@cello-protocol/gateway 0.0.12 → 0.0.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/cello-gateway.js +45 -15
- package/dist/bin/cello-gateway.js.map +1 -1
- package/dist/client.d.ts +12 -1
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +30 -0
- package/dist/client.js.map +1 -1
- package/dist/config/config-store.d.ts +19 -1
- package/dist/config/config-store.d.ts.map +1 -1
- package/dist/config/config-store.js +2 -2
- package/dist/config/config-store.js.map +1 -1
- package/dist/detect/index.d.ts +9 -5
- package/dist/detect/index.d.ts.map +1 -1
- package/dist/detect/index.js +9 -5
- package/dist/detect/index.js.map +1 -1
- package/dist/index.d.ts +3 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -2
- package/dist/index.js.map +1 -1
- package/dist/passthrough.d.ts +11 -6
- package/dist/passthrough.d.ts.map +1 -1
- package/dist/passthrough.js +10 -5
- package/dist/passthrough.js.map +1 -1
- package/dist/records/record-store.d.ts +21 -1
- package/dist/records/record-store.d.ts.map +1 -1
- package/dist/records/record-store.js +2 -2
- package/dist/records/record-store.js.map +1 -1
- package/dist/spawn.d.ts.map +1 -1
- package/dist/spawn.js +33 -5
- package/dist/spawn.js.map +1 -1
- package/dist/store/encrypted-db.d.ts +12 -2
- package/dist/store/encrypted-db.d.ts.map +1 -1
- package/dist/store/encrypted-db.js +73 -10
- package/dist/store/encrypted-db.js.map +1 -1
- package/dist/testing.d.ts +14 -0
- package/dist/testing.d.ts.map +1 -0
- package/dist/testing.js +14 -0
- package/dist/testing.js.map +1 -0
- package/dist/types.d.ts +10 -0
- package/dist/types.d.ts.map +1 -1
- package/dist/types.js.map +1 -1
- package/package.json +6 -2
|
@@ -18,6 +18,7 @@ import { initLinearRegex } from "../detect/linear-regex.js";
|
|
|
18
18
|
import { compileInjectionPatterns } from "../detect/injection-patterns.js";
|
|
19
19
|
import { compileSecretRules } from "../detect/secrets.js";
|
|
20
20
|
import { GatewayConfigStore } from "../config/config-store.js";
|
|
21
|
+
import { stderrStoreEventSink } from "../store/encrypted-db.js";
|
|
21
22
|
import { GatewayRecordStore } from "../records/record-store.js";
|
|
22
23
|
import { createHash } from "node:crypto";
|
|
23
24
|
async function main() {
|
|
@@ -40,8 +41,13 @@ async function main() {
|
|
|
40
41
|
// security records, keyed by the daemon's key file — the daemon's spawn plumbing passes the two
|
|
41
42
|
// paths (M9C-D8: a key FILE path, never key bytes). Both stores fail closed: a missing or wrong
|
|
42
43
|
// key throws GatewayStoreError, which exits the process rather than screening unconfigured.
|
|
43
|
-
|
|
44
|
-
|
|
44
|
+
// `|| undefined` so the guard below and the two call sites read the SAME value. Testing
|
|
45
|
+
// `=== undefined` here while the call sites test truthiness let CELLO_GATEWAY_STORE_DB="" pass
|
|
46
|
+
// the guard and then silently produce NO stores — screening every message with no audit trail
|
|
47
|
+
// and no config governance, while printing READY as if healthy. An empty string is exactly what
|
|
48
|
+
// a path computation that returned nothing interpolates to.
|
|
49
|
+
const storeDbPath = process.env["CELLO_GATEWAY_STORE_DB"] || undefined;
|
|
50
|
+
const storeKeyFile = process.env["CELLO_GATEWAY_STORE_KEY_FILE"] || undefined;
|
|
45
51
|
if ((storeDbPath === undefined) !== (storeKeyFile === undefined)) {
|
|
46
52
|
// Half-configured storage is a plumbing bug, not a degraded mode to run through: it would
|
|
47
53
|
// silently drop either the operator's config or the whole audit trail.
|
|
@@ -49,26 +55,34 @@ async function main() {
|
|
|
49
55
|
process.exit(2);
|
|
50
56
|
return;
|
|
51
57
|
}
|
|
52
|
-
// M9-CFG-001 (INV-4): the gateway owns its config
|
|
53
|
-
//
|
|
54
|
-
//
|
|
55
|
-
//
|
|
56
|
-
|
|
57
|
-
|
|
58
|
+
// M9-CFG-001 (INV-4) + DOD-M9C-ENV-1 (policy D-5): the gateway owns its config, and the STORE IS
|
|
59
|
+
// THE ONLY SOURCE. There is deliberately no environment fallback for any policy value.
|
|
60
|
+
//
|
|
61
|
+
// There used to be four: CELLO_GATEWAY_AUTONOMOUS_OVERRIDE, _PII_WHITELIST,
|
|
62
|
+
// _RATE_MAX_PER_WINDOW and _RATE_WINDOW_MS sat UNDER the store as defaults. Each one could loosen
|
|
63
|
+
// a guard with no confirmation, no versioned row, and no hash-chained fingerprint — the entire
|
|
64
|
+
// tighten-free / loosen-confirmed mechanism bypassed by anyone who could set a variable. A gate
|
|
65
|
+
// with a published bypass is not a gate. They are gone; `cello config set` is the way in, and it
|
|
66
|
+
// asks a human before it weakens anything.
|
|
67
|
+
//
|
|
68
|
+
// Each key still falls back to its TIGHTEST value when the store has not set it (empty whitelist,
|
|
69
|
+
// override off, no rate cap), so an absent or empty config never silently loosens.
|
|
70
|
+
const config = storeDbPath && storeKeyFile ? new GatewayConfigStore(storeDbPath, storeKeyFile, stderrStoreEventSink) : undefined;
|
|
71
|
+
const cfg = (key, tightestDefault) => {
|
|
58
72
|
const v = config?.get(key);
|
|
59
|
-
return v !== undefined ? v :
|
|
73
|
+
return v !== undefined ? v : tightestDefault;
|
|
60
74
|
};
|
|
61
|
-
const piiWhitelist = cfg("pii_whitelist",
|
|
75
|
+
const piiWhitelist = cfg("pii_whitelist", []);
|
|
62
76
|
// autonomous_override defaults OFF — the agent's only autonomous lever over a PII warn is `redact`;
|
|
63
77
|
// allowing a value out is a human action (loosening the store requires confirmation).
|
|
64
|
-
const autonomousOverride = cfg("autonomous_override",
|
|
78
|
+
const autonomousOverride = cfg("autonomous_override", false);
|
|
65
79
|
// OUT-004 per-agent outbound rate cap. A positive cap enables it. NOTE: "no cap" is the LOOSEST state,
|
|
66
80
|
// not the tightest — so rate-limiting is OFF by default (the operator opts in to a cap). If a cap IS
|
|
67
81
|
// set but the window is missing/invalid, do NOT silently disable the cap (code-review M1) — fall back
|
|
68
82
|
// to a sane default window so a configured limit is never lost.
|
|
69
83
|
const DEFAULT_RATE_WINDOW_MS = 60_000;
|
|
70
|
-
const rateMax = Number(cfg("rate_max_per_window",
|
|
71
|
-
const rawWindow = Number(cfg("rate_window_ms",
|
|
84
|
+
const rateMax = Number(cfg("rate_max_per_window", 0));
|
|
85
|
+
const rawWindow = Number(cfg("rate_window_ms", DEFAULT_RATE_WINDOW_MS));
|
|
72
86
|
const rateWindowMs = Number.isFinite(rawWindow) && rawWindow > 0 ? rawWindow : DEFAULT_RATE_WINDOW_MS;
|
|
73
87
|
const rateLimit = Number.isFinite(rateMax) && rateMax > 0
|
|
74
88
|
? { maxPerWindow: rateMax, windowMs: rateWindowMs }
|
|
@@ -79,7 +93,7 @@ async function main() {
|
|
|
79
93
|
// tamper-evidence, in the same encrypted store as the config (M9C-D9). The verdict's disposition
|
|
80
94
|
// maps to the record: allow → clean (a clean pass IS recorded — an absent record is itself
|
|
81
95
|
// evidence of suppression), redact/block/warn verbatim.
|
|
82
|
-
const records = storeDbPath && storeKeyFile ? new GatewayRecordStore(storeDbPath, storeKeyFile) : undefined;
|
|
96
|
+
const records = storeDbPath && storeKeyFile ? new GatewayRecordStore(storeDbPath, storeKeyFile, stderrStoreEventSink) : undefined;
|
|
83
97
|
const recordOutcome = (direction, v, content, correlationId) => {
|
|
84
98
|
if (!records)
|
|
85
99
|
return;
|
|
@@ -177,9 +191,25 @@ async function main() {
|
|
|
177
191
|
};
|
|
178
192
|
process.on("SIGTERM", () => shutdown("SIGTERM"));
|
|
179
193
|
process.on("SIGINT", () => shutdown("SIGINT"));
|
|
194
|
+
// PARENT DEATH SWITCH (review F5). The daemon spawns this process with a piped stdin and never
|
|
195
|
+
// writes to it; when the daemon dies — including the ways that skip its shutdown path entirely,
|
|
196
|
+
// SIGKILL and crashes — the kernel closes the pipe and this fires. Without it the gateway
|
|
197
|
+
// outlives its daemon holding the store's write lock, and the next daemon comes up permanently
|
|
198
|
+
// fail-closed against a lock nobody can explain.
