bonecode 1.1.0 → 1.2.1

package/README.md

@@ -11,27 +11,90 @@
 npm install -g bonecode
 ```
 
-Then just run it from any project directory:
+Then run it from any project directory:
 
 ```bash
 bonecode
 ```
 
+---
+
+## Interfaces
+
+BoneCode ships three ways to interact with the agent.
+
+### Terminal UI (default)
+
+```bash
+bonecode
+```
+
+Opens an interactive terminal session in the current directory. Type `/` to see all available commands.
+
+| Key | Action |
+|-----|--------|
+| `/` | Show command menu (arrow keys to navigate, Enter/Tab to select) |
+| `Ctrl+C` | Interrupt the current agent request |
+| `Ctrl+D` | Exit |
+| `↑ / ↓` | Scroll through prompt history |
+| `@<path>` | Attach a file (Tab to autocomplete) |
+
+### Web UI
+
+```bash
+bonecode web
+```
+
+Starts the server and opens the web interface in your browser at `http://localhost:3000/ui`.
+
+If you already have the server running separately (`bonecode serve`), just navigate to:
+
+```
+http://localhost:3000/ui
+```
+
+**Build the web UI for production** (optional — the server serves it automatically after building):
+
+```bash
+cd web && npm install && npm run build
+```
+
+The built assets are served from `/ui`. Without a build, the server serves the raw source files in dev mode — functional but without bundling.
+
+**Run the web UI in hot-reload dev mode** (separate terminal):
+
+```bash
+cd web && npm install && npm run dev
+# Opens at http://localhost:5173 with proxy to the BoneCode server
+```
+
+### Headless server
+
+```bash
+bonecode serve
+```
+
+Starts the API server only (no TUI, no browser). Useful for CI, Docker, or connecting your own client.
+
+---
+
 ## Database modes
 
-BoneCode automatically detects what's available and picks the best option:
+BoneCode automatically detects what's available:
 
 | Mode | Setup required | Features |
 |------|---------------|----------|
 | **PostgreSQL** (full) | Docker | Sessions + agents + **pgvector RAG** + hybrid search + durable events |
 | **SQLite** (basic) | Nothing | Sessions + agents only — no RAG, no vector search |
 
-**No Docker?** BoneCode falls back to SQLite automatically. You get a fully working AI coding agent — just without the codebase indexing and RAG features.
+No Docker? BoneCode falls back to SQLite automatically — fully working agent, just without codebase indexing.
 
-**Want the full experience?** Install Docker, then run `bonecode` — it starts the Postgres container for you automatically on first run.
+Want the full experience? Install Docker and run `bonecode` — it starts Postgres automatically on first run.
 
 > Install Docker: https://docs.docker.com/get-docker/
 
+---
+
 ## Configuration
 
 Copy `.env.example` to `.env` and set your LLM provider:
@@ -50,14 +113,77 @@ OPENAI_API_KEY=not-needed
 MODEL_SUPPORTS_TOOLS=false
 ```
 
-For cloud providers (Anthropic, OpenAI, Google) just set the API key — no base URL needed.
+For cloud providers just set the API key — no base URL needed:
+
+```env
+# Anthropic
+ANTHROPIC_API_KEY=sk-ant-...
+DEFAULT_PROVIDER=anthropic
+DEFAULT_MODEL=claude-sonnet-4-5
+
+# OpenAI
+OPENAI_API_KEY=sk-...
+DEFAULT_PROVIDER=openai
+DEFAULT_MODEL=gpt-4o
+
+# Google
+GOOGLE_API_KEY=...
+DEFAULT_PROVIDER=google
+DEFAULT_MODEL=gemini-2.0-flash
+```
+
+---
+
+## CLI commands
+
+```
+bonecode                    Start server + open TUI
+bonecode serve              Start headless server only
+bonecode web                Start server + open web UI in browser
+bonecode run "fix the bug"  Send a one-shot prompt
+bonecode run -i             Interactive terminal mode (no TUI)
+bonecode stats              Show token usage and cost statistics
+bonecode export [id]        Export a session as JSON
+bonecode pr <number>        Checkout a GitHub PR branch
+bonecode github install     Show GitHub Actions agent setup
+bonecode compile            Recompile .bone domain models
+bonecode migrate            Run database migrations
+bonecode status             Check if server is running
+bonecode --version          Show version
+```
+
+### Stats
+
+```bash
+bonecode stats                  # all-time usage
+bonecode stats --days 7         # last 7 days
+bonecode stats --models 5       # show top 5 models
+bonecode stats --tools          # show tool usage breakdown
+```
+
+### Export
+
+```bash
+bonecode export                 # export most recent session
+bonecode export <session-id>    # export specific session
+bonecode export --sanitize      # redact file paths, tool outputs, etc.
+bonecode export > session.json  # pipe to file
+```
+
+---
 
