ava-engine 0.0.0-stage → 0.1.0

package/public/vendor/lenis.min.js

@@ -0,0 +1,3 @@
+/*! Lenis v1.1.13 | MIT License | Copyright (c) darkroom.engineering | https://github.com/darkroomengineering/lenis */
+!function(t,i){"object"==typeof exports&&"undefined"!=typeof module?module.exports=i():"function"==typeof define&&define.amd?define(i):(t="undefined"!=typeof globalThis?globalThis:t||self).Lenis=i()}(this,(function(){"use strict";function clamp(t,i,e){return Math.max(t,Math.min(i,e))}class Animate{constructor(){this.isRunning=!1,this.value=0,this.from=0,this.to=0,this.currentTime=0}advance(t){var i;if(!this.isRunning)return;let e=!1;if(this.duration&&this.easing){this.currentTime+=t;const i=clamp(0,this.currentTime/this.duration,1);e=i>=1;const s=e?1:this.easing(i);this.value=this.from+(this.to-this.from)*s}else this.lerp?(this.value=function damp(t,i,e,s){return function lerp(t,i,e){return(1-e)*t+e*i}(t,i,1-Math.exp(-e*s))}(this.value,this.to,60*this.lerp,t),Math.round(this.value)===this.to&&(this.value=this.to,e=!0)):(this.value=this.to,e=!0);e&&this.stop(),null===(i=this.onUpdate)||void 0===i||i.call(this,this.value,e)}stop(){this.isRunning=!1}fromTo(t,i,{lerp:e,duration:s,easing:o,onStart:n,onUpdate:l}){this.from=this.value=t,this.to=i,this.lerp=e,this.duration=s,this.easing=o,this.currentTime=0,this.isRunning=!0,null==n||n(),this.onUpdate=l}}class Dimensions{constructor(t,i,{autoResize:e=!0,debounce:s=250}={}){this.wrapper=t,this.content=i,this.width=0,this.height=0,this.scrollHeight=0,this.scrollWidth=0,this.resize=()=>{this.onWrapperResize(),this.onContentResize()},this.onWrapperResize=()=>{this.wrapper instanceof Window?(this.width=window.innerWidth,this.height=window.innerHeight):(this.width=this.wrapper.clientWidth,this.height=this.wrapper.clientHeight)},this.onContentResize=()=>{this.wrapper instanceof Window?(this.scrollHeight=this.content.scrollHeight,this.scrollWidth=this.content.scrollWidth):(this.scrollHeight=this.wrapper.scrollHeight,this.scrollWidth=this.wrapper.scrollWidth)},e&&(this.debouncedResize=function debounce(t,i){let e;return function(...s){let o=this;clearTimeout(e),e=setTimeout((()=>{e=void 0,t.apply(o,s)}),i)}}(this.resize,s),this.wrapper instanceof Window?window.addEventListener("resize",this.debouncedResize,!1):(this.wrapperResizeObserver=new ResizeObserver(this.debouncedResize),this.wrapperResizeObserver.observe(this.wrapper)),this.contentResizeObserver=new ResizeObserver(this.debouncedResize),this.contentResizeObserver.observe(this.content)),this.resize()}destroy(){var t,i;null===(t=this.wrapperResizeObserver)||void 0===t||t.disconnect(),null===(i=this.contentResizeObserver)||void 0===i||i.disconnect(),this.wrapper===window&&this.debouncedResize&&window.removeEventListener("resize",this.debouncedResize,!1)}get limit(){return{x:this.scrollWidth-this.width,y:this.scrollHeight-this.height}}}class Emitter{constructor(){this.events={}}emit(t,...i){var e;let s=this.events[t]||[];for(let t=0,o=s.length;t<o;t++)null===(e=s[t])||void 0===e||e.call(s,...i)}on(t,i){var e;return(null===(e=this.events[t])||void 0===e?void 0:e.push(i))||(this.events[t]=[i]),()=>{var e;this.events[t]=null===(e=this.events[t])||void 0===e?void 0:e.filter((t=>i!==t))}}off(t,i){var e;this.events[t]=null===(e=this.events[t])||void 0===e?void 0:e.filter((t=>i!==t))}destroy(){this.events={}}}const t=100/6,i={passive:!1};class VirtualScroll{constructor(e,s={wheelMultiplier:1,touchMultiplier:1}){this.element=e,this.options=s,this.touchStart={x:0,y:0},this.lastDelta={x:0,y:0},this.window={width:0,height:0},this.emitter=new Emitter,this.onTouchStart=t=>{const{clientX:i,clientY:e}=t.targetTouches?t.targetTouches[0]:t;this.touchStart.x=i,this.touchStart.y=e,this.lastDelta={x:0,y:0},this.emitter.emit("scroll",{deltaX:0,deltaY:0,event:t})},this.onTouchMove=t=>{const{clientX:i,clientY:e}=t.targetTouches?t.targetTouches[0]:t,s=-(i-this.touchStart.x)*this.options.touchMultiplier,o=-(e-this.touchStart.y)*this.options.touchMultiplier;this.touchStart.x=i,this.touchStart.y=e,this.lastDelta={x:s,y:o},this.emitter.emit("scroll",{deltaX:s,deltaY:o,event:t})},this.onTouchEnd=t=>{this.emitter.emit("scroll",{deltaX:this.lastDelta.x,deltaY:this.lastDelta.y,event:t})},this.onWheel=i=>{let{deltaX:e,deltaY:s,deltaMode:o}=i;e*=1===o?t:2===o?this.window.width:1,s*=1===o?t:2===o?this.window.height:1,e*=this.options.wheelMultiplier,s*=this.options.wheelMultiplier,this.emitter.emit("scroll",{deltaX:e,deltaY:s,event:i})},this.onWindowResize=()=>{this.window={width:window.innerWidth,height:window.innerHeight}},window.addEventListener("resize",this.onWindowResize,!1),this.onWindowResize(),this.element.addEventListener("wheel",this.onWheel,i),this.element.addEventListener("touchstart",this.onTouchStart,i),this.element.addEventListener("touchmove",this.onTouchMove,i),this.element.addEventListener("touchend",this.onTouchEnd,i)}on(t,i){return