|
|
199
|
+
process.stdin.on("end", () => shutdown("parent_exited"));
|
|
200
|
+
process.stdin.on("close", () => shutdown("parent_exited"));
|
|
201
|
+
process.stdin.resume();
|
|
180
202
|
}
|
|
181
203
|
main().catch((err) => {
|
|
182
|
-
|
|
204
|
+
// Print the CODE and the GUIDANCE, not just the message. The guidance is the only part that
|
|
205
|
+
// tells the operator what to do, and dropping it was how "your key file is missing" reached
|
|
206
|
+
// them as "sidecar exited before ready (code 1)".
|
|
207
|
+
const code = err?.code;
|
|
208
|
+
const guidance = err?.guidance;
|
|
209
|
+
const message = err instanceof Error ? err.message : String(err);
|
|
210
|
+
process.stderr.write(`cello-gateway: fatal${code ? ` [${code}]` : ""} ${message}\n`);
|
|
211
|
+
if (guidance)
|
|
212
|
+
process.stderr.write(`cello-gateway: ${guidance}\n`);
|
|
183
213
|
process.exit(1);
|
|
184
214
|
});
|
|
185
215
|
//# sourceMappingURL=cello-gateway.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,SAAS,CAAC;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,IAAI,SAAS,CAAC;IAC9E,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,0FAA0F;QAC1F,uEAAuE;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,iGAAiG;IACjG,uFAAuF;IACvF,EAAE;IACF,4EAA4E;IAC5E,kGAAkG;IAClG,+FAA+F;IAC/F,gGAAgG;IAChG,iGAAiG;IACjG,2CAA2C;IAC3C,EAAE;IACF,kGAAkG;IAClG,mFAAmF;IACnF,MAAM,MAAM,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjI,MAAM,GAAG,GAAG,CAAI,GAAW,EAAE,eAAkB,EAAK,EAAE;QACpD,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,CAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,CAAW,eAAe,EAAE,EAAE,CAAC,CAAC;IACxD,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,kBAAkB,GAAG,GAAG,CAAU,qBAAqB,EAAE,KAAK,CAAC,CAAC;IACtE,uGAAuG;IACvG,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAS,qBAAqB,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAS,gBAAgB,EAAE,sBAAsB,CAAC,CAAC,CAAC;IAChF,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACtG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QACvD,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IAEtC,yFAAyF;IACzF,iGAAiG;IACjG,2FAA2F;IAC3F,wDAAwD;IACxD,MAAM,OAAO,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClI,MAAM,aAAa,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QAC/H,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,WAAW,GAAsB,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3F,gGAAgG;QAChG,oGAAoG;QACpG,iGAAiG;QACjG,MAAM,MAAM,GAAG,WAAW,KAAK,OAAO;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC;YACb,SAAS;YACT,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,6DAA6D;SACzH,CAAC,CAAC;IACL,CAAC,CAAC;IACF,0GAA0G;IAC1G,MAAM,uBAAuB,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QACzI,IAAI,CAAC;YAAC,aAAa,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;YAC5C,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnG,CAAC,CAAC;oBACH,MAAM,OAAO,GAAkB;wBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9D,CAAC;oBACF,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,6FAA6F;gBAC7F,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+FAA+F;gBAC/F,gGAAgG;gBAChG,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9H,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,2EAA2E;wBACnF,wDAAwD;iBAC3D,CAAC;gBACF,uBAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAChF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,IAAI,UAAU,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAEtF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,KAAK,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAE/C,+FAA+F;IAC/F,gGAAgG;IAChG,0FAA0F;IAC1F,+FAA+F;IAC/F,iDAAiD;IACjD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACzD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3D,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACzB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,4FAA4F;IAC5F,4FAA4F;IAC5F,kDAAkD;IAClD,MAAM,IAAI,GAAI,GAAgC,EAAE,IAAI,CAAC;IACrD,MAAM,QAAQ,GAAI,GAAoC,EAAE,QAAQ,CAAC;IACjE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uBAAuB,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,CAAC;IACrF,IAAI,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,QAAQ,IAAI,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
package/dist/client.d.ts
CHANGED
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
import { type ScreenContext, type ScreenVerdict, type SecurityGatewayClient } from "./types.js";
|
|
1
|
+
import { type GatewayMode, type ScreenContext, type ScreenVerdict, type SecurityGatewayClient } from "./types.js";
|
|
2
2
|
import type { GatewayLogger } from "./server.js";
|
|
3
3
|
export interface LocalSidecarGatewayClientOptions {
|
|
4
4
|
socketPath: string;
|
|
@@ -8,7 +8,18 @@ export interface LocalSidecarGatewayClientOptions {
|
|
|
8
8
|
}
|
|
9
9
|
export declare class LocalSidecarGatewayClient implements SecurityGatewayClient {
|
|
10
10
|
#private;
|
|
11
|
+
/**
|
|
12
|
+
* `enforcing` — and it stays `enforcing` even when the socket is down, because a client whose
|
|
13
|
+
* gateway is unreachable does not start allowing content: it fails closed (`gateway_unavailable`).
|
|
14
|
+
* The mode describes what this client DOES with content, not whether the socket happens to be up.
|
|
15
|
+
*/
|
|
16
|
+
readonly mode: GatewayMode;
|
|
11
17
|
constructor(opts: LocalSidecarGatewayClientOptions);
|
|
18
|
+
/**
|
|
19
|
+
* Record why the sidecar could not be started, so every later refusal names THAT rather than the
|
|
20
|
+
* generic unreachable label. Called by the composition root when the spawn fails.
|
|
21
|
+
*/
|
|
22
|
+
setUnavailableCause(reason: string, guidance: string): void;
|
|
12
23
|
screenOutbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
13
24
|
screenInbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
14
25
|
close(): Promise<void>;
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyC,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAqBA,OAAO,EAAyC,KAAK,WAAW,EAAE,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AACzJ,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAYjD,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,qBAAa,yBAA0B,YAAW,qBAAqB;;IACrE;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAe;gBAsB7B,IAAI,EAAE,gCAAgC;IAMlD;;;OAGG;IACH,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI;IAI3D,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAI/E,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAIxE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAmJ7B"}
|
package/dist/client.js
CHANGED
|
@@ -15,6 +15,12 @@ import { failClosedVerdict, GOVERNANCE_TIMEOUT } from "./types.js";
|
|
|
15
15
|
const NOOP_LOGGER = { info() { }, warn() { }, error() { } };
|
|
16
16
|
const DEFAULT_DEADLINE_MS = 5_000;
|
|
17
17
|
export class LocalSidecarGatewayClient {
|
|
18
|
+
/**
|
|
19
|
+
* `enforcing` — and it stays `enforcing` even when the socket is down, because a client whose
|
|
20
|
+
* gateway is unreachable does not start allowing content: it fails closed (`gateway_unavailable`).
|
|
21
|
+
* The mode describes what this client DOES with content, not whether the socket happens to be up.
|
|
22
|
+
*/
|
|
23
|
+
mode = "enforcing";
|
|
18
24
|
#socketPath;
|
|
19
25
|
#deadlineMs;
|
|
20
26
|
#logger;
|
|
@@ -23,11 +29,29 @@ export class LocalSidecarGatewayClient {
|
|
|
23
29
|
#pending = new Map();
|
|
24
30
|
#nextId = 1;
|
|
25
31
|
#closed = false;
|
|
32
|
+
/**
|
|
33
|
+
* Why the gateway is unreachable, when the composition root already knows (review F2).
|
|
34
|
+
*
|
|
35
|
+
* Without this, a sidecar that never started surfaced as `gateway_unavailable` on every message
|
|
36
|
+
* — an exit-point label that says "the transport failed, check the gateway is running and
|
|
37
|
+
* retry". But the gateway is not running and never will be, retrying can never work, and the
|
|
38
|
+
* actual cause (a missing key file, a store locked by an orphan, a leftover plaintext store, a
|
|
39
|
+
* missing binary) was logged once at boot and then thrown away. The spawner already captures
|
|
40
|
+
* the child's coded, guided stderr; this is where it survives to the operator.
|
|
41
|
+
*/
|
|
42
|
+
#unavailable;
|
|
26
43
|
constructor(opts) {
|
|
27
44
|
this.#socketPath = opts.socketPath;
|
|
28
45
|
this.#deadlineMs = opts.deadlineMs ?? DEFAULT_DEADLINE_MS;
|
|
29
46
|
this.#logger = opts.logger ?? NOOP_LOGGER;
|
|
30
47
|
}
|
|
48
|
+
/**
|
|
49
|
+
* Record why the sidecar could not be started, so every later refusal names THAT rather than the
|
|
50
|
+
* generic unreachable label. Called by the composition root when the spawn fails.
