@cello-protocol/gateway 0.0.9 → 0.0.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin/cello-gateway.js +23 -12
- package/dist/bin/cello-gateway.js.map +1 -1
- package/dist/config/config-store.d.ts +3 -1
- package/dist/config/config-store.d.ts.map +1 -1
- package/dist/config/config-store.js +11 -13
- package/dist/config/config-store.js.map +1 -1
- package/dist/detect/corpus-digest.d.ts +19 -0
- package/dist/detect/corpus-digest.d.ts.map +1 -0
- package/dist/detect/corpus-digest.js +32 -0
- package/dist/detect/corpus-digest.js.map +1 -0
- package/dist/detect/index.d.ts +3 -2
- package/dist/detect/index.d.ts.map +1 -1
- package/dist/detect/index.js +3 -2
- package/dist/detect/index.js.map +1 -1
- package/dist/detect/injection-patterns.d.ts +11 -0
- package/dist/detect/injection-patterns.d.ts.map +1 -1
- package/dist/detect/injection-patterns.js +13 -0
- package/dist/detect/injection-patterns.js.map +1 -1
- package/dist/detect/secrets.d.ts +6 -0
- package/dist/detect/secrets.d.ts.map +1 -1
- package/dist/detect/secrets.js +8 -0
- package/dist/detect/secrets.js.map +1 -1
- package/dist/index.d.ts +2 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +1 -0
- package/dist/index.js.map +1 -1
- package/dist/records/record-store.d.ts +3 -1
- package/dist/records/record-store.d.ts.map +1 -1
- package/dist/records/record-store.js +7 -5
- package/dist/records/record-store.js.map +1 -1
- package/dist/store/encrypted-db.d.ts +27 -0
- package/dist/store/encrypted-db.d.ts.map +1 -0
- package/dist/store/encrypted-db.js +131 -0
- package/dist/store/encrypted-db.js.map +1 -0
- package/package.json +2 -1
|
@@ -36,12 +36,24 @@ async function main() {
|
|
|
36
36
|
const engine = await initLinearRegex();
|
|
37
37
|
compileInjectionPatterns();
|
|
38
38
|
compileSecretRules();
|
|
39
|
-
//
|
|
40
|
-
//
|
|
41
|
-
//
|
|
42
|
-
//
|
|
43
|
-
const
|
|
44
|
-
const
|
|
39
|
+
// DOD-M9C-STORE-1 (M9C-D9): ONE encrypted store file holds both the config versions and the
|
|
40
|
+
// security records, keyed by the daemon's key file — the daemon's spawn plumbing passes the two
|
|
41
|
+
// paths (M9C-D8: a key FILE path, never key bytes). Both stores fail closed: a missing or wrong
|
|
42
|
+
// key throws GatewayStoreError, which exits the process rather than screening unconfigured.
|
|
43
|
+
const storeDbPath = process.env["CELLO_GATEWAY_STORE_DB"];
|
|
44
|
+
const storeKeyFile = process.env["CELLO_GATEWAY_STORE_KEY_FILE"];
|
|
45
|
+
if ((storeDbPath === undefined) !== (storeKeyFile === undefined)) {
|
|
46
|
+
// Half-configured storage is a plumbing bug, not a degraded mode to run through: it would
|
|
47
|
+
// silently drop either the operator's config or the whole audit trail.
|
|
48
|
+
process.stderr.write("cello-gateway: CELLO_GATEWAY_STORE_DB and CELLO_GATEWAY_STORE_KEY_FILE must be set together\n");
|
|
49
|
+
process.exit(2);
|
|
50
|
+
return;
|
|
51
|
+
}
|
|
52
|
+
// M9-CFG-001 (INV-4): the gateway owns its config. When the store is configured it is the SOURCE
|
|
53
|
+
// OF TRUTH (with its tighten-free / loosen-confirmed governance); env vars are the bootstrap
|
|
54
|
+
// fallback for any key the store has not set. Each setting defaults to its TIGHTEST value (empty
|
|
55
|
+
// whitelist, override off, no rate cap) so an absent/empty config never silently loosens.
|
|
56
|
+
const config = storeDbPath && storeKeyFile ? new GatewayConfigStore(storeDbPath, storeKeyFile) : undefined;
|
|
45
57
|
const cfg = (key, envFallback) => {
|
|
46
58
|
const v = config?.get(key);
|
|
47
59
|
return v !== undefined ? v : envFallback;
|
|
@@ -63,12 +75,11 @@ async function main() {
|
|
|
63
75
|
: undefined;
|
|
64
76
|
const outbound = new OutboundScreener({ piiWhitelist, autonomousOverride, ...(rateLimit ? { rateLimit } : {}) });
|
|
65
77
|
const inbound = new InboundScreener();
|
|
66
|
-
// M9-REC-001 (INV-4): the gateway records what it did to EVERY message
|
|
67
|
-
//
|
|
68
|
-
//
|
|
69
|
-
//
|
|
70
|
-
const
|
|
71
|
-
const records = recordDbPath ? new GatewayRecordStore(recordDbPath) : undefined;
|
|
78
|
+
// M9-REC-001 (INV-4): the gateway records what it did to EVERY message, hash-chained for
|
|
79
|
+
// tamper-evidence, in the same encrypted store as the config (M9C-D9). The verdict's disposition
|
|
80
|
+
// maps to the record: allow → clean (a clean pass IS recorded — an absent record is itself
|
|
81
|
+
// evidence of suppression), redact/block/warn verbatim.
