atabey-shared 0.1.0-beta.0 → 0.1.0

package/dist/migrations.js

@@ -1,375 +1,2 @@
-/**
- * SQLite Schema Migration Runner, Startup Integrity Check & Online Backup/Restore (Phase 1.5)
- *
- * Provides:
- *   1. Versioned, checksummed schema migrations (`schema_migrations` table).
- *   2. Startup integrity verification (`PRAGMA quick_check` / `PRAGMA integrity_check`).
- *   3. Atomic online backup (`VACUUM INTO` + `.sha256` manifest) and verified restore.
- */
-import Database from "better-sqlite3";
-import crypto from "crypto";
-import fs from "fs";
-import path from "path";
-export const BUILTIN_MIGRATIONS = [
-    {
-        version: 1,
-        name: "001_initial_core_tables",
-        sql: `
-            CREATE TABLE IF NOT EXISTS agents (
-                name TEXT PRIMARY KEY,
-                state TEXT DEFAULT 'READY',
-                task TEXT DEFAULT 'Idle',
-                description TEXT DEFAULT '',
-                skills TEXT DEFAULT '[]',
-                last_updated DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS messages (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                sender TEXT,
-                receiver TEXT,
-                category TEXT,
-                content TEXT,
-                trace_id TEXT,
-                parent_id TEXT,
-                status TEXT DEFAULT 'PENDING',
-                priority TEXT DEFAULT 'NORMAL',
-                requires_approval BOOLEAN DEFAULT 0
-            );
-            CREATE TABLE IF NOT EXISTS tasks (
-                id TEXT PRIMARY KEY,
-                trace_id TEXT,
-                description TEXT,
-                agent TEXT,
-                status TEXT DEFAULT 'PENDING',
-                priority TEXT DEFAULT 'NORMAL',
-                dependencies TEXT,
-                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS logs (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                agent TEXT,
-                action TEXT,
-                trace_id TEXT,
-                status TEXT,
-                summary TEXT,
-                findings TEXT,
-                prev_hash TEXT,
-                hash TEXT
-            );
-            CREATE TABLE IF NOT EXISTS metadata (
-                key TEXT PRIMARY KEY,
-                value TEXT
-            );
-            CREATE TABLE IF NOT EXISTS costs (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                provider TEXT,
-                model TEXT,
-                input_tokens INTEGER,
-                output_tokens INTEGER,
-                cost REAL,
-                timestamp DATETIME DEFAULT CURRENT_TIMESTAMP,
-                trace_id TEXT
-            );
-            CREATE TABLE IF NOT EXISTS knowledge (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                filename TEXT UNIQUE,
-                content TEXT,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS users (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                name TEXT UNIQUE,
-                token TEXT UNIQUE,
-                role TEXT DEFAULT 'user',
-                created_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-        `,
-    },
-    {
-        version: 2,
-        name: "002_governance_approvals_discipline_cooldowns",
-        sql: `
-            CREATE TABLE IF NOT EXISTS loop_cooldowns (
-                agent TEXT PRIMARY KEY,
-                cooldown_until INTEGER NOT NULL,
-                detail TEXT,
-                cooldown_count INTEGER DEFAULT 1,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-            CREATE TABLE IF NOT EXISTS approvals (
-                trace_id TEXT PRIMARY KEY,
-                tool_name TEXT NOT NULL,
-                agent TEXT NOT NULL,
-                risk_score INTEGER NOT NULL,
-                risk_level TEXT NOT NULL,
-                reason TEXT NOT NULL,
