@fangorn-network/westmarch 2026.10.29 → 2026.11.4-dev

package/src/publish/envelope.js

@@ -1,185 +0,0 @@
-// The on-the-wire envelope format, shared by everything that writes it.
-//
-// `ns` — the app's namespace string — is the first argument of the two id
-// derivations and it is NOT defaulted. It is folded into every resourceId ever
-// minted, so it is permanent: changing an app's ns orphans everything that app
-// already published, and two apps that accidentally share one mint into each
-// other's id space. An app pins it once (sond3r: src/pay/envelope.js) and never
-// again. A default here would be a way to pick it by accident.
-//
-// Three implementations used to need these constants to agree — server/settle.js
-// (relay-side publish), src/pay/encrypt.js (browser-side publish) and src/pay/stream.js /
-// src/pay/buy.js (the buyer, unpacking). They agree because they import from here.
-// A mismatch is not a crash: chunk `i` decrypts to garbage, or a key lands where
-// the worker's /access gate isn't looking, and the file goes dark for everyone
-// who paid for it.
-//
-// Browser-safe on purpose: viem only, no node builtins.
-import { concat, encodePacked, hexToBytes, keccak256, numberToHex, stringToBytes } from "viem";
-
-/** The bytes32 the publisher hands createResource. Stable per manifest uid. */
-export const uidHashFor = (ns, uid) => keccak256(stringToBytes(`${ns}:${uid}`));
-
-/** What that uid becomes on-chain: keccak(publisher ++ uid), derived by the
- *  registry (`resource_id_of`) and reproduced here. Two publishers with the same
- *  uid get two different resources, which is what makes an id impossible to
- *  squat — and it means this derivation must match the contract exactly, or a
- *  publish uploads ciphertext to a key no on-chain resource points at.
- *
- *  It lives here rather than in server/index.js because the BROWSER derives it
- *  too now (it names the R2 key it uploads ciphertext to) and the server derives
- *  it when minting the resource. Two copies that disagreed would put the bytes
- *  and the resource at different ids, and the file would be unbuyable. Pinned
- *  against the registry's own view in sond3r's server/index.js --selfcheck. */
-export const resourceIdFor = (ns, owner, uid) => keccak256(concat([owner, uidHashFor(ns, uid)]));
-
-export const NONCE_LEN = 12;
-
-/** 64MiB — under Cloudflare's 100MB body cap with room for nonce/tag/headers. */
-export const CHUNK_SIZE = 64 * 1024 * 1024;
-
-/** R2 key for chunk `i`. Chunk 0 is the resourceId itself, so the sealed DEK
- *  lands exactly where the worker's /access gate looks for it and a small file
- *  is still a single object. Every buyer-side unpacker must match this. */
-export const chunkKey = (resourceId, i) =>
-    i === 0 ? resourceId : keccak256(encodePacked(["bytes32", "uint32"], [resourceId, i]));
-
-/** AES-GCM additional data: the chunk index, big-endian. MUST match src/pay/buy.js. */
-export const aadFor = (i) => hexToBytes(numberToHex(i, { size: 4 }));
-
-/**
- * Compress-then-encrypt: what gets sealed is `flag(1) || bytes`, flag 1 = gzip.
- * ponytail: gzip only when it actually shrinks. mp4/webm/jpeg are already
- * compressed and gzip *grows* them, so the flag makes the store-raw case the
- * fallback instead of a 0.03% tax. MUST match unpack() in src/pay/stream.js.
- */
-export async function pack(plain) {
-    const gz = new Uint8Array(await new Response(
-        new Response(plain).body.pipeThrough(new CompressionStream("gzip")),
-    ).arrayBuffer());
-    const win = gz.length < plain.length;
-    const out = new Uint8Array((win ? gz.length : plain.length) + 1);
-    out[0] = win ? 1 : 0;
-    out.set(win ? gz : plain, 1);
-    return out;
-}
-
-/**
- * The inverse of pack(). It lives here, beside its inverse, because a packer and
- * an unpacker in two repos is a format with two definitions — and the failure is
- * not a crash but a file that uploads fine and is undecryptable forever.
