bonecode 1.0.0 → 1.2.0

package/compat/opencode_adapter.ts

@@ -11,7 +11,9 @@
  *   GET    /v2/session/:id                → get session
  *   DELETE /v2/session/:id                → delete_session
  *   POST   /v2/session/:id/prompt         → run_agent_turn (streaming SSE)
- *   GET    /v2/session/:id/message        → list messages
+ *   POST   /v2/session/:id/cancel         → cancel in-flight agent turn
+ *   POST   /v2/session/:id/subagent       → spawn child session
+ *   GET    /v2/session/:id/message        → list messages (cursor pagination)
  *   GET    /v2/session/:id/message/:msgId → get message
  *   GET    /v2/event                      → SSE event stream (global)
  *   GET    /v2/provider                   → list providers
@@ -25,6 +27,7 @@ import { Router, Request, Response } from "express";
 import { pool } from "../bone/output/session/src/db";
 import { eventBus } from "../bone/output/session/src/events";
 import { requireAuth } from "../bone/output/session/src/auth";
+import { subscribeToChannel, unsubscribeFromChannel } from "../bone/output/session/src/websocket";
 import { v4 as uuid } from "uuid";
 
 export const compatRouter = Router();
@@ -85,10 +88,12 @@ compatRouter.post("/v2/session", async (req: Request, res: Response) => {
   }
 });
 
-// GET /v2/session — list sessions
+// GET /v2/session — list sessions (with optional cursor pagination)
 compatRouter.get("/v2/session", async (req: Request, res: Response) => {
   try {
-    const { projectID, directory, search } = req.query;
+    const { projectID, directory, search, cursor, limit: limitStr, direction = "next", roots } = req.query;
+    const limit = Math.min(parseInt(String(limitStr || "100")), 200);
+
     let sql = `SELECT * FROM sessions WHERE state != 'deleted'`;
     const params: unknown[] = [];
     let idx = 1;
@@ -96,11 +101,43 @@ compatRouter.get("/v2/session", async (req: Request, res: Response) => {
     if (projectID) { sql += ` AND project_id = $${idx++}`; params.push(projectID); }
     if (directory) { sql += ` AND directory = $${idx++}`; params.push(directory); }
     if (search) { sql += ` AND title ILIKE $${idx++}`; params.push(`%${search}%`); }
+    if (roots === "true") { sql += ` AND parent_id IS NULL`; }
+
+    // Cursor-based keyset pagination (opencode v2 pattern)
+    if (cursor) {
+      try {
+        const decoded = JSON.parse(Buffer.from(String(cursor), "base64url").toString("utf8"));
+        const { id, time } = decoded;
+        if (direction === "next") {
+          sql += ` AND (updated_at < $${idx++} OR (updated_at = $${idx++} AND id < $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2; // already incremented above
+        } else {
+          sql += ` AND (updated_at > $${idx++} OR (updated_at = $${idx++} AND id > $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        }
+      } catch {}
+    }
 
-    sql += ` ORDER BY updated_at DESC LIMIT 100`;
+    const orderDir = direction === "previous" ? "ASC" : "DESC";
+    sql += ` ORDER BY updated_at ${orderDir}, id ${orderDir} LIMIT $${idx++}`;
+    params.push(limit + 1); // fetch one extra to detect "more"
 
     const result = await pool.query(sql, params);
-    res.json(result.rows.map(toOpenCodeSession));
+    const rows = result.rows;
+    const more = rows.length > limit;
+    const slice = more ? rows.slice(0, limit) : rows;
+    const items = direction === "previous" ? slice.reverse() : slice;
+
+    const nextCursor = more && slice.length > 0
+      ? Buffer.from(JSON.stringify({
+          id: slice[slice.length - 1].id,
+          time: new Date(slice[slice.length - 1].updated_at).getTime(),
+        })).toString("base64url")
+      : undefined;
+
+    res.json(items.map(toOpenCodeSession));
   } catch (e: any) {
     res.status(500).json({ error: { code: "LIST_FAILED", message: e.message } });
   }
@@ -127,6 +164,35 @@ compatRouter.delete("/v2/session/:id", async (req: Request, res: Response) => {
   }
 });
 