|
|
82
|
+
const records = storeDbPath && storeKeyFile ? new GatewayRecordStore(storeDbPath, storeKeyFile) : undefined;
|
|
72
83
|
const recordOutcome = (direction, v, content, correlationId) => {
|
|
73
84
|
if (!records)
|
|
74
85
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,
|
|
1
|
+
{"version":3,"file":"cello-gateway.js","sourceRoot":"","sources":["../../src/bin/cello-gateway.ts"],"names":[],"mappings":";AACA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAC3E,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAA0B,MAAM,4BAA4B,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,KAAK,UAAU,IAAI;IACjB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAEhE,gGAAgG;IAChG,6FAA6F;IAC7F,6DAA6D;IAC7D,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,MAAM,GAAG,MAAM,eAAe,EAAE,CAAC;IACvC,wBAAwB,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC;IAErB,4FAA4F;IAC5F,gGAAgG;IAChG,gGAAgG;IAChG,4FAA4F;IAC5F,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IACjE,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,CAAC,EAAE,CAAC;QACjE,0FAA0F;QAC1F,uEAAuE;QACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+FAA+F,CAAC,CAAC;QACtH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,iGAAiG;IACjG,6FAA6F;IAC7F,iGAAiG;IACjG,0FAA0F;IAC1F,MAAM,MAAM,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3G,MAAM,GAAG,GAAG,CAAI,GAAW,EAAE,WAAc,EAAK,EAAE;QAChD,MAAM,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAC3B,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAE,CAAO,CAAC,CAAC,CAAC,WAAW,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,CACtB,eAAe,EACf,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CACnG,CAAC;IACF,oGAAoG;IACpG,sFAAsF;IACtF,MAAM,kBAAkB,GAAG,GAAG,CAAU,qBAAqB,EAAE,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,KAAK,GAAG,CAAC,CAAC;IACzH,uGAAuG;IACvG,qGAAqG;IACrG,sGAAsG;IACtG,gEAAgE;IAChE,MAAM,sBAAsB,GAAG,MAAM,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAS,qBAAqB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrH,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAS,gBAAgB,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACtG,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QACvD,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,QAAQ,GAAG,IAAI,gBAAgB,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACjH,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IAEtC,yFAAyF;IACzF,iGAAiG;IACjG,2FAA2F;IAC3F,wDAAwD;IACxD,MAAM,OAAO,GAAG,WAAW,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,kBAAkB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5G,MAAM,aAAa,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QAC/H,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,WAAW,GAAsB,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;QAC3F,gGAAgG;QAChG,oGAAoG;QACpG,iGAAiG;QACjG,MAAM,MAAM,GAAG,WAAW,KAAK,OAAO;YACpC,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC;QAC5G,OAAO,CAAC,MAAM,CAAC;YACb,SAAS;YACT,WAAW;YACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC/D,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3C,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,6DAA6D;SACzH,CAAC,CAAC;IACL,CAAC,CAAC;IACF,0GAA0G;IAC1G,MAAM,uBAAuB,GAAG,CAAC,SAAiC,EAAE,CAAgB,EAAE,OAAmB,EAAE,aAAsB,EAAQ,EAAE;QACzI,IAAI,CAAC;YAAC,aAAa,CAAC,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;QAAC,CAAC;QAC5D,OAAO,GAAG,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;IACpJ,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC;QACvC,UAAU;QACV,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,KAAK,EAAE,GAAG,EAA0B,EAAE;YAC5C,6FAA6F;YAC7F,kGAAkG;YAClG,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE;wBACrC,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,SAAS,EAAE,GAAG,CAAC,SAAS;wBACxB,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACnG,CAAC,CAAC;oBACH,MAAM,OAAO,GAAkB;wBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,OAAO,EAAE,CAAC,CAAC,OAAO;wBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;wBAChB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9D,CAAC;oBACF,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnE,OAAO,OAAO,CAAC;gBACjB,CAAC;gBACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,6FAA6F;gBAC7F,+FAA+F;gBAC/F,oGAAoG;gBACpG,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,CAAC,CAAC,WAAW;oBAC1B,GAAG,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC7D,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvD,GAAG,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9D,CAAC;gBACF,aAAa,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,+FAA+F;gBAC/F,gGAAgG;gBAChG,2EAA2E;gBAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,GAAG,CAAC,SAAS,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC9H,MAAM,OAAO,GAAkB;oBAC7B,WAAW,EAAE,OAAO;oBACpB,MAAM,EAAE,cAAc;oBACtB,QAAQ,EAAE,2EAA2E;wBACnF,wDAAwD;iBAC3D,CAAC;gBACF,uBAAuB,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC;gBAChF,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,uEAAuE;IACvE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,IAAI,UAAU,iBAAiB,MAAM,IAAI,CAAC,CAAC;IAEtF,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAE,EAAE;QAClC,IAAI,QAAQ;YAAE,OAAO;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE;YAC3B,MAAM,EAAE,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,KAAK,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACnG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
|
|
@@ -19,7 +19,9 @@ export interface ConfigVersionRow {
|
|
|
19
19
|
}
|
|
20
20
|
export declare class GatewayConfigStore {
|
|
21
21
|
#private;
|
|
22
|
-
|
|
22
|
+
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
23
|
+
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
24
|
+
constructor(dbPath: string, keyFilePath: string);
|
|
23
25
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
24
26
|
* set of a key is classified against the per-key TIGHTEST baseline, not treated as free (B1). */
|
|
25
27
|
set(key: string, value: unknown, opts?: {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"config-store.d.ts","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAoBA,uGAAuG;AACvG,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE/D,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,eAAe,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC9E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAC;IAAC,SAAS,EAAE,QAAQ,CAAA;CAAE,CAAC;AAErE,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AA4FD,qBAAa,kBAAkB;;IAI7B;uGACmG;gBACvF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAK/C;sGACkG;IAClG,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,SAAS;IA2C/E,+EAA+E;IAC/E,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAKzB,oEAAoE;IACpE,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,EAAE;IAaxC;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAcjC,KAAK,IAAI,IAAI;CAWd"}
|
|
@@ -1,24 +1,21 @@
|
|
|
1
1
|
/**
|
|
2
|
-
* M9-CFG-001 — the gateway's
|
|
2
|
+
* M9-CFG-001 — the gateway's versioned config store (INV-4 as amended by M9C-D2).
|
|
3
3
|
*
|
|
4
|
-
* The
|
|
5
|
-
* local DB file (node:sqlite — the same library the daemon uses, a separate file), is append-only and
|
|
6
|
-
* versioned, and enforces the §7 governance asymmetry:
|
|
4
|
+
* The store is append-only and versioned, and enforces the §7 governance asymmetry:
|
|
7
5
|
*
|
|
8
6
|
* - TIGHTENING a guard (making the gateway MORE restrictive) is free — no confirmation.
|
|
9
7
|
* - LOOSENING a guard (making it LESS restrictive — enabling autonomous override, adding a value to
|
|
10
8
|
* the PII whitelist, raising/removing the rate cap, allowing another language) requires an explicit
|
|
11
|
-
* `confirmed` flag. Without it the change is REJECTED and not versioned. (The human confirmation
|
|
12
|
-
*
|
|
9
|
+
* `confirmed` flag. Without it the change is REJECTED and not versioned. (The human confirmation
|
|
10
|
+
* is the CLI prompt — the portal passkey later; this store is the enforcement point.)
|
|
13
11
|
*
|
|
14
12
|
* Every applied change appends a row whose `fingerprint` is hash-chained to the previous version, so
|
|
15
13
|
* the change history is tamper-evident and ready to attest to the directory in Phase 2 (M9-ATTEST-001).
|
|
16
14
|
*
|
|
17
|
-
* Encryption-at-rest: the
|
|
18
|
-
*
|
|
19
|
-
* the daemon's DB, not a CFG-001-local concern.
|
|
15
|
+
* Encryption-at-rest (DOD-M9C-STORE-1): the store lives in the gateway's SQLCipher file, opened with
|
|
16
|
+
* the daemon's key via a key FILE path — fail-closed, no plaintext fallback (see store/encrypted-db.ts).
