.authenticated).toBe(true);
+    expect(identity.source).toBe('external');
+  });
+
+  test('authenticates external request when token matches legacy OWNER_TOKEN', () => {
+    process.env.OWNER_TOKEN = 'owner-secret';
+    process.env.NODE_ENV = 'production';
+
+    const identity = resolveIdentity(mockReq('owner-secret'));
+    expect(identity.authenticated).toBe(true);
+    expect(identity.source).toBe('external');
+  });
+
+  test('rejects external request when token is missing in production with configured token', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
+    process.env.NODE_ENV = 'production';
+
+    const identity = resolveIdentity(mockReq());
+    expect(identity.authenticated).toBe(false);
+  });
+
+  test('rejects external request for invalid token in production', () => {
+    process.env.AUTH_TOKEN = 'secret-auth-key';
+    process.env.NODE_ENV = 'production';
+
+    const identity = resolveIdentity(mockReq('invalid-token'));
+    expect(identity.authenticated).toBe(false);
+  });
+
+  test('authenticates local loopback request in development mode', () => {
+    process.env.NODE_ENV = 'development';
+    process.env.DEV_LOCAL_AUTH_ROLE = 'OWNER';
+    process.env.AUTH_TOKEN = 'secret-key';
+
+    const devIdentity = resolveIdentity(mockReq(undefined, '127.0.0.1'));
+    expect(devIdentity.authenticated).toBe(true);
+    expect(devIdentity.source).toBe('local');
+  });
+
+  test('requireAuth middleware accepts authenticated request and rejects unauthenticated with 401', () => {
+    process.env.AUTH_TOKEN = 'secret-key';
+    process.env.NODE_ENV = 'production';
+
+    const nextFn = jest.fn();
+    const resUnauthorized = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    } as any;
+
+    // Unauthorized call
+    requireAuth(mockReq('wrong-token'), resUnauthorized, nextFn);
+    expect(resUnauthorized.status).toHaveBeenCalledWith(401);
+    expect(nextFn).not.toHaveBeenCalled();
+
+    // Authorized call
+    const resAuthorized = {
+      status: jest.fn().mockReturnThis(),
+      json: jest.fn().mockReturnThis(),
+    } as any;
+    requireAuth(mockReq('secret-key'), resAuthorized, nextFn);
+    expect(nextFn).toHaveBeenCalled();
+  });
+});

package/src/auth.ts

@@ -0,0 +1,101 @@
+import { Request, Response, NextFunction } from 'express';
+
+export type Role = 'OWNER' | 'OPERATOR' | 'VIEWER' | 'user' | string;
+
+export interface Identity {
+  authenticated: boolean;
+  source: 'local' | 'external';
+  actorId?: string;
+  role?: Role;
+  [key: string]: unknown;
+}
+
+/**
+ * Checks whether an incoming request originates from the local machine loopback interface.
+ */
+export function isLocalRequest(req: Request): boolean {
+  const ip = req.ip || req.socket?.remoteAddress || '';
+  return (
+    ip === '127.0.0.1' ||
+    ip === '::1' ||
+    ip === '::ffff:127.0.0.1' ||
+    ip.endsWith('127.0.0.1') ||
+    ip === 'localhost'
+  );
+}
+
+/**
+ * Resolves request identity according to the single-owner external machine boundary security model.
+ * 
+ * - Security is enforced at the external machine boundary, NOT internally.
+ * - External network requests require a matching token (AUTH_TOKEN / OWNER_TOKEN).
+ * - There are no internal viewer/operator/owner role privileges inside the machine.