+// POST /v2/session/:id/cancel — cancel an in-flight agent turn
+compatRouter.post("/v2/session/:id/cancel", async (req: Request, res: Response) => {
+  const session_id = req.params.id;
+  try {
+    // Mark any running agents as cancelled
+    await pool.query(
+      `UPDATE agent_instances SET state = 'cancelled', updated_at = NOW()
+       WHERE session_id = $1 AND state IN ('running', 'waiting_for_tool', 'compacting')`,
+      [session_id]
+    );
+    // Move session back to active so the user can keep working
+    await pool.query(
+      `UPDATE sessions SET state = 'active', updated_at = NOW()
+       WHERE id = $1 AND state IN ('busy', 'compacting')`,
+      [session_id]
+    );
+    // Notify subscribers
+    await eventBus.publish("AgentFailed", {
+      agent_id: "",
+      session_id,
+      error: "cancelled by user",
+      failed_at: new Date().toISOString(),
+    }, "CompatAdapter");
+    res.json({ ok: true });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "CANCEL_FAILED", message: e.message } });
+  }
+});
+
 // POST /v2/session/:id/prompt — run agent turn (streaming SSE)
 compatRouter.post("/v2/session/:id/prompt", requireAuth, async (req: Request, res: Response) => {
   const session_id = req.params.id;
@@ -160,58 +226,159 @@ compatRouter.post("/v2/session/:id/prompt", requireAuth, async (req: Request, re
       [session_id]
     );
 
-    // Emit session.updated event to SSE subscribers
     sendSSE(res, "session.updated", { type: "session.updated", properties: { id: session_id } });
     sendSSE(res, "message.updated", { type: "message.updated", properties: { id: message_id, sessionID: session_id } });
 
-    // Subscribe to part updates for this session (live streaming)
-    const unsubscribe = subscribeToSessionEvents(session_id, (event) => {
+    // Subscribe to part_stream BEFORE starting the agent so we don't miss any deltas.
+    // The agent loop calls broadcastToChannel("part_stream", {type:"part.delta",...})
+    // synchronously during streaming — this handler forwards them straight to SSE.
+    const channelHandler = (msg: any) => {
+      if (msg.session_id !== session_id) return;
+      if (msg.type === "part.delta") {
+        sendSSE(res, "part.delta", {
+          type: "part.delta",
+          delta: msg.delta,
+          partID: msg.part_id,
+          messageID: msg.message_id,
+        });
+      }
+    };
+    subscribeToChannel("part_stream", channelHandler);
+
+    // Subscribe to eventBus for tool calls and agent state changes
+    const unsubscribeEvents = subscribeToSessionEvents(session_id, (event) => {
       sendSSE(res, event.type, event.data);
     });
 
-    // Start the agent turn (async — results come via events)
+    const cleanup = () => {
+      unsubscribeFromChannel("part_stream", channelHandler);
+      unsubscribeEvents();
+    };
+
+    req.on("close", cleanup);
+
+    // Start agent — runs async, deltas flow via channelHandler above
     startAgentTurn(session_id, message_id, modelID, providerID)
       .then(() => {
         sendSSE(res, "session.updated", { type: "session.updated", properties: { id: session_id } });
         res.end();
       })
       .catch((e) => {
-        console.error("[AgentLoop] Error:", e.message, e.stack?.split("\n").slice(0,5).join(" | "));
+        console.error("[AgentLoop] Error:", e.message);
         sendSSE(res, "error", { type: "error", properties: { message: e.message } });
         res.end();
       })
-      .finally(() => {
-        unsubscribe();
-      });
+      .finally(cleanup);
 
-    // Handle client disconnect
-    req.on("close", () => {
-      unsubscribe();
-    });
   } catch (e: any) {
     sendSSE(res, "error", { type: "error", properties: { message: e.message } });
     res.end();
   }
 });
 