|
|
20
17
|
*/
|
|
21
|
-
import {
|
|
18
|
+
import { openEncryptedStoreDb } from "../store/encrypted-db.js";
|
|
22
19
|
import { createHash } from "node:crypto";
|
|
23
20
|
const asArray = (v) => (Array.isArray(v) ? v : []);
|
|
24
21
|
/** Set-membership delta: more members = looser, fewer = tighter (for allowlists/whitelists). */
|
|
@@ -98,9 +95,10 @@ CREATE TABLE IF NOT EXISTS config_versions (
|
|
|
98
95
|
export class GatewayConfigStore {
|
|
99
96
|
#db;
|
|
100
97
|
#closed = false;
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
98
|
+
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
99
|
+
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
100
|
+
constructor(dbPath, keyFilePath) {
|
|
101
|
+
this.#db = openEncryptedStoreDb(dbPath, keyFilePath);
|
|
104
102
|
this.#db.exec(DDL);
|
|
105
103
|
}
|
|
106
104
|
/** Set `key` to `value`. Loosening requires `opts.confirmed`; tightening/neutral is free. The FIRST
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"config-store.js","sourceRoot":"","sources":["../../src/config/config-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,oBAAoB,EAAgB,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAqBzC,MAAM,OAAO,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACpF,gGAAgG;AAChG,SAAS,mBAAmB,CAAC,IAAa,EAAE,IAAa;IACvD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,IAAI,KAAK;QAAE,OAAO,QAAQ,CAAC,CAAC,mDAAmD;IAC/E,IAAI,OAAO;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uGAAuG;AACvG,MAAM,WAAW,GAA+B;IAC9C,kFAAkF;IAClF,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,oEAAoE;IACpE,aAAa,EAAE,mBAAmB;IAClC,mCAAmC;IACnC,cAAc,EAAE,mBAAmB;IACnC,0EAA0E;IAC1E,mBAAmB,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAClC,MAAM,SAAS,GAAG,CAAC,CAAU,EAAU,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACvG,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;IACD,qGAAqG;IACrG,wGAAwG;IACxG,cAAc,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1D,CAAC;CACF,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,QAAQ,GAA4B;IACxC,mBAAmB,EAAE,KAAK,EAAO,kCAAkC;IACnE,aAAa,EAAE,EAAc,EAAI,0BAA0B;IAC3D,cAAc,EAAE,CAAC,OAAO,CAAC,EAAQ,sEAAsE;IACvG,mBAAmB,EAAE,CAAC,EAAW,oEAAoE;IACrG,cAAc,EAAE,MAAM,EAAW,gEAAgE;CAClG,CAAC;AAEF,0GAA0G;AAC1G,MAAM,UAAU,GAA4C;IAC1D,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,SAAS;IAClD,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAC/E,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;IAChF,mBAAmB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;CAC5E,CAAC;AAEF,2GAA2G;AAC3G,SAAS,aAAa,CACpB,GAAW,EACX,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,SAAiB,EACjB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,OAAO,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,IAAI,eAAe,EAAE,CAAC;SACrF,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB;QAC7C,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;sGACkG;IAClG,GAAG,CAAC,GAAW,EAAE,KAAc,EAAE,OAAgC,EAAE;QACjE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,GAAG,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAEhH,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACpC,uGAAuG;QACvG,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACtF,MAAM,SAAS,GAAoB,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAE9D,IAAI,SAAS,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC1E,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzC,MAAM,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;QAClD,qGAAqG;QACrG,uGAAuG;QACvG,+FAA+F;QAC/F,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;QAElG,oGAAoG;QACpG,2DAA2D;QAC3D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,CAAC;YACH,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;2CAEiC,CAClC;iBACA,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAChG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACvD,CAAC;IAED,+EAA+E;IAC/E,GAAG,CAAC,GAAW;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,OAAO,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,CAAC;IAED,oEAAoE;IACpE,OAAO,CAAC,GAAW;QACjB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,uHAAuH,CAAC;aAChI,GAAG,CAAC,GAAG,CAA8G,CAAC;QACzH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAY;YAC1C,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,SAAS,EAAE,CAAC,CAAC,SAAS,KAAK,CAAC;YAC5B,WAAW,EAAE,CAAC,CAAC,WAAW;SAC3B,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACH,WAAW,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,yIAAyI,CAAC;aAClJ,GAAG,CAAC,GAAG,CAAwI,CAAC;QACnJ,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YACzD,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;YACxG,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC;YAC7C,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO,CAAC,sFAAsF;QAChH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,0GAA0G,CAAC;aACnH,GAAG,CAAC,GAAG,CAA6E,CAAC;IAC1F,CAAC;CACF"}
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* M10B / DOD-END-SCAN-1 (`M10B-D15`) — a stable digest of the ACTIVE detector corpus.
|
|
3
|
+
*
|
|
4
|
+
* The intake scanner's `scanner_version` is DERIVED from this, never hand-maintained. A hand-bumped
|
|
5
|
+
* constant goes stale the first time someone edits a regex and forgets — and because the directory
|
|
6
|
+
* cannot re-run the scan, that stale value is notarized as evidence of a scan that did not happen,
|
|
7
|
+
* which is the stated reason `DOD-DIR-WRITE-1` made the field signed in the first place.
|
|
8
|
+
*
|
|
9
|
+
* Returns null when either corpus is uncompiled. A digest over "no rules" would be a perfectly
|
|
10
|
+
* stable, perfectly meaningless value that a fail-closed caller could not distinguish from a real
|
|
11
|
+
* one — so the absence is reported as absence (§5a), and the caller refuses.
|
|
12
|
+
*
|
|
13
|
+
* SORTED before hashing, because corpus ORDER is not a property anyone should depend on: reordering
|
|
14
|
+
* the source array changes nothing about which text is caught, and a digest that moved on a reorder
|
|
15
|
+
* would force a spurious `scanner_version` change and read as a rule change to anyone auditing it.
|
|
16
|
+
* What the digest MUST track is the SET of active rules.
|
|
17
|
+
*/
|
|
18
|
+
export declare function detectorCorpusDigest(): string | null;
|
|
19
|
+
//# sourceMappingURL=corpus-digest.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"corpus-digest.d.ts","sourceRoot":"","sources":["../../src/detect/corpus-digest.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CASpD"}
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { createHash } from "node:crypto";
|
|
2
|
+
import { injectionPatternIds } from "./injection-patterns.js";
|
|
3
|
+
import { secretRuleIds } from "./secrets.js";
|
|
4
|
+
/**
|
|
5
|
+
* M10B / DOD-END-SCAN-1 (`M10B-D15`) — a stable digest of the ACTIVE detector corpus.
|
|
6
|
+
*
|
|
7
|
+
* The intake scanner's `scanner_version` is DERIVED from this, never hand-maintained. A hand-bumped
|
|
8
|
+
* constant goes stale the first time someone edits a regex and forgets — and because the directory
|
|
9
|
+
* cannot re-run the scan, that stale value is notarized as evidence of a scan that did not happen,
|
|
10
|
+
* which is the stated reason `DOD-DIR-WRITE-1` made the field signed in the first place.