 ## What's different from OpenCode
 
-- **BoneScript backend** — all domain models (sessions, agents, RAG, workspaces) are declared in `.bone` files and compiled to a full Node.js + Express backend with state machines, saga flows, and durable events
-- **pgvector RAG** — codebase indexing with hybrid search (vector + BM25 full-text + RRF fusion). Works without an embedding model using structural context (git recency, import graph, FTS)
-- **Single command** — `bonecode` starts everything in one process, no separate server terminal needed
-- **SQLite fallback** — works out of the box without Docker for users who just want the agent
+- **BoneScript backend** — domain models declared in `.bone` files, compiled to Express + state machines + saga flows + durable events
+- **pgvector RAG** — hybrid search (vector + BM25 + RRF fusion), works without an embedding model using structural context
+- **Web UI** — browser interface at `/ui` in addition to the TUI
+- **mDNS discovery** — server announces itself as `bonecode.local` on the local network
+- **Cursor pagination** — v2 session and message APIs support bidirectional keyset pagination
+- **Subagent spawning** — `POST /v2/session/:id/subagent` creates and runs a child session
+- **Single command** — `bonecode` starts everything in one process
+- **SQLite fallback** — works out of the box without Docker
+
+---
 
 ## Architecture
 
@@ -77,8 +203,18 @@ BoneCode/
 │   ├── cli.ts          # bonecode CLI entry point
 │   ├── tui.ts          # Interactive terminal UI
 │   ├── server.ts       # Express server (auto Postgres/SQLite)
+│   ├── mdns.ts         # mDNS/Bonjour local network discovery
+│   ├── stats.ts        # Token/cost statistics
+│   ├── export.ts       # Session export with PII redaction
 │   ├── db_adapter.ts   # Database detection + SQLite shim
 │   └── engine/         # Agent loop, tools, context builder
+├── web/                # Web UI (vanilla TypeScript + Vite)
+│   ├── index.html
+│   ├── src/
+│   │   ├── main.ts     # Entry point
+│   │   ├── app.ts      # Main app class
+│   │   └── api.ts      # API client
+│   └── vite.config.ts  # Dev server with proxy to :3000
 ├── compat/
 │   └── opencode_adapter.ts  # OpenCode v2 API compatibility layer
 └── extensions/         # Custom extension points (embeddings, chunking, etc.)

package/bin/bonecode

@@ -1,62 +1,67 @@
 #!/usr/bin/env node
-// BoneCode CLI entry point
-// Resolves and runs the CLI via ts-node (dev) or compiled JS (prod).
+"use strict";
 
 const path = require("path");
 const { spawnSync } = require("child_process");
 const fs = require("fs");
-const os = require("os");
 
-const isWindows = os.platform() === "win32";
-
-// Resolve the package root (two levels up from bin/)
-const scriptPath = fs.realpathSync(__filename);
-const pkgRoot = path.dirname(path.dirname(scriptPath));
+// Resolve package root (one level up from bin/)
+const pkgRoot = path.dirname(path.dirname(fs.realpathSync(__filename)));
 