-                args TEXT NOT NULL,
-                created_at INTEGER NOT NULL,
-                expires_at INTEGER NOT NULL,
-                status TEXT DEFAULT 'PENDING',
-                passcode TEXT
-            );
-            CREATE TABLE IF NOT EXISTS discipline (
-                agent TEXT PRIMARY KEY,
-                total_calls INTEGER DEFAULT 0,
-                violations INTEGER DEFAULT 0,
-                last_violation TEXT,
-                cooldown_until INTEGER DEFAULT 0,
-                updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
-            );
-        `,
-    },
-    {
-        version: 3,
-        name: "003_performance_indexes",
-        sql: `
-            CREATE INDEX IF NOT EXISTS idx_messages_receiver_status ON messages(receiver, status);
-            CREATE INDEX IF NOT EXISTS idx_messages_trace ON messages(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_tasks_trace ON tasks(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_logs_trace ON logs(trace_id);
-            CREATE INDEX IF NOT EXISTS idx_costs_timestamp ON costs(timestamp);
-            CREATE INDEX IF NOT EXISTS idx_costs_trace ON costs(trace_id);
-        `,
-    },
-    {
-        version: 4,
-        name: "004_api_catalog",
-        sql: `
-            CREATE TABLE IF NOT EXISTS api_endpoints (
-                method TEXT NOT NULL,
-                path TEXT NOT NULL,
-                tag TEXT,
-                summary TEXT,
-                auth_required INTEGER DEFAULT 0,
-                request_schema TEXT,
-                response_schema TEXT,
-                source TEXT,
-                updated_at TEXT NOT NULL,
-                PRIMARY KEY (method, path)
-            );
-            CREATE INDEX IF NOT EXISTS idx_api_endpoints_tag ON api_endpoints(tag);
-        `,
-    },
-    {
-        version: 5,
-        name: "005_discipline_call_history",
-        sql: `
-            CREATE TABLE IF NOT EXISTS discipline_calls (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                agent TEXT NOT NULL,
-                tool TEXT NOT NULL,
-                ts INTEGER NOT NULL,
-                args_size INTEGER DEFAULT 0
-            );
-            CREATE INDEX IF NOT EXISTS idx_discipline_calls_agent_ts ON discipline_calls(agent, ts);
-        `,
-    },
-    {
-        version: 6,
-        name: "006_code_graph",
-        sql: `
-            CREATE TABLE IF NOT EXISTS code_files (
-                path TEXT PRIMARY KEY,
-                hash TEXT NOT NULL,
-                updated_at TEXT NOT NULL
-            );
-            CREATE TABLE IF NOT EXISTS code_symbols (
-                id INTEGER PRIMARY KEY AUTOINCREMENT,
-                file TEXT NOT NULL,
-                name TEXT NOT NULL,
-                kind TEXT NOT NULL,
-                start_line INTEGER,
-                end_line INTEGER,
-                signature TEXT,
-                exported INTEGER DEFAULT 0
-            );
-            CREATE INDEX IF NOT EXISTS idx_code_symbols_name ON code_symbols(name);
-            CREATE INDEX IF NOT EXISTS idx_code_symbols_file ON code_symbols(file);
-            CREATE TABLE IF NOT EXISTS code_imports (
-                file TEXT NOT NULL,
-                specifier TEXT NOT NULL
-            );
-            CREATE INDEX IF NOT EXISTS idx_code_imports_file ON code_imports(file);
-        `,
-    },
-];
-function migrationChecksum(sql) {
-    return crypto.createHash("sha256").update(sql.trim(), "utf8").digest("hex");
-}
-function ensureMigrationsTable(db) {
-    db.exec(`
-        CREATE TABLE IF NOT EXISTS schema_migrations (
-            version INTEGER PRIMARY KEY,
-            name TEXT NOT NULL,
-            checksum TEXT NOT NULL,
-            applied_at TEXT NOT NULL
-        )
-    `);
-}
-/**
- * Run all pending schema migrations transactionally and return applied version numbers.