|
|
11
|
+
*
|
|
12
|
+
* Returns null when either corpus is uncompiled. A digest over "no rules" would be a perfectly
|
|
13
|
+
* stable, perfectly meaningless value that a fail-closed caller could not distinguish from a real
|
|
14
|
+
* one — so the absence is reported as absence (§5a), and the caller refuses.
|
|
15
|
+
*
|
|
16
|
+
* SORTED before hashing, because corpus ORDER is not a property anyone should depend on: reordering
|
|
17
|
+
* the source array changes nothing about which text is caught, and a digest that moved on a reorder
|
|
18
|
+
* would force a spurious `scanner_version` change and read as a rule change to anyone auditing it.
|
|
19
|
+
* What the digest MUST track is the SET of active rules.
|
|
20
|
+
*/
|
|
21
|
+
export function detectorCorpusDigest() {
|
|
22
|
+
const patterns = injectionPatternIds();
|
|
23
|
+
const secrets = secretRuleIds();
|
|
24
|
+
if (patterns === null || secrets === null)
|
|
25
|
+
return null;
|
|
26
|
+
const canonical = JSON.stringify({
|
|
27
|
+
injection: [...patterns].sort(),
|
|
28
|
+
secrets: [...secrets].sort(),
|
|
29
|
+
});
|
|
30
|
+
return createHash("sha256").update(canonical, "utf8").digest("hex");
|
|
31
|
+
}
|
|
32
|
+
//# sourceMappingURL=corpus-digest.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"corpus-digest.js","sourceRoot":"","sources":["../../src/detect/corpus-digest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,oBAAoB;IAClC,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAC;IACvC,MAAM,OAAO,GAAG,aAAa,EAAE,CAAC;IAChC,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,SAAS,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,EAAE;QAC/B,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE;KAC7B,CAAC,CAAC;IACH,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC"}
|
package/dist/detect/index.d.ts
CHANGED
|
@@ -28,7 +28,8 @@
|
|
|
28
28
|
* constraint 3). Reusing `InboundScreener`'s disposition would produce a scanner that passes its
|
|
29
29
|
* tests and never refuses anything (`M10B-D16`). The corpus is shared; the policy is the portal's.
|
|
30
30
|
*/
|
|
31
|
-
export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns } from "./injection-patterns.js";
|
|
32
|
-
export { compileSecretRules, secretRulesReady, redactSecrets } from "./secrets.js";
|
|
31
|
+
export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns, injectionPatternIds } from "./injection-patterns.js";
|
|
32
|
+
export { compileSecretRules, secretRulesReady, redactSecrets, secretRuleIds } from "./secrets.js";
|
|
33
|
+
export { detectorCorpusDigest } from "./corpus-digest.js";
|
|
33
34
|
export type { SecretFinding, SecretScanResult } from "./secrets.js";
|
|
34
35
|
//# sourceMappingURL=index.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC"}
|
package/dist/detect/index.js
CHANGED
|
@@ -28,6 +28,7 @@
|
|
|
28
28
|
* constraint 3). Reusing `InboundScreener`'s disposition would produce a scanner that passes its
|
|
29
29
|
* tests and never refuses anything (`M10B-D16`). The corpus is shared; the policy is the portal's.
|
|
30
30
|
*/
|
|
31
|
-
export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns } from "./injection-patterns.js";
|
|
32
|
-
export { compileSecretRules, secretRulesReady, redactSecrets } from "./secrets.js";
|
|
31
|
+
export { compileInjectionPatterns, injectionPatternsReady, scanInjectionPatterns, injectionPatternIds } from "./injection-patterns.js";
|
|
32
|
+
export { compileSecretRules, secretRulesReady, redactSecrets, secretRuleIds } from "./secrets.js";
|
|
33
|
+
export { detectorCorpusDigest } from "./corpus-digest.js";
|
|
33
34
|
//# sourceMappingURL=index.js.map
|
package/dist/detect/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AACvI,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC"}
|
|
@@ -1,5 +1,16 @@
|
|
|
1
1
|
/** Compile the pattern set. Call once at gateway startup, after `initLinearRegex()` resolves. */
|
|
2
2
|
export declare function compileInjectionPatterns(): void;
|
|
3
|
+
/**
|
|
4
|
+
* The ids of the patterns that ACTUALLY COMPILED, in corpus order — the input to the intake
|
|
5
|
+
* scanner's derived `scanner_version` (`M10B-D15`).
|
|
6
|
+
*
|
|
7
|
+
* The ACTIVE set, not the source list, and the difference is the point: if two deployments compile
|
|
8
|
+
* different subsets (a different RE2 build, a rule that fails to compile), their digests diverge —
|
|
9
|
+
* which is what makes "byte-identical across nodes" mechanically checkable rather than aspirational.
|
|
10
|
+
* Returns null when nothing is compiled, so a caller that must fail closed can tell "no rules" from
|
|
11
|
+
* "not ready".
|
|
12
|
+
*/
|
|
13
|
+
export declare function injectionPatternIds(): string[] | null;
|
|
3
14
|
/** Whether the patterns are compiled (the RE2 engine was initialized). */
|
|
4
15
|
export declare function injectionPatternsReady(): boolean;
|
|
5
16
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"injection-patterns.d.ts","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAmCA,iGAAiG;AACjG,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5D"}
|
|
1
|
+
{"version":3,"file":"injection-patterns.d.ts","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAmCA,iGAAiG;AACjG,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,GAAG,IAAI,CAErD;AAED,0EAA0E;AAC1E,wBAAgB,sBAAsB,IAAI,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAO5D"}
|
|
@@ -32,6 +32,19 @@ const PATTERN_SOURCES = [
|
|
|
32
32
|
export function compileInjectionPatterns() {
|
|
33
33
|
compiled = PATTERN_SOURCES.map(({ id, src }) => ({ id, re: new LinearRegex(src, "i") }));
|
|
34
34
|
}
|
|
35
|
+
/**
|
|
36
|
+
* The ids of the patterns that ACTUALLY COMPILED, in corpus order — the input to the intake
|
|
37
|
+
* scanner's derived `scanner_version` (`M10B-D15`).
|
|
38
|
+
*
|
|
39
|
+
* The ACTIVE set, not the source list, and the difference is the point: if two deployments compile
|
|
40
|
+
* different subsets (a different RE2 build, a rule that fails to compile), their digests diverge —
|
|
41
|
+
* which is what makes "byte-identical across nodes" mechanically checkable rather than aspirational.
|
|
42
|
+
* Returns null when nothing is compiled, so a caller that must fail closed can tell "no rules" from
|
|
43
|
+
* "not ready".