+// Prefer compiled JS — always built by `npm run build`
 const cliJs = path.join(pkgRoot, "dist", "src", "cli.js");
-const cliTs = path.join(pkgRoot, "src", "cli.ts");
+if (fs.existsSync(cliJs)) {
+  const result = spawnSync(process.execPath, [cliJs, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    cwd: process.cwd(),
+    env: process.env,
+  });
+  process.exit(result.status ?? 0);
+}
 
-function findTsNode() {
-  // Try local node_modules first
-  const local = path.join(pkgRoot, "node_modules", ".bin", isWindows ? "ts-node.cmd" : "ts-node");
-  if (fs.existsSync(local)) return local;
-  // Fall back to global ts-node
-  return isWindows ? "ts-node.cmd" : "ts-node";
+// Dev fallback: try tsx (works without compilation, no .cmd issues)
+const cliTs = path.join(pkgRoot, "src", "cli.ts");
+if (!fs.existsSync(cliTs)) {
+  console.error("BoneCode: CLI entry point not found.");
+  console.error("  Run `npm run build` inside the BoneCode directory first.");
+  process.exit(1);
 }
 
-function run(cmd, args) {
-  const result = spawnSync(cmd, args, {
+// Find tsx in local node_modules
+const tsxLocal = path.join(pkgRoot, "node_modules", ".bin", "tsx");
+const tsxLocalCmd = tsxLocal + (process.platform === "win32" ? ".cmd" : "");
+
+if (fs.existsSync(tsxLocalCmd)) {
+  const result = spawnSync(tsxLocalCmd, [cliTs, ...process.argv.slice(2)], {
     stdio: "inherit",
     cwd: process.cwd(),
     env: process.env,
-    shell: false,
+    shell: process.platform === "win32",
   });
-
-  if (result.error) {
-    // If the command failed (e.g. .cmd not found), try with shell: true
-    const result2 = spawnSync(cmd, args, {
-      stdio: "inherit",
-      cwd: process.cwd(),
-      env: process.env,
-      shell: true,
-    });
-    process.exit(result2.status ?? 0);
-    return;
-  }
-
   process.exit(result.status ?? 0);
 }
 
-if (fs.existsSync(cliJs)) {
-  // Production: use compiled JS
-  run(process.execPath, [cliJs, ...process.argv.slice(2)]);
-} else if (fs.existsSync(cliTs)) {
-  // Development: use ts-node
-  const tsNode = findTsNode();
-  const tsconfig = path.join(pkgRoot, "tsconfig.json");
-  run(tsNode, ["--project", tsconfig, cliTs, ...process.argv.slice(2)]);
-} else {
-  console.error("BoneCode: could not find CLI entry point.");
-  console.error("  Run `npm run build` to compile, or ensure ts-node is installed.");
+// Last resort: npx tsx (downloads on first run)
+console.error("BoneCode: compiled JS not found. Building now...");
+const build = spawnSync(
+  process.platform === "win32" ? "npm.cmd" : "npm",
+  ["run", "build"],
+  { stdio: "inherit", cwd: pkgRoot, shell: process.platform === "win32" }
+);
+if (build.status !== 0) {
+  console.error("Build failed. Run `npm run build` manually in the BoneCode directory.");
   process.exit(1);
 }
+
+// Retry with compiled JS
+if (fs.existsSync(cliJs)) {
+  const result = spawnSync(process.execPath, [cliJs, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    cwd: process.cwd(),
+    env: process.env,
+  });
+  process.exit(result.status ?? 0);
+}
+
+console.error("Build succeeded but CLI not found at:", cliJs);
+process.exit(1);

package/compat/opencode_adapter.ts

@@ -11,7 +11,9 @@
  *   GET    /v2/session/:id                → get session
  *   DELETE /v2/session/:id                → delete_session
  *   POST   /v2/session/:id/prompt         → run_agent_turn (streaming SSE)
- *   GET    /v2/session/:id/message        → list messages
+ *   POST   /v2/session/:id/cancel         → cancel in-flight agent turn
+ *   POST   /v2/session/:id/subagent       → spawn child session
+ *   GET    /v2/session/:id/message        → list messages (cursor pagination)
  *   GET    /v2/session/:id/message/:msgId → get message
  *   GET    /v2/event                      → SSE event stream (global)
  *   GET    /v2/provider                   → list providers
@@ -86,10 +88,12 @@ compatRouter.post("/v2/session", async (req: Request, res: Response) => {
   }
 });
 