-// GET /v2/session/:id/message — list messages
+// GET /v2/session/:id/message — list messages (with cursor pagination)
 compatRouter.get("/v2/session/:id/message", async (req: Request, res: Response) => {
   try {
-    const result = await pool.query(
-      `SELECT m.*, json_agg(p.* ORDER BY p.order_index) FILTER (WHERE p.id IS NOT NULL) as parts
+    const { cursor, limit: limitStr, direction = "next" } = req.query;
+    const limit = Math.min(parseInt(String(limitStr || "200")), 500);
+
+    let sql = `SELECT m.*, json_agg(p.* ORDER BY p.order_index) FILTER (WHERE p.id IS NOT NULL) as parts
        FROM messages m
        LEFT JOIN parts p ON p.message_id = m.id
-       WHERE m.session_id = $1
-       GROUP BY m.id
-       ORDER BY m.created_at ASC`,
-      [req.params.id]
-    );
-    res.json(result.rows.map(toOpenCodeMessage));
+       WHERE m.session_id = $1`;
+    const params: unknown[] = [req.params.id];
+    let idx = 2;
+
+    if (cursor) {
+      try {
+        const decoded = JSON.parse(Buffer.from(String(cursor), "base64url").toString("utf8"));
+        const { id, time } = decoded;
+        if (direction === "next") {
+          sql += ` AND (m.created_at < $${idx++} OR (m.created_at = $${idx++} AND m.id < $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        } else {
+          sql += ` AND (m.created_at > $${idx++} OR (m.created_at = $${idx++} AND m.id > $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        }
+      } catch {}
+    }
+
+    const orderDir = direction === "previous" ? "ASC" : "DESC";
+    sql += ` GROUP BY m.id ORDER BY m.created_at ${orderDir}, m.id ${orderDir} LIMIT $${idx++}`;
+    params.push(limit + 1);
+
+    const result = await pool.query(sql, params);
+    const rows = result.rows;
+    const more = rows.length > limit;
+    const slice = more ? rows.slice(0, limit) : rows;
+    const items = direction === "previous" ? slice.reverse() : slice;
+
+    const nextCursor = more && slice.length > 0
+      ? Buffer.from(JSON.stringify({
+          id: slice[slice.length - 1].id,
+          time: new Date(slice[slice.length - 1].created_at).getTime(),
+        })).toString("base64url")
+      : undefined;
+
+    res.json(items.map(toOpenCodeMessage));
   } catch (e: any) {
     res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
   }
 });
 
+// POST /v2/session/:id/subagent — spawn a child session and run it
+compatRouter.post("/v2/session/:parentId/subagent", requireAuth, async (req: Request, res: Response) => {
+  try {
+    const { prompt, agent = "build", modelID, providerID } = req.body;
+    if (!prompt) return res.status(400).json({ error: { code: "MISSING_PROMPT", message: "prompt is required" } });
+
+    const parentId = req.params.parentId;
+    const parentResult = await pool.query(`SELECT * FROM sessions WHERE id = $1`, [parentId]);
+    if (!parentResult.rows[0]) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Parent session not found" } });
+    const parent = parentResult.rows[0];
+
+    // Create child session
+    const childId = require("uuid").v4();
+    const slug = `subagent-${Date.now()}`;
+    await pool.query(
+      `INSERT INTO sessions (id, slug, project_id, parent_id, directory, title, version, state)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, 'created')`,
+      [childId, slug, parent.project_id, parentId, parent.directory, `Subagent: ${prompt.slice(0, 60)}`, "1.0.0"]
+    );
+
+    // Add user message
+    const msgId = require("uuid").v4();
+    await pool.query(
+      `INSERT INTO messages (id, session_id, role) VALUES ($1, $2, 'user')`,
+      [msgId, childId]
+    );
+    const partId = require("uuid").v4();
+    await pool.query(
+      `INSERT INTO parts (id, message_id, session_id, part_type, data, order_index) VALUES ($1, $2, $3, 'text', $4, 0)`,
+      [partId, msgId, childId, JSON.stringify({ text: prompt })]
+    );
+
+    // Run agent asynchronously
+    const { runAgentLoop } = await import("../src/engine/session/prompt");
+    runAgentLoop({
+      session_id: childId,
+      message_id: msgId,
+      content: prompt,
+      model_id: modelID || process.env.DEFAULT_MODEL || "claude-sonnet-4-5",
+      provider_id: providerID || process.env.DEFAULT_PROVIDER || "anthropic",
+      agent_name: agent,
+    }).catch((e: any) => {
+      console.error(`[Subagent] Failed for session ${childId}:`, e.message);
+    });
+
+    res.status(202).json({ childSessionId: childId, status: "running" });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "SUBAGENT_FAILED", message: e.message } });
+  }
+});
+
 // ─── Global SSE Event Stream ──────────────────────────────────────────────────
 