|
|
44
|
+
*/
|
|
45
|
+
export function injectionPatternIds() {
|
|
46
|
+
return compiled === null ? null : compiled.map((c) => c.id);
|
|
47
|
+
}
|
|
35
48
|
/** Whether the patterns are compiled (the RE2 engine was initialized). */
|
|
36
49
|
export function injectionPatternsReady() {
|
|
37
50
|
return compiled !== null;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"injection-patterns.js","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,IAAI,QAAQ,GAA6B,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAuC;IAC1D,iGAAiG;IACjG,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,oHAAoH,EAAE;IAChJ,qBAAqB;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,2LAA2L,EAAE;IACpN,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChH,sCAAsC;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACrG,2CAA2C;IAC3C,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,8DAA8D,EAAE;IACxF,gCAAgC;IAChC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IACxG,iCAAiC;IACjC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mCAAmC,EAAE;CAC9D,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,wBAAwB;IACtC,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
|
1
|
+
{"version":3,"file":"injection-patterns.js","sourceRoot":"","sources":["../../src/detect/injection-patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,IAAI,QAAQ,GAA6B,IAAI,CAAC;AAE9C,MAAM,eAAe,GAAuC;IAC1D,iGAAiG;IACjG,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE,oHAAoH,EAAE;IAChJ,qBAAqB;IACrB,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,2LAA2L,EAAE;IACpN,EAAE,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,8EAA8E,EAAE;IAChH,sCAAsC;IACtC,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,6EAA6E,EAAE;IACrG,2CAA2C;IAC3C,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,8DAA8D,EAAE;IACxF,gCAAgC;IAChC,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,+EAA+E,EAAE;IACxG,iCAAiC;IACjC,EAAE,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,mCAAmC,EAAE;CAC9D,CAAC;AAEF,iGAAiG;AACjG,MAAM,UAAU,wBAAwB;IACtC,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,sBAAsB;IACpC,OAAO,QAAQ,KAAK,IAAI,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,QAAQ,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}
|
package/dist/detect/secrets.d.ts
CHANGED
|
@@ -1,3 +1,9 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The ids of the secret rules that ACTUALLY COMPILED — see `injectionPatternIds` for why the active
|
|
3
|
+
* set rather than the source list. `compileSecretRules` deliberately skips a rule that will not
|
|
4
|
+
* compile under RE2, so the two can differ, and the digest must follow what is really running.
|
|
5
|
+
*/
|
|
6
|
+
export declare function secretRuleIds(): string[] | null;
|
|
1
7
|
/** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */
|
|
2
8
|
export declare function compileSecretRules(): {
|
|
3
9
|
compiled: number;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAqBA;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,EAAE,GAAG,IAAI,CAE/C;AAID,mGAAmG;AACnG,wBAAgB,kBAAkB,IAAI;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAexE;AAED,wBAAgB,gBAAgB,IAAI,OAAO,CAE1C;AAED,MAAM,WAAW,aAAa;IAAG,MAAM,EAAE,MAAM,CAAA;CAAE;AACjD,MAAM,WAAW,gBAAgB;IAAG,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,EAAE,CAAA;CAAE;AAmB7E;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CA6B7D"}
|
package/dist/detect/secrets.js
CHANGED
|
@@ -15,6 +15,14 @@
|
|
|
15
15
|
import { LinearRegex } from "./linear-regex.js";
|
|
16
16
|
import { GITLEAKS_RULES, GITLEAKS_STOPWORDS, GITLEAKS_ALLOW_REGEXES } from "./gitleaks-rules.js";
|
|
17
17
|
let RULES = null;
|
|
18
|
+
/**
|
|
19
|
+
* The ids of the secret rules that ACTUALLY COMPILED — see `injectionPatternIds` for why the active
|
|
20
|
+
* set rather than the source list. `compileSecretRules` deliberately skips a rule that will not
|
|
21
|
+
* compile under RE2, so the two can differ, and the digest must follow what is really running.
|
|
22
|
+
*/
|
|
23
|
+
export function secretRuleIds() {
|
|
24
|
+
return RULES === null ? null : RULES.map((r) => r.id);
|
|
25
|
+
}
|
|
18
26
|
let STOPWORDS = [];
|
|
19
27
|
let ALLOW = [];
|
|
20
28
|
/** Compile the rule set + the false-positive layer. Returns how many of the 222 rules compiled. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIjG,IAAI,KAAK,GAA0B,IAAI,CAAC;
|
|
1
|
+
{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/detect/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIjG,IAAI,KAAK,GAA0B,IAAI,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AACxD,CAAC;AACD,IAAI,SAAS,GAAa,EAAE,CAAC;AAC7B,IAAI,KAAK,GAAkB,EAAE,CAAC;AAE9B,mGAAmG;AACnG,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,cAAc,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtG,CAAC;QAAC,MAAM,CAAC;YACP,sFAAsF;QACxF,CAAC;IACH,CAAC;IACD,KAAK,GAAG,QAAQ,CAAC;IACjB,SAAS,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC3D,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvC,IAAI,CAAC;YAAC,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,IAAI,CAAC;QAAC,CAAC;IAC3D,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IAC/C,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,EAAE,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAKD,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;QAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;IACjF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,qGAAqG;AACrG,SAAS,eAAe,CAAC,KAAa,EAAE,WAAmB;IACzD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,WAAW;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACjD,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAEzC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,4FAA4F;QAC5F,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,SAAS;QAE/F,8FAA8F;QAC9F,uCAAuC;QACvC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;QAClC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,OAAO,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;gBAAE,MAAM;YACvC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC"}
|
package/dist/index.d.ts
CHANGED
|
@@ -23,6 +23,8 @@ export type { InstallResult, InstallOptions } from "./detect/model-installer.js"
|
|
|
23
23
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
24
24
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
25
25
|
export type { ConfigDirection, SetResult, ConfigVersionRow } from "./config/config-store.js";
|
|
26
|
+
export { GatewayStoreError } from "./store/encrypted-db.js";
|
|
27
|
+
export type { GatewayStoreErrorCode } from "./store/encrypted-db.js";
|
|
26
28
|
export { GatewayRecordStore } from "./records/record-store.js";
|
|
27
29
|
export type { RecordDisposition, RecordDirection, RecordInput, SecurityRecord } from "./records/record-store.js";
|
|
28
30
|