|
|
51
|
+
*/
|
|
52
|
+
setUnavailableCause(reason, guidance) {
|
|
53
|
+
this.#unavailable = { reason, guidance };
|
|
54
|
+
}
|
|
31
55
|
screenOutbound(content, ctx) {
|
|
32
56
|
return this.#screen(SCREEN_OUTBOUND, content, ctx);
|
|
33
57
|
}
|
|
@@ -60,6 +84,12 @@ export class LocalSidecarGatewayClient {
|
|
|
60
84
|
direction,
|
|
61
85
|
error: err instanceof Error ? err.message : String(err),
|
|
62
86
|
});
|
|
87
|
+
// The known cause wins over the generic one (F2): "your daemon key file is missing" sends
|
|
88
|
+
// the operator to the right place; "the gateway could not be reached, retry" does not.
|
|
89
|
+
if (this.#unavailable) {
|
|
90
|
+
const verdict = failClosedVerdict(direction, this.#unavailable.reason);
|
|
91
|
+
return { ...verdict, guidance: this.#unavailable.guidance };
|
|
92
|
+
}
|
|
63
93
|
return failClosedVerdict(direction);
|
|
64
94
|
}
|
|
65
95
|
const id = this.#nextId++;
|
package/dist/client.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,GAIf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,
|
|
1
|
+
{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAe,MAAM,UAAU,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,WAAW,EACX,eAAe,EACf,cAAc,GAIf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAwF,MAAM,YAAY,CAAC;AAGzJ,MAAM,WAAW,GAAkB,EAAE,IAAI,KAAI,CAAC,EAAE,IAAI,KAAI,CAAC,EAAE,KAAK,KAAI,CAAC,EAAE,CAAC;AACxE,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAgBlC,MAAM,OAAO,yBAAyB;IACpC;;;;OAIG;IACM,IAAI,GAAgB,WAAW,CAAC;IAChC,WAAW,CAAS;IACpB,WAAW,CAAS;IACpB,OAAO,CAAgB;IAChC,OAAO,GAAkB,IAAI,CAAC;IAC9B,WAAW,GAA2B,IAAI,CAAC;IAC3C,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IACtC,OAAO,GAAG,CAAC,CAAC;IACZ,OAAO,GAAG,KAAK,CAAC;IAEhB;;;;;;;;;OASG;IACH,YAAY,CAAmD;IAE/D,YAAY,IAAsC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,mBAAmB,CAAC,MAAc,EAAE,QAAgB;QAClD,IAAI,CAAC,YAAY,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IAC3C,CAAC;IAED,cAAc,CAAC,OAAmB,EAAE,GAAkB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,OAAmB,EAAE,GAAkB;QACnD,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC;QAC1B,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,IAAI;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,4EAA4E;QAC5E,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,MAAoB,EAAE,OAAmB,EAAE,GAAkB;QACzE,MAAM,SAAS,GAAG,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;QAEtD,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE;gBAC1C,SAAS;gBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,0FAA0F;YAC1F,uFAAuF;YACvF,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvE,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,OAAO,GAAsB;YACjC,EAAE;YACF,MAAM;YACN,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,GAAG,EAAE;gBACH,SAAS;gBACT,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACnG;SACF,CAAC;QAEF,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;YAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;oBACzF,uFAAuF;oBACvF,0EAA0E;oBAC1E,OAAO,CAAC,iBAAiB,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC,CAAC;gBAC5D,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrB,IAAI,OAAQ,KAAgC,CAAC,KAAK,KAAK,UAAU;gBAAG,KAA+B,CAAC,KAAK,EAAE,CAAC;YAC5G,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YACrC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;oBAC7B,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE;wBACxC,SAAS;wBACT,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;oBACH,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;gBACxC,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAED,gBAAgB;QACd,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClF,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC,WAAW,CAAC;QAE9C,IAAI,CAAC,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACvC,qFAAqF;YACrF,iGAAiG;YACjG,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;gBACnC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,IAAI,KAAK,CAAC,mCAAmC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;YAC7E,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACrB,IAAI,OAAQ,YAAuC,CAAC,KAAK,KAAK,UAAU;gBAAG,YAAsC,CAAC,KAAK,EAAE,CAAC;YAC1H,MAAM,OAAO,GAAG,CAAC,GAAU,EAAE,EAAE;gBAC7B,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5B,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;gBACxB,YAAY,CAAC,YAAY,CAAC,CAAC;gBAC3B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC3B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC;gBACxB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;gBAEpB,MAAM,OAAO,GAAG,IAAI,YAAY,CAC9B,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,GAAyB,CAAC,EACpD,CAAC,GAAG,EAAE,EAAE;oBACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC5E,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,CAAC,CACF,CAAC;gBACF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,iFAAiF;gBACjF,MAAM,OAAO,GAAG,GAAG,EAAE;oBACnB,IAAI,IAAI,CAAC,OAAO,KAAK,IAAI;wBAAE,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;oBAC/C,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;wBAClC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;wBACtB,CAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;oBAC5C,CAAC;oBACD,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACxB,CAAC,CAAC;gBACF,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5B,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,WAAW,CAAC,GAAuB;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,iCAAiC;QACvD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7B,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAE5B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC;QACzB,MAAM,OAAO,GAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjE,IAAI,IAAI,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC;YACjC,oFAAoF;YACpF,+BAA+B;YAC/B,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACxG,CAAC;aAAM,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC5D,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAClE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;CACF"}
|
|
@@ -1,3 +1,21 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* M9-CFG-001 — the gateway's versioned config store (INV-4 as amended by M9C-D2).
|
|
3
|
+
*
|
|
4
|
+
* The store is append-only and versioned, and enforces the §7 governance asymmetry:
|
|
5
|
+
*
|
|
6
|
+
* - TIGHTENING a guard (making the gateway MORE restrictive) is free — no confirmation.
|
|
7
|
+
* - LOOSENING a guard (making it LESS restrictive — enabling autonomous override, adding a value to
|
|
8
|
+
* the PII whitelist, raising/removing the rate cap, allowing another language) requires an explicit
|
|
9
|
+
* `confirmed` flag. Without it the change is REJECTED and not versioned. (The human confirmation
|
|
10
|
+
* is the CLI prompt — the portal passkey later; this store is the enforcement point.)
|
|
11
|
+
*
|
|
12
|
+
* Every applied change appends a row whose `fingerprint` is hash-chained to the previous version, so
|
|
13
|
+
* the change history is tamper-evident and ready to attest to the directory in Phase 2 (M9-ATTEST-001).
|
|
14
|
+
*
|
|
15
|
+
* Encryption-at-rest (DOD-M9C-STORE-1): the store lives in the gateway's SQLCipher file, opened with
|
|
16
|
+
* the daemon's key via a key FILE path — fail-closed, no plaintext fallback (see store/encrypted-db.ts).
|
|
17
|
+
*/
|
|
18
|
+
import { type StoreEventSink } from "../store/encrypted-db.js";
|
|
1
19
|
/** Whether a config change makes the gateway more restrictive (tighten), less (loosen), or neither. */
|
|
2
20
|
export type ConfigDirection = "tighten" | "loosen" | "neutral";
|
|
3
21
|
export type SetResult = {
|
|
@@ -21,7 +39,7 @@ export declare class GatewayConfigStore {
|
|
|
21
39
|
#private;
|
|
22
40
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
23
41
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
24
|
-
constructor(dbPath: string, keyFilePath: string);
|
|
42
|
+
constructor(dbPath: string, keyFilePath: string, onEvent?: StoreEventSink);
|
|
25
43
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
26
44
|
* set of a key is classified against the per-key TIGHTEST baseline, not treated as free (B1). */
|
|
27
45
|
set(key: string, value: unknown, opts?: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAsC,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGnG,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AA4FD,qBAAa,kBAAkB;;IAI7B;uGACmG;gBACvF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc;IAKzE;sGACkG;IAClG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,SAAS;IA2C/E,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB,oEAAoE;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE;IAaxC;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAcjC,KAAK,IAAI,IAAI;CAWd"}
|
|
@@ -97,8 +97,8 @@ export class GatewayConfigStore {
|
|
|
97
97
|
#closed = false;
|
|
98
98
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
99
99
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
100
|
-
constructor(dbPath, keyFilePath) {
|
|
101
|
-
this.#db = openEncryptedStoreDb(dbPath, keyFilePath);
|
|
100
|
+
constructor(dbPath, keyFilePath, onEvent) {
|
|
101
|
+
this.#db = openEncryptedStoreDb(dbPath, keyFilePath, onEvent);
|
|
102
102
|
this.#db.exec(DDL);
|
|
103
103
|
}
|
|
104
104
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,
|
|
1
|
+
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAqC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,gGAAgG;AAChG,SAAS,mBAAmB,CAAC,IAAa,EAAE,IAAa;IACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;IAC/E,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,MAAM,WAAW,GAA+B;IAC9C,kFAAkF;IAClF,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,oEAAoE;IACpE,aAAa,EAAE,mBAAmB;IAClC,mCAAmC;IACnC,cAAc,EAAE,mBAAmB;IACnC,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,qGAAqG;IACrG,wGAAwG;IACxG,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,mBAAmB,EAAE,KAAK,EAAO,kCAAkC;IACnE,aAAa,EAAE,EAAc,EAAI,0BAA0B;IAC3D,cAAc,EAAE,CAAC,OAAO,CAAC,EAAQ,sEAAsE;IACvG,mBAAmB,EAAE,CAAC,EAAW,oEAAoE;IACrG,cAAc,EAAE,MAAM,EAAW,gEAAgE;CAClG,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,GAA4C;IAC1D,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS;IAClD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;CAC5E,CAAC;AAEF,2GAA2G;AAC3G,SAAS,aAAa,CACpB,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,SAAiB,EACjB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB,EAAE,OAAwB;QACvE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;sGACkG;IAClG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,OAAgC,EAAE;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,uGAAuG;QACvG,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,SAAS,GAAoB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;QAClD,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAElG,oGAAoG;QACpG,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;2CAEiC,CAClC;iBACA,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,GAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,uHAAuH,CAAC;aAChI,GAAG,CAAC,GAAG,CAA8G,CAAC;QACzH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAY;YAC1C,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,yIAAyI,CAAC;aAClJ,GAAG,CAAC,GAAG,CAAwI,CAAC;QACnJ,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACxG,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC7C,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,sFAAsF;QAChH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,0GAA0G,CAAC;aACnH,GAAG,CAAC,GAAG,CAA6E,CAAC;IAC1F,CAAC;CACF"}
|
package/dist/detect/index.d.ts
CHANGED
|
@@ -6,11 +6,15 @@
|
|
|
6
6
|
* consumes THIS entry point and never the package barrel.