- */
-export function runPendingMigrations(db, migrations = BUILTIN_MIGRATIONS) {
-    ensureMigrationsTable(db);
-    const existingRows = db
-        .prepare("SELECT version, name, checksum, applied_at FROM schema_migrations ORDER BY version ASC")
-        .all();
-    const existingMap = new Map(existingRows.map((r) => [r.version, r]));
-    const sorted = [...migrations].sort((a, b) => a.version - b.version);
-    const applied = [];
-    for (const m of sorted) {
-        const prev = existingMap.get(m.version);
-        const checksum = migrationChecksum(m.sql);
-        if (prev) {
-            if (prev.checksum !== checksum) {
-                throw new Error(`[MIGRATION] Checksum mismatch for migration v${m.version} (${m.name}): ` +
-                    `expected ${prev.checksum}, got ${checksum}.`);
-            }
-            continue;
-        }
-        const applyOne = db.transaction(() => {
-            db.exec(m.sql);
-            db.prepare("INSERT INTO schema_migrations (version, name, checksum, applied_at) VALUES (?, ?, ?, ?)").run(m.version, m.name, checksum, new Date().toISOString());
-        });
-        applyOne();
-        applied.push(m.version);
-    }
-    // Legacy column backfill for older databases that predate v1 hash columns
-    try {
-        const tableInfo = db.prepare("PRAGMA table_info(logs)").all();
-        const colNames = tableInfo.map((c) => c.name);
-        if (colNames.length > 0) {
-            if (!colNames.includes("prev_hash"))
-                db.exec("ALTER TABLE logs ADD COLUMN prev_hash TEXT");
-            if (!colNames.includes("hash"))
-                db.exec("ALTER TABLE logs ADD COLUMN hash TEXT");
-        }
-    }
-    catch {
-        /* ignore if logs table does not exist in custom migration test */
-    }
-    const latest = db.prepare("SELECT MAX(version) as v FROM schema_migrations").get();
-    return {
-        applied,
-        currentVersion: latest?.v ?? 0,
-    };
-}
-/**
- * Return applied and pending migrations for diagnostics/CLI.
- */
-export function getMigrationStatus(db, migrations = BUILTIN_MIGRATIONS) {
-    ensureMigrationsTable(db);
-    const applied = db
-        .prepare("SELECT version, name, checksum, applied_at FROM schema_migrations ORDER BY version ASC")
-        .all();
-    const appliedSet = new Set(applied.map((a) => a.version));
-    const pending = migrations
-        .filter((m) => !appliedSet.has(m.version))
-        .map((m) => ({ version: m.version, name: m.name }));
-    const currentVersion = applied.length > 0 ? applied[applied.length - 1].version : 0;
-    return { currentVersion, applied, pending };
-}
-/**
- * Run SQLite integrity_check / quick_check and foreign_key_check.
- */
-export function verifyDatabaseIntegrity(db, mode = "quick") {
-    const pragma = mode === "full" ? "integrity_check" : "quick_check";
-    const rows = db.prepare(`PRAGMA ${pragma}`).all();
-    const messages = rows.map((r) => Object.values(r)[0] || "");
-    const fkRows = db.prepare("PRAGMA foreign_key_check").all();
-    const ok = messages.length === 1 && messages[0].toLowerCase() === "ok" && fkRows.length === 0;
-    return {
-        ok,
-        messages,
-        foreignKeyViolations: fkRows.length,
-    };
-}
-/**
- * Perform a consistent online backup using SQLite `VACUUM INTO` and write a `.sha256` sidecar.
- */
-export function backupDatabase(db, destinationPath) {
-    const absDest = path.resolve(destinationPath);
-    const parentDir = path.dirname(absDest);
-    fs.mkdirSync(parentDir, { recursive: true });
-    if (fs.existsSync(absDest)) {
-        fs.unlinkSync(absDest);
-    }
-    // Escape single quotes in path for SQLite VACUUM INTO literal
-    const escapedPath = absDest.replace(/'/g, "''");
-    db.exec(`VACUUM INTO '${escapedPath}'`);
-    const bytes = fs.readFileSync(absDest);
-    const sha256 = crypto.createHash("sha256").update(bytes).digest("hex");
-    fs.writeFileSync(`${absDest}.sha256`, `${sha256}  ${path.basename(absDest)}\n`, { mode: 0o600 });
-    const status = getMigrationStatus(db);
-    return {
-        backupPath: absDest,
-        sha256,
-        sizeBytes: bytes.length,
-        createdAt: new Date().toISOString(),
-        schemaVersion: status.currentVersion,
-    };
-}
-/**
- * Verify a backup file (checksum sidecar + SQLite integrity_check) and atomically restore it.