-// GET /v2/session — list sessions
+// GET /v2/session — list sessions (with optional cursor pagination)
 compatRouter.get("/v2/session", async (req: Request, res: Response) => {
   try {
-    const { projectID, directory, search } = req.query;
+    const { projectID, directory, search, cursor, limit: limitStr, direction = "next", roots } = req.query;
+    const limit = Math.min(parseInt(String(limitStr || "100")), 200);
+
     let sql = `SELECT * FROM sessions WHERE state != 'deleted'`;
     const params: unknown[] = [];
     let idx = 1;
@@ -97,11 +101,43 @@ compatRouter.get("/v2/session", async (req: Request, res: Response) => {
     if (projectID) { sql += ` AND project_id = $${idx++}`; params.push(projectID); }
     if (directory) { sql += ` AND directory = $${idx++}`; params.push(directory); }
     if (search) { sql += ` AND title ILIKE $${idx++}`; params.push(`%${search}%`); }
+    if (roots === "true") { sql += ` AND parent_id IS NULL`; }
+
+    // Cursor-based keyset pagination (opencode v2 pattern)
+    if (cursor) {
+      try {
+        const decoded = JSON.parse(Buffer.from(String(cursor), "base64url").toString("utf8"));
+        const { id, time } = decoded;
+        if (direction === "next") {
+          sql += ` AND (updated_at < $${idx++} OR (updated_at = $${idx++} AND id < $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2; // already incremented above
+        } else {
+          sql += ` AND (updated_at > $${idx++} OR (updated_at = $${idx++} AND id > $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        }
+      } catch {}
+    }
 
-    sql += ` ORDER BY updated_at DESC LIMIT 100`;
+    const orderDir = direction === "previous" ? "ASC" : "DESC";
+    sql += ` ORDER BY updated_at ${orderDir}, id ${orderDir} LIMIT $${idx++}`;
+    params.push(limit + 1); // fetch one extra to detect "more"
 
     const result = await pool.query(sql, params);
-    res.json(result.rows.map(toOpenCodeSession));
+    const rows = result.rows;
+    const more = rows.length > limit;
+    const slice = more ? rows.slice(0, limit) : rows;
+    const items = direction === "previous" ? slice.reverse() : slice;
+
+    const nextCursor = more && slice.length > 0
+      ? Buffer.from(JSON.stringify({
+          id: slice[slice.length - 1].id,
+          time: new Date(slice[slice.length - 1].updated_at).getTime(),
+        })).toString("base64url")
+      : undefined;
+
+    res.json(items.map(toOpenCodeSession));
   } catch (e: any) {
     res.status(500).json({ error: { code: "LIST_FAILED", message: e.message } });
   }
@@ -128,6 +164,35 @@ compatRouter.delete("/v2/session/:id", async (req: Request, res: Response) => {
   }
 });
 