this.emitter.on(t,i)}destroy(){this.emitter.destroy(),window.removeEventListener("resize",this.onWindowResize,!1),this.element.removeEventListener("wheel",this.onWheel,i),this.element.removeEventListener("touchstart",this.onTouchStart,i),this.element.removeEventListener("touchmove",this.onTouchMove,i),this.element.removeEventListener("touchend",this.onTouchEnd,i)}}return class Lenis{constructor({wrapper:t=window,content:i=document.documentElement,eventsTarget:e=t,smoothWheel:s=!0,syncTouch:o=!1,syncTouchLerp:n=.075,touchInertiaMultiplier:l=35,duration:r,easing:h=(t=>Math.min(1,1.001-Math.pow(2,-10*t))),lerp:a=.1,infinite:c=!1,orientation:u="vertical",gestureOrientation:d="vertical",touchMultiplier:p=1,wheelMultiplier:m=1,autoResize:v=!0,prevent:g,virtualScroll:S,__experimental__naiveDimensions:w=!1}={}){this._isScrolling=!1,this._isStopped=!1,this._isLocked=!1,this._preventNextNativeScrollEvent=!1,this._resetVelocityTimeout=null,this.time=0,this.userData={},this.lastVelocity=0,this.velocity=0,this.direction=0,this.animate=new Animate,this.emitter=new Emitter,this.onPointerDown=t=>{1===t.button&&this.reset()},this.onVirtualScroll=t=>{if("function"==typeof this.options.virtualScroll&&!1===this.options.virtualScroll(t))return;const{deltaX:i,deltaY:e,event:s}=t;if(this.emitter.emit("virtual-scroll",{deltaX:i,deltaY:e,event:s}),s.ctrlKey)return;const o=s.type.includes("touch"),n=s.type.includes("wheel");this.isTouching="touchstart"===s.type||"touchmove"===s.type;if(this.options.syncTouch&&o&&"touchstart"===s.type&&!this.isStopped&&!this.isLocked)return void this.reset();const l=0===i&&0===e,r="vertical"===this.options.gestureOrientation&&0===e||"horizontal"===this.options.gestureOrientation&&0===i;if(l||r)return;let h=s.composedPath();h=h.slice(0,h.indexOf(this.rootElement));const a=this.options.prevent;if(h.find((t=>{var i,e,s,l,r;return t instanceof HTMLElement&&("function"==typeof a&&(null==a?void 0:a(t))||(null===(i=t.hasAttribute)||void 0===i?void 0:i.call(t,"data-lenis-prevent"))||o&&(null===(e=t.hasAttribute)||void 0===e?void 0:e.call(t,"data-lenis-prevent-touch"))||n&&(null===(s=t.hasAttribute)||void 0===s?void 0:s.call(t,"data-lenis-prevent-wheel"))||(null===(l=t.classList)||void 0===l?void 0:l.contains("lenis"))&&!(null===(r=t.classList)||void 0===r?void 0:r.contains("lenis-stopped")))})))return;if(this.isStopped||this.isLocked)return void s.preventDefault();if(!(this.options.syncTouch&&o||this.options.smoothWheel&&n))return this.isScrolling="native",void this.animate.stop();s.preventDefault();let c=e;"both"===this.options.gestureOrientation?c=Math.abs(e)>Math.abs(i)?e:i:"horizontal"===this.options.gestureOrientation&&(c=i);const u=o&&this.options.syncTouch,d=o&&"touchend"===s.type&&Math.abs(c)>5;d&&(c=this.velocity*this.options.touchInertiaMultiplier),this.scrollTo(this.targetScroll+c,Object.assign({programmatic:!1},u?{lerp:d?this.options.syncTouchLerp:1}:{lerp:this.options.lerp,duration:this.options.duration,easing:this.options.easing}))},this.onNativeScroll=()=>{if(null!==this._resetVelocityTimeout&&(clearTimeout(this._resetVelocityTimeout),this._resetVelocityTimeout=null),this._preventNextNativeScrollEvent)this._preventNextNativeScrollEvent=!1;else if(!1===this.isScrolling||"native"===this.isScrolling){const t=this.animatedScroll;this.animatedScroll=this.targetScroll=this.actualScroll,this.lastVelocity=this.velocity,this.velocity=this.animatedScroll-t,this.direction=Math.sign(this.animatedScroll-t),this.isScrolling="native",this.emit(),0!==this.velocity&&(this._resetVelocityTimeout=setTimeout((()=>{this.lastVelocity=this.velocity,this.velocity=0,this.isScrolling=!1,this.emit()}),400))}},window.lenisVersion="1.1.13",t&&t!==document.documentElement&&t!