 // GET /v2/event — global SSE stream for all events
@@ -248,11 +415,71 @@ compatRouter.get("/v2/event", (req: Request, res: Response) => {
 // GET /v2/provider — list available providers
 compatRouter.get("/v2/provider", (_req: Request, res: Response) => {
   res.json([
-    { id: "anthropic", name: "Anthropic", models: ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-3-5"] },
-    { id: "openai", name: "OpenAI", models: ["gpt-4o", "gpt-4o-mini", "o1", "o3-mini"] },
-    { id: "google", name: "Google", models: ["gemini-2.0-flash", "gemini-1.5-pro"] },
-    { id: "ollama", name: "Ollama (local)", models: [] },
-    { id: "openrouter", name: "OpenRouter", models: [] },
+    {
+      id: "anthropic", name: "Anthropic",
+      models: ["claude-opus-4-5", "claude-sonnet-4-5", "claude-haiku-3-5"],
+      keyEnv: "ANTHROPIC_API_KEY", url: "https://console.anthropic.com/",
+    },
+    {
+      id: "openai", name: "OpenAI",
+      models: ["gpt-4o", "gpt-4o-mini", "o3-mini", "o4-mini"],
+      keyEnv: "OPENAI_API_KEY", url: "https://platform.openai.com/api-keys",
+    },
+    {
+      id: "google", name: "Google Gemini",
+      models: ["gemini-2.0-flash", "gemini-2.5-pro", "gemini-1.5-flash"],
+      keyEnv: "GOOGLE_API_KEY", url: "https://aistudio.google.com/apikey",
+      free: true, freeNote: "Free tier available via Google AI Studio",
+    },
+    {
+      id: "groq", name: "Groq",
+      models: ["llama-3.3-70b-versatile", "llama-3.1-8b-instant", "mixtral-8x7b-32768", "gemma2-9b-it"],
+      keyEnv: "GROQ_API_KEY", url: "https://console.groq.com/keys",
+      free: true, freeNote: "Generous free tier — very fast inference",
+    },
+    {
+      id: "cerebras", name: "Cerebras",
+      models: ["llama3.1-8b", "llama3.1-70b", "llama-4-scout-17b-16e-instruct"],
+      keyEnv: "CEREBRAS_API_KEY", url: "https://cloud.cerebras.ai/",
+      free: true, freeNote: "Free tier — fastest inference available",
+    },
+    {
+      id: "deepseek", name: "DeepSeek",
+      models: ["deepseek-chat", "deepseek-reasoner"],
+      keyEnv: "DEEPSEEK_API_KEY", url: "https://platform.deepseek.com/api_keys",
+      free: false, freeNote: "Paid API but very cheap (~$0.07/1M tokens). Free access via OpenRouter: deepseek/deepseek-chat-v3-0324:free — or via opencode.ai/go (OpenCode's own hosted service)",
+    },
+    {
+      id: "openrouter", name: "OpenRouter",
+      models: [
+        "deepseek/deepseek-chat-v3-0324:free",
+        "deepseek/deepseek-r1:free",
+        "meta-llama/llama-3.3-70b-instruct:free",
+        "google/gemma-3-27b-it:free",
+        "mistralai/mistral-7b-instruct:free",
+      ],
+      keyEnv: "OPENROUTER_API_KEY", url: "https://openrouter.ai/keys",
+      free: true, freeNote: "Free models available — append :free to any model ID. DeepSeek V3 and R1 are free here",
+    },
+    {
+      id: "ollama", name: "Ollama (local)",
+      models: [],
+      keyEnv: null, url: "https://ollama.com/",
+      free: true, freeNote: "Fully local — no API key needed",
+    },
+    {
+      id: "openai_compatible", name: "OpenAI-compatible (LM Studio, vLLM, etc.)",
+      models: [],
+      keyEnv: "OPENAI_API_KEY", url: "https://lmstudio.ai/",
+      free: true, freeNote: "Local models via any OpenAI-compatible endpoint",
+    },
+    {
+      id: "local", name: "Local config (.env)",
+      models: [process.env.DEFAULT_MODEL || ""].filter(Boolean),
+      keyEnv: null, url: null,
+      free: true,
+      freeNote: `Uses DEFAULT_PROVIDER=${process.env.DEFAULT_PROVIDER || "openai_compatible"} and DEFAULT_MODEL=${process.env.DEFAULT_MODEL || "(not set)"} from your .env`,
+    },
   ]);
 });
 