- */
-export function restoreDatabase(backupPath, targetDbPath, options = {}) {
-    const absBackup = path.resolve(backupPath);
-    const absTarget = path.resolve(targetDbPath);
-    if (!fs.existsSync(absBackup)) {
-        throw new Error(`Backup file does not exist: ${absBackup}`);
-    }
-    const bytes = fs.readFileSync(absBackup);
-    const actualSha256 = crypto.createHash("sha256").update(bytes).digest("hex");
-    const sidecarPath = `${absBackup}.sha256`;
-    if (options.verifyChecksum !== false && fs.existsSync(sidecarPath)) {
-        const expected = fs.readFileSync(sidecarPath, "utf8").trim().split(/\s+/)[0];
-        if (expected && expected !== actualSha256) {
-            throw new Error(`Backup checksum mismatch for ${absBackup}: expected ${expected}, got ${actualSha256}`);
-        }
-    }
-    // Open backup in read-only mode to verify SQLite integrity before overwriting target
-    const tempCheckDb = new Database(absBackup, { readonly: true });
-    let schemaVersion = 0;
-    try {
-        const integrity = verifyDatabaseIntegrity(tempCheckDb, "full");
-        if (!integrity.ok) {
-            throw new Error(`Backup file failed SQLite integrity check: ${integrity.messages.join("; ")}`);
-        }
-        try {
-            const row = tempCheckDb
-                .prepare("SELECT MAX(version) as v FROM schema_migrations")
-                .get();
-            schemaVersion = row?.v ?? 0;
-        }
-        catch {
-            /* schema_migrations table may not exist in older backups */
-        }
-    }
-    finally {
-        tempCheckDb.close();
-    }
-    fs.mkdirSync(path.dirname(absTarget), { recursive: true });
-    const stagingPath = `${absTarget}.restore.${process.pid}`;
-    fs.copyFileSync(absBackup, stagingPath);
-    // Remove stale WAL/SHM files before atomic swap
-    for (const suffix of ["-wal", "-shm"]) {
-        const walFile = `${absTarget}${suffix}`;
-        if (fs.existsSync(walFile)) {
-            try {
-                fs.unlinkSync(walFile);
-            }
-            catch {
-                /* ignore */
-            }
-        }
-    }
-    fs.renameSync(stagingPath, absTarget);
-    return {
-        restoredPath: absTarget,
-        sha256: actualSha256,
-        schemaVersion,
-    };
-}
+export * from "./modules/storage/migrations.js";
 //# sourceMappingURL=migrations.js.map

package/dist/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AA6BxB,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACjD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,yBAAyB;QAC/B,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAuEJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,+CAA+C;QACrD,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SA6BJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,yBAAyB;QAC/B,GAAG,EAAE;;;;;;;SAOJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,iBAAiB;QACvB,GAAG,EAAE;;;;;;;;;;;;;;SAcJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,6BAA6B;QACnC,GAAG,EAAE;;;;;;;;;SASJ;KACJ;IACD;QACI,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,gBAAgB;QACtB,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;;SAuBJ;KACJ;CACJ,CAAC;AAEF,SAAS,iBAAiB,CAAC,GAAW;IAClC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChF,CAAC;AAED,SAAS,qBAAqB,CAAC,EAAqB;IAChD,EAAE,CAAC,IAAI,CAAC;;;;;;;KAOP,CAAC,CAAC;AACP,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAChC,EAAqB,EACrB,aAAgC,kBAAkB;IAElD,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAE1B,MAAM,YAAY,GAAG,EAAE;SAClB,OAAO,CAAC,wFAAwF,CAAC;SACjG,GAAG,EAAwB,CAAC;IACjC,MAAM,WAAW,GAAG,IAAI,GAAG,CAA2B,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/F,MAAM,MAAM,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,IAAI,EAAE,CAAC;YACP,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CACX,gDAAgD,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,IAAI,KAAK;oBACrE,YAAY,IAAI,CAAC,QAAQ,SAAS,QAAQ,GAAG,CACpD,CAAC;YACN,CAAC;YACD,SAAS;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE;YACjC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACf,EAAE,CAAC,OAAO,CACN,yFAAyF,CAC5F,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,QAAQ,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAED,0EAA0E;IAC1E,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,CAAC,GAAG,EAA6B,CAAC;QACzF,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC3F,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;QACrF,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,kEAAkE;IACtE,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,EAA0B,CAAC;IAC3G,OAAO;QACH,OAAO;QACP,cAAc,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC;KACjC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAC9B,EAAqB,EACrB,aAAgC,kBAAkB;IAMlD,qBAAqB,CAAC,EAAE,CAAC,CAAC;IAC1B,MAAM,OAAO,GAAG,EAAE;SACb,OAAO,CAAC,wFAAwF,CAAC;SACjG,GAAG,EAAwB,CAAC;IACjC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,UAAU;SACrB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;SACzC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxD,MAAM,cAAc,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACpF,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAChD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,uBAAuB,CACnC,EAAqB,EACrB,OAAyB,OAAO;IAEhC,MAAM,MAAM,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC;IACnE,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,UAAU,MAAM,EAAE,CAAC,CAAC,GAAG,EAAmC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,GAAG,EAAe,CAAC;IACzE,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9F,OAAO;QACH,EAAE;QACF,QAAQ;QACR,oBAAoB,EAAE,MAAM,CAAC,MAAM;KACtC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,EAAqB,EAAE,eAAuB;IACzE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,8DAA8D;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,EAAE,CAAC,IAAI,CAAC,gBAAgB,WAAW,GAAG,CAAC,CAAC;IAExC,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,EAAE,CAAC,aAAa,CAAC,GAAG,OAAO,SAAS,EAAE,GAAG,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEjG,MAAM,MAAM,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;IACtC,OAAO;QACH,UAAU,EAAE,OAAO;QACnB,MAAM;QACN,SAAS,EAAE,KAAK,CAAC,MAAM;QACvB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,aAAa,EAAE,MAAM,CAAC,cAAc;KACvC,CAAC;AACN,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC3B,UAAkB,EAClB,YAAoB,EACpB,UAAwC,EAAE;IAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAE7C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,+BAA+B,SAAS,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE7E,MAAM,WAAW,GAAG,GAAG,SAAS,SAAS,CAAC;IAC1C,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACjE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7E,IAAI,QAAQ,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACX,gCAAgC,SAAS,cAAc,QAAQ,SAAS,YAAY,EAAE,CACzF,CAAC;QACN,CAAC;IACL,CAAC;IAED,qFAAqF;IACrF,MAAM,WAAW,GAAG,IAAI,QAAQ,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,8CAA8C,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,WAAW;iBAClB,OAAO,CAAC,iDAAiD,CAAC;iBAC1D,GAAG,EAAsC,CAAC;YAC/C,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACL,4DAA4D;QAChE,CAAC;IACL,CAAC;YAAS,CAAC;QACP,WAAW,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,WAAW,GAAG,GAAG,SAAS,YAAY,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1D,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAExC,gDAAgD;IAChD,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,GAAG,SAAS,GAAG,MAAM,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC;gBACD,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACL,YAAY;YAChB,CAAC;QACL,CAAC;IACL,CAAC;IAED,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACtC,OAAO;QACH,YAAY,EAAE,SAAS;QACvB,MAAM,EAAE,YAAY;QACpB,aAAa;KAChB,CAAC;AACN,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../src/migrations.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAC"}