==document.body||(t=window),this.options={wrapper:t,content:i,eventsTarget:e,smoothWheel:s,syncTouch:o,syncTouchLerp:n,touchInertiaMultiplier:l,duration:r,easing:h,lerp:a,infinite:c,gestureOrientation:d,orientation:u,touchMultiplier:p,wheelMultiplier:m,autoResize:v,prevent:g,virtualScroll:S,__experimental__naiveDimensions:w},this.dimensions=new Dimensions(t,i,{autoResize:v}),this.updateClassName(),this.targetScroll=this.animatedScroll=this.actualScroll,this.options.wrapper.addEventListener("scroll",this.onNativeScroll,!1),this.options.wrapper.addEventListener("pointerdown",this.onPointerDown,!1),this.virtualScroll=new VirtualScroll(e,{touchMultiplier:p,wheelMultiplier:m}),this.virtualScroll.on("scroll",this.onVirtualScroll)}destroy(){this.emitter.destroy(),this.options.wrapper.removeEventListener("scroll",this.onNativeScroll,!1),this.options.wrapper.removeEventListener("pointerdown",this.onPointerDown,!1),this.virtualScroll.destroy(),this.dimensions.destroy(),this.cleanUpClassName()}on(t,i){return this.emitter.on(t,i)}off(t,i){return this.emitter.off(t,i)}setScroll(t){this.isHorizontal?this.rootElement.scrollLeft=t:this.rootElement.scrollTop=t}resize(){this.dimensions.resize(),this.animatedScroll=this.targetScroll=this.actualScroll,this.emit()}emit(){this.emitter.emit("scroll",this)}reset(){this.isLocked=!1,this.isScrolling=!1,this.animatedScroll=this.targetScroll=this.actualScroll,this.lastVelocity=this.velocity=0,this.animate.stop()}start(){this.isStopped&&(this.isStopped=!1,this.reset())}stop(){this.isStopped||(this.isStopped=!0,this.animate.stop(),this.reset())}raf(t){const i=t-(this.time||t);this.time=t,this.animate.advance(.001*i)}scrollTo(t,{offset:i=0,immediate:e=!1,lock:s=!1,duration:o=this.options.duration,easing:n=this.options.easing,lerp:l=this.options.lerp,onStart:r,onComplete:h,force:a=!1,programmatic:c=!0,userData:u}={}){if(!this.isStopped&&!this.isLocked||a){if("string"==typeof t&&["top","left","start"].includes(t))t=0;else if("string"==typeof t&&["bottom","right","end"].includes(t))t=this.limit;else{let e;if("string"==typeof t?e=document.querySelector(t):t instanceof HTMLElement&&(null==t?void 0:t.nodeType)&&(e=t),e){if(this.options.wrapper!==window){const t=this.rootElement.getBoundingClientRect();i-=this.isHorizontal?t.left:t.top}const s=e.getBoundingClientRect();t=(this.isHorizontal?s.left:s.top)+this.animatedScroll}}if("number"==typeof t){if(t+=i,t=Math.round(t),this.options.infinite?c&&(this.targetScroll=this.animatedScroll=this.scroll):t=clamp(0,t,this.limit),t===this.targetScroll)return null==r||r(this),void(null==h||h(this));if(this.userData=null!=u?u:{},e)return this.animatedScroll=this.targetScroll=t,this.setScroll(this.scroll),this.reset(),this.preventNextNativeScrollEvent(),this.emit(),null==h||h(this),void(this.userData={});c||(this.targetScroll=t),this.animate.fromTo(this.animatedScroll,t,{duration:o,easing:n,lerp:l,onStart:()=>{s&&(this.isLocked=!0),this.isScrolling="smooth",null==r||r(this)},onUpdate:(t,i)=>{this.isScrolling="smooth",this.lastVelocity=this.velocity,this.velocity=t-this.animatedScroll,this.direction=Math.sign(this.velocity),this.animatedScroll=t,this.setScroll(this.scroll),c&&(this.targetScroll=t),i||this.emit(),i&&(this.reset(),this.emit(),null==h||h(this),this.userData={},this.preventNextNativeScrollEvent())}})}}}preventNextNativeScrollEvent(){this._preventNextNativeScrollEvent=!0,requestAnimationFrame((()=>{this._preventNextNativeScrollEvent=!1}))}get rootElement(){return this.options.wrapper===window?document.documentElement:this.options.wrapper}get limit(){return this.options.__experimental__naiveDimensions?this.isHorizontal?this.rootElement.scrollWidth-this.rootElement.clientWidth:this.rootElement.scrollHeight-this.rootElement.clientHeight:this.dimensions.limit[this.isHorizontal?"x":"y"]}get isHorizontal(){return"horizontal"===this.options.orientation}get actualScroll(){return this.isHorizontal?this.rootElement.scrollLeft:this.rootElement.scrollTop}get scroll(){return this.options.infinite?function modulo(t,i){return(t%i+i)%i}(this.animatedScroll,this.limit):this.animatedScroll}get progress(){return 0===this.limit?1:this.scroll/this.limit}get isScrolling(){return this._isScrolling}set isScrolling(t){this._isScrolling!==t&&(this._isScrolling=t,this.updateClassName())}get isStopped(){return this._isStopped}set isStopped(t){this._isStopped!==t&&(this._isStopped=t,this.updateClassName())}get isLocked(){return this._isLocked}set isLocked(t){this._isLocked!==t&&(this._isLocked=t,this.updateClassName())}get isSmooth(){return"smooth"===this.isScrolling}get className(){let t="lenis";return this.isStopped&&(t+=" lenis-stopped"),this.isLocked&&(t+=" lenis-locked"),this.isScrolling&&(t+=" lenis-scrolling"),"smooth"===this.isScrolling&&(t+=" lenis-smooth"),t}updateClassName(){this.cleanUpClassName(),this.rootElement.className=`${this.rootElement.className} ${this.className}`.trim()}cleanUpClassName(){this.rootElement.className=this.rootElement.className.replace(/lenis(-\w+)?/g,"").trim()}}}));
+//# sourceMappingURL=lenis.min.js.map

package/scripts/fetch-models.sh

@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+# Download the offline speech-to-text models into ./models.
+# Without them Ava falls back to the browser's speech recognition.