- */
-export async function unpack(bytes) {
-    if (bytes[0] === 0) return bytes.subarray(1);
-    // Not 0/1 means these bytes aren't packed at all — almost always ciphertext
-    // uploaded before the compression format landed. The publisher re-publishes;
-    // there is nothing the buyer can do.
-    if (bytes[0] !== 1) throw new Error(`unknown chunk encoding ${bytes[0]} — this file needs re-publishing`);
-    return new Uint8Array(await new Response(
-        new Response(bytes.subarray(1)).body.pipeThrough(new DecompressionStream("gzip")),
-    ).arrayBuffer());
-}
-
-/** GET the worker's static X25519 pubkey (what DEKs are sealed to). */
-export async function getWorkerPubkey(workerUrl) {
-    const res = await fetch(`${workerUrl}/pubkey`);
-    if (!res.ok) throw new Error(`/pubkey failed: ${res.status}`);
-    const { pubkey } = await res.json();
-    return hexToBytes(pubkey);
-}
-
-/**
- * POST one already-encrypted chunk to the access worker's R2.
- *
- * `sealedDek` is omitted for objects that are the publisher's own state rather
- * than something a buyer will pay for — the worker then writes no DEK object, so
- * /access has nothing to release. See handleUpload in the worker.
- */
-export async function putChunk({ workerUrl, uploadToken, key, body, sealedDek, immutable = false }) {
-    const res = await fetch(`${workerUrl}/upload/${key}`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/octet-stream",
-            ...(sealedDek ? { "X-Sealed-Dek": sealedDek } : {}),
-            // Only for a key that IS its content's digest. A resourceId is derived
-            // from (publisher, uid), so a re-publish rewrites it with new bytes
-            // under a new DEK, and an edge still serving the old ones hands every
-            // buyer ciphertext that decrypts to garbage. A shard named by its own
-            // sha256 cannot have that problem, and is the reason this flag exists.
-            ...(immutable ? { "X-Immutable": "1" } : {}),
-            // The worker's upload gate. On a fresh publisher-owned worker the
-            // first request carrying this claims the bucket to it.
-            ...(uploadToken ? { Authorization: `Bearer ${uploadToken}` } : {}),
-        },
-        body,
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        // A quota refusal is the one upload failure a publisher can act on, so its
-        // message is passed through instead of buried in a URL and a status code.
-        const reason = (() => { try { return JSON.parse(text).error; } catch { return null; } })();
-        throw new Error(res.status === 413 && reason ? reason : `${workerUrl}/upload/${key}: ${res.status} ${text}`);
-    }
-    return res;
-}
-
-/**
- * Delete every chunk of a published resource, and its sealed DEK, from the
- * worker. Returns the number of chunks it asked the worker to drop.
- *
- * The chunk count comes from the caller's manifest rather than from the worker,
- * because the worker deliberately won't synthesize keys (see handleDelete in
- * webworker/fangorn-access-worker) — the key derivation lives here, next to the
- * upload that used it.
- *
- * Failures are RAISED, not swallowed. A delete that half-worked must not be
- * reported as freed space: the operator is still paying for whatever is left,
- * and silently crediting the publisher for it is how the storage ledger drifts
- * away from the R2 bill.
- */
-export async function deleteResource({ workerUrl, uploadToken, resourceId, chunks = 1 }) {
-    for (let i = 0; i < Math.max(1, chunks); i++) {
-        const res = await fetch(`${workerUrl}/upload/${chunkKey(resourceId, i)}`, {
-            method: "DELETE",
-            headers: uploadToken ? { Authorization: `Bearer ${uploadToken}` } : {},
-        });
-        // 404 is a worker too old to have the route; that's a real failure, since
-        // nothing was deleted and the caller is about to free the allowance.