+ */
+export function resolveIdentity(req: Request): Identity {
+  const authHeader = req.headers?.authorization;
+  const token = authHeader?.startsWith('Bearer ') ? authHeader.split(' ')[1] : undefined;
+  const ownerToken = process.env.AUTH_TOKEN || process.env.API_TOKEN || process.env.OWNER_TOKEN;
+  const operatorToken = process.env.OPERATOR_TOKEN;
+  const configuredToken = ownerToken || operatorToken;
+
+  const local = isLocalRequest(req);
+
+  // 1. Explicit token matches
+  if (ownerToken && token === ownerToken) {
+    return { authenticated: true, source: local ? 'local' : 'external', role: 'OWNER' };
+  }
+  if (operatorToken && token === operatorToken) {
+    return { authenticated: true, source: local ? 'local' : 'external', role: 'OPERATOR' };
+  }
+
+  // 2. Dev local auth role fallback
+  const isDev = process.env.NODE_ENV !== 'production';
+  if (isDev && process.env.DEV_LOCAL_AUTH_ROLE) {
+    const fallbackRole = process.env.DEV_LOCAL_AUTH_ROLE.toUpperCase() as Role;
+    return {
+      authenticated: fallbackRole === 'OWNER' || fallbackRole === 'OPERATOR',
+      source: 'local',
+      role: fallbackRole,
+    };
+  }
+
+  // 3. Default unauthenticated / visitor
+  return { authenticated: false, source: local ? 'local' : 'external', role: 'VIEWER' };
+}
+
+/**
+ * External boundary authentication middleware.
+ * Verifies that requests crossing the external boundary are authorized.
+ */
+export function requireAuth(req: Request, res: Response, next: NextFunction) {
+  const identity = resolveIdentity(req);
+  (req as any).identity = identity;
+
+  if (!identity.authenticated) {
+    return res.status(401).json({ error: 'Unauthorized: missing or invalid authentication token' });
+  }
+  next();
+}
+
+/**
+ * Attaches the resolved machine identity to the request.
+ */
+export function attachIdentity(req: Request, res: Response, next: NextFunction) {
+  (req as any).identity = resolveIdentity(req);
+  next();
+}
+
+/**
+ * Compatibility alias: in single-owner model, all authenticated callers have full access.
+ */
+export function requireRole(allowedRoles?: Role[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    const identity = resolveIdentity(req);
+    (req as any).identity = identity;
+
+    if (!identity.authenticated) {
+      return res.status(403).json({ error: `Forbidden: requires one of ${(allowedRoles || []).join(', ')}` });
+    }
+    next();
+  };
+}

package/src/b0-b6.test.ts

@@ -0,0 +1,137 @@
+import request from 'supertest';
+import { createApp } from './app';
+import { SiduriRuntime } from './runtime';
+import { Message, BrainContext, ResponsePlan } from '@sidurijs/core';
+
+describe('T0 B0 & B6 Runtime Proof Suite', () => {
+  let mockBrain: any;
+  let mockMemory: any;
+  let mockKnowledge: any;
+  let mockBehavior: any;
+  let runtime: SiduriRuntime;
+  let app: any;
+
+  beforeEach(async () => {
+    mockBrain = {
+      generatePlan: jest.fn().mockImplementation(async (ctx: BrainContext): Promise<ResponsePlan> => {
+        return {
+          speech: 'Hello. I am a neutral companion.',
+          language: 'en',
+        };
+      }),
+    };
+
+    mockMemory = {
+      initialize: jest.fn().mockResolvedValue(undefined),
+      searchClaims: jest.fn().mockResolvedValue([]),
+      getClaims: jest.fn().mockResolvedValue([]),
+      getDirectives: jest.fn().mockResolvedValue([]),
+      getPendingClaims: jest.fn().mockResolvedValue([]),
+      proposeClaim: jest.fn().mockResolvedValue({}),
+      approveClaim: jest.fn().mockResolvedValue(undefined),
+      rejectClaim: jest.fn().mockResolvedValue(undefined),
+    };
+
+    mockKnowledge = {
+      search: jest.fn().mockResolvedValue([]),
+    };
+
+    mockBehavior = {