+#
+#   ./scripts/fetch-models.sh                 # English (fast, 122 MB)
+#   ./scripts/fetch-models.sh english         # English, most accurate (296 MB)
+#   ./scripts/fetch-models.sh multilingual    # zh/en/ja/ko/yue (1 GB)
+#   ./scripts/fetch-models.sh all             # english + multilingual
+#
+# Installed with npm? Use `npx ava-engine models` instead.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+args=()
+for a in "$@"; do case "$a" in zipformer) args+=(english) ;; sensevoice) args+=(multilingual) ;; *) args+=("$a") ;; esac; done
+exec node lib/fetch-models.mjs "${args[@]}"

package/server.mjs

@@ -0,0 +1,502 @@
+import http from "node:http";
+import { readFile, stat } from "node:fs/promises";
+import { brotliCompressSync, gzipSync, constants as zc } from "node:zlib";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { dirname, join, extname, normalize, sep } from "node:path";
+
+import { MOCK, chat, requestScope } from "./lib/openrouter.mjs";
+import { MODELS, ROLE_LABEL, PROVIDER } from "./lib/models.mjs";
+import { newSession, getSession, getSessionBySpecialistKey, hasCapacity, scoreView, endSession, onSpecialistRevoked } from "./lib/state.mjs";
+import { oursTurnStream, greetStream, observeUpdate, screenOff, proactiveNudge, truncateAssistant, sessionSummary, requestHandoff, handoffStatus, cancelHandoff, bridgePoll, specialistJoin, specialistSay, specialistLeave, userSayToBridge } from "./lib/ours.mjs";
+import { synth, TTS_ENABLED, providers, defaultProvider, warmKokoro, kokoroStream, KOKORO_STREAMS, elevenStream, ELEVEN_STREAMS, TtsBusyError } from "./lib/tts.mjs";
+import { transcribe, STT_ENABLED } from "./lib/stt.mjs";
+import { createAsrSession, asrAvailable, warmAsr, availableEngines, defaultEngine, ENGINE_LABELS } from "./lib/asr.mjs";
+import { platformsView, platformById } from "./lib/platforms.mjs";
+import { AUTH_ENABLED, isAuthorized, challengeHeaders, authCookieHeader, clientIp, sameOrigin, limiter } from "./lib/guard.mjs";
+import { WebSocketServer } from "ws";
+
+// A stray rejection is logged, not fatal. An uncaught exception leaves the process
+// in an unknown state, so log it and exit — the supervisor (Fly, Docker) restarts us.
+process.on("unhandledRejection", (e) => console.error("[unhandled rejection]", e));
+process.on("uncaughtException", (e) => { console.error("[uncaught exception]", e); process.exit(1); });
+
+const __dir = dirname(fileURLToPath(import.meta.url));
+const PUBLIC = join(__dir, "public");
+const PORT = Number(process.env.PORT) || 5190;
+
+// Spend limits. Each session is capped in model spend; each client IP in request rate.
+const SESSION_BUDGET_USD = Number(process.env.SESSION_BUDGET_USD) || 2;
+const MAX_USER_TEXT = 2000;
+const MAX_FRAME_BYTES = 2 * 1024 * 1024; // a downscaled JPEG screen frame is ~100-300 KB
+const FRAME_RE = /^data:image\/(jpeg|png|webp);base64,[A-Za-z0-9+/=]+$/;
+const rate = {
+  session: limiter("session", Number(process.env.RATE_SESSIONS_PER_MIN) || 10, 60_000), // new calls per IP per minute
+  api: limiter("api", Number(process.env.RATE_API_PER_MIN) || 240, 60_000),            // all other /api calls per IP per minute
+  authFail: limiter("authFail", 20, 10 * 60_000),                                         // wrong passwords per IP per 10 minutes
+};
+
+// A wrong password counts against the client; past the limit, stop checking.
+// (A first visit with no credentials at all is just the login prompt, not a guess.)
+const triedPassword = (req) => !!req.headers.authorization || /ava_auth=/.test(String(req.headers.cookie || ""));
+function lockedOut(req) { return triedPassword(req) && rate.authFail.blocked(clientIp(req)); }
+function denyAuth(req, res) {
+  if (triedPassword(req)) rate.authFail(clientIp(req));
+  return send(res, 401, "authentication required", challengeHeaders());
+}
+const LOCKED = "too many failed logins — try again in 10 minutes";
+const asrPerIp = new Map(); // ip → open /asr sockets
+const MAX_ASR_PER_IP = 3, MAX_ASR_TOTAL = Number(process.env.MAX_ASR_CONNECTIONS) || 40;
+let asrOpen = 0;
+
+const SECURITY_HEADERS = {
+  "X-Content-Type-Options": "nosniff",
+  "Referrer-Policy": "no-referrer",          // specialist links carry a key in the query
+  "X-Frame-Options": "DENY",
+  "Permissions-Policy": "geolocation=(), payment=(), usb=(), microphone=(self), display-capture=(self)",
+};
+
+const MIME = {
+  ".html": "text/html; charset=utf-8", ".js": "text/javascript; charset=utf-8", ".css": "text/css; charset=utf-8", ".json": "application/json",
+  ".svg": "image/svg+xml", ".ico": "image/x-icon", ".avif": "image/avif", ".webp": "image/webp", ".png": "image/png", ".jpg": "image/jpeg",
+  ".woff2": "font/woff2",
+};
+const COMPRESSIBLE = new Set([".html", ".js", ".css", ".json", ".svg"]);
+const packed = new Map(); // "path|mtime|enc" → compressed bytes, so each file is compressed once per version
+const cspCache = new Map(); // "path|mtime" → CSP header for that HTML page
+
+// Content-Security-Policy: same-origin everything, and inline <script>s allowed
+// only by hash (computed per file version) — never 'unsafe-inline' for scripts.
+function cspFor(html, key, host) {
+  let scripts = cspCache.get(key);
+  if (!scripts) {
+    const hashes = [...html.toString("utf8").matchAll(/<script>([\s\S]*?)<\/script>/g)]
+      .map((m) => `'sha256-${createHash("sha256").update(m[1]).digest("base64")}'`);
+    scripts = ["'self'", ...hashes].join(" ");
+    cspCache.set(key, scripts);
+  }
+  const ws = host ? ` ws://${host} wss://${host}` : "";
+  return [
+    "default-src 'self'", `script-src ${scripts}`, "style-src 'self' 'unsafe-inline'",
+    "img-src 'self' data: blob:", "media-src 'self' blob: mediastream:", "font-src 'self'",
+    `connect-src 'self'${ws}`, "worker-src 'self' blob:", "object-src 'none'",
+    "base-uri 'self'", "form-action 'self'", "frame-ancestors 'none'",
+  ].join("; ");
+}
+
+function send(res, code, body, headers = {}) {
+  const data = typeof body === "string" || Buffer.isBuffer(body) ? body : JSON.stringify(body);
+  res.writeHead(code, { "Content-Type": typeof body === "object" ? "application/json" : "text/plain", ...headers });
+  res.end(data);
+}
+
+// Upstream errors (OpenRouter, ElevenLabs, Deepgram…) can carry account or quota
+// detail. Log it here; the browser only gets a short, generic reason.