|
|
7
7
|
*
|
|
8
8
|
* WHY A SEPARATE ENTRY POINT AT ALL. `src/index.ts` re-exports `GatewayConfigStore` and
|
|
9
|
-
* `GatewayRecordStore`,
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
9
|
+
* `GatewayRecordStore`, which reach `@signalapp/sqlcipher` — a NATIVE prebuilt binary — alongside
|
|
10
|
+
* the gateway HTTP server and the sidecar spawner. A barrel import from the portal would evaluate
|
|
11
|
+
* all of that inside a Next.js Fargate app. The package `exports` map previously offered only
|
|
12
|
+
* `"."`, so there was no deep-import escape; this is that escape, made deliberate and narrow.
|
|
13
|
+
*
|
|
14
|
+
* Note the danger changed shape but not size on 2026-07-29 (`DOD-M9C-STORE-1`): the stores used to
|
|
15
|
+
* import `node:sqlite` statically, and now load SQLCipher through `createRequire` inside a
|
|
16
|
+
* function — so a scanner looking for a static import would no longer SEE it. The structural
|
|
17
|
+
* assertions that name the store files by name are what still guard this boundary.
|
|
14
18
|
*
|
|
15
19
|
* WHAT IS DELIBERATELY ABSENT, and it is the more important half:
|
|
16
20
|
*
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
|
package/dist/detect/index.js
CHANGED
|
@@ -6,11 +6,15 @@
|
|
|
6
6
|
* consumes THIS entry point and never the package barrel.
|
|
7
7
|
*
|
|
8
8
|
* WHY A SEPARATE ENTRY POINT AT ALL. `src/index.ts` re-exports `GatewayConfigStore` and
|
|
9
|
-
* `GatewayRecordStore`,
|
|
10
|
-
*
|
|
11
|
-
*
|
|
12
|
-
*
|
|
13
|
-
*
|
|
9
|
+
* `GatewayRecordStore`, which reach `@signalapp/sqlcipher` — a NATIVE prebuilt binary — alongside
|
|
10
|
+
* the gateway HTTP server and the sidecar spawner. A barrel import from the portal would evaluate
|
|
11
|
+
* all of that inside a Next.js Fargate app. The package `exports` map previously offered only
|
|
12
|
+
* `"."`, so there was no deep-import escape; this is that escape, made deliberate and narrow.
|
|
13
|
+
*
|
|
14
|
+
* Note the danger changed shape but not size on 2026-07-29 (`DOD-M9C-STORE-1`): the stores used to
|
|
15
|
+
* import `node:sqlite` statically, and now load SQLCipher through `createRequire` inside a
|
|
16
|
+
* function — so a scanner looking for a static import would no longer SEE it. The structural
|
|
17
|
+
* assertions that name the store files by name are what still guard this boundary.
|
|
14
18
|
*
|
|
15
19
|
* WHAT IS DELIBERATELY ABSENT, and it is the more important half:
|
|
16
20
|
*
|
package/dist/detect/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -5,6 +5,7 @@
|
|
|
5
5
|
* (`SecurityGatewayClient` + verdict types) and a client implementation; all detection lives
|
|
6
6
|
* here. M9-CORE-001 ships the seam with a pass-through; later stories add the pipeline.
|
|
7
7
|
*/
|
|
8
|
+
export type { GatewayMode } from "./types.js";
|
|
8
9
|
export type { ScreenDirection, ScreenDisposition, GovernanceDisposition, GovernanceEvent, ScreenContext, ScreenVerdict, SecurityGatewayClient, } from "./types.js";
|
|
9
10
|
export { OutboundScreener } from "./screen/outbound.js";
|
|
10
11
|
export type { OutboundVerdict, OutboundScreenerOptions, OutboundScreenContext } from "./screen/outbound.js";
|
|
@@ -23,12 +24,11 @@ export type { InstallResult, InstallOptions } from "./detect/model-installer.js"
|
|
|
23
24
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
24
25
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
25
26
|
export type { ConfigDirection, SetResult, ConfigVersionRow } from "./config/config-store.js";
|
|
26
|
-
export { GatewayStoreError } from "./store/encrypted-db.js";
|
|
27
|
-
export type { GatewayStoreErrorCode } from "./store/encrypted-db.js";
|
|
27
|
+
export { GatewayStoreError, stderrStoreEventSink, openEncryptedStoreDb } from "./store/encrypted-db.js";
|
|
28
|
+
export type { GatewayStoreErrorCode, StoreEventSink } from "./store/encrypted-db.js";
|
|
28
29
|
export { GatewayRecordStore } from "./records/record-store.js";
|
|
29
30
|
export type { RecordDisposition, RecordDirection, RecordInput, SecurityRecord } from "./records/record-store.js";
|
|
30
31
|
export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
|
|
31
|
-
export { PassthroughGatewayClient } from "./passthrough.js";
|
|
32
32
|
export { SCREEN_OUTBOUND, SCREEN_INBOUND, encodeFrame, FrameDecoder, } from "./protocol.js";
|
|
33
33
|
export type { ScreenMethod, WireScreenRequest, WireScreenResponse } from "./protocol.js";
|
|
34
34
|
export { createGatewayServer } from "./server.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACxG,YAAY,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAMxF,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -11,10 +11,12 @@ export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } fro
|
|
|
11
11
|
export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
|
|
12
12
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
13
13
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
14
|
-
export { GatewayStoreError } from "./store/encrypted-db.js";
|
|
14
|
+
export { GatewayStoreError, stderrStoreEventSink, openEncryptedStoreDb } from "./store/encrypted-db.js";
|
|
15
15
|
export { GatewayRecordStore } from "./records/record-store.js";
|
|
16
16
|
export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
|
|
17
|
-
|
|
17
|
+
// PassthroughGatewayClient is NOT exported here — it lives at `@cello-protocol/gateway/testing`
|
|
18
|
+
// (DOD-M9C-WIRE-1). An always-allow client on the production barrel is how the security layer
|
|
19
|
+
// shipped inert; reaching for it should be a deliberate act, visible in a diff.
|
|
18
20
|
// Wire protocol (shared by the local sidecar; Phase 2's mTLS gateway reuses these shapes).
|
|
19
21
|
export { SCREEN_OUTBOUND, SCREEN_INBOUND, encodeFrame, FrameDecoder, } from "./protocol.js";
|
|
20
22
|
// The gateway server (the separate program) + the screen-function and logger seams.