+      compile: jest.fn().mockResolvedValue(''),
+    };
+
+    const config = {
+      name: 'NeutralCompanion',
+      brain: { provider: 'openrouter' },
+      memory: { provider: 'sqlite' },
+      knowledge: { provider: 'e-knowledge' },
+      behavior: { provider: 'active-self' },
+      voice: { provider: 'none' },
+      vision: { provider: 'none' },
+      body: { provider: 'none' },
+    };
+
+    runtime = new SiduriRuntime('companion-a', config as any, {
+      brain: mockBrain,
+      memory: mockMemory,
+      knowledge: mockKnowledge,
+      behavior: mockBehavior,
+    });
+    await runtime.initialize();
+
+    const runtimes = new Map([['companion-a', runtime]]);
+    const created = createApp(runtimes);
+    app = created.app;
+  });
+
+  // B0: Fresh companion is empty (no prior claims, no user relationship, no knowledge search on greeting)
+  describe('B0 — Fresh companion is empty', () => {
+    test('initial state has empty memory and empty directives', async () => {
+      const claims = await runtime.memory?.getClaims();
+      const directives = await runtime.memory?.getDirectives();
+      expect(claims).toEqual([]);
+      expect(directives).toEqual([]);
+    });
+
+    test('greeting does not query knowledge or inject prior personal knowledge', async () => {
+      const res = await request(app)
+        .post('/chat')
+        .send({
+          companionId: 'companion-a',
+          message: 'Hello.',
+          history: [],
+        });
+
+      expect(res.status).toBe(200);
+      expect(mockKnowledge.search).not.toHaveBeenCalled();
+      expect(mockBrain.generatePlan).toHaveBeenCalledWith(
+        expect.objectContaining({
+          contextPrompt: '',
+          recipient: 'OWNER',
+        })
+      );
+    });
+  });
+
+  // B6: Identity and relationship are learned, not inferred (self identity questions do not query external knowledge)
+  describe('B6 — Identity and relationship are learned, not inferred', () => {
+    test('asking "Who are you?" suppresses knowledge query and asserts self identity without external search', async () => {
+      mockBrain.generatePlan.mockResolvedValueOnce({
+        speech: 'I am NeutralCompanion.',
+        language: 'en',
+      });
+
+      const res = await request(app)
+        .post('/chat')
+        .send({
+          companionId: 'companion-a',
+          message: 'Who are you?',
+          history: [],
+        });
+
+      expect(res.status).toBe(200);
+      // B6 oracle: self identity chat does not query external knowledge
+      expect(mockKnowledge.search).not.toHaveBeenCalled();
+      expect(mockMemory.searchClaims).toHaveBeenCalled();
+      expect(mockBrain.generatePlan).toHaveBeenCalledWith(
+        expect.objectContaining({
+          contextPrompt: '',
+        })
+      );
+      expect(res.body.response.subtitle_en).toBe('I am NeutralCompanion.');
+    });
+
+    test('asking "Tell me about yourself" suppresses knowledge query', async () => {
+      const res = await request(app)
+        .post('/chat')
+        .send({
+          companionId: 'companion-a',
+          message: 'Tell me about yourself',
+          history: [],
+        });
+
+      expect(res.status).toBe(200);
+      expect(mockKnowledge.search).not.toHaveBeenCalled();
+    });
+  });
+});

package/src/boot.test.ts

@@ -0,0 +1,112 @@
+import { bootCompanion, isDisabled, createBrain, createMemory, createVoice, createKnowledge, createVision, createBehavior, createBody, createHands, createEar, createMouth, createSelf, createObservation } from './boot';
+import { FixtureObservationOrgan } from '@sidurijs/observation';
+
+describe('Canonical bootCompanion & Organ Factory Suite', () => {
+  const originalEnv = process.env;