+function upstreamFail(res, e, what) {
+  console.error(`  [${what}]`, e?.message || e);
+  return send(res, e?.status === 429 ? 429 : 502, { error: `${what} failed` });
+}
+
+class HttpError extends Error { constructor(status, msg) { super(msg); this.status = status; } }
+
+function readRaw(req, limit = 5 * 1024 * 1024) {
+  return new Promise((resolve, reject) => {
+    let size = 0; const chunks = [];
+    req.on("data", (c) => { size += c.length; if (size > limit) { reject(new Error("body too large")); req.destroy(); } else chunks.push(c); });
+    req.on("end", () => resolve(Buffer.concat(chunks)));
+    req.on("error", reject);
+  });
+}
+
+// JSON bodies only: requiring the content type also blocks cross-site form posts,
+// which can't set application/json without a CORS preflight.
+function readBody(req, limit = 3 * 1024 * 1024) {
+  if (!/^application\/json\b/i.test(String(req.headers["content-type"] || ""))) return Promise.reject(new HttpError(415, "expected application/json"));
+  return new Promise((resolve, reject) => {
+    let size = 0; const chunks = [];
+    req.on("data", (c) => { size += c.length; if (size > limit) { reject(new HttpError(413, "body too large")); req.destroy(); } else chunks.push(c); });
+    req.on("end", () => {
+      try { const v = chunks.length ? JSON.parse(Buffer.concat(chunks).toString("utf8")) : {}; resolve(v && typeof v === "object" ? v : {}); }
+      catch { reject(new HttpError(400, "invalid JSON")); }
+    });
+    req.on("error", reject);
+  });
+}
+
+function safeHost(req) { const h = String(req.headers.host || ""); return /^[a-z0-9.-]+(:\d+)?$/i.test(h) ? h : ""; }
+function validFrame(f) { return typeof f === "string" && f.length <= MAX_FRAME_BYTES && FRAME_RE.test(f) ? f : null; }
+function overBudget(sess) { return sess.score.ours.cost >= SESSION_BUDGET_USD; }
+
+async function serveStatic(req, res, pathname) {
+  let p;
+  try { p = decodeURIComponent(pathname); } catch { return send(res, 400, "bad request"); }
+  if (p === "/") p = "/landing.html";              // marketing landing page
+  else if (p === "/app" || p === "/app/") p = "/index.html"; // the live assistant
+  const full = normalize(join(PUBLIC, p));
+  if (!full.startsWith(PUBLIC + sep)) return send(res, 403, "forbidden");
+  try {
+    const st = await stat(full);
+    if (!st.isFile()) return send(res, 404, "not found");
+    const ext = extname(full), etag = `W/"${st.size.toString(36)}-${st.mtimeMs.toString(36)}"`;
+    // Photos, fonts and vendored libs rarely change: cache them hard. Pages and app code revalidate (cheap 304s).
+    const longLived = /^\/(img|fonts|vendor)\//.test(p) || p === "/favicon.svg";
+    const headers = {
+      "Content-Type": MIME[ext] || "application/octet-stream",
+      "Cache-Control": longLived ? "public, max-age=2592000, stale-while-revalidate=86400" : "no-cache",
+      ETag: etag, Vary: "Accept-Encoding",
+      ...(ext === ".html" ? authCookieHeader(req) : {}),
+    };
+    if (req.headers["if-none-match"] === etag) { res.writeHead(304, headers); return res.end(); }
+    let body = await readFile(full);
+    if (ext === ".html") headers["Content-Security-Policy"] = cspFor(body, `${full}|${st.mtimeMs}`, safeHost(req));
+    const accept = String(req.headers["accept-encoding"] || "");
+    const enc = !COMPRESSIBLE.has(ext) || body.length < 1024 ? null : /\bbr\b/.test(accept) ? "br" : /\bgzip\b/.test(accept) ? "gzip" : null;
+    if (enc) {
+      const key = `${full}|${st.mtimeMs}|${enc}`;
+      let z = packed.get(key);
+      if (!z) {
+        z = enc === "br" ? brotliCompressSync(body, { params: { [zc.BROTLI_PARAM_QUALITY]: 11, [zc.BROTLI_PARAM_SIZE_HINT]: body.length } }) : gzipSync(body, { level: 9 });
+        packed.set(key, z);
+      }
+      body = z; headers["Content-Encoding"] = enc;
+    }
+    headers["Content-Length"] = body.length;
+    res.writeHead(200, headers);
+    res.end(req.method === "HEAD" ? undefined : body);
+  } catch {
+    send(res, 404, "not found");
+  }
+}
+
+// Pages that open a call (and everything they talk to) sit behind ACCESS_PASSWORD
+// when it's set. The landing page and its assets stay public.
+function needsAuth(pathname) {
+  return pathname.startsWith("/api/") && pathname !== "/api/health"
+    || pathname === "/app" || pathname === "/app/" || pathname === "/index.html"
+    || pathname === "/specialist" || pathname === "/specialist.html";
+}
+
+// Aborts when the client goes away before we've answered (not after a normal finish).
+function clientGone(res) {
+  const ac = new AbortController();
+  res.once("close", () => { if (!res.writableFinished) ac.abort(); });
+  return ac.signal;
+}
+
+const server = http.createServer((req, res) => requestScope.run({ signal: clientGone(res) }, () => handle(req, res)));
+
+async function handle(req, res) {
+  for (const [k, v] of Object.entries(SECURITY_HEADERS)) res.setHeader(k, v);
+  let url;
+  try { url = new URL(req.url, "http://x"); } catch { return send(res, 400, "bad request"); }
+  if (needsAuth(url.pathname)) {
+    // Locked-out clients get no answer about any password, right or wrong.