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAElH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEtG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAExG,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,gGAAgG;AAChG,8FAA8F;AAC9F,gFAAgF;AAEhF,2FAA2F;AAC3F,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQlD,sCAAsC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/passthrough.d.ts
CHANGED
|
@@ -1,17 +1,22 @@
|
|
|
1
|
-
import type { ScreenContext, ScreenVerdict, SecurityGatewayClient } from "./types.js";
|
|
1
|
+
import type { GatewayMode, ScreenContext, ScreenVerdict, SecurityGatewayClient } from "./types.js";
|
|
2
2
|
/**
|
|
3
3
|
* The null-object gateway client: screens nothing, always allows.
|
|
4
4
|
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
9
|
-
*
|
|
5
|
+
* ⚠️ TEST-ONLY (INV-9). No shipped code path may construct this. It was once the daemon's DEFAULT
|
|
6
|
+
* when no gateway was configured, and because nothing in the product ever configured one, the
|
|
7
|
+
* entire security layer was inert in every released build for weeks while the daemon cheerfully
|
|
8
|
+
* announced it was connected. `DaemonConfig.securityGateway` is now REQUIRED, so a test that
|
|
9
|
+
* wants no screening must say so by passing this explicitly — an honest declaration instead of a
|
|
10
|
+
* silent inheritance.
|
|
11
|
+
*
|
|
12
|
+
* It still RETURNS a verdict (`allow`), so SI-001 ("never act on content without a verdict") holds
|
|
13
|
+
* on this path too: "not screening" means "always-allow verdict", never "no verdict".
|
|
10
14
|
*
|
|
11
15
|
* It contains no detection logic. Real screening lives in the gateway PROGRAM (the server +
|
|
12
16
|
* the local sidecar / remote client), never in the daemon.
|
|
13
17
|
*/
|
|
14
18
|
export declare class PassthroughGatewayClient implements SecurityGatewayClient {
|
|
19
|
+
readonly mode: GatewayMode;
|
|
15
20
|
screenOutbound(content: Uint8Array, _ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
16
21
|
screenInbound(content: Uint8Array, _ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
17
22
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"passthrough.d.ts","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;
|
|
1
|
+
{"version":3,"file":"passthrough.d.ts","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAEnG;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,wBAAyB,YAAW,qBAAqB;IACpE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAiB;IAErC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAIhF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;CAGtF"}
|
package/dist/passthrough.js
CHANGED
|
@@ -1,16 +1,21 @@
|
|
|
1
1
|
/**
|
|
2
2
|
* The null-object gateway client: screens nothing, always allows.
|
|
3
3
|
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
6
|
-
*
|
|
7
|
-
*
|
|
8
|
-
*
|
|
4
|
+
* ⚠️ TEST-ONLY (INV-9). No shipped code path may construct this. It was once the daemon's DEFAULT
|
|
5
|
+
* when no gateway was configured, and because nothing in the product ever configured one, the
|
|
6
|
+
* entire security layer was inert in every released build for weeks while the daemon cheerfully
|
|
7
|
+
* announced it was connected. `DaemonConfig.securityGateway` is now REQUIRED, so a test that
|
|
8
|
+
* wants no screening must say so by passing this explicitly — an honest declaration instead of a
|
|
9
|
+
* silent inheritance.
|
|
10
|
+
*
|
|
11
|
+
* It still RETURNS a verdict (`allow`), so SI-001 ("never act on content without a verdict") holds
|
|
12
|
+
* on this path too: "not screening" means "always-allow verdict", never "no verdict".
|
|
9
13
|
*
|
|
10
14
|
* It contains no detection logic. Real screening lives in the gateway PROGRAM (the server +
|
|
11
15
|
* the local sidecar / remote client), never in the daemon.
|
|
12
16
|
*/
|
|
13
17
|
export class PassthroughGatewayClient {
|
|
18
|
+
mode = "passthrough";
|
|
14
19
|
async screenOutbound(content, _ctx) {
|
|
15
20
|
return { disposition: "allow", content };
|
|
16
21
|
}
|
package/dist/passthrough.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"passthrough.js","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAEA
|
|
1
|
+
{"version":3,"file":"passthrough.js","sourceRoot":"","sources":["../src/passthrough.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,wBAAwB;IAC1B,IAAI,GAAgB,aAAa,CAAC;IAE3C,KAAK,CAAC,cAAc,CAAC,OAAmB,EAAE,IAAmB;QAC3D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAmB,EAAE,IAAmB;QAC1D,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IAC3C,CAAC;CACF"}
|
|
@@ -1,3 +1,23 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* M9-REC-001 — local security-pass records.
|
|
3
|
+
*
|
|
4
|
+
* The gateway records what it did to EVERY message it screens — clean / redacted / blocked / warned —
|
|
5
|
+
* in the gateway's SQLCipher store, opened with the daemon's key (DOD-M9C-STORE-1; INV-4 as amended).
|
|
6
|
+
* Each record is hash-chained to the
|
|
7
|
+
* prior one (a per-record fingerprint over the record fields + the previous fingerprint), so a NAIVELY
|
|
8
|
+
* edited, deleted (mid-chain), or reordered record breaks the chain and `verifyChain()` returns false.
|
|
9
|
+
* A CLEAN pass is recorded too: an ABSENT record for a delivered message is itself evidence of suppression.
|
|
10
|
+
*
|
|
11
|
+
* Local limit (the chain is an UNKEYED sha256): an actor with DB write access can still TAIL-TRUNCATE the
|
|
12
|
+
* most recent records or rewrite the WHOLE chain consistently and pass `verifyChain()`. Detecting that
|
|
13
|
+
* needs the Phase-2 attested head anchored on the directory (M9-ATTEST-001) — this store is the local
|
|
14
|
+
* half; the fingerprint computed here is exactly what that head attests.
|
|
15
|
+
*
|
|
16
|
+
* This is the cheap, local half of #5 (tamper-proof records). Sending each fingerprint to the directory
|
|
17
|
+
* for cross-node tamper detection is Phase-2 (M9-ATTEST-001); the fingerprint computed here is exactly
|
|
18
|
+
* what gets attested, so Phase 2 is an add, not a rework.
|
|
19
|
+
*/
|
|
20
|
+
import { type StoreEventSink } from "../store/encrypted-db.js";
|
|
1
21
|
export type RecordDisposition = "clean" | "redact" | "block" | "warn";
|
|
2
22
|
export type RecordDirection = "inbound" | "outbound";
|
|
3
23
|
export interface RecordInput {
|
|
@@ -17,7 +37,7 @@ export declare class GatewayRecordStore {
|
|
|
17
37
|
#private;
|
|
18
38
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
19
39
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
20
|
-
constructor(dbPath: string, keyFilePath: string);
|
|
40
|
+
constructor(dbPath: string, keyFilePath: string, onEvent?: StoreEventSink);
|
|
21
41
|
/** Append a security-pass record for one screened message, hash-chained to the prior record. */
|
|
22
42
|
record(input: RecordInput): SecurityRecord;
|
|
23
43
|
/** Every record, oldest first. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAsC,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGnG,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AA+BD,qBAAa,kBAAkB;;IAI7B;uGACmG;gBACvF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc;IAKzE,gGAAgG;IAChG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc;IAwC1C,kCAAkC;IAClC,GAAG,IAAI,cAAc,EAAE;IAgBvB,KAAK,IAAI,MAAM;IAKf,yGAAyG;IACzG,WAAW,IAAI,OAAO;IActB,KAAK,IAAI,IAAI;CAWd"}
|
|
@@ -43,8 +43,8 @@ export class GatewayRecordStore {
|
|
|
43
43
|
#closed = false;
|
|
44
44
|
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
45
45
|
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
46
|
-
constructor(dbPath, keyFilePath) {
|
|
47
|
-
this.#db = openEncryptedStoreDb(dbPath, keyFilePath);
|
|
46
|
+
constructor(dbPath, keyFilePath, onEvent) {
|
|
47
|
+
this.#db = openEncryptedStoreDb(dbPath, keyFilePath, onEvent);
|
|
48
48
|
this.#db.exec(DDL);
|
|
49
49
|
}
|
|
50
50
|
/** Append a security-pass record for one screened message, hash-chained to the prior record. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,oBAAoB,
|
|
1
|
+
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,oBAAoB,EAAqC,MAAM,0BAA0B,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBzC,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,0FAA0F;AAC1F,SAAS,aAAa,CACpB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,WAAmB,EACnB,MAAc,EACd,aAAqB,EACrB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;SACzG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB,EAAE,OAAwB;QACvE,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;QAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,KAAkB;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,iGAAiG;QACjG,oEAAoE;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,GAAW,CAAC;QAChB,IAAI,eAAuB,CAAC;QAC5B,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;YAC5C,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;8CAEoC,CACrC;iBACA,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACpI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO;YACL,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,WAAW;YACX,UAAU;SACX,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,GAAG;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,2IAA2I,CAAC;aACpJ,GAAG,EAA4K,CAAC;QACnL,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,WAAW,EAAE,CAAC,CAAC,WAAgC;YAC/C,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,EAAmB,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC;IACf,CAAC;IAED,yGAAyG;IACzG,WAAW;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,gJAAgJ,CAAC;aACzJ,GAAG,EAAiL,CAAC;QACxL,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;YAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/H,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;YAChE,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,EAAsD,CAAC;IAC/D,CAAC;CACF"}
|
package/dist/spawn.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AASD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,
|
|
1
|
+
{"version":3,"file":"spawn.d.ts","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,iEAAiE;AACjE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AAEnD,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,4DAA4D;IAC5D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACvB;AASD,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CA6F5F"}
|
package/dist/spawn.js
CHANGED
|
@@ -17,7 +17,13 @@ function defaultEntryPath() {
|
|
|
17
17
|
export async function spawnGatewaySidecar(opts) {
|
|
18
18
|
const entry = opts.entryPath ?? defaultEntryPath();
|
|
19
19
|
const child = spawn(process.execPath, [entry], {
|
|
20
|
-
|
|
20
|
+
// stdin is a PIPE, not "ignore", and it is the child's death switch (review F5). A daemon that
|
|
21
|
+
// dies without running its shutdown path — SIGKILL, a crash, the OOM killer — leaves the
|
|
22
|
+
// gateway alive holding the encrypted store's write lock. The NEXT daemon's gateway then hits
|
|
23
|
+
// `store_locked`, exits before ready, and with no auto-restart (M9C-D14) that daemon spends its
|
|
24
|
+
// whole life fail-closed on one boot log line. When the parent dies the kernel closes this
|
|
25
|
+
// pipe, and the child exits on the `end` event.