export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,YAAY,EACV,eAAe,EACf,iBAAiB,EACjB,qBAAqB,EACrB,eAAe,EACf,aAAa,EACb,aAAa,EACb,qBAAqB,GACtB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,YAAY,EAAE,eAAe,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,YAAY,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAIlF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC1F,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAClH,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC;AACvG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AACtG,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,eAAe,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC7F,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAC5D,YAAY,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,iBAAiB,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AACjH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAG5D,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,YAAY,EACV,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,aAAa,GACd,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AACxD,YAAY,EAAE,gCAAgC,EAAE,MAAM,aAAa,CAAC;AAGpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -11,6 +11,7 @@ export { InjectionScanner, scoreToVerdict, BLOCK_THRESHOLD, FLAG_THRESHOLD } fro
|
|
|
11
11
|
export { isModelInstalled, installModel, verifyModel, sha256File } from "./detect/model-installer.js";
|
|
12
12
|
export { DEBERTA_MODEL } from "./detect/deberta-model-manifest.js";
|
|
13
13
|
export { GatewayConfigStore } from "./config/config-store.js";
|
|
14
|
+
export { GatewayStoreError } from "./store/encrypted-db.js";
|
|
14
15
|
export { GatewayRecordStore } from "./records/record-store.js";
|
|
15
16
|
export { GATEWAY_UNAVAILABLE, GOVERNANCE_TIMEOUT, failClosedVerdict } from "./types.js";
|
|
16
17
|
export { PassthroughGatewayClient } from "./passthrough.js";
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAElH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEtG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,2FAA2F;AAC3F,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQlD,sCAAsC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAiBA,mGAAmG;AACnG,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,6FAA6F;AAC7F,yFAAyF;AACzF,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAE1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAElH,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAEtG,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAE5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACxF,OAAO,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,2FAA2F;AAC3F,OAAO,EACL,eAAe,EACf,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,eAAe,CAAC;AAGvB,oFAAoF;AACpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAQlD,sCAAsC;AACtC,OAAO,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAGxD,mEAAmE;AACnE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC"}
|
|
@@ -15,7 +15,9 @@ export interface SecurityRecord extends RecordInput {
|
|
|
15
15
|
}
|
|
16
16
|
export declare class GatewayRecordStore {
|
|
17
17
|
#private;
|
|
18
|
-
|
|
18
|
+
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
19
|
+
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
20
|
+
constructor(dbPath: string, keyFilePath: string);
|
|
19
21
|
/** Append a security-pass record for one screened message, hash-chained to the prior record. */
|
|
20
22
|
record(input: RecordInput): SecurityRecord;
|
|
21
23
|
/** Every record, oldest first. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"record-store.d.ts","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAsBA,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,CAAC;AACtE,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,UAAU,CAAC;AAErD,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,eAAe,CAAC;IAC3B,WAAW,EAAE,iBAAiB,CAAC;IAC/B,6FAA6F;IAC7F,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,cAAe,SAAQ,WAAW;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AA+BD,qBAAa,kBAAkB;;IAI7B;uGACmG;gBACvF,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;IAK/C,gGAAgG;IAChG,MAAM,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc;IAwC1C,kCAAkC;IAClC,GAAG,IAAI,cAAc,EAAE;IAgBvB,KAAK,IAAI,MAAM;IAKf,yGAAyG;IACzG,WAAW,IAAI,OAAO;IActB,KAAK,IAAI,IAAI;CAWd"}
|
|
@@ -2,7 +2,8 @@
|
|
|
2
2
|
* M9-REC-001 — local security-pass records.
|
|
3
3
|
*
|
|
4
4
|
* The gateway records what it did to EVERY message it screens — clean / redacted / blocked / warned —
|
|
5
|
-
* in
|
|
5
|
+
* in the gateway's SQLCipher store, opened with the daemon's key (DOD-M9C-STORE-1; INV-4 as amended).
|
|
6
|
+
* Each record is hash-chained to the
|
|
6
7
|
* prior one (a per-record fingerprint over the record fields + the previous fingerprint), so a NAIVELY
|
|
7
8
|
* edited, deleted (mid-chain), or reordered record breaks the chain and `verifyChain()` returns false.
|
|
8
9
|
* A CLEAN pass is recorded too: an ABSENT record for a delivered message is itself evidence of suppression.
|
|
@@ -16,7 +17,7 @@
|
|
|
16
17
|
* for cross-node tamper detection is Phase-2 (M9-ATTEST-001); the fingerprint computed here is exactly
|
|
17
18
|
* what gets attested, so Phase 2 is an add, not a rework.
|
|
18
19
|
*/
|
|
19
|
-
import {
|
|
20
|
+
import { openEncryptedStoreDb } from "../store/encrypted-db.js";
|
|
20
21
|
import { createHash } from "node:crypto";
|
|
21
22
|
const DDL = `
|
|
22
23
|
CREATE TABLE IF NOT EXISTS security_records (
|
|
@@ -40,9 +41,10 @@ function fingerprintOf(seq, direction, disposition, contentHash, reason, correla
|
|
|
40
41
|
export class GatewayRecordStore {
|
|
41
42
|
#db;
|
|
42
43
|
#closed = false;
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
44
|
+
/** Opens (creating if absent) the encrypted store at `dbPath`, keyed by the raw 32-byte key in
|
|
45
|
+
* `keyFilePath` — the daemon's own key file (M9C-D8/D9). Throws GatewayStoreError fail-closed. */
|
|
46
|
+
constructor(dbPath, keyFilePath) {
|
|
47
|
+
this.#db = openEncryptedStoreDb(dbPath, keyFilePath);
|
|
46
48
|
this.#db.exec(DDL);
|
|
47
49
|
}
|
|
48
50
|
/** Append a security-pass record for one screened message, hash-chained to the prior record. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA
|
|
1
|
+
{"version":3,"file":"record-store.js","sourceRoot":"","sources":["../../src/records/record-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,oBAAoB,EAAgB,MAAM,0BAA0B,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAoBzC,MAAM,GAAG,GAAG;;;;;;;;;;;;CAYX,CAAC;AAEF,0FAA0F;AAC1F,SAAS,aAAa,CACpB,GAAW,EACX,SAAiB,EACjB,WAAmB,EACnB,WAAmB,EACnB,MAAc,EACd,aAAqB,EACrB,eAAuB;IAEvB,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,GAAG,GAAG,IAAI,SAAS,IAAI,WAAW,IAAI,WAAW,IAAI,MAAM,IAAI,aAAa,IAAI,eAAe,EAAE,CAAC;SACzG,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,OAAO,kBAAkB;IACpB,GAAG,CAAU;IACtB,OAAO,GAAG,KAAK,CAAC;IAEhB;uGACmG;IACnG,YAAY,MAAc,EAAE,WAAmB;QAC7C,IAAI,CAAC,GAAG,GAAG,oBAAoB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED,gGAAgG;IAChG,MAAM,CAAC,KAAkB;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;QAChD,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,iGAAiG;QACjG,oEAAoE;QACpE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACjC,IAAI,GAAW,CAAC;QAChB,IAAI,eAAuB,CAAC;QAC5B,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9B,GAAG,GAAG,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC7B,eAAe,GAAG,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC;YAC5C,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG;iBACL,OAAO,CACN;;8CAEoC,CACrC;iBACA,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;YACpI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC1B,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,OAAO;YACL,GAAG;YACH,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpF,WAAW;YACX,UAAU;SACX,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,GAAG;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,2IAA2I,CAAC;aACpJ,GAAG,EAA4K,CAAC;QACnL,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtB,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,SAAS,EAAE,CAAC,CAAC,SAA4B;YACzC,WAAW,EAAE,CAAC,CAAC,WAAgC;YAC/C,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,CAAC,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,UAAU,EAAE,CAAC,CAAC,WAAW;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,EAAmB,CAAC;QAClG,OAAO,GAAG,CAAC,CAAC,CAAC;IACf,CAAC;IAED,yGAAyG;IACzG,WAAW;QACT,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG;aAClB,OAAO,CAAC,gJAAgJ,CAAC;aACzJ,GAAG,EAAiL,CAAC;QACxL,IAAI,eAAe,GAAG,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC,CAAC,gBAAgB,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC,CAAC,kCAAkC;YAC5F,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;YAC/H,IAAI,QAAQ,KAAK,CAAC,CAAC,WAAW;gBAAE,OAAO,KAAK,CAAC,CAAC,kBAAkB;YAChE,eAAe,GAAG,CAAC,CAAC,WAAW,CAAC;QAClC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,GAAG;aACZ,OAAO,CAAC,yEAAyE,CAAC;aAClF,GAAG,EAAsD,CAAC;IAC/D,CAAC;CACF"}