+
+  beforeEach(() => {
+    process.env = { ...originalEnv };
+  });
+
+  afterAll(() => {
+    process.env = originalEnv;
+  });
+
+  test('isDisabled correctly identifies undefined or none provider', () => {
+    expect(isDisabled(undefined)).toBe(true);
+    expect(isDisabled({ provider: 'none' })).toBe(true);
+    expect(isDisabled({ provider: 'openrouter' })).toBe(false);
+    expect(isDisabled({ provider: 'sqlite' })).toBe(false);
+  });
+
+  test('creates all standard organs with fallback configurations', () => {
+    const brain = createBrain({ provider: 'openai-compatible', baseUrl: 'http://localhost:11434/v1', apiKey: 'test' });
+    expect(brain).toBeDefined();
+
+    const voice = createVoice({ provider: 'none' });
+    expect(voice).toBeUndefined();
+
+    const memory = createMemory({ provider: 'sqlite', dbPath: ':memory:' });
+    expect(memory).toBeDefined();
+
+    const selfRepo = createSelf({ dbPath: ':memory:' });
+    expect(selfRepo).toBeDefined();
+
+    const vision = createVision({ provider: 'none' });
+    expect(vision).toBeUndefined();
+
+    const behavior = createBehavior({ provider: 'active_self' });
+    expect(behavior).toBeDefined();
+
+    const bodyNone = createBody({ provider: 'none' });
+    expect(bodyNone).toBeUndefined();
+
+    const bodyLive2d = createBody({ provider: 'live2d', modelPath: './assets/avatar.model3.json' });
+    expect(bodyLive2d).toBeDefined();
+    expect((bodyLive2d as any).format).toBe('live2d');
+
+    const bodyVrm = createBody({ provider: 'vrm', modelPath: './assets/avatar.vrm', vrm: { lookAtMode: 'camera' } });
+    expect(bodyVrm).toBeDefined();
+    expect((bodyVrm as any).format).toBe('vrm');
+    expect((bodyVrm as any).vrmOptions?.lookAtMode).toBe('camera');
+
+    const hands = createHands();
+    expect(hands).toBeDefined();
+
+    const ear = createEar();
+    expect(ear).toBeDefined();
+
+    const mouth = createMouth(undefined, voice);
+    expect(mouth).toBeDefined();
+
+    const observation = createObservation();
+    expect(observation).toBeInstanceOf(FixtureObservationOrgan);
+  });
+
+  test('bootCompanion wires all organs and runs migrations', async () => {
+    let migrationsRun = false;
+    const testConfig = {
+      name: 'Test Companion',
+      brain: { provider: 'openrouter', apiKey: 'mock-key', model: 'mock-model' },
+      memory: { provider: 'none' }, // will use custom mock
+      voice: { provider: 'none' },
+      vision: { provider: 'none' },
+      behavior: { provider: 'none' },
+      body: { provider: 'none' },
+      hands: { provider: 'none' },
+      ear: { provider: 'none' },
+      mouth: { provider: 'none' },
+      knowledge: { provider: 'none' },
+    };
+
+    const mockObservation = new FixtureObservationOrgan({ analyze: async () => JSON.stringify({ readings: [] }) });
+
+    const runtime = await bootCompanion('test-comp-1', testConfig as any, {
+      observationOrgan: mockObservation,
+    });
+
+    expect(runtime).toBeDefined();
+    expect(runtime.id).toBe('test-comp-1');
+    expect(runtime.observation).toBe(mockObservation);
+    expect(runtime.hands).toBeDefined();
+    expect(runtime.ear).toBeDefined();
+    expect(runtime.mouth).toBeDefined();
+  });
+
+  test('bootCompanion handles nested organs configuration structure', async () => {
+    const nestedConfig = {
+      name: 'Nested Companion',
+      organs: {
+        brain: { provider: 'openrouter', apiKey: 'mock' },
+        memory: { provider: 'none' },
+        knowledge: { provider: 'none' },
+        voice: { provider: 'none' },
+      },
+    };
+
+    const runtime = await bootCompanion('nested-comp', nestedConfig as any);
+    expect(runtime).toBeDefined();