|
|
26
|
+
stdio: ["pipe", "pipe", "pipe"],
|
|
21
27
|
env: {
|
|
22
28
|
...process.env,
|
|
23
29
|
...opts.env,
|
|
@@ -26,6 +32,24 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
26
32
|
},
|
|
27
33
|
});
|
|
28
34
|
const readyTimeoutMs = opts.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
|
|
35
|
+
// DRAIN the child's stderr and keep the tail. Two reasons, and the first one is the whole point:
|
|
36
|
+
// every refusal the gateway can produce — a missing key file, a locked store, a leftover
|
|
37
|
+
// plaintext store, each with its own code and its own guidance — is written HERE. Without a
|
|
38
|
+
// listener it went into a pipe nobody read, and the only thing the caller ever saw was
|
|
39
|
+
// "gateway sidecar exited before ready (code 1)" — a message naming where the failure surfaced
|
|
40
|
+
// and nothing about what went wrong. Second: an unread pipe fills, and the gateway writes a
|
|
41
|
+
// stderr line per screen error, so a long-running gateway would eventually block on it.
|
|
42
|
+
// A ChildProcess with no `error` listener turns a spawn-level failure (EMFILE, ENOMEM, EACCES)
|
|
43
|
+
// into an UNCAUGHT exception on a later tick — outside the caller's try — which would kill the
|
|
44
|
+
// daemon at boot rather than letting it degrade to the announced fail-closed mode (review F11).
|
|
45
|
+
// The promise below rejects on `exit`; this makes sure `error` cannot escape in the meantime.
|
|
46
|
+
let stderrTail = "";
|
|
47
|
+
const MAX_STDERR_TAIL = 8_192;
|
|
48
|
+
child.stderr?.on("data", (chunk) => {
|
|
49
|
+
stderrTail = (stderrTail + chunk.toString("utf8")).slice(-MAX_STDERR_TAIL);
|
|
50
|
+
});
|
|
51
|
+
/** The child's own words, appended to a failure so the CAUSE travels with the symptom. */
|
|
52
|
+
const withChildStderr = (message) => stderrTail.trim() ? `${message}\n--- gateway stderr ---\n${stderrTail.trim()}` : message;
|
|
29
53
|
await new Promise((resolve, reject) => {
|
|
30
54
|
let settled = false;
|
|
31
55
|
const timer = setTimeout(() => {
|
|
@@ -33,7 +57,7 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
33
57
|
return;
|
|
34
58
|
settled = true;
|
|
35
59
|
child.kill("SIGKILL");
|
|
36
|
-
reject(new Error(`gateway sidecar did not become ready within ${readyTimeoutMs}ms`));
|
|
60
|
+
reject(new Error(withChildStderr(`gateway sidecar did not become ready within ${readyTimeoutMs}ms`)));
|
|
37
61
|
}, readyTimeoutMs);
|
|
38
62
|
const onStdout = (chunk) => {
|
|
39
63
|
if (chunk.toString("utf8").includes(GATEWAY_READY_TOKEN)) {
|
|
@@ -46,13 +70,17 @@ export async function spawnGatewaySidecar(opts) {
|
|
|
46
70
|
}
|
|
47
71
|
};
|
|
48
72
|
child.stdout?.on("data", onStdout);
|
|
49
|
-
|
|
73
|
+
const fail = (message) => {
|
|
50
74
|
if (settled)
|
|
51
75
|
return;
|
|
52
76
|
settled = true;
|
|
53
77
|
clearTimeout(timer);
|
|
54
|
-
reject(new Error(
|
|
55
|
-
}
|
|
78
|
+
reject(new Error(withChildStderr(message)));
|
|
79
|
+
};
|
|
80
|
+
child.once("exit", (code) => fail(`gateway sidecar exited before ready (code ${code})`));
|
|
81
|
+
// The spawn itself failing is a different cause from the child exiting, and the operator needs
|
|
82
|
+
// to be able to tell them apart.
|
|
83
|
+
child.once("error", (err) => fail(`gateway sidecar could not be spawned: ${err.message}`));
|
|
56
84
|
});
|
|
57
85
|
return {
|
|
58
86
|
socketPath: opts.socketPath,
|
package/dist/spawn.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAwBnD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,SAAS,gBAAgB;IACvB,4CAA4C;IAC5C,OAAO,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,KAAK,EAAE,CAAC,
|
|
1
|
+
{"version":3,"file":"spawn.js","sourceRoot":"","sources":["../src/spawn.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAEnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAwBnD,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC,SAAS,gBAAgB;IACvB,4CAA4C;IAC5C,OAAO,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAyB;IACjE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,IAAI,gBAAgB,EAAE,CAAC;IACnD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;QAC7C,+FAA+F;QAC/F,yFAAyF;QACzF,8FAA8F;QAC9F,gGAAgG;QAChG,2FAA2F;QAC3F,gDAAgD;QAChD,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC/B,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,IAAI,CAAC,GAAG;YACX,oBAAoB,EAAE,IAAI,CAAC,UAAU;YACrC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,yBAAyB,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF;KACF,CAAC,CAAC;IAEH,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAEvE,iGAAiG;IACjG,yFAAyF;IACzF,4FAA4F;IAC5F,uFAAuF;IACvF,+FAA+F;IAC/F,4FAA4F;IAC5F,wFAAwF;IACxF,+FAA+F;IAC/F,+FAA+F;IAC/F,gGAAgG;IAChG,8FAA8F;IAC9F,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,MAAM,eAAe,GAAG,KAAK,CAAC;IAC9B,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;QACzC,UAAU,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,eAAe,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IACH,0FAA0F;IAC1F,MAAM,eAAe,GAAG,CAAC,OAAe,EAAU,EAAE,CAClD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,6BAA6B,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IAE3F,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,+CAA+C,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC,EAAE,cAAc,CAAC,CAAC;QAEnB,MAAM,QAAQ,GAAG,CAAC,KAAa,EAAE,EAAE;YACjC,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;gBACzD,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACpC,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,OAAe,EAAQ,EAAE;YACrC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,6CAA6C,IAAI,GAAG,CAAC,CAAC,CAAC;QACzF,+FAA+F;QAC/F,iCAAiC;QACjC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAU,EAAE,EAAE,CAAC,IAAI,CAAC,yCAAyC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,EAAE,KAAK,CAAC,GAAG;QACd,OAAO,EAAE,KAAK;QACd,KAAK,CAAC,IAAI;YACR,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI;gBAAE,OAAO;YACjE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,2FAA2F;YAC3F,sCAAsC;YACtC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnC,IAAI,UAAqD,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;gBAC3C,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;gBAC5E,IAAI,OAAQ,UAAqC,CAAC,KAAK,KAAK,UAAU;oBAAG,UAAoC,CAAC,KAAK,EAAE,CAAC;YACxH,CAAC,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,CAAC;oBAAS,CAAC;gBACT,IAAI,UAAU;oBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
export type GatewayStoreErrorCode = "store_key_unavailable" | "store_key_mismatch" | "store_engine_unavailable" | "store_open_failed";
|
|
1
|
+
export type GatewayStoreErrorCode = "store_key_unavailable" | "store_key_mismatch" | "store_plaintext_file" | "store_locked" | "store_engine_unavailable" | "store_open_failed";
|
|
2
2
|
export declare class GatewayStoreError extends Error {
|
|
3
3
|
readonly code: GatewayStoreErrorCode;
|
|
4
4
|
/** Actionable next step for the operator — never contains key material. */
|
|
@@ -18,10 +18,20 @@ export interface StoreDb {
|
|
|
18
18
|
prepare(sql: string): StoreStatement;
|
|
19
19
|
close(): void;
|
|
20
20
|
}
|
|
21
|
+
/**
|
|
22
|
+
* Where this module's events go. INJECTED, because the store now has two callers with opposite
|
|
23
|
+
* needs: the gateway BIN is a composition root with no logger, whose stdout is reserved for the
|
|
24
|
+
* READY handshake the spawner parses — so its events go to stderr, which the spawner drains and
|
|
25
|
+
* surfaces. The DAEMON has an injected logger and a hard rule against writing anywhere else
|
|
26
|
+
* (INV-7), so it passes one in. Defaulting to stderr would have put raw writes in daemon code.
|
|
27
|
+
*/
|
|
28
|
+
export type StoreEventSink = (event: string, context: Record<string, unknown>) => void;
|
|
29
|
+
/** The gateway bin's sink: one structured line on stderr, never stdout. */
|
|
30
|
+
export declare const stderrStoreEventSink: StoreEventSink;
|
|
21
31
|
/**
|
|
22
32
|
* Open (creating if absent) the gateway's encrypted store file, keyed by the raw 32-byte key in
|
|
23
33
|
* `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
|
|
24
34
|
* Throws GatewayStoreError on every failure path — never returns a plaintext handle.