@@ -381,16 +608,35 @@ function subscribeToSessionEvents(
 ): () => void {
   const handler = async (event: any) => {
     if (event.payload?.session_id === session_id) {
-      callback({ type: mapEventType(event.type), data: event.payload });
+      // Pass through key tool fields directly so SSE listeners can render them
+      const payload: any = { ...event.payload };
+      if (event.type === "ToolCallRequested") {
+        payload.tool_call_id = event.payload.tool_call_id;
+        payload.tool_name = event.payload.tool_name;
+        payload.tool_input = event.payload.tool_input;
+      }
+      if (event.type === "ToolCallCompleted") {
+        payload.tool_call_id = event.payload.tool_call_id;
+        payload.tool_name = event.payload.tool_name;
+        payload.duration_ms = event.payload.duration_ms;
+      }
+      callback({ type: mapEventType(event.type), data: payload });
     }
   };
 
-  const types = ["PartUpdated", "MessageAdded", "AgentCompleted", "AgentFailed", "ToolCallRequested"];
+  const types = [
+    "PartUpdated",
+    "MessageAdded",
+    "AgentCompleted",
+    "AgentFailed",
+    "ToolCallRequested",
+    "ToolCallCompleted",
+    "SessionCompacted",
+  ];
   for (const type of types) {
     eventBus.subscribe(type, handler);
   }
 
-  // Return a real cleanup function that removes all registered handlers
   return () => {
     for (const type of types) {
       eventBus.unsubscribe(type, handler);
@@ -405,6 +651,8 @@ function mapEventType(boneEventType: string): string {
     AgentCompleted: "session.updated",
     AgentFailed: "session.updated",
     ToolCallRequested: "tool.requested",
+    ToolCallCompleted: "tool.completed",
+    SessionCompacted: "session.compacted",
   };
   return map[boneEventType] || boneEventType.toLowerCase();
 }

package/dist/bone/output/agent/src/algorithms.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/bone/output/agent/src/algorithms.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=algorithms.js.map

package/dist/bone/output/agent/src/algorithms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"algorithms.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/algorithms.ts"],"names":[],"mappings":""}

package/dist/bone/output/agent/src/audit.d.ts

@@ -0,0 +1,3 @@
+import { Request, Response, NextFunction } from "express";
+export declare function auditLog(action: string, entityType?: string): (req: Request, _res: Response, next: NextFunction) => Promise<void>;
+export declare function getAuditLog(entityType: string, entityId: string): Promise<any[]>;