+    if (lockedOut(req)) return send(res, 429, LOCKED, { "Retry-After": "600" });
+    if (!isAuthorized(req)) return denyAuth(req, res);
+  }
+  if (url.pathname.startsWith("/api/") && url.pathname !== "/api/health" && !rate.api(clientIp(req))) {
+    return send(res, 429, { error: "too many requests — slow down" }, { "Retry-After": "30" });
+  }
+  try {
+    if (req.method === "GET" && url.pathname === "/api/health") {
+      return send(res, 200, {
+        mock: MOCK,
+        models: { talker: MODELS.talker, perception: MODELS.perception, planner: MODELS.planner, intent: MODELS.intent },
+        labels: ROLE_LABEL,
+        tts: { enabled: TTS_ENABLED, providers: providers(), default: defaultProvider() },
+        stt: { enabled: STT_ENABLED, streaming: asrAvailable(), engines: availableEngines().map((id) => ({ id, label: ENGINE_LABELS[id] || id })), defaultEngine: defaultEngine() },
+        modes: [
+          { id: "flexible", name: "Flexible agent", tagline: "Sees your screen and helps with anything you're doing." },
+          { id: "onboarding", name: "Onboarding agent", tagline: "Focused on getting a new user into their dashboard on a chosen platform." },
+        ],
+        platforms: platformsView(),
+      });
+    }
+
+    // End-of-call recap for the session report.
+    if (req.method === "POST" && url.pathname === "/api/summary") {
+      const { sessionId } = await readBody(req);
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      try { return send(res, 200, await sessionSummary(sess)); }
+      catch (e) { return upstreamFail(res, e, "summary"); }
+    }
+
+    // The user barged in — rewrite Ava's last reply to what was actually heard.
+    if (req.method === "POST" && url.pathname === "/api/truncate") {
+      const { sessionId, heard = "" } = await readBody(req);
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      return send(res, 200, truncateAssistant(sess, String(heard).slice(0, 2000)));
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/stt") {
+      if (!STT_ENABLED) return send(res, 503, { error: "stt disabled" });
+      const type = String(req.headers["content-type"] || "");
+      if (!/^audio\//i.test(type)) return send(res, 415, { error: "expected audio/*" });
+      const buf = await readRaw(req);
+      try { return send(res, 200, { text: await transcribe(buf, type) }); }
+      catch (e) { return upstreamFail(res, e, "speech-to-text"); }
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/tts") {
+      const { text, provider = defaultProvider() } = await readBody(req);
+      if (typeof text !== "string" || !text.trim()) return send(res, 400, { error: "text required" });
+      // Streaming providers (Kokoro, ElevenLabs) emit clause-by-clause: each frame
+      // is a 4-byte big-endian length + a complete audio clip (WAV for Kokoro, MP3
+      // for ElevenLabs — the client decodes both). The client plays after frame
+      // one, so time-to-first-audio is one short chunk, not the whole reply.
+      const streamFn = (provider === "kokoro" && KOKORO_STREAMS) ? kokoroStream
+        : (provider === "elevenlabs" && ELEVEN_STREAMS) ? elevenStream : null;
+      if (streamFn) {
+        try {
+          const t0 = Date.now();
+          let first = 0;
+          // Frame: [4-byte meta length][meta JSON {t: chunk, n: audio bytes}][audio]
+          // The chunk text rides with its audio so the client knows exactly which
+          // chunks were HEARD when the user barges in.
+          let started = false;
+          await streamFn(text, (audio, chunk) => {
+            if (res.destroyed) throw new Error("client went away"); // stop synthesizing for nobody
+            if (!started) { started = true; res.writeHead(200, { "Content-Type": "application/x-wav-stream", "Cache-Control": "no-store", "X-Accel-Buffering": "no", "X-TTS-Provider": provider }); }
+            if (!first) { first = Date.now() - t0; console.log(`  ${provider} first chunk in ${first}ms`); }
+            const meta = Buffer.from(JSON.stringify({ t: chunk, n: audio.length }));
+            const head = Buffer.alloc(4); head.writeUInt32BE(meta.length, 0);
+            res.write(head); res.write(meta); res.write(audio);
+          });
+          res.end();
+        } catch (e) {
+          if (res.destroyed) return;
+          if (!res.headersSent) return e instanceof TtsBusyError ? send(res, 429, { error: "voice busy" }, { "Retry-After": "2" }) : upstreamFail(res, e, "voice");
+          try { res.end(); } catch {}
+        }
+        return;
+      }
+      try {
+        const { audio, chars, latencyMs, model, mime } = await synth(provider, text);
+        return send(res, 200, audio, { "Content-Type": mime || "audio/mpeg", "X-TTS-Chars": String(chars), "X-TTS-Latency": String(latencyMs), "X-TTS-Model": model, "X-TTS-Provider": provider });
+      } catch (e) {
+        if (e instanceof TtsBusyError) return send(res, 429, { error: "voice busy" }, { "Retry-After": "2" });
+        if (e.status === 400) return send(res, 400, { error: e.message });
+        return upstreamFail(res, e, "voice");
+      }
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/session") {
+      if (!rate.session(clientIp(req))) return send(res, 429, { error: "too many new sessions — try again in a minute" }, { "Retry-After": "60" });
+      if (!hasCapacity()) return send(res, 503, { error: "Ava is at capacity right now — try again in a few minutes" }, { "Retry-After": "60" });
+      const body = await readBody(req);
+      const mode = body.mode === "onboarding" ? "onboarding" : "flexible";
+      const platform = typeof body.platformId === "string" ? platformById(body.platformId) : null; // knowledge in any mode
+      const s = newSession({ mode, platform });
+      if (!s) return send(res, 503, { error: "Ava is at capacity right now — try again in a few minutes" }, { "Retry-After": "60" });
+      // pre-warm the talker route so the greeting isn't a cold start
+      if (!MOCK) chat({ model: MODELS.talker, role: "talker", provider: PROVIDER.talker, messages: [{ role: "user", content: "hi" }], maxTokens: 1 }).catch(() => {});
+      return send(res, 200, { sessionId: s.id, mock: MOCK, models: MODELS, mode, platform: platform ? { id: platform.id, name: platform.name, url: platform.url } : null });
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/turn") {
+      const body = await readBody(req);
+      const { sessionId, frameHash = null, greet = false, voice = false, changed = false, screenActive = false } = body;
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      if (overBudget(sess)) return send(res, 402, { error: "this session reached its spend limit — start a new call" });
+      const userText = String(body.userText ?? "").slice(0, MAX_USER_TEXT);
+      const frame = validFrame(body.frame);
+
+      res.writeHead(200, { "Content-Type": "text/event-stream", "Cache-Control": "no-cache, no-transform", "Connection": "keep-alive", "X-Accel-Buffering": "no" });
+      const emit = (ev, data) => { if (res.destroyed) return; try { res.write(`event: ${ev}\ndata: ${JSON.stringify(data)}\n\n`); } catch {} };
+      try {
+        if (greet) await greetStream(sess, emit, !!voice);
+        else await oursTurnStream(sess, userText, frame, !!screenActive, frameHash, emit, !!voice, !!changed);
+      } catch (e) {
+        console.error("  [turn]", e?.message || e);
+        emit("error", { error: "Ava couldn't answer that one — try again" });
+      }
+      res.end();
+      return;
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/observe") {
+      const { sessionId, frame: rawFrame, frameHash = null, stopped = false, changed = false } = await readBody(req);
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      if (stopped) return send(res, 200, screenOff(sess)); // user stopped sharing → mark state stale now
+      if (overBudget(sess)) return send(res, 402, { error: "spend limit reached" });
+      const frame = validFrame(rawFrame);
+      if (!frame) return send(res, 400, { error: "no frame" });
+      try { return send(res, 200, await observeUpdate(sess, frame, frameHash, !!changed)); }
+      catch (e) { return upstreamFail(res, e, "screen read"); }
+    }
+
+    // Specialist console page (opened at /specialist?key=<specialist key>).