|
|
25
35
|
*/
|
|
26
|
-
export declare function openEncryptedStoreDb(dbPath: string, keyFilePath: string): StoreDb;
|
|
36
|
+
export declare function openEncryptedStoreDb(dbPath: string, keyFilePath: string, onEvent?: StoreEventSink): StoreDb;
|
|
27
37
|
//# sourceMappingURL=encrypted-db.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AA8CA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,sBAAsB,GACtB,cAAc,GACd,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAkCD;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AAEvF,2EAA2E;AAC3E,eAAO,MAAM,oBAAoB,EAAE,cAElC,CAAC;AAsCF;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,cAAc,GAAG,OAAO,CAwF3G"}
|
|
@@ -17,8 +17,33 @@
|
|
|
17
17
|
* writes config and reads records).
|
|
18
18
|
*/
|
|
19
19
|
import { createRequire } from "node:module";
|
|
20
|
-
import { readFileSync } from "node:fs";
|
|
20
|
+
import { readFileSync, existsSync, openSync, readSync, closeSync } from "node:fs";
|
|
21
21
|
const STORE_KEY_BYTES = 32; // AES-256 — the daemon's key size
|
|
22
|
+
/**
|
|
23
|
+
* A plaintext SQLite file begins with these bytes; a SQLCipher file encrypts its header, so its
|
|
24
|
+
* first bytes are ciphertext and never match. Used to tell "someone left a plaintext store here"
|
|
25
|
+
* apart from "wrong key" — two very different operator actions.
|
|
26
|
+
*/
|
|
27
|
+
const SQLITE_PLAINTEXT_MAGIC = Buffer.concat([Buffer.from("SQLite format 3", "latin1"), Buffer.from([0x00])]);
|
|
28
|
+
function isPlaintextSqliteFile(dbPath) {
|
|
29
|
+
if (!existsSync(dbPath))
|
|
30
|
+
return false;
|
|
31
|
+
const head = Buffer.alloc(SQLITE_PLAINTEXT_MAGIC.length);
|
|
32
|
+
try {
|
|
33
|
+
const fd = openSync(dbPath, "r");
|
|
34
|
+
try {
|
|
35
|
+
if (readSync(fd, head, 0, head.length, 0) < head.length)
|
|
36
|
+
return false;
|
|
37
|
+
}
|
|
38
|
+
finally {
|
|
39
|
+
closeSync(fd);
|
|
40
|
+
}
|
|
41
|
+
}
|
|
42
|
+
catch {
|
|
43
|
+
return false;
|
|
44
|
+
}
|
|
45
|
+
return head.equals(SQLITE_PLAINTEXT_MAGIC);
|
|
46
|
+
}
|
|
22
47
|
export class GatewayStoreError extends Error {
|
|
23
48
|
code;
|
|
24
49
|
/** Actionable next step for the operator — never contains key material. */
|
|
@@ -60,6 +85,10 @@ class AdaptedDb {
|
|
|
60
85
|
this.#inner.close();
|
|
61
86
|
}
|
|
62
87
|
}
|
|
88
|
+
/** The gateway bin's sink: one structured line on stderr, never stdout. */
|
|
89
|
+
export const stderrStoreEventSink = (event, context) => {
|
|
90
|
+
process.stderr.write(`${JSON.stringify({ level: "info", event, ...context })}\n`);
|
|
91
|
+
};
|
|
63
92
|
function loadEngine() {
|
|
64
93
|
const require = createRequire(import.meta.url);
|
|
65
94
|
try {
|
|
@@ -89,8 +118,18 @@ function readStoreKey(keyFilePath) {
|
|
|
89
118
|
* `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
|
|
90
119
|
* Throws GatewayStoreError on every failure path — never returns a plaintext handle.
|
|
91
120
|
*/
|
|
92
|
-
export function openEncryptedStoreDb(dbPath, keyFilePath) {
|
|
121
|
+
export function openEncryptedStoreDb(dbPath, keyFilePath, onEvent) {
|
|
122
|
+
const emit = (event, context) => onEvent?.(event, context);
|
|
93
123
|
const key = readStoreKey(keyFilePath);
|
|
124
|
+
// Distinguish "a plaintext store was left here" from "wrong key" BEFORE trying to decrypt.
|
|
125
|
+
// Both surface as an unreadable header, and they call for opposite operator actions: one is
|
|
126
|
+
// "delete this stale file", the other is "restore your key from backup" — advice that destroys
|
|
127
|
+
// data if given for the wrong cause.
|
|
128
|
+
if (isPlaintextSqliteFile(dbPath)) {
|
|
129
|
+
throw new GatewayStoreError("store_plaintext_file", `the file at ${dbPath} is an UNENCRYPTED SQLite database`, "The gateway store must be encrypted. This is a leftover plaintext store from before the " +
|
|
130
|
+
"store was encrypted; it is not migrated and not read. Move or delete it and restart — a " +
|
|
131
|
+
"fresh encrypted store is created automatically.");
|
|
132
|
+
}
|
|
94
133
|
const mod = loadEngine();
|
|
95
134
|
const Ctor = mod.Database ?? mod.default;
|
|
96
135
|
let inner;
|
|
@@ -104,28 +143,52 @@ export function openEncryptedStoreDb(dbPath, keyFilePath) {
|
|
|
104
143
|
// Key set outside the message-bearing try: key hex must never reach an error string.
|
|
105
144
|
const keyHex = Buffer.from(key).toString("hex");
|
|
106
145
|
inner.pragma(`key = "x'${keyHex}'"`);
|
|
146
|
+
// busy_timeout FIRST — before the verify read and before the WAL pragma, both of which take
|
|
147
|
+
// locks. This file is shared with the daemon (M9C-D9), so a contended startup is ordinary, and
|
|
148
|
+
// with the SQLite default timeout of 0 the very first contended open returns SQLITE_BUSY
|
|
149
|
+
// instantly — which the verify-read catch below would then report as a wrong key. Setting it
|
|
150
|
+
// last (as this did) turns lock contention into "your key is wrong. Restore it from backup."
|
|
151
|
+
inner.pragma("busy_timeout = 3000");
|
|
107
152
|
try {
|
|
108
153
|
inner.prepare("SELECT count(*) AS c FROM sqlite_master").get([]);
|
|
109
154
|
}
|
|
110
|
-
catch {
|
|
155
|
+
catch (err) {
|
|
111
156
|
try {
|
|
112
157
|
inner.close();
|
|
113
158
|
}
|
|
114
159
|
catch {
|
|
115
160
|
/* ignore */
|
|
116
161
|
}
|
|
117
|
-
|
|
162
|
+
// The upstream reason MUST survive. A wrong key, a locked file, a truncated file and an I/O
|
|
163
|
+
// error all surface here, and a label that names only the exit point sends the operator to
|
|
164
|
+
// the wrong subsystem. No key material can appear in this string — the key is only ever in
|
|
165
|
+
// the pragma above, which is not part of the thrown error. (The daemon's opener does the
|
|
166
|
+
// same at sqlcipher-db.ts; this copy dropped it, which is the defect being fixed.)
|
|
167
|
+
const reason = err instanceof Error ? err.message : String(err);
|
|
168
|
+
const locked = /SQLITE_BUSY|database is locked/i.test(reason);
|
|
169
|
+
if (locked) {
|
|
170
|
+
throw new GatewayStoreError("store_locked", `gateway store is locked by another process (${reason})`, "Another process holds the gateway store's write lock — usually an orphaned gateway from " +
|
|
171
|
+
"a previous daemon. Stop it and restart the daemon. The key is not the problem.");
|
|
172
|
+
}
|
|
173
|
+
throw new GatewayStoreError("store_key_mismatch", `gateway store did not decrypt with the supplied key (${reason})`, "The daemon's key does not match this gateway store file. Restore the matching key file; " +
|
|
118
174
|
"the gateway will not fall back to a plaintext store.");
|
|
119
175
|
}
|
|
120
|
-
// WAL after verification so WAL/SHM are ciphertext
|
|
121
|
-
//
|
|
176
|
+
// WAL after verification so WAL/SHM are ciphertext. CHECK the result rather than assuming it:
|
|
177
|
+
// the file is shared with the daemon, and a silent fall back to rollback-journal mode means a
|
|
178
|
+
// daemon write blocks gateway reads, which surfaces to the user as messages fail-closed with a
|
|
179
|
+
// generic screen error. Not fatal — SQLCipher encrypts the rollback journal too, so custody
|
|
180
|
+
// holds either way — but never silent.
|
|
122
181
|
try {
|
|
123
|
-
inner.pragma("journal_mode=WAL", { simple: true });
|
|
182
|
+
const mode = inner.pragma("journal_mode=WAL", { simple: true });
|
|
183
|
+
if (mode !== "wal")
|
|
184
|
+
emit("gateway.store.wal_unavailable", { mode: String(mode) });
|
|
124
185
|
}
|
|
125
|
-
catch {
|
|
126
|
-
|
|
186
|
+
catch (err) {
|
|
187
|
+
emit("gateway.store.wal_unavailable", { error: err instanceof Error ? err.message : String(err) });
|
|
127
188
|
}
|
|
128
|
-
|
|
189
|
+
// The store is open and encrypted. Structured, on stderr: stdout carries the READY handshake the
|
|
190
|
+
// parent parses, so nothing else may go there. Never the key, and never the key file's contents.