package/dist/bone/output/agent/src/audit.js

@@ -0,0 +1,40 @@
+"use strict";
+// Generated by BoneScript compiler.
+// Audit middleware for: AgentDomain v1.0.0
+//
+// Modules requiring audit logging:
+//   - AgentInstanceService
+//   - TaskService
+//   - PlanService
+//   - BuildStepService
+//   - ToolCallService
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuditLog = exports.auditLog = void 0;
+const db_1 = require("./db");
+function auditLog(action, entityType) {
+    return async (req, _res, next) => {
+        try {
+            const auth = req.auth;
+            const actorId = auth?.actor_id ?? null;
+            const entityId = req.params.id ?? req.body?.id ?? null;
+            const payload = req.body ?? null;
+            const ipAddress = req.ip ?? null;
+            const userAgent = req.headers["user-agent"] ?? null;
+            await (0, db_1.query)(`INSERT INTO audit_log
+          (actor_id, action, entity_type, entity_id, payload, ip_address, user_agent)
+          VALUES ($1, $2, $3, $4, $5, $6, $7)`, [actorId, action, entityType ?? null, entityId, JSON.stringify(payload), ipAddress, userAgent]);
+        }
+        catch (err) {
+            // Audit failures must not block the request — log and continue
+            console.error("[audit] Failed to write audit log:", err);
+        }
+        next();
+    };
+}
+exports.auditLog = auditLog;
+async function getAuditLog(entityType, entityId) {
+    const result = await (0, db_1.query)("SELECT * FROM audit_log WHERE entity_type = $1 AND entity_id = $2 ORDER BY created_at DESC LIMIT 100", [entityType, entityId]);
+    return result;
+}
+exports.getAuditLog = getAuditLog;
+//# sourceMappingURL=audit.js.map

package/dist/bone/output/agent/src/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/audit.ts"],"names":[],"mappings":";AAAA,oCAAoC;AACpC,2CAA2C;AAC3C,EAAE;AACF,mCAAmC;AACnC,2BAA2B;AAC3B,kBAAkB;AAClB,kBAAkB;AAClB,uBAAuB;AACvB,sBAAsB;;;AAGtB,6BAA6B;AAE7B,SAAgB,QAAQ,CAAC,MAAc,EAAE,UAAmB;IAC1D,OAAO,KAAK,EAAE,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAiB,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAAgD,CAAC;YAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAK,GAAG,CAAC,IAAgC,EAAE,EAAE,IAAI,IAAI,CAAC;YACpF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;YAEpD,MAAM,IAAA,UAAK,EACT;;8CAEsC,EACtC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAC/F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAtBD,4BAsBC;AAEM,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,UAAK,EACxB,sGAAsG,EACtG,CAAC,UAAU,EAAE,QAAQ,CAAC,CACvB,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAND,kCAMC"}

package/dist/bone/output/agent/src/auth.d.ts

@@ -0,0 +1,8 @@
+import { Request, Response, NextFunction } from "express";
+export interface AuthContext {
+    authenticated: boolean;
+    actor_id: string | null;
+    trace_id: string;
+}
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;