package/dist/modules/agent/agent-identity.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+export interface AgentIdentity {
+    agent: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface AgentTokenResult {
+    valid: boolean;
+    agent?: string;
+    reason?: string;
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export declare function isAgentIdentityEnforced(): boolean;
+/** Sign an agent identity into a compact token. */
+export declare function signAgentToken(agent: string, options?: {
+    ttlMs?: number;
+    key?: string | Buffer;
+}): string;
+/** Verify an agent token (signature + expiry). */
+export declare function verifyAgentToken(token: string, options?: {
+    key?: string | Buffer;
+}): AgentTokenResult;
+/** Decode a token's identity without verification (for diagnostics only). */
+export declare function decodeAgentToken(token: string): AgentIdentity | null;

package/dist/modules/agent/agent-identity.js

@@ -0,0 +1,77 @@
+/**
+ * Agent Identity — cryptographically signed agent tokens.
+ *
+ * Problem: `ATABEY_ACTIVE_AGENT` is a plain env var, so any tool/subprocess can
+ * impersonate `@manager` or `@security`. When `ATABEY_AGENT_SECRET` is set,
+ * Atabey accepts an HMAC-signed `ATABEY_AGENT_TOKEN` and verifies it
+ * (fail-closed on tampering/expiry). Set `ATABEY_AGENT_IDENTITY_REQUIRED=true`
+ * to refuse plain-env identity entirely.
+ *
+ * Token format: `${agent}.${issuedAt}.${expiresAt}.${hmacSha256Base64url}`
+ */
+import crypto from "crypto";
+import { resolveAuditChainKey } from "../observability/audit-chain.js";
+function resolveKey(explicit) {
+    if (explicit) {
+        return Buffer.isBuffer(explicit) ? explicit : crypto.createHash("sha256").update(explicit, "utf8").digest();
+    }
+    const envSecret = process.env.ATABEY_AGENT_SECRET;
+    if (envSecret && envSecret.trim()) {
+        return crypto.createHash("sha256").update(envSecret.trim(), "utf8").digest();
+    }
+    return resolveAuditChainKey();
+}
+function timingSafeEqual(a, b) {
+    const ba = Buffer.from(a);
+    const bb = Buffer.from(b);
+    if (ba.length !== bb.length)
+        return false;
+    return crypto.timingSafeEqual(ba, bb);
+}
+/** True when agent-token verification is mandatory (plain env rejected). */
+export function isAgentIdentityEnforced() {
+    return process.env.ATABEY_AGENT_IDENTITY_REQUIRED === "true";
+}
+/** Sign an agent identity into a compact token. */
+export function signAgentToken(agent, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key) {
+        throw new Error("[AGENT_IDENTITY] No signing key. Set ATABEY_AGENT_SECRET.");
+    }
+    const name = agent.replace(/^@/, "");
+    const issuedAt = Date.now();
+    const expiresAt = issuedAt + (options.ttlMs ?? 60 * 60 * 1000);
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const sig = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    return `${payload}.${sig}`;
+}
+/** Verify an agent token (signature + expiry). */
+export function verifyAgentToken(token, options = {}) {
+    const key = resolveKey(options.key);
+    if (!key)
+        return { valid: false, reason: "No signing key configured." };
+    if (!token || typeof token !== "string")
+        return { valid: false, reason: "Empty token." };
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return { valid: false, reason: "Malformed token." };
+    const [name, issuedAt, expiresAt, sig] = parts;
+    const payload = `${name}.${issuedAt}.${expiresAt}`;
+    const expected = crypto.createHmac("sha256", key).update(payload).digest("base64url");
+    if (!timingSafeEqual(sig, expected))
+        return { valid: false, reason: "Signature mismatch." };
+    const exp = Number(expiresAt);
+    if (!Number.isFinite(exp))
+        return { valid: false, reason: "Invalid expiry." };