+// POST /v2/session/:id/cancel — cancel an in-flight agent turn
+compatRouter.post("/v2/session/:id/cancel", async (req: Request, res: Response) => {
+  const session_id = req.params.id;
+  try {
+    // Mark any running agents as cancelled
+    await pool.query(
+      `UPDATE agent_instances SET state = 'cancelled', updated_at = NOW()
+       WHERE session_id = $1 AND state IN ('running', 'waiting_for_tool', 'compacting')`,
+      [session_id]
+    );
+    // Move session back to active so the user can keep working
+    await pool.query(
+      `UPDATE sessions SET state = 'active', updated_at = NOW()
+       WHERE id = $1 AND state IN ('busy', 'compacting')`,
+      [session_id]
+    );
+    // Notify subscribers
+    await eventBus.publish("AgentFailed", {
+      agent_id: "",
+      session_id,
+      error: "cancelled by user",
+      failed_at: new Date().toISOString(),
+    }, "CompatAdapter");
+    res.json({ ok: true });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "CANCEL_FAILED", message: e.message } });
+  }
+});
+
 // POST /v2/session/:id/prompt — run agent turn (streaming SSE)
 compatRouter.post("/v2/session/:id/prompt", requireAuth, async (req: Request, res: Response) => {
   const session_id = req.params.id;
@@ -211,24 +276,109 @@ compatRouter.post("/v2/session/:id/prompt", requireAuth, async (req: Request, re
   }
 });
 
-// GET /v2/session/:id/message — list messages
+// GET /v2/session/:id/message — list messages (with cursor pagination)
 compatRouter.get("/v2/session/:id/message", async (req: Request, res: Response) => {
   try {
-    const result = await pool.query(
-      `SELECT m.*, json_agg(p.* ORDER BY p.order_index) FILTER (WHERE p.id IS NOT NULL) as parts
+    const { cursor, limit: limitStr, direction = "next" } = req.query;
+    const limit = Math.min(parseInt(String(limitStr || "200")), 500);
+
+    let sql = `SELECT m.*, json_agg(p.* ORDER BY p.order_index) FILTER (WHERE p.id IS NOT NULL) as parts
        FROM messages m
        LEFT JOIN parts p ON p.message_id = m.id
-       WHERE m.session_id = $1
-       GROUP BY m.id
-       ORDER BY m.created_at ASC`,
-      [req.params.id]
-    );
-    res.json(result.rows.map(toOpenCodeMessage));
+       WHERE m.session_id = $1`;
+    const params: unknown[] = [req.params.id];
+    let idx = 2;
+
+    if (cursor) {
+      try {
+        const decoded = JSON.parse(Buffer.from(String(cursor), "base64url").toString("utf8"));
+        const { id, time } = decoded;
+        if (direction === "next") {
+          sql += ` AND (m.created_at < $${idx++} OR (m.created_at = $${idx++} AND m.id < $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        } else {
+          sql += ` AND (m.created_at > $${idx++} OR (m.created_at = $${idx++} AND m.id > $${idx++}))`;
+          params.push(new Date(time), new Date(time), id);
+          idx += 2;
+        }
+      } catch {}
+    }
+
+    const orderDir = direction === "previous" ? "ASC" : "DESC";
+    sql += ` GROUP BY m.id ORDER BY m.created_at ${orderDir}, m.id ${orderDir} LIMIT $${idx++}`;
+    params.push(limit + 1);
+
+    const result = await pool.query(sql, params);
+    const rows = result.rows;
+    const more = rows.length > limit;
+    const slice = more ? rows.slice(0, limit) : rows;
+    const items = direction === "previous" ? slice.reverse() : slice;
+
+    const nextCursor = more && slice.length > 0
+      ? Buffer.from(JSON.stringify({
+          id: slice[slice.length - 1].id,
+          time: new Date(slice[slice.length - 1].created_at).getTime(),
+        })).toString("base64url")
+      : undefined;
+
+    res.json(items.map(toOpenCodeMessage));
   } catch (e: any) {
     res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
   }
 });
 
