@chatpanel/events 0.102.0 → 0.103.1

package/vault.js

@@ -1,250 +1,2 @@
-// The vault — secrets that survive a copied disk.
-//
-// ChatPanel already encrypts two things at rest (meeting transcripts, stored API keys), and
-// both of those modules say the same thing in their own comments: the key sits in storage
-// beside the data, so it is obfuscation, not protection, and the real answer is "a key
-// derived from a user passphrase and never written to disk". This is that answer.
-//
-// WHAT IS DIFFERENT HERE, and why it justifies a third crypto path rather than a fourth
-// caller of the second one:
-//
-//   • The key is derived from a passphrase and lives ONLY in session memory. Disk holds
-//     ciphertext, the KDF parameters, and a verifier — nothing that yields the key.
-//   • It FAILS CLOSED. The other two deliberately fail open: a crypto hiccup must never lose
-//     someone's API key, so they fall back to plaintext. A vault that quietly writes
-//     plaintext when something goes wrong is not a vault, so every failure here is an error
-//     the caller has to handle.
-//   • EVERYTHING is encrypted, titles included. A list of entry names is a list of the
-//     accounts someone has — "Chatpanel", "bank", "ex-employer" — which is most of what an
-//     attacker wanted. So a locked vault can say how many entries it holds and nothing else,
-//     and search runs over decrypted entries in memory, after unlocking.
-//
-// Pure and portable: the crypto is WebCrypto, which the browser, Node and a mobile runtime
-// all have, and `subtle`/`random`/`now` are injected so this is testable and replayable. The
-// envelope is versioned and self-describing — a vault written by the extension today must
-// open in a phone app in two years, and the iteration count must be raisable without
-// stranding anyone's data.
-
-export class VaultError extends Error {
-  constructor(code, message) { super(message); this.name = 'VaultError'; this.code = code; }
-}
-
-export const VAULT_VERSION = 1;
-
-// PBKDF2-SHA256. Higher than the backup envelope's 250k because a vault is a standing
-// target rather than a file someone chose to export, and unlocking is a once-per-session
-// cost a person is already waiting through. The parameters travel WITH the vault, so this
-// number can rise later without breaking anything already written.
-export const KDF_ITERATIONS = 310_000;
-export const KDF_HASH = 'SHA-256';
-
-export const MAX_TITLE_CHARS = 200;
-export const MAX_NOTE_CHARS = 20_000;
-export const MAX_SECRET_CHARS = 8_000;
-export const MAX_ENTRIES = 2_000;
-
-// What the verifier proves: that the passphrase derives the same key as last time. It is a
-// constant sealed under the key, so a wrong passphrase fails the AES-GCM tag check and is
-// TOLD APART from an empty vault — "wrong passphrase" and "nothing here" must never look
-// alike to a user staring at an empty list.
-const VERIFIER_PLAINTEXT = 'chatpanel-vault-v1';
-
-const enc = new TextEncoder();
-const dec = new TextDecoder();
-
-const B64_CHUNK = 0x8000;
-export function toB64(bytes) {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let binary = '';
-  for (let i = 0; i < view.length; i += B64_CHUNK) binary += String.fromCharCode(...view.subarray(i, i + B64_CHUNK));
-  return btoa(binary);
-}
-export function fromB64(s) {
-  const binary = atob(String(s || ''));
-  const out = new Uint8Array(binary.length);
-  for (let i = 0; i < binary.length; i += 1) out[i] = binary.charCodeAt(i);
-  return out;
-}
-
-function subtleOf(subtle) {
-  const s = subtle || globalThis.crypto?.subtle;
-  if (!s) throw new VaultError('NO_CRYPTO', 'WebCrypto is unavailable in this runtime');
-  return s;
-}
-function randomOf(random) {
-  const r = random || ((n) => globalThis.crypto.getRandomValues(new Uint8Array(n)));
-  return r;
-}
-
-// ---------------------------------------------------------------------------
-// Entries
-// ---------------------------------------------------------------------------
-
-const str = (v) => typeof v === 'string';
-
-/**
- * An entry is a title, an optional note, and an optional secret. The secret is not special
- * to the crypto — everything is sealed together — it is special to the UI, which must not
- * put it on screen without being asked.
- */
-export function validateEntry(entry) {
-  if (!entry || typeof entry !== 'object') throw new VaultError('SHAPE', 'entry must be an object');
-  if (!str(entry.title) || !entry.title.trim()) throw new VaultError('SHAPE', 'entry.title required');
-  if (entry.title.length > MAX_TITLE_CHARS) throw new VaultError('SHAPE', `entry.title exceeds ${MAX_TITLE_CHARS} chars`);
-  if (entry.note != null && (!str(entry.note) || entry.note.length > MAX_NOTE_CHARS)) {
-    throw new VaultError('SHAPE', `entry.note must be a string under ${MAX_NOTE_CHARS} chars`);
-  }
-  if (entry.secret != null && (!str(entry.secret) || entry.secret.length > MAX_SECRET_CHARS)) {
-    throw new VaultError('SHAPE', `entry.secret must be a string under ${MAX_SECRET_CHARS} chars`);
-  }
-  return entry;
-}
-
-/**
- * What may be shown, logged or handed to a widget WITHOUT revealing anything.
- *
- * `hasSecret` rather than the secret, and never the note: a note is where people put the
- * answers to their security questions. This is the shape every list, search result and log
- * line uses, so there is one definition of "safe to show" instead of one per caller.
- */
-export function entryMeta(entry) {
-  return {
-    id: entry.id,
-    title: entry.title,
-    hasSecret: !!entry.secret,
-    updatedAt: entry.updatedAt || 0,
-    createdAt: entry.createdAt || 0,
-  };
-}
-
-/** Search decrypted entries. Titles and notes match; secrets are never searched. */
-export function searchEntries(entries, query) {
-  const q = String(query || '').trim().toLowerCase();
-  if (!q) return entries;
-  // Searching secret material would leak it through timing and through "1 result" on a page
-  // that never shows the secret — and nobody searches for a password they already have.
-  return entries.filter((e) => `${e.title || ''}\n${e.note || ''}`.toLowerCase().includes(q));
-}
-
-// ---------------------------------------------------------------------------
-// Keys, sealing, opening
-// ---------------------------------------------------------------------------
-
-export async function deriveKey(passphrase, salt, iterations = KDF_ITERATIONS, { subtle } = {}) {
-  const s = subtleOf(subtle);
-  if (!str(passphrase) || !passphrase) throw new VaultError('NO_PASSPHRASE', 'a passphrase is required');
-  const base = await s.importKey('raw', enc.encode(passphrase), 'PBKDF2', false, ['deriveKey']);
-  return s.deriveKey(
-    { name: 'PBKDF2', salt, iterations, hash: KDF_HASH },
-    base,
-    { name: 'AES-GCM', length: 256 },
-    // Extractable, because the host has to hand this key to session storage to survive the
-    // panel being closed and reopened. It never touches disk — see the client's session-only
-    // storage — and a non-extractable key would force a re-prompt on every panel open, which
-    // is the kind of friction that makes people choose a weaker passphrase.
-    true,
-    ['encrypt', 'decrypt'],
-  );
-}
-
-async function seal(key, plaintextString, { subtle, random } = {}) {
-  const s = subtleOf(subtle);
-  const iv = randomOf(random)(12); // fresh per seal — an IV reused under one key breaks GCM
-  const ct = await s.encrypt({ name: 'AES-GCM', iv }, key, enc.encode(plaintextString));
-  return { iv: toB64(iv), ct: toB64(ct) };
-}
-
-async function open(key, sealed, { subtle } = {}) {
-  const s = subtleOf(subtle);
-  if (!sealed?.iv || !sealed?.ct) throw new VaultError('CORRUPT', 'sealed value is missing its iv or ciphertext');
-  try {
-    const out = await s.decrypt({ name: 'AES-GCM', iv: fromB64(sealed.iv) }, key, fromB64(sealed.ct));
-    return dec.decode(out);
-  } catch {
-    // AES-GCM authenticates: this is either the wrong key or tampered bytes, and the caller
-    // cannot tell which. Both mean "do not trust what came back", which is the only thing
-    // the caller needs to act on.
-    throw new VaultError('BAD_KEY', 'wrong passphrase, or the data has been altered');
-  }
-}
-
-/** A brand-new, empty vault. Returns what is safe to write to disk. */
-export async function createVault(passphrase, { subtle, random, now = () => Date.now() } = {}) {
-  const salt = randomOf(random)(16);
-  const key = await deriveKey(passphrase, salt, KDF_ITERATIONS, { subtle });
-  const verifier = await seal(key, VERIFIER_PLAINTEXT, { subtle, random });
-  return {
-    vault: {
-      version: VAULT_VERSION,
-      kdf: { name: 'PBKDF2', hash: KDF_HASH, iterations: KDF_ITERATIONS, salt: toB64(salt) },
-      verifier,
-      entries: {},
-      createdAt: now(),
-    },
-    key,
-  };
-}
-
-/**
- * Derive the key and PROVE it is the right one before the caller stores it.
- *
- * Without the proof, a typo would be discovered later, one entry at a time, as
- * "corrupt data" — and a user would reasonably conclude their vault was destroyed.
- */
-export async function unlockVault(vault, passphrase, { subtle } = {}) {
-  if (!vault?.kdf?.salt) throw new VaultError('NO_VAULT', 'no vault has been created yet');
-  if (vault.version > VAULT_VERSION) {
-    // Forward-compat is a promise in one direction only. Opening a newer vault with older
-    // rules risks writing back something the newer client cannot read.
-    throw new VaultError('TOO_NEW', 'this vault was written by a newer version of ChatPanel');
-  }
-  const key = await deriveKey(passphrase, fromB64(vault.kdf.salt), vault.kdf.iterations || KDF_ITERATIONS, { subtle });
-  await open(key, vault.verifier, { subtle }); // throws BAD_KEY on a wrong passphrase
-  return key;
-}
-
-/** Seal one entry. The whole entry, titles included — see the note at the top. */
-export async function sealEntry(key, entry, { subtle, random, now = () => Date.now() } = {}) {
-  validateEntry(entry);
-  const at = now();
-  const full = { ...entry, updatedAt: at, createdAt: entry.createdAt || at };
-  const sealed = await seal(key, JSON.stringify(full), { subtle, random });
-  // updatedAt is deliberately OUTSIDE the ciphertext as well: a list has to sort without
-  // unlocking, and "something changed at 14:02" is not a secret worth the cost of hiding.
-  return { id: entry.id, updatedAt: at, ...sealed };
-}
-
-export async function openEntry(key, record, { subtle } = {}) {
-  const json = await open(key, record, { subtle });
-  try {
-    const entry = JSON.parse(json);
-    return { ...entry, id: record.id ?? entry.id };
-  } catch {
-    throw new VaultError('CORRUPT', 'entry could not be read');
-  }
-}
-
-// ---------------------------------------------------------------------------
-// Locking
-// ---------------------------------------------------------------------------
-
-export const DEFAULT_LOCK_MS = 15 * 60_000;
-
-/**
- * Auto-lock is measured from the last USE, not from the unlock: a vault someone is actively
- * working in should not lock under their hands, and one they walked away from should.
- */
-export function isLocked({ unlockedAt = 0, lastUsedAt = 0, now = Date.now(), timeoutMs = DEFAULT_LOCK_MS } = {}) {
-  if (!unlockedAt) return true;
-  if (!timeoutMs) return false; // 0 = stay unlocked until the session ends or the user locks
-  return now - Math.max(unlockedAt, lastUsedAt) >= timeoutMs;
-}
-
-/** How many entries a locked vault may admit to holding. A count is not a secret; names are. */
-export function lockedSummary(vault) {
-  return { exists: !!vault?.kdf, entries: Object.keys(vault?.entries || {}).length, locked: true };
-}
-
-export function canAddEntry(vault) {
-  return Object.keys(vault?.entries || {}).length < MAX_ENTRIES;
-}
+class i extends Error{constructor(e,n){super(n),this.name="VaultError",this.code=e}}const w=1,s=31e4,h="SHA-256",p=200,A=2e4,E=8e3,m=2e3,C="chatpanel-vault-v1",x=new TextEncoder,v=new TextDecoder,y=32768;function d(t){const e=t instanceof Uint8Array?t:new Uint8Array(t);let n="";for(let r=0;r<e.length;r+=y)n+=String.fromCharCode(...e.subarray(r,r+y));return btoa(n)}function l(t){const e=atob(String(t||"")),n=new Uint8Array(e.length);for(let r=0;r<e.length;r+=1)n[r]=e.charCodeAt(r);return n}function f(t){const e=t||globalThis.crypto?.subtle;if(!e)throw new i("NO_CRYPTO","WebCrypto is unavailable in this runtime");return e}function S(t){return t||(n=>globalThis.crypto.getRandomValues(new Uint8Array(n)))}const u=t=>typeof t=="string";function O(t){if(!t||typeof t!="object")throw new i("SHAPE","entry must be an object");if(!u(t.title)||!t.title.trim())throw new i("SHAPE","entry.title required");if(t.title.length>p)throw new i("SHAPE",`entry.title exceeds ${p} chars`);if(t.note!=null&&(!u(t.note)||t.note.length>A))throw new i("SHAPE",`entry.note must be a string under ${A} chars`);if(t.secret!=null&&(!u(t.secret)||t.secret.length>E))throw new i("SHAPE",`entry.secret must be a string under ${E} chars`);return t}function P(t){return{id:t.id,title:t.title,hasSecret:!!t.secret,updatedAt:t.updatedAt||0,createdAt:t.createdAt||0}}function H(t,e){const n=String(e||"").trim().toLowerCase();return n?t.filter(r=>`${r.title||""}
+${r.note||""}`.toLowerCase().includes(n)):t}async function _(t,e,n=s,{subtle:r}={}){const o=f(r);if(!u(t)||!t)throw new i("NO_PASSPHRASE","a passphrase is required");const a=await o.importKey("raw",x.encode(t),"PBKDF2",!1,["deriveKey"]);return o.deriveKey({name:"PBKDF2",salt:e,iterations:n,hash:h},a,{name:"AES-GCM",length:256},!0,["encrypt","decrypt"])}async function g(t,e,{subtle:n,random:r}={}){const o=f(n),a=S(r)(12),c=await o.encrypt({name:"AES-GCM",iv:a},t,x.encode(e));return{iv:d(a),ct:d(c)}}async function T(t,e,{subtle:n}={}){const r=f(n);if(!e?.iv||!e?.ct)throw new i("CORRUPT","sealed value is missing its iv or ciphertext");try{const o=await r.decrypt({name:"AES-GCM",iv:l(e.iv)},t,l(e.ct));return v.decode(o)}catch{throw new i("BAD_KEY","wrong passphrase, or the data has been altered")}}async function k(t,{subtle:e,random:n,now:r=()=>Date.now()}={}){const o=S(n)(16),a=await _(t,o,s,{subtle:e}),c=await g(a,C,{subtle:e,random:n});return{vault:{version:w,kdf:{name:"PBKDF2",hash:h,iterations:s,salt:d(o)},verifier:c,entries:{},createdAt:r()},key:a}}async function K(t,e,{subtle:n}={}){if(!t?.kdf?.salt)throw new i("NO_VAULT","no vault has been created yet");if(t.version>w)throw new i("TOO_NEW","this vault was written by a newer version of ChatPanel");const r=await _(e,l(t.kdf.salt),t.kdf.iterations||s,{subtle:n});return await T(r,t.verifier,{subtle:n}),r}async function N(t,e,{subtle:n,random:r,now:o=()=>Date.now()}={}){O(e);const a=o(),c={...e,updatedAt:a,createdAt:e.createdAt||a},b=await g(t,JSON.stringify(c),{subtle:n,random:r});return{id:e.id,updatedAt:a,...b}}async function D(t,e,{subtle:n}={}){const r=await T(t,e,{subtle:n});try{const o=JSON.parse(r);return{...o,id:e.id??o.id}}catch{throw new i("CORRUPT","entry could not be read")}}const R=15*6e4;function U({unlockedAt:t=0,lastUsedAt:e=0,now:n=Date.now(),timeoutMs:r=R}={}){return t?r?n-Math.max(t,e)>=r:!1:!0}function L(t){return{exists:!!t?.kdf,entries:Object.keys(t?.entries||{}).length,locked:!0}}function M(t){return Object.keys(t?.entries||{}).length<m}export{R as DEFAULT_LOCK_MS,h as KDF_HASH,s as KDF_ITERATIONS,m as MAX_ENTRIES,A as MAX_NOTE_CHARS,E as MAX_SECRET_CHARS,p as MAX_TITLE_CHARS,w as VAULT_VERSION,i as VaultError,M as canAddEntry,k as createVault,_ as deriveKey,P as entryMeta,l as fromB64,U as isLocked,L as lockedSummary,D as openEntry,N as sealEntry,H as searchEntries,d as toB64,K as unlockVault,O as validateEntry};

package/view.js

@@ -1,88 +1 @@
-// CAPABILITY VIEWS — a capability may ship its own UI, so a result can be an interactive
-// component instead of a paragraph of text.
-//
-// This is NOT the model writing HTML. That already exists (an ```html artifact runs in the
-// sandbox) and is deliberately powerless: it is untrusted text, so it can only draw. A view
-// is declared by a capability that a user or admin approved at load time, which is what
-// makes it safe to give it something a model-authored page can never have — the ability to
-// ACT, by invoking capabilities.
-//
-// The rule that keeps that safe is one line: a view may invoke only what its own capability
-// is already allowed to invoke. A calculator view can compute because its capability may; it
-// cannot read history unless that capability was granted `history` in the first place. There
-// is no path here that widens a permission — `mayInvoke` can only ever name capabilities the
-// declaring capability already lists in `requires`, and validateViewInvocation refuses
-// anything outside that set before the kernel is ever consulted.
-//
-// Pure and host-free by design: no DOM, no postMessage, no chrome.*. The client owns the
-// transport; this owns what is legal to say over it.
-
-import { EventError } from './event.js';
-
-const str = (v) => typeof v === 'string' && v.length > 0;
-
-/**
- * Validate a view DECLARATION. Like the rest of the capability contract this must be
- * readable — and therefore approvable — without executing anything.
- */
-export function validateView(view, capability = null) {
-  if (!view || typeof view !== 'object') throw new EventError('SHAPE', 'view must be an object');
-  if (!str(view.id)) throw new EventError('SHAPE', 'view.id required');
-  if (!str(view.html)) throw new EventError('SHAPE', 'view.html required — a self-contained document');
-  if (view.mayInvoke != null && !(Array.isArray(view.mayInvoke) && view.mayInvoke.every(str))) {
-    throw new EventError('SHAPE', 'view.mayInvoke must be string[]');
-  }
-  // NO PRIVILEGE ESCALATION BY DECLARATION. A view is part of its capability, so it cannot
-  // reach past it: every id it wants to call must already be in that capability's `requires`
-  // (or be the capability itself). Caught here, at approval time, rather than at call time.
-  if (capability && view.mayInvoke?.length) {
-    const allowed = new Set([capability.id, ...(capability.requires || [])]);
-    const extra = view.mayInvoke.filter((id) => !allowed.has(id));
-    if (extra.length) {
-      throw new EventError('CONTRADICTION',
-        `view.mayInvoke exceeds its capability: ${extra.join(', ')} not in requires`);
-    }
-  }
-  if (view.height != null && !(Number.isInteger(view.height) && view.height > 0 && view.height <= 2000)) {
-    throw new EventError('SHAPE', 'view.height must be a positive integer <= 2000');
-  }
-  return view;
-}
-
-/**
- * Turn a message a VIEW sent into a capability invocation the kernel can judge — or refuse
- * it. The view is sandboxed and its messages are untrusted input, so nothing here trusts a
- * field: the capability id is checked against what the declaration allows, not against what
- * the message claims to be entitled to.
- *
- * Returns { capability, args, callId }. Throws EventError otherwise.
- */
-export function validateViewInvocation(msg, capability) {
-  if (!capability?.view) throw new EventError('SHAPE', 'capability declares no view');
-  if (!msg || typeof msg !== 'object') throw new EventError('SHAPE', 'view message must be an object');
-  if (!str(msg.callId)) throw new EventError('SHAPE', 'view message needs a callId to correlate its result');
-  if (!str(msg.capability)) throw new EventError('SHAPE', 'view message must name a capability');
-
-  const allowed = new Set([capability.id, ...(capability.view.mayInvoke || [])]);
-  if (!allowed.has(msg.capability)) {
-    // The important refusal. A compromised or buggy view asking for something else stops
-    // here, before any kernel guard has to have an opinion about it.
-    throw new EventError('DENIED',
-      `view of "${capability.id}" may not invoke "${msg.capability}"`);
-  }
-  if (msg.args != null && (typeof msg.args !== 'object' || Array.isArray(msg.args))) {
-    throw new EventError('SHAPE', 'view invocation args must be an object');
-  }
-  return { capability: msg.capability, args: msg.args || {}, callId: msg.callId };
-}
-
-/**
- * The state a view is mounted with, as it appears on a capability RESULT. Kept separate from
- * the canonical value: `value` is what the capability computed and what everything else
- * reasons about; `view`/`state` are only how it is shown. A host that cannot render views
- * ignores these two fields and still has the whole answer.
- */
-export function viewResult(value, capability, state = null) {
-  if (!capability?.view) return { value };
-  return { value, view: capability.view.id, state: state ?? value };
-}
+import{EventError as t}from"./event.js";const i=e=>typeof e=="string"&&e.length>0;function w(e,n=null){if(!e||typeof e!="object")throw new t("SHAPE","view must be an object");if(!i(e.id))throw new t("SHAPE","view.id required");if(!i(e.html))throw new t("SHAPE","view.html required — a self-contained document");if(e.mayInvoke!=null&&!(Array.isArray(e.mayInvoke)&&e.mayInvoke.every(i)))throw new t("SHAPE","view.mayInvoke must be string[]");if(n&&e.mayInvoke?.length){const r=new Set([n.id,...n.requires||[]]),o=e.mayInvoke.filter(a=>!r.has(a));if(o.length)throw new t("CONTRADICTION",`view.mayInvoke exceeds its capability: ${o.join(", ")} not in requires`)}if(e.height!=null&&!(Number.isInteger(e.height)&&e.height>0&&e.height<=2e3))throw new t("SHAPE","view.height must be a positive integer <= 2000");return e}function s(e,n){if(!n?.view)throw new t("SHAPE","capability declares no view");if(!e||typeof e!="object")throw new t("SHAPE","view message must be an object");if(!i(e.callId))throw new t("SHAPE","view message needs a callId to correlate its result");if(!i(e.capability))throw new t("SHAPE","view message must name a capability");if(!new Set([n.id,...n.view.mayInvoke||[]]).has(e.capability))throw new t("DENIED",`view of "${n.id}" may not invoke "${e.capability}"`);if(e.args!=null&&(typeof e.args!="object"||Array.isArray(e.args)))throw new t("SHAPE","view invocation args must be an object");return{capability:e.capability,args:e.args||{},callId:e.callId}}function h(e,n,r=null){return n?.view?{value:e,view:n.view.id,state:r??e}:{value:e}}export{w as validateView,s as validateViewInvocation,h as viewResult};