+    expect(runtime.id).toBe('nested-comp');
+    expect(runtime.brain).toBeDefined();
+  });
+});

package/src/boot.ts

@@ -0,0 +1,197 @@
+import { OpenAICompatibleBrain, OpenRouterBrain } from '@sidurijs/brain';
+import { SqliteMemoryStore } from '@sidurijs/memory';
+import { VoiceAdapter, VoiceConfig } from '@sidurijs/voice';
+import { UnifiedKnowledgeOrgan, UnifiedKnowledgeConfig } from '@sidurijs/knowledge';
+import { OpenRouterVisionAdapter, OpenRouterVisionConfig } from '@sidurijs/vision';
+import { ActiveSelfCompiler, SqliteSelfRepository } from '@sidurijs/self';
+import { Live2DAdapter, VRMAdapter, NeutralBodyOrganConfig } from '@sidurijs/body';
+import { FixtureObservationOrgan } from '@sidurijs/observation';
+import { DefaultHandsOrgan, DefaultHandsOrganConfig } from '@sidurijs/hands';
+import { DefaultEarOrgan, EarOrganConfig } from '@sidurijs/ear';
+import { DefaultMouthOrgan, DefaultMouthOrganConfig } from '@sidurijs/mouth';
+import { SiduriRuntime } from './runtime';
+
+export interface AppBrainConfig {
+  provider?: 'openrouter' | 'openai-compatible' | string;
+  model?: string;
+  apiKey?: string;
+  apiKeyEnv?: string;
+  baseUrl?: string;
+  timeoutMs?: number;
+  [key: string]: unknown;
+}
+
+export interface AppBehaviorConfig {
+  provider?: 'active_self' | 'none' | string;
+  preset?: string;
+  [key: string]: unknown;
+}
+
+export interface AppBootCompanionConfig {
+  name: string;
+  id?: string;
+  brain?: AppBrainConfig;
+  voice?: VoiceConfig;
+  memory?: { provider?: string; connectionString?: string; maxConnections?: number; dbPath?: string; [key: string]: unknown };
+  knowledge?: UnifiedKnowledgeConfig;
+  vision?: OpenRouterVisionConfig;
+  behavior?: AppBehaviorConfig;
+  body?: NeutralBodyOrganConfig;
+  hands?: DefaultHandsOrganConfig;
+  ear?: EarOrganConfig;
+  mouth?: DefaultMouthOrganConfig;
+  self?: { dbPath?: string; [key: string]: unknown };
+  organs?: Record<string, any>;
+  [key: string]: unknown;
+}
+
+export interface BootCompanionOptions {
+  observationOrgan?: FixtureObservationOrgan;
+}
+
+export function isDisabled(config?: { provider?: string }): boolean {
+  return !config || config.provider === 'none';
+}
+
+export function createBrain(config?: AppBrainConfig) {
+  const provider = config?.provider || 'openrouter';
+  const defaultKeyEnv = provider === 'openai-compatible' ? 'OPENAI_COMPATIBLE_API_KEY' : 'OPENROUTER_API_KEY';
+  const apiKey = config?.apiKey || process.env[config?.apiKeyEnv || defaultKeyEnv] || '';
+  if (provider === 'openai-compatible') {
+    return new OpenAICompatibleBrain({
+      apiKey,
+      model: config?.model || 'local-model',
+      baseUrl: config?.baseUrl || 'http://127.0.0.1:1234/v1',
+    });
+  }
+  return new OpenRouterBrain({ apiKey, model: config?.model || 'gpt-4o-mini' });
+}
+
+export function createVoice(config?: VoiceConfig) {
+  return isDisabled(config)
+    ? undefined
+    : new VoiceAdapter({
+        provider: (config?.provider as any) || 'voicevox',
+        baseUrl: config?.baseUrl || process.env.VOICEVOX_URL || 'http://localhost:50021',
+        speakerId: config?.speakerId || 1,
+        ...config,
+      });
+}
+
+export function createKnowledge(config?: UnifiedKnowledgeConfig) {
+  if (isDisabled(config)) return undefined;
+  const dbPath = (config?.dbPath as string) || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || 'siduri.sqlite';
+  return new UnifiedKnowledgeOrgan({
+    ...config,
+    dbPath,
+    lifeDatabase: config?.lifeDatabase ?? true,
+  });
+}
+
+export function createVision(config?: OpenRouterVisionConfig & { provider?: string }) {
+  return isDisabled(config)
+    ? undefined
+    : new OpenRouterVisionAdapter({
+        apiKey: config?.apiKey || process.env.OPENROUTER_API_KEY || '',