|
|
191
|
+
emit("gateway.store.opened", { encrypted: true, path: dbPath });
|
|
129
192
|
return new AdaptedDb(inner);
|
|
130
193
|
}
|
|
131
194
|
//# sourceMappingURL=encrypted-db.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAElF,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAE9D;;;;GAIG;AACH,MAAM,sBAAsB,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE9G,SAAS,qBAAqB,CAAC,MAAc;IAC3C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAC7C,CAAC;AAUD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAWD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,oBAAoB,GAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;IACrE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC,CAAC;AAEF,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,uCAAuC,WAAW,EAAE,EACpD,8FAA8F;YAC5F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,6BAA6B,GAAG,CAAC,MAAM,oBAAoB,eAAe,EAAE,EAC5E,mBAAmB,WAAW,wCAAwC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB,EAAE,OAAwB;IAChG,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAgC,EAAQ,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAEtC,2FAA2F;IAC3F,4FAA4F;IAC5F,+FAA+F;IAC/F,qCAAqC;IACrC,IAAI,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,iBAAiB,CACzB,sBAAsB,EACtB,eAAe,MAAM,oCAAoC,EACzD,0FAA0F;YACxF,0FAA0F;YAC1F,iDAAiD,CACpD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,4FAA4F;IAC5F,+FAA+F;IAC/F,yFAAyF;IACzF,6FAA6F;IAC7F,6FAA6F;IAC7F,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpC,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,4FAA4F;QAC5F,2FAA2F;QAC3F,2FAA2F;QAC3F,yFAAyF;QACzF,mFAAmF;QACnF,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,MAAM,GAAG,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,iBAAiB,CACzB,cAAc,EACd,+CAA+C,MAAM,GAAG,EACxD,0FAA0F;gBACxF,gFAAgF,CACnF,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,wDAAwD,MAAM,GAAG,EACjE,0FAA0F;YACxF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,8FAA8F;IAC9F,8FAA8F;IAC9F,+FAA+F;IAC/F,4FAA4F;IAC5F,uCAAuC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,IAAI,KAAK,KAAK;YAAE,IAAI,CAAC,+BAA+B,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,CAAC,+BAA+B,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACrG,CAAC;IAED,iGAAiG;IACjG,iGAAiG;IACjG,IAAI,CAAC,sBAAsB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEhE,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
|
|
3
|
+
* package barrel (DOD-M9C-WIRE-1: "the stub moves to test-only visibility").
|
|
4
|
+
*
|
|
5
|
+
* `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
|
|
6
|
+
* once, and because no production caller ever overrode it, the entire security layer shipped inert
|
|
7
|
+
* while the daemon logged that its gateway was connected. It still has to EXIST — tests are
|
|
8
|
+
* out-of-tree consumers and need a way to satisfy the now-required `securityGateway` field — but
|
|
9
|
+
* putting it on the main barrel leaves an always-allow client one ordinary import away from any
|
|
10
|
+
* production file. A separate entry point makes reaching for it a deliberate act that shows up in
|
|
11
|
+
* a diff.
|
|
12
|
+
*/
|
|
13
|
+
export { PassthroughGatewayClient } from "./passthrough.js";
|
|
14
|
+
//# sourceMappingURL=testing.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"testing.d.ts","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC"}
|
package/dist/testing.js
ADDED
|
@@ -0,0 +1,14 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* TEST-ONLY exports. Reachable as `@cello-protocol/gateway/testing`, deliberately NOT from the
|
|
3
|
+
* package barrel (DOD-M9C-WIRE-1: "the stub moves to test-only visibility").
|
|
4
|
+
*
|
|
5
|
+
* `PassthroughGatewayClient` screens nothing and allows everything. It was the daemon's DEFAULT
|
|
6
|
+
* once, and because no production caller ever overrode it, the entire security layer shipped inert
|
|
7
|
+
* while the daemon logged that its gateway was connected. It still has to EXIST — tests are
|
|
8
|
+
* out-of-tree consumers and need a way to satisfy the now-required `securityGateway` field — but
|
|
9
|
+
* putting it on the main barrel leaves an always-allow client one ordinary import away from any
|
|
10
|
+
* production file. A separate entry point makes reaching for it a deliberate act that shows up in
|
|
11
|
+
* a diff.
|
|
12
|
+
*/
|
|
13
|
+
export { PassthroughGatewayClient } from "./passthrough.js";
|
|
14
|
+
//# sourceMappingURL=testing.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"testing.js","sourceRoot":"","sources":["../src/testing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -102,7 +102,17 @@ export interface ScreenVerdict {
|
|
|
102
102
|
* deadline. A timeout or unreachable gateway resolves to a fail-closed `block`
|
|
103
103
|
* (`gateway_unavailable`), never a rejected/never-settling promise (INV-6 / SI-001).
|
|
104
104
|
*/
|
|
105
|
+
/** What a client actually does to content. `enforcing` screens; `passthrough` allows everything. */
|
|
106
|
+
export type GatewayMode = "enforcing" | "passthrough";
|
|
105
107
|
export interface SecurityGatewayClient {
|
|
108
|
+
/**
|
|
109
|
+
* Declared by the implementation, never computed by the caller (M9C-D11). The daemon announces
|
|
110
|
+
* this at boot, and it is the field an operator greps to know whether their agent is screened —
|
|
111
|
+
* so it must come from the object that will actually do (or not do) the screening. The defect
|
|
112
|
+
* this closes: the daemon used to announce `config.securityGateway ? "sidecar" : "passthrough"`,
|
|
113
|
+
* so the boot line described the caller's intent rather than the object's behavior.
|
|
114
|
+
*/
|
|
115
|
+
readonly mode: GatewayMode;
|
|
106
116
|
screenOutbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
107
117
|
screenInbound(content: Uint8Array, ctx: ScreenContext): Promise<ScreenVerdict>;
|
|
108
118
|
}
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,yGAAyG;AACzG,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,qBAAqB;IACpC,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChF;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAA4B,GAAG,aAAa,CAcjH"}
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qEAAqE;AACrE,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,SAAS,CAAC;AAErD;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtE,yGAAyG;AACzG,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AAE5E;;;;;;;;GAQG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAC;AAE1E;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,qBAAqB,CAAC;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gGAAgG;IAChG,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;CAC1D;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC;IAC3B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,oGAAoG;AACpG,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,aAAa,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChF,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAChF;AAED,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,wBAAwB,CAAC;AACzD;0EAC0E;AAC1E,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAA4B,GAAG,aAAa,CAcjH"}
|
package/dist/types.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;
|
|
1
|
+
{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAoHH,wFAAwF;AACxF,MAAM,CAAC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AACzD;0EAC0E;AAC1E,MAAM,CAAC,MAAM,kBAAkB,GAAG,oBAAoB,CAAC;AAEvD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAA0B,EAAE,SAAiB,mBAAmB;IAChG,MAAM,KAAK,GAAG,MAAM,KAAK,kBAAkB;QACzC,CAAC,CAAC,6EAA6E;QAC/E,CAAC,CAAC,2CAA2C,CAAC;IAChD,OAAO;QACL,WAAW,EAAE,OAAO;QACpB,MAAM;QACN,QAAQ,EACN,SAAS,KAAK,UAAU;YACtB,CAAC,CAAC,gBAAgB,KAAK,4DAA4D;gBACjF,wDAAwD;YAC1D,CAAC,CAAC,gBAAgB,KAAK,mEAAmE;gBACxF,sGAAsG;KAC7G,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cello-protocol/gateway",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.13",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"engines": {
|
|
@@ -16,6 +16,10 @@
|
|
|
16
16
|
"import": "./dist/index.js",
|
|
17
17
|
"types": "./dist/index.d.ts"
|
|
18
18
|
},
|
|
19
|
+
"./testing": {
|
|
20
|
+
"import": "./dist/testing.js",
|
|
21
|
+
"types": "./dist/testing.d.ts"
|
|
22
|
+
},
|
|
19
23
|
"./detect": {
|
|
20
24
|
"import": "./dist/detect/index.js",
|
|
21
25
|
"types": "./dist/detect/index.d.ts"
|
|
@@ -30,10 +34,10 @@
|
|
|
30
34
|
"package.json"
|
|
31
35
|
],
|
|
32
36
|
"dependencies": {
|
|
33
|
-
"@signalapp/sqlcipher": "^3.3.5",
|
|
34
37
|
"re2-wasm": "^1.0.2"
|
|
35
38
|
},
|
|
36
39
|
"optionalDependencies": {
|
|
40
|
+
"@signalapp/sqlcipher": "^3.3.5",
|
|
37
41
|
"re2": "^1.25.0"
|
|
38
42
|
},
|
|
39
43
|
"devDependencies": {
|