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
export type GatewayStoreErrorCode = "store_key_unavailable" | "store_key_mismatch" | "store_engine_unavailable" | "store_open_failed";
|
|
2
|
+
export declare class GatewayStoreError extends Error {
|
|
3
|
+
readonly code: GatewayStoreErrorCode;
|
|
4
|
+
/** Actionable next step for the operator — never contains key material. */
|
|
5
|
+
readonly guidance: string;
|
|
6
|
+
constructor(code: GatewayStoreErrorCode, message: string, guidance: string);
|
|
7
|
+
}
|
|
8
|
+
export interface StoreStatement {
|
|
9
|
+
run(...params: unknown[]): {
|
|
10
|
+
changes: number | bigint;
|
|
11
|
+
lastInsertRowid: number | bigint;
|
|
12
|
+
};
|
|
13
|
+
get(...params: unknown[]): unknown;
|
|
14
|
+
all(...params: unknown[]): unknown[];
|
|
15
|
+
}
|
|
16
|
+
export interface StoreDb {
|
|
17
|
+
exec(sql: string): void;
|
|
18
|
+
prepare(sql: string): StoreStatement;
|
|
19
|
+
close(): void;
|
|
20
|
+
}
|
|
21
|
+
/**
|
|
22
|
+
* Open (creating if absent) the gateway's encrypted store file, keyed by the raw 32-byte key in
|
|
23
|
+
* `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
|
|
24
|
+
* Throws GatewayStoreError on every failure path — never returns a plaintext handle.
|
|
25
|
+
*/
|
|
26
|
+
export declare function openEncryptedStoreDb(dbPath: string, keyFilePath: string): StoreDb;
|
|
27
|
+
//# sourceMappingURL=encrypted-db.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"encrypted-db.d.ts","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAuBA,MAAM,MAAM,qBAAqB,GAC7B,uBAAuB,GACvB,oBAAoB,GACpB,0BAA0B,GAC1B,mBAAmB,CAAC;AAExB,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC;IACrC,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBACd,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM;CAM3E;AA0BD,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAAA;KAAE,CAAC;IAC1F,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAAC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAsED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CA2CjF"}
|
|
@@ -0,0 +1,131 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* The gateway's encrypted store engine (DOD-M9C-STORE-1, INV-4 as amended).
|
|
3
|
+
*
|
|
4
|
+
* One SQLCipher file holds BOTH gateway stores (config versions + security records — M9C-D9),
|
|
5
|
+
* keyed by the daemon's key: the caller hands over the KEY FILE PATH (M9C-D8 — never key bytes in
|
|
6
|
+
* env or argv), and this module reads the same raw 32-byte key file the daemon uses for its own
|
|
7
|
+
* database. Same key, same backup set — that is policy D-3's "one key, covered by backup".
|
|
8
|
+
*
|
|
9
|
+
* FAILS CLOSED. A missing key file, a malformed key, or a key that does not decrypt the file each
|
|
10
|
+
* refuse with a distinct code. There is no plaintext fallback and no plaintext read path: no
|
|
11
|
+
* production plaintext gateway store has ever existed (M9C-D7), so nothing here consults one.
|
|
12
|
+
*
|
|
13
|
+
* This deliberately does NOT import from core/daemon (the dependency points the other way); the
|
|
14
|
+
* ~50 lines shared with the daemon's opener are the price of the package boundary. WAL is enabled
|
|
15
|
+
* only AFTER key verification so WAL/SHM files are encrypted; busy_timeout + the stores' own
|
|
16
|
+
* BEGIN IMMEDIATE transactions carry the two-process access (gateway writes records, the daemon
|
|
17
|
+
* writes config and reads records).
|
|
18
|
+
*/
|
|
19
|
+
import { createRequire } from "node:module";
|
|
20
|
+
import { readFileSync } from "node:fs";
|
|
21
|
+
const STORE_KEY_BYTES = 32; // AES-256 — the daemon's key size
|
|
22
|
+
export class GatewayStoreError extends Error {
|
|
23
|
+
code;
|
|
24
|
+
/** Actionable next step for the operator — never contains key material. */
|
|
25
|
+
guidance;
|
|
26
|
+
constructor(code, message, guidance) {
|
|
27
|
+
super(message);
|
|
28
|
+
this.name = "GatewayStoreError";
|
|
29
|
+
this.code = code;
|
|
30
|
+
this.guidance = guidance;
|
|
31
|
+
}
|
|
32
|
+
}
|
|
33
|
+
class AdaptedStatement {
|
|
34
|
+
#inner;
|
|
35
|
+
constructor(inner) {
|
|
36
|
+
this.#inner = inner;
|
|
37
|
+
}
|
|
38
|
+
run(...params) {
|
|
39
|
+
return this.#inner.run(params);
|
|
40
|
+
}
|
|
41
|
+
get(...params) {
|
|
42
|
+
return this.#inner.get(params);
|
|
43
|
+
}
|
|
44
|
+
all(...params) {
|
|
45
|
+
return this.#inner.all(params);
|
|
46
|
+
}
|
|
47
|
+
}
|
|
48
|
+
class AdaptedDb {
|
|
49
|
+
#inner;
|
|
50
|
+
constructor(inner) {
|
|
51
|
+
this.#inner = inner;
|
|
52
|
+
}
|
|
53
|
+
exec(sql) {
|
|
54
|
+
this.#inner.exec(sql);
|
|
55
|
+
}
|
|
56
|
+
prepare(sql) {
|
|
57
|
+
return new AdaptedStatement(this.#inner.prepare(sql));
|
|
58
|
+
}
|
|
59
|
+
close() {
|
|
60
|
+
this.#inner.close();
|
|
61
|
+
}
|
|
62
|
+
}
|
|
63
|
+
function loadEngine() {
|
|
64
|
+
const require = createRequire(import.meta.url);
|
|
65
|
+
try {
|
|
66
|
+
return require("@signalapp/sqlcipher");
|
|
67
|
+
}
|
|
68
|
+
catch (err) {
|
|
69
|
+
const reason = err instanceof Error ? err.message : String(err);
|
|
70
|
+
throw new GatewayStoreError("store_engine_unavailable", `SQLCipher native module unavailable: ${reason}`, "The @signalapp/sqlcipher prebuilt failed to load for this platform. Reinstall the CELLO client.");
|
|
71
|
+
}
|
|
72
|
+
}
|
|
73
|
+
function readStoreKey(keyFilePath) {
|
|
74
|
+
let key;
|
|
75
|
+
try {
|
|
76
|
+
key = readFileSync(keyFilePath);
|
|
77
|
+
}
|
|
78
|
+
catch {
|
|
79
|
+
throw new GatewayStoreError("store_key_unavailable", `gateway store key file not found at ${keyFilePath}`, "The gateway store is encrypted with the daemon's database key and will not open without it. " +
|
|
80
|
+
"Restore the key file from backup; the gateway never falls back to a plaintext store.");
|
|
81
|
+
}
|
|
82
|
+
if (key.length !== STORE_KEY_BYTES) {
|
|
83
|
+
throw new GatewayStoreError("store_key_unavailable", `gateway store key file is ${key.length} bytes, expected ${STORE_KEY_BYTES}`, `The key file at ${keyFilePath} is malformed. Restore it from backup.`);
|
|
84
|
+
}
|
|
85
|
+
return new Uint8Array(key);
|
|
86
|
+
}
|
|
87
|
+
/**
|
|
88
|
+
* Open (creating if absent) the gateway's encrypted store file, keyed by the raw 32-byte key in
|
|
89
|
+
* `keyFilePath`. Verifies the key by reading sqlite_master; enables WAL only after verification.