+// POST /v2/session/:id/subagent — spawn a child session and run it
+compatRouter.post("/v2/session/:parentId/subagent", requireAuth, async (req: Request, res: Response) => {
+  try {
+    const { prompt, agent = "build", modelID, providerID } = req.body;
+    if (!prompt) return res.status(400).json({ error: { code: "MISSING_PROMPT", message: "prompt is required" } });
+
+    const parentId = req.params.parentId;
+    const parentResult = await pool.query(`SELECT * FROM sessions WHERE id = $1`, [parentId]);
+    if (!parentResult.rows[0]) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Parent session not found" } });
+    const parent = parentResult.rows[0];
+
+    // Create child session
+    const childId = require("uuid").v4();
+    const slug = `subagent-${Date.now()}`;
+    await pool.query(
+      `INSERT INTO sessions (id, slug, project_id, parent_id, directory, title, version, state)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, 'created')`,
+      [childId, slug, parent.project_id, parentId, parent.directory, `Subagent: ${prompt.slice(0, 60)}`, "1.0.0"]
+    );
+
+    // Add user message
+    const msgId = require("uuid").v4();
+    await pool.query(
+      `INSERT INTO messages (id, session_id, role) VALUES ($1, $2, 'user')`,
+      [msgId, childId]
+    );
+    const partId = require("uuid").v4();
+    await pool.query(
+      `INSERT INTO parts (id, message_id, session_id, part_type, data, order_index) VALUES ($1, $2, $3, 'text', $4, 0)`,
+      [partId, msgId, childId, JSON.stringify({ text: prompt })]
+    );
+
+    // Run agent asynchronously
+    const { runAgentLoop } = await import("../src/engine/session/prompt");
+    runAgentLoop({
+      session_id: childId,
+      message_id: msgId,
+      content: prompt,
+      model_id: modelID || process.env.DEFAULT_MODEL || "claude-sonnet-4-5",
+      provider_id: providerID || process.env.DEFAULT_PROVIDER || "anthropic",
+      agent_name: agent,
+    }).catch((e: any) => {
+      console.error(`[Subagent] Failed for session ${childId}:`, e.message);
+    });
+
+    res.status(202).json({ childSessionId: childId, status: "running" });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "SUBAGENT_FAILED", message: e.message } });
+  }
+});
+
 // ─── Global SSE Event Stream ──────────────────────────────────────────────────
 
 // GET /v2/event — global SSE stream for all events
@@ -458,16 +608,35 @@ function subscribeToSessionEvents(
 ): () => void {
   const handler = async (event: any) => {
     if (event.payload?.session_id === session_id) {
-      callback({ type: mapEventType(event.type), data: event.payload });
+      // Pass through key tool fields directly so SSE listeners can render them
+      const payload: any = { ...event.payload };
+      if (event.type === "ToolCallRequested") {
+        payload.tool_call_id = event.payload.tool_call_id;
+        payload.tool_name = event.payload.tool_name;
+        payload.tool_input = event.payload.tool_input;
+      }
+      if (event.type === "ToolCallCompleted") {
+        payload.tool_call_id = event.payload.tool_call_id;
+        payload.tool_name = event.payload.tool_name;
+        payload.duration_ms = event.payload.duration_ms;
+      }
+      callback({ type: mapEventType(event.type), data: payload });
     }
   };
 
-  const types = ["PartUpdated", "MessageAdded", "AgentCompleted", "AgentFailed", "ToolCallRequested"];
+  const types = [
+    "PartUpdated",
+    "MessageAdded",
+    "AgentCompleted",
+    "AgentFailed",
+    "ToolCallRequested",
+    "ToolCallCompleted",
+    "SessionCompacted",
+  ];
   for (const type of types) {
     eventBus.subscribe(type, handler);
   }
 
-  // Return a real cleanup function that removes all registered handlers
   return () => {
     for (const type of types) {
       eventBus.unsubscribe(type, handler);
@@ -482,6 +651,8 @@ function mapEventType(boneEventType: string): string {
     AgentCompleted: "session.updated",
     AgentFailed: "session.updated",
     ToolCallRequested: "tool.requested",
+    ToolCallCompleted: "tool.completed",
+    SessionCompacted: "session.compacted",
   };
   return map[boneEventType] || boneEventType.toLowerCase();
 }

package/dist/bone/output/agent/src/algorithms.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/bone/output/agent/src/algorithms.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=algorithms.js.map

package/dist/bone/output/agent/src/algorithms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"algorithms.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/algorithms.ts"],"names":[],"mappings":""}