+    if (Date.now() > exp)
+        return { valid: false, reason: "Token expired." };
+    return { valid: true, agent: `@${name}` };
+}
+/** Decode a token's identity without verification (for diagnostics only). */
+export function decodeAgentToken(token) {
+    const parts = token.split(".");
+    if (parts.length !== 4)
+        return null;
+    return { agent: `@${parts[0]}`, issuedAt: Number(parts[1]), expiresAt: Number(parts[2]) };
+}
+//# sourceMappingURL=agent-identity.js.map

package/dist/modules/agent/agent-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-identity.js","sourceRoot":"","sources":["../../../src/modules/agent/agent-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAcvE,SAAS,UAAU,CAAC,QAA0B;IAC1C,IAAI,QAAQ,EAAE,CAAC;QACX,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAChH,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAClD,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,oBAAoB,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,CAAS,EAAE,CAAS;IACzC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,uBAAuB;IACnC,OAAO,OAAO,CAAC,GAAG,CAAC,8BAA8B,KAAK,MAAM,CAAC;AACjE,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,UAAqD,EAAE;IACjG,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,QAAQ,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IACnD,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AAC/B,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,UAAqC,EAAE;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAEzF,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC5E,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;IAC/C,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACtF,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAE5F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAExE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9F,CAAC"}

package/dist/modules/agent/api-catalog.d.ts

@@ -0,0 +1,57 @@
+/**
+ * API Catalog — endpoint registry, route/OpenAPI scanner, and drift detection.
+ *
+ * Purpose: let frontend/mobile agents integrate against the backend API using
+ * a compact JSON catalog instead of reading large route source files (token
+ * savings + zero context pollution).
+ *
+ * The scanner is HEURISTIC (regex/AST-lite) and covers:
+ *   - Express / Fastify:  app|router|server|fastify.get('/path', ...)
+ *   - Fastify route():    fastify.route({ method, url, ... })
+ *   - NestJS decorators:  @Get('path') / @Post('path')
+ *   - OpenAPI v3 / Swagger v2 JSON specs
+ */
+export interface ApiEndpoint {
+    method: string;
+    path: string;
+    tag?: string;
+    summary?: string;
+    authRequired: boolean;
+    requestSchema?: string;
+    responseSchema?: string;
+    source?: string;
+    updatedAt: string;
+}
+export interface ApiCatalog {
+    version: 1;
+    generatedAt: string;
+    endpoints: ApiEndpoint[];
+}
+export interface ApiDrift {
+    added: ApiEndpoint[];
+    removed: ApiEndpoint[];
+    changed: Array<{
+        previous: ApiEndpoint;
+        current: ApiEndpoint;
+    }>;
+}
+export declare function endpointKey(e: {
+    method: string;
+    path: string;
+}): string;
+export declare function normalizePath(p: string): string;
+/** Parse an OpenAPI v3 or Swagger v2 spec object into endpoints. */
+export declare function parseOpenApiSpec(spec: unknown): ApiEndpoint[];
+/**
+ * Walk a project tree and collect endpoints from route source files and any
+ * OpenAPI/Swagger JSON specs.
+ */
+export declare function scanProjectForEndpoints(rootDir: string, options?: {
+    maxFiles?: number;
+}): ApiEndpoint[];
+export declare function dedupe(endpoints: ApiEndpoint[]): ApiEndpoint[];
+/**
+ * Diff a previous catalog against a freshly scanned one.
+ */
+export declare function detectApiDrift(previous: ApiEndpoint[], current: ApiEndpoint[]): ApiDrift;
+export declare function isApiDriftClean(drift: ApiDrift): boolean;