-        if (!res.ok) throw new Error(`${workerUrl} refused to delete chunk ${i} of ${resourceId}: ${res.status} ${res.statusText}`);
-    }
-    return Math.max(1, chunks);
-}
-
-// ── self-check: `node src/publish/envelope.js` ───────────────────────────────────
-//
-// These vectors are PINNED to the values sond3r's own envelope.js produced before
-// this file was extracted from it, with ns = "sond3r". They are not a style test:
-// every resourceId ever minted by fangorn.tv is derived by this function, and a
-// change here that shifts one byte makes ciphertext already in R2 unreachable from
-// the resource anyone paid for. If this fails, the extraction broke money.
-if (typeof process !== "undefined" && import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/envelope.js")) {
-    const owner = `0x${"11".repeat(20)}`;
-    const uid = "Show/S1/a.mp4";
-
-    const h = uidHashFor("sond3r", uid);
-    if (h !== "0x855b20df257479ad7d5d5be0bcddc8c8554bff19edb33adb818872dd3d9e0d04") {
-        throw new Error(`uidHashFor drifted: ${h}`);
-    }
-    const r = resourceIdFor("sond3r", owner, uid);
-    if (r !== "0x0f919abdf691fae94b36395e67f7ed3301f0faea6027ffe609612656556a28a5") {
-        throw new Error(`resourceIdFor drifted: ${r}`);
-    }
-
-    // The namespace is what separates two apps' id spaces. Same owner, same uid,
-    // different app → different resource, or one app could mint over another's.
-    if (resourceIdFor("wiki", owner, uid) === r) throw new Error("ns does not reach the resourceId");
-    if (uidHashFor("wiki", uid) === h) throw new Error("ns does not reach the uid hash");
-
-    // Chunk 0 IS the resourceId — the worker's /access gate looks for the sealed
-    // DEK there and nowhere else.
-    if (chunkKey(r, 0) !== r) throw new Error("chunk 0 must be the resourceId itself");
-    if (chunkKey(r, 1) === r) throw new Error("chunk 1 collided with chunk 0");
-    if (aadFor(1).length !== 4) throw new Error("aad must be 4 bytes, big-endian");
-
-    console.log("envelope.js self-check ok — pinned sond3r ids, ns separation, chunk keys");
-}

package/src/publish/manifest.js

@@ -1,142 +0,0 @@
-// The publisher's working library, kept in their own bucket.
-//
-// It records what a relay must never hold: the per-file price, description, and
-// the stable `uid` that keeps a file's PAID identity across a rename. Storing it
-// in the bucket rather than on the relay is what lets a library follow its
-// publisher between machines, and what stops the relay from being the thing that
-// remembers who sells what.
-//
-// It is a CACHE of something already public — the commit graph carries every
-// published file's path, price, description and pointer — so an empty bucket is
-// recoverable (`manifestFromTree`) rather than fatal.
-//
-// `ns` is the app's namespace and is NOT defaulted, for the same reason
-// envelope.js refuses to default it: the key is derived from it, so a changed ns
-// silently addresses a DIFFERENT manifest and the next publish re-mints every
-// uid in a library that looks empty.
-import { keccak256, stringToBytes } from "viem";
-import { putChunk } from "./envelope.js";
-
-/** R2 key for `owner`'s manifest under app `ns`. A bytes32, because that is the
- *  only key shape the worker accepts — see isObjectKey. */
-export const manifestKey = (ns, owner) => keccak256(stringToBytes(`${ns}:manifest:${owner.toLowerCase()}`));
-
-// A FUNCTION, not a constant. `{ ...EMPTY }` is a shallow copy — every caller
-// would share one `files` object, so in any process that serves more than one
-// publisher a first-publish read hands back the previous publisher's staged
-// entries and the next write commits them to the wrong library.
-const empty = () => ({ files: {} });
-
-/** Read `owner`'s manifest back. A worker that has never seen one answers 404,
- *  which is the ordinary first-publish state, not an error. */
-export async function readManifest({ ns, workerUrl, uploadToken, owner }) {
-    const res = await fetch(`${workerUrl}/upload/${manifestKey(ns, owner)}`, {
-        headers: uploadToken ? { Authorization: `Bearer ${uploadToken}` } : {},
-    });
-    if (res.status === 404) return empty();
-    if (!res.ok) throw new Error(`could not read your library manifest from ${workerUrl}: ${res.status} ${await res.text()}`);
-    try {
-        return JSON.parse(new TextDecoder().decode(await res.arrayBuffer()));
-    } catch {
-        // Better to say so than to hand back an empty manifest, which would look
-        // like an empty library and re-mint every uid on the next publish.