package/dist/bone/output/agent/src/auth.js

@@ -0,0 +1,56 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireAuth = exports.authMiddleware = void 0;
+const jsonwebtoken_1 = __importDefault(require("jsonwebtoken"));
+// JWT_SECRET must be set in production. The server will refuse to start without it
+// when NODE_ENV is "production" to prevent accidental use of a weak fallback.
+const JWT_SECRET = (() => {
+    const secret = process.env.JWT_SECRET;
+    if (!secret) {
+        if (process.env.NODE_ENV === "production") {
+            console.error("[FATAL] JWT_SECRET environment variable is not set. Refusing to start in production.");
+            process.exit(1);
+        }
+        console.warn("[WARN] JWT_SECRET is not set. Using insecure default — do not use in production.");
+        return "bonescript-dev-secret-do-not-use-in-production";
+    }
+    if (secret.length < 32) {
+        console.warn("[WARN] JWT_SECRET is shorter than 32 characters. Use a longer secret in production.");
+    }
+    return secret;
+})();
+function authMiddleware(req, res, next) {
+    const header = req.headers.authorization;
+    if (!header || !header.startsWith("Bearer ")) {
+        req.auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] || "" };
+        next();
+        return;
+    }
+    try {
+        const token = header.slice(7);
+        const decoded = jsonwebtoken_1.default.verify(token, JWT_SECRET);
+        req.auth = {
+            authenticated: true,
+            actor_id: decoded.sub,
+            trace_id: req.headers["x-trace-id"] || "",
+        };
+    }
+    catch {
+        req.auth = { authenticated: false, actor_id: null, trace_id: req.headers["x-trace-id"] || "" };
+    }
+    next();
+}
+exports.authMiddleware = authMiddleware;
+function requireAuth(req, res, next) {
+    const auth = req.auth;
+    if (!auth || !auth.authenticated) {
+        res.status(401).json({ error: { code: "UNAUTHORIZED", message: "Authentication required" } });
+        return;
+    }
+    next();
+}
+exports.requireAuth = requireAuth;
+//# sourceMappingURL=auth.js.map

package/dist/bone/output/agent/src/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/auth.ts"],"names":[],"mappings":";;;;;;AAEA,gEAA+B;AAE/B,mFAAmF;AACnF,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC;IACtC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,EAAE,CAAC;YAC1C,OAAO,CAAC,KAAK,CAAC,sFAAsF,CAAC,CAAC;YACtG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QACjG,OAAO,gDAAgD,CAAC;IAC1D,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;IACtG,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC,EAAE,CAAC;AAQL,SAAgB,cAAc,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IAC5E,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,GAAW,CAAC,IAAI,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAW,IAAI,EAAE,EAAE,CAAC;QAClH,IAAI,EAAE,CAAC;QACP,OAAO;IACT,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,sBAAG,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAoB,CAAC;QAChE,GAAW,CAAC,IAAI,GAAG;YAClB,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,OAAO,CAAC,GAAG;YACrB,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAW,IAAI,EAAE;SACpD,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACN,GAAW,CAAC,IAAI,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,OAAO,CAAC,YAAY,CAAW,IAAI,EAAE,EAAE,CAAC;IACpH,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAnBD,wCAmBC;AAED,SAAgB,WAAW,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;IACzE,MAAM,IAAI,GAAiB,GAAW,CAAC,IAAI,CAAC;IAC5C,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QACjC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IACD,IAAI,EAAE,CAAC;AACT,CAAC;AAPD,kCAOC"}

package/dist/bone/output/agent/src/db.d.ts

@@ -0,0 +1,6 @@
+import { PoolClient } from "pg";
+export declare const pool: any;
+export declare function query<T = any>(text: string, params?: any[]): Promise<T[]>;
+export declare function queryOne<T = any>(text: string, params?: any[]): Promise<T | null>;
+export declare function execute(text: string, params?: any[]): Promise<number>;
+export declare function transaction<T>(fn: (client: PoolClient) => Promise<T>): Promise<T>;