|
|
90
|
+
* Throws GatewayStoreError on every failure path — never returns a plaintext handle.
|
|
91
|
+
*/
|
|
92
|
+
export function openEncryptedStoreDb(dbPath, keyFilePath) {
|
|
93
|
+
const key = readStoreKey(keyFilePath);
|
|
94
|
+
const mod = loadEngine();
|
|
95
|
+
const Ctor = mod.Database ?? mod.default;
|
|
96
|
+
let inner;
|
|
97
|
+
try {
|
|
98
|
+
inner = new Ctor(dbPath);
|
|
99
|
+
}
|
|
100
|
+
catch (err) {
|
|
101
|
+
const reason = err instanceof Error ? err.message : String(err);
|
|
102
|
+
throw new GatewayStoreError("store_open_failed", reason, `Could not open the gateway store at ${dbPath}.`);
|
|
103
|
+
}
|
|
104
|
+
// Key set outside the message-bearing try: key hex must never reach an error string.
|
|
105
|
+
const keyHex = Buffer.from(key).toString("hex");
|
|
106
|
+
inner.pragma(`key = "x'${keyHex}'"`);
|
|
107
|
+
try {
|
|
108
|
+
inner.prepare("SELECT count(*) AS c FROM sqlite_master").get([]);
|
|
109
|
+
}
|
|
110
|
+
catch {
|
|
111
|
+
try {
|
|
112
|
+
inner.close();
|
|
113
|
+
}
|
|
114
|
+
catch {
|
|
115
|
+
/* ignore */
|
|
116
|
+
}
|
|
117
|
+
throw new GatewayStoreError("store_key_mismatch", "gateway store did not decrypt with the supplied key", "The daemon's key does not match this gateway store file. Restore the matching key file; " +
|
|
118
|
+
"the gateway will not fall back to a plaintext store.");
|
|
119
|
+
}
|
|
120
|
+
// WAL after verification so WAL/SHM are ciphertext; busy_timeout tolerates the daemon's own
|
|
121
|
+
// connection to the same file (SURFACE-1 config writes, AUDIT-1 record reads).
|
|
122
|
+
try {
|
|
123
|
+
inner.pragma("journal_mode=WAL", { simple: true });
|
|
124
|
+
}
|
|
125
|
+
catch {
|
|
126
|
+
/* non-WAL degrades performance, not custody — SQLCipher encrypts the rollback journal too */
|
|
127
|
+
}
|
|
128
|
+
inner.pragma("busy_timeout = 3000");
|
|
129
|
+
return new AdaptedDb(inner);
|
|
130
|
+
}
|
|
131
|
+
//# sourceMappingURL=encrypted-db.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"encrypted-db.js","sourceRoot":"","sources":["../../src/store/encrypted-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,kCAAkC;AAQ9D,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IACjC,IAAI,CAAwB;IACrC,2EAA2E;IAClE,QAAQ,CAAS;IAC1B,YAAY,IAA2B,EAAE,OAAe,EAAE,QAAgB;QACxE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAsCD,MAAM,gBAAgB;IACX,MAAM,CAAkB;IACjC,YAAY,KAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IACD,GAAG,CAAC,GAAG,MAAiB;QACtB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;CACF;AAED,MAAM,SAAS;IACJ,MAAM,CAAiB;IAChC,YAAY,KAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;IACtB,CAAC;IACD,IAAI,CAAC,GAAW;QACd,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IACD,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,KAAK;QACH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,SAAS,UAAU;IACjB,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,sBAAsB,CAAiB,CAAC;IACzD,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CACzB,0BAA0B,EAC1B,wCAAwC,MAAM,EAAE,EAChD,iGAAiG,CAClG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB;IACvC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,uCAAuC,WAAW,EAAE,EACpD,8FAA8F;YAC5F,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACnC,MAAM,IAAI,iBAAiB,CACzB,uBAAuB,EACvB,6BAA6B,GAAG,CAAC,MAAM,oBAAoB,eAAe,EAAE,EAC5E,mBAAmB,WAAW,wCAAwC,CACvE,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,WAAmB;IACtE,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC;IAEzC,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,EAAE,MAAM,EAAE,uCAAuC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAChD,KAAK,CAAC,MAAM,CAAC,YAAY,MAAM,IAAI,CAAC,CAAC;IAErC,IAAI,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,MAAM,IAAI,iBAAiB,CACzB,oBAAoB,EACpB,qDAAqD,EACrD,0FAA0F;YACxF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,4FAA4F;IAC5F,+EAA+E;IAC/E,IAAI,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;IAC/F,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEpC,OAAO,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@cello-protocol/gateway",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.11",
|
|
4
4
|
"private": false,
|
|
5
5
|
"type": "module",
|
|
6
6
|
"engines": {
|
|
@@ -30,6 +30,7 @@
|
|
|
30
30
|
"package.json"
|
|
31
31
|
],
|
|
32
32
|
"dependencies": {
|
|
33
|
+
"@signalapp/sqlcipher": "^3.3.5",
|
|
33
34
|
"re2-wasm": "^1.0.2"
|
|
34
35
|
},
|
|
35
36
|
"optionalDependencies": {
|