+    if (req.method === "GET" && url.pathname === "/specialist") {
+      try {
+        const full = join(PUBLIC, "specialist.html"), html = await readFile(full), st = await stat(full);
+        return send(res, 200, html, { "Content-Type": "text/html; charset=utf-8", "Cache-Control": "no-store", "Content-Security-Policy": cspFor(html, `${full}|${st.mtimeMs}`, safeHost(req)), ...authCookieHeader(req) });
+      }
+      catch { return send(res, 404, "not found"); }
+    }
+
+    // Live bridge between the user's call and a human specialist. The user is
+    // identified by sessionId; the specialist only ever holds the specialist key
+    // minted when the user asked for a person (revoked when the handoff ends).
+    if (req.method === "GET" && url.pathname === "/api/bridge") {
+      const key = url.searchParams.get("key");
+      const sess = key ? getSessionBySpecialistKey(key) : getSession(url.searchParams.get("sessionId"));
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      return send(res, 200, bridgePoll(sess, Number(url.searchParams.get("since")) || 0));
+    }
+    if (req.method === "POST" && url.pathname === "/api/bridge") {
+      const { sessionId, key, action = "say", text = "" } = await readBody(req);
+      if (action === "usersay") {
+        const sess = getSession(sessionId);
+        if (!sess) return send(res, 404, { error: "unknown session" });
+        return send(res, 200, userSayToBridge(sess, String(text).slice(0, MAX_USER_TEXT)));
+      }
+      const sess = getSessionBySpecialistKey(key);
+      if (!sess) return send(res, 404, { error: "unknown or expired link" });
+      if (action === "join") { const r = specialistJoin(sess); return r ? send(res, 200, r) : send(res, 409, { error: "no handoff requested" }); }
+      if (action === "leave") return send(res, 200, specialistLeave(sess));
+      if (action === "say") return send(res, 200, specialistSay(sess, String(text).slice(0, MAX_USER_TEXT)));
+      return send(res, 400, { error: "unknown action" });
+    }
+
+    // The customer hung up: end any handoff and free the session slot right away.
+    if (req.method === "POST" && url.pathname === "/api/end") {
+      const { sessionId } = await readBody(req);
+      return send(res, 200, { ended: endSession(sessionId) });
+    }
+
+    // Human handoff — request a real person, poll the connect state.
+    if (req.method === "POST" && url.pathname === "/api/handoff") {
+      const { sessionId, action = "request" } = await readBody(req);
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      if (action === "cancel") return send(res, 200, cancelHandoff(sess));
+      if (action === "status") return send(res, 200, handoffStatus(sess));
+      return send(res, 200, requestHandoff(sess));
+    }
+
+    if (req.method === "POST" && url.pathname === "/api/nudge") {
+      const { sessionId } = await readBody(req);
+      const sess = getSession(sessionId);
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      if (overBudget(sess)) return send(res, 402, { error: "spend limit reached" });
+      try { return send(res, 200, await proactiveNudge(sess)); }
+      catch (e) { return upstreamFail(res, e, "nudge"); }
+    }
+
+    if (req.method === "GET" && url.pathname === "/api/scoreboard") {
+      const sess = getSession(url.searchParams.get("sessionId"));
+      if (!sess) return send(res, 404, { error: "unknown session" });
+      return send(res, 200, { ours: scoreView(sess.score.ours) });
+    }
+
+    if (req.method === "GET" || req.method === "HEAD") return await serveStatic(req, res, url.pathname);
+    return send(res, 405, "method not allowed");
+  } catch (e) {
+    if (res.headersSent) { try { res.end(); } catch {} return; }
+    if (e instanceof HttpError) return send(res, e.status, { error: e.message });
+    console.error("  [request]", req.method, url.pathname, e);
+    return send(res, 500, { error: "internal error" });
+  }
+}
+
+// ── /asr WebSocket: browser streams echo-cancelled 16kHz Int16 PCM; we stream
+// back {partial|final} transcripts from the offline sherpa recognizer. ──
+const wss = new WebSocketServer({ noServer: true, maxPayload: 64 * 1024 }); // ~1s of 16 kHz PCM is 32 KB
+// ── /rtc WebSocket: signaling relay between the two peers (user ↔ specialist)
+// of one session, so they can open a WebRTC connection (screen video + voice). ──
+const rtcWss = new WebSocketServer({ noServer: true, maxPayload: 256 * 1024 }); // SDP + ICE only
+const rtcRooms = new Map(); // sessionId → { user: ws|null, specialist: ws|null }
+// A revoked handoff link must also cut the specialist's live call, not just future requests.