package/dist/bone/output/agent/src/audit.d.ts

@@ -0,0 +1,3 @@
+import { Request, Response, NextFunction } from "express";
+export declare function auditLog(action: string, entityType?: string): (req: Request, _res: Response, next: NextFunction) => Promise<void>;
+export declare function getAuditLog(entityType: string, entityId: string): Promise<any[]>;

package/dist/bone/output/agent/src/audit.js

@@ -0,0 +1,40 @@
+"use strict";
+// Generated by BoneScript compiler.
+// Audit middleware for: AgentDomain v1.0.0
+//
+// Modules requiring audit logging:
+//   - AgentInstanceService
+//   - TaskService
+//   - PlanService
+//   - BuildStepService
+//   - ToolCallService
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getAuditLog = exports.auditLog = void 0;
+const db_1 = require("./db");
+function auditLog(action, entityType) {
+    return async (req, _res, next) => {
+        try {
+            const auth = req.auth;
+            const actorId = auth?.actor_id ?? null;
+            const entityId = req.params.id ?? req.body?.id ?? null;
+            const payload = req.body ?? null;
+            const ipAddress = req.ip ?? null;
+            const userAgent = req.headers["user-agent"] ?? null;
+            await (0, db_1.query)(`INSERT INTO audit_log
+          (actor_id, action, entity_type, entity_id, payload, ip_address, user_agent)
+          VALUES ($1, $2, $3, $4, $5, $6, $7)`, [actorId, action, entityType ?? null, entityId, JSON.stringify(payload), ipAddress, userAgent]);
+        }
+        catch (err) {
+            // Audit failures must not block the request — log and continue
+            console.error("[audit] Failed to write audit log:", err);
+        }
+        next();
+    };
+}
+exports.auditLog = auditLog;
+async function getAuditLog(entityType, entityId) {
+    const result = await (0, db_1.query)("SELECT * FROM audit_log WHERE entity_type = $1 AND entity_id = $2 ORDER BY created_at DESC LIMIT 100", [entityType, entityId]);
+    return result;
+}
+exports.getAuditLog = getAuditLog;
+//# sourceMappingURL=audit.js.map

package/dist/bone/output/agent/src/audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../../../bone/output/agent/src/audit.ts"],"names":[],"mappings":";AAAA,oCAAoC;AACpC,2CAA2C;AAC3C,EAAE;AACF,mCAAmC;AACnC,2BAA2B;AAC3B,kBAAkB;AAClB,kBAAkB;AAClB,uBAAuB;AACvB,sBAAsB;;;AAGtB,6BAA6B;AAE7B,SAAgB,QAAQ,CAAC,MAAc,EAAE,UAAmB;IAC1D,OAAO,KAAK,EAAE,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAiB,EAAE;QAC/E,IAAI,CAAC;YACH,MAAM,IAAI,GAAI,GAAW,CAAC,IAAgD,CAAC;YAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,QAAQ,IAAI,IAAI,CAAC;YACvC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,IAAK,GAAG,CAAC,IAAgC,EAAE,EAAE,IAAI,IAAI,CAAC;YACpF,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;YACjC,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;YAEpD,MAAM,IAAA,UAAK,EACT;;8CAEsC,EACtC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,IAAI,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS,CAAC,CAC/F,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,+DAA+D;YAC/D,OAAO,CAAC,KAAK,CAAC,oCAAoC,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAtBD,4BAsBC;AAEM,KAAK,UAAU,WAAW,CAAC,UAAkB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,IAAA,UAAK,EACxB,sGAAsG,EACtG,CAAC,UAAU,EAAE,QAAQ,CAAC,CACvB,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAND,kCAMC"}

package/dist/bone/output/agent/src/auth.d.ts

@@ -0,0 +1,8 @@
+import { Request, Response, NextFunction } from "express";
+export interface AuthContext {
+    authenticated: boolean;
+    actor_id: string | null;
+    trace_id: string;
+}
+export declare function authMiddleware(req: Request, res: Response, next: NextFunction): void;
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;