package/dist/bone/output/agent/src/db.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.transaction = exports.execute = exports.queryOne = exports.query = exports.pool = void 0;
+// Generated by BoneScript compiler. DO NOT EDIT.
+const pg_1 = require("pg");
+// Lazy pool — created on first use so DATABASE_URL is read after dotenv loads
+let _pool = null;
+function getPool() {
+    if (!_pool) {
+        _pool = new pg_1.Pool({ connectionString: process.env.DATABASE_URL || "postgresql://localhost:5432/agent_domain", max: 20 });
+        _pool.on("error", (err) => console.error("[DB] Pool error (non-fatal):", err.message));
+    }
+    return _pool;
+}
+exports.pool = new Proxy({}, { get(_t, p) { return getPool()[p]; } });
+async function query(text, params) {
+    try {
+        const result = await exports.pool.query(text, params);
+        return result.rows;
+    }
+    catch (e) {
+        throw new Error(`DB query failed: ${e.message}`);
+    }
+}
+exports.query = query;
+async function queryOne(text, params) {
+    try {
+        const rows = await query(text, params);
+        return rows[0] || null;
+    }
+    catch (e) {
+        throw new Error(`DB query failed: ${e.message}`);
+    }
+}
+exports.queryOne = queryOne;
+async function execute(text, params) {
+    try {
+        const result = await exports.pool.query(text, params);
+        return result.rowCount || 0;
+    }
+    catch (e) {
+        throw new Error(`DB execute failed: ${e.message}`);
+    }
+}
+exports.execute = execute;
+async function transaction(fn) {
+    const client = await exports.pool.connect();
+    try {
+        await client.query("BEGIN");
+        const result = await fn(client);
+        await client.query("COMMIT");
+        return result;
+    }
+    catch (e) {
+        await client.query("ROLLBACK");
+        throw e;
+    }
+    finally {
+        client.release();
+    }
+}
+exports.transaction = transaction;
+//# sourceMappingURL=db.js.map

package/dist/bone/output/agent/src/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/db.ts"],"names":[],"mappings":";;;AAAA,iDAAiD;AACjD,2BAAsC;AAEtC,8EAA8E;AAC9E,IAAI,KAAK,GAAgB,IAAI,CAAC;AAC9B,SAAS,OAAO;IACd,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,KAAK,GAAG,IAAI,SAAI,CAAC,EAAE,gBAAgB,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,0CAA0C,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACxH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AACY,QAAA,IAAI,GAAG,IAAI,KAAK,CAAC,EAAU,EAAE,EAAE,GAAG,CAAC,EAAO,EAAE,CAAM,IAAI,OAAQ,OAAO,EAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAE/F,KAAK,UAAU,KAAK,CAAU,IAAY,EAAE,MAAc;IAC/D,IAAI,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,YAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,IAAW,CAAC;IAAC,CAAC;IACjF,OAAO,CAAM,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AACtE,CAAC;AAHD,sBAGC;AACM,KAAK,UAAU,QAAQ,CAAU,IAAY,EAAE,MAAc;IAClE,IAAI,CAAC;QAAC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAI,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAAC,CAAC;IAC1E,OAAO,CAAM,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AACtE,CAAC;AAHD,4BAGC;AACM,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IACxD,IAAI,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,YAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC;IAAC,CAAC;IACnF,OAAO,CAAM,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AACxE,CAAC;AAHD,0BAGC;AACM,KAAK,UAAU,WAAW,CAAI,EAAsC;IACzE,MAAM,MAAM,GAAG,MAAM,YAAI,CAAC,OAAO,EAAE,CAAC;IACpC,IAAI,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAAC,OAAO,MAAM,CAAC;IAAC,CAAC;IAClH,OAAO,CAAC,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAAC,MAAM,CAAC,CAAC;IAAC,CAAC;YAC9C,CAAC;QAAC,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC/B,CAAC;AALD,kCAKC"}

package/dist/bone/output/agent/src/events.d.ts

@@ -0,0 +1,25 @@
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+/// <reference types="node" />
+import { PoolClient } from "pg";
+export type EventDeliveryMode = "in_process" | "durable";
+export interface EventMetadata {
+    source: string;
+    timestamp: Date;
+    correlation_id: string;
+    causation_id: string;
+}
+export interface SystemEvent {
+    type: string;
+    payload: Record<string, unknown>;
+    metadata: EventMetadata;
+}
+type Handler = (event: SystemEvent) => Promise<void>;
+export declare const eventBus: {
+    subscribe(type: string, handler: Handler): void;
+    publish(type: string, payload: Record<string, unknown>, source: string, correlationId?: string, client?: PoolClient): Promise<void>;
+    startWorker(intervalMs?: number): NodeJS.Timeout | null;
+};
+export {};