+onSpecialistRevoked((sess) => {
+  const ws = rtcRooms.get(sess.id)?.specialist;
+  if (ws) { try { ws.close(4403, "handoff ended"); } catch {} }
+});
+server.on("upgrade", (req, socket, head) => {
+  let path;
+  try { path = new URL(req.url, "http://x").pathname; } catch { return socket.destroy(); }
+  const reject = (code, msg) => { try { socket.write(`HTTP/1.1 ${code} ${msg}\r\nConnection: close\r\n\r\n`); } catch {} socket.destroy(); };
+  if (!sameOrigin(req)) return reject(403, "Forbidden");
+  if (lockedOut(req)) return reject(429, "Too Many Requests");
+  if (!isAuthorized(req)) { if (triedPassword(req)) rate.authFail(clientIp(req)); return reject(401, "Unauthorized"); }
+  if (path === "/asr") {
+    const ip = clientIp(req);
+    if (asrOpen >= MAX_ASR_TOTAL || (asrPerIp.get(ip) || 0) >= MAX_ASR_PER_IP) return reject(503, "Service Unavailable");
+  }
+  if (path === "/asr") return wss.handleUpgrade(req, socket, head, (ws) => wss.emit("connection", ws, req));
+  if (path === "/rtc") return rtcWss.handleUpgrade(req, socket, head, (ws) => rtcWss.emit("connection", ws, req));
+  socket.destroy();
+});
+rtcWss.on("connection", (ws, req) => {
+  const u = new URL(req.url, "http://x");
+  const role = u.searchParams.get("role") === "specialist" ? "specialist" : "user";
+  const other = role === "user" ? "specialist" : "user";
+  // The user proves the call with its session id, the specialist with the handoff key.
+  const sess = role === "specialist" ? getSessionBySpecialistKey(u.searchParams.get("key")) : getSession(u.searchParams.get("session"));
+  if (!sess) { try { ws.close(4404, "unknown session"); } catch {} return; }
+  const session = sess.id;
+  let room = rtcRooms.get(session);
+  if (!room) { room = { user: null, specialist: null }; rtcRooms.set(session, room); }
+  if (room[role] && room[role] !== ws) { try { room[role].close(); } catch {} }
+  room[role] = ws;
+  const j = (w, m) => { try { if (w && w.readyState === 1) w.send(JSON.stringify(m)); } catch {} };
+  j(ws, { type: "peer", present: !!room[other] });          // tell me if my peer is already here
+  j(room[other], { type: "peer", present: true, joined: role }); // tell my peer I arrived
+  ws.on("message", (data, isBinary) => { const w = room[other]; if (w && w.readyState === 1) { try { w.send(data, { binary: isBinary }); } catch {} } });
+  ws.on("close", () => {
+    if (room[role] !== ws) return; // replaced by a newer socket — its peer is still present
+    room[role] = null;
+    j(room[other], { type: "peer", present: false, left: role });
+    if (!room.user && !room.specialist) rtcRooms.delete(session);
+  });
+  ws.on("error", () => {});
+});
+wss.on("connection", (ws, req) => {
+  const engine = new URL(req.url, "http://x").searchParams.get("engine") || undefined;
+  const session = createAsrSession(engine);
+  if (!session) { ws.send(JSON.stringify({ type: "error", error: "asr unavailable" })); ws.close(); return; }
+  const ip = clientIp(req);
+  asrOpen += 1; asrPerIp.set(ip, (asrPerIp.get(ip) || 0) + 1);
+  ws.once("close", () => { asrOpen -= 1; const n = (asrPerIp.get(ip) || 1) - 1; if (n > 0) asrPerIp.set(ip, n); else asrPerIp.delete(ip); });
+  try { ws.send(JSON.stringify({ type: "ready", engine: session.engine })); } catch {}
+  ws.on("message", (data, isBinary) => {
+    if (!isBinary) return; // no control messages yet
+    try {
+      const out = session.feed(data);
+      if (out.partial) ws.send(JSON.stringify({ type: "partial", text: out.partial }));
+      if (out.final) ws.send(JSON.stringify({ type: "final", text: out.final }));
+    } catch (e) {
+      console.error("  [asr]", e?.message || e);
+      try { ws.send(JSON.stringify({ type: "error", error: "transcription failed" })); } catch {}
+    }
+  });
+  ws.on("close", () => session.close());
+  ws.on("error", () => {});
+});
+
+// HOST=127.0.0.1 keeps Ava private to this computer (the CLI's "just me" setup).
+const HOST = process.env.HOST || undefined;
+const LOCAL_ONLY = HOST === "127.0.0.1" || HOST === "localhost" || HOST === "::1";
+
+server.on("error", (e) => {
+  if (e.code === "EADDRINUSE") console.error(`\n  ✗ Port ${PORT} is already in use. Stop whatever is using it, or pick another port (PORT=5191, or \`ava-engine start --port 5191\`).\n`);
+  else if (e.code === "EACCES") console.error(`\n  ✗ No permission to use port ${PORT}. Pick a port above 1024.\n`);
+  else console.error("  ✗ server error:", e);
+  process.exit(1);
+});
+
+server.listen(PORT, HOST, () => {
+  console.log(`\n  Ava — screen-aware voice agent`);
+  console.log(`  → http://localhost:${PORT}/app`);
+  console.log(`  mode: ${MOCK ? "MOCK (no OPENROUTER_API_KEY set — synthetic replies)" : "LIVE (OpenRouter)"}`);
+  if (!MOCK) console.log(`  models: talker=${MODELS.talker}  perception=${MODELS.perception}  planner=${MODELS.planner}  intent=${MODELS.intent}`);
+  if (LOCAL_ONLY) console.log("  access: this computer only");
+  else if (!AUTH_ENABLED) console.log("  access: OPEN — anyone who can reach this server can spend your API credit. Set ACCESS_PASSWORD before exposing it.");
+  else console.log("  access: password protected");
+  console.log("");
+  warmKokoro(); // preload the offline voice so the first reply is fast
+  warmAsr();    // preload the offline ear so the first utterance is fast
+});