+        model: config?.model || 'gpt-4-vision',
+        ...config,
+      });
+}
+
+export function createBehavior(config?: AppBehaviorConfig) {
+  return isDisabled(config) ? undefined : new ActiveSelfCompiler();
+}
+
+export function createBody(config?: NeutralBodyOrganConfig) {
+  if (isDisabled(config)) {
+    return undefined;
+  }
+  if (config?.provider === 'vrm' || config?.format === 'vrm') {
+    return new VRMAdapter(config);
+  }
+  return new Live2DAdapter(config);
+}
+
+export function createHands(config?: DefaultHandsOrganConfig & { provider?: string }) {
+  return isDisabled(config)
+    ? new DefaultHandsOrgan()
+    : new DefaultHandsOrgan(config);
+}
+
+export function createEar(config?: EarOrganConfig & { provider?: string }) {
+  return isDisabled(config)
+    ? new DefaultEarOrgan()
+    : new DefaultEarOrgan(config);
+}
+
+export function createMouth(config?: DefaultMouthOrganConfig & { provider?: string }, voice?: any) {
+  return isDisabled(config)
+    ? new DefaultMouthOrgan({ voice })
+    : new DefaultMouthOrgan({ ...config, voice });
+}
+
+export function createMemory(config?: { provider?: string; connectionString?: string; maxConnections?: number; dbPath?: string }) {
+  if (isDisabled(config)) return undefined;
+  const defaultPath = process.env.NODE_ENV === 'test' ? ':memory:' : 'siduri.sqlite';
+  return new SqliteMemoryStore({ dbPath: config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || defaultPath });
+}
+
+export function createSelf(config?: { dbPath?: string; provider?: string }) {
+  if (isDisabled(config)) return undefined;
+  const defaultPath = process.env.NODE_ENV === 'test' ? ':memory:' : 'siduri.sqlite';
+  return new SqliteSelfRepository({ dbPath: config?.dbPath || process.env.STORAGE_PATH || process.env.SQLITE_DB_PATH || defaultPath });
+}
+
+export function createObservation(vision?: any): FixtureObservationOrgan {
+  return new FixtureObservationOrgan(
+    vision ?? { analyze: async () => JSON.stringify({ readings: [] }) }
+  );
+}
+
+/**
+ * Canonical companion bootstrapper.
+ * Wires all 10 organs, runs memory migrations, and initializes the SiduriRuntime.
+ */
+export async function bootCompanion(
+  id: string,
+  config: AppBootCompanionConfig,
+  options?: BootCompanionOptions
+): Promise<SiduriRuntime> {
+  const organs = (config as any)?.organs || {};
+
+  const brain = createBrain(organs.brain || config?.brain);
+  const memory = createMemory(organs.memory || (config as any)?.memory);
+  const selfRepo = createSelf(organs.self || (config as any)?.self);
+  const voice = createVoice(organs.voice || config?.voice);
+  const knowledge = createKnowledge(organs.knowledge || config?.knowledge);
+  const vision = createVision(organs.vision || config?.vision);
+  const behavior = createBehavior(organs.behavior || config?.behavior);
+  const body = createBody(organs.body || config?.body);
+  const hands = createHands({ ...((organs.hands || config?.hands) as any), knowledge });
+  const ear = createEar(organs.ear || config?.ear);
+  const mouth = createMouth(organs.mouth || config?.mouth, voice);
+  const observation = options?.observationOrgan;
+
+  if (memory && typeof (memory as any).runMigrations === 'function') {
+    await (memory as any).runMigrations().catch((e: any) => console.warn("Migrations warning:", e.message));
+  }
+
+  const runtime = new SiduriRuntime(id, config as any, {
+    brain,
+    memory,
+    voice,
+    knowledge,
+    vision,
+    behavior,
+    body,
+    hands,
+    ear,
+    mouth,
+    observation,
+    self: selfRepo,
+    externalKnowledge: (knowledge as any)?.eAdapter ?? knowledge,
+  });
+
+  await runtime.initialize();
+  return runtime;
+}