-        throw new Error(`your library manifest at ${workerUrl} is corrupt — it did not parse as JSON`);
-    }
-}
-
-export async function writeManifest({ ns, workerUrl, uploadToken, owner, manifest }) {
-    await putChunk({
-        workerUrl, uploadToken, key: manifestKey(ns, owner),
-        body: new TextEncoder().encode(JSON.stringify(manifest, null, 2)),
-    });
-    return manifest;
-}
-
-export const newUid = () => `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 8)}`;
-
-/**
- * Rebuild manifest entries from a publisher's own on-chain library tree.
- *
- * Two things it deliberately does not recover:
- *  - `uid`. resourceId is keccak(owner ++ keccak(ns+":"+uid)), which is one-way.
- *    It does not matter: identity is carried by `published.resourceId`, and every
- *    path that could re-derive an id prefers the recorded one. So a fresh uid on
- *    a recovered entry never changes what a buyer already paid for.
- *  - Unpublished files. They were never on-chain.
- */
-export function manifestFromTree(files, { defaultPrice = "1000", newUid: uid = newUid } = {}) {
-    const out = {};
-    for (const n of files ?? []) {
-        if (!n?.path) continue;
-        out[n.path] = {
-            uid: uid(),
-            ...(n.mime ? { mime: n.mime } : {}),
-            ...(n.desc ? { desc: n.desc } : {}),
-            price: String(n.price ?? defaultPrice),
-            // No resourceId in the payload means a free catalog entry — that
-            // absence is the signal everywhere downstream, so it round-trips as
-            // `forSale: false` rather than as a price with nothing to buy.
-            ...(n.resourceId
-                ? {
-                    published: {
-                        resourceId: n.resourceId, workerUrl: n.workerUrl, plaintextHash: n.plaintextHash,
-                        chunks: n.chunks ?? 1, size: n.size, chunkSize: n.chunkSize, mime: n.mime,
-                    },
-                }
-                : { forSale: false }),
-        };
-    }
-    return out;
-}
-
-// ── self-check: `node src/publish/manifest.js` ───────────────────────────────────
-if (import.meta.url === `file://${process.argv[1]}` && process.argv[1].endsWith("/manifest.js")) {
-    const assert = (c, m) => { if (!c) throw new Error(m); };
-
-    // PINNED. sond3r's manifests are already in R2 under this exact key; if this
-    // value moves, every existing publisher's library reads back as empty and the
-    // next publish re-mints every uid they own.
-    const owner = "0x147c24c5Ea2f1EE1ac42AD16820De23bBba45Ef6";
-    assert(manifestKey("sond3r", owner) === keccak256(stringToBytes(`sond3r:manifest:${owner.toLowerCase()}`)),
-        "the sond3r manifest key must not move");
-    assert(manifestKey("sond3r", owner) === manifestKey("sond3r", owner.toLowerCase()),
-        "address casing is not identity");
-    assert(manifestKey("sond3r", owner) !== manifestKey("other", owner),
-        "two apps must not share one manifest key");
-
-    // A 404 is the first-publish state, and it must not be confused with a read
-    // that failed — one returns an empty library, the other has to raise.
-    const real = globalThis.fetch;
-    try {
-        globalThis.fetch = async () => ({ status: 404 });
-        assert((await readManifest({ ns: "x", workerUrl: "http://w", owner })).files &&
-            Object.keys((await readManifest({ ns: "x", workerUrl: "http://w", owner })).files).length === 0,
-            "404 is an empty library");
-        globalThis.fetch = async () => ({ status: 500, ok: false, text: async () => "boom" });
-        await readManifest({ ns: "x", workerUrl: "http://w", owner }).then(
-            () => { throw new Error("a failed read must raise, not look empty"); },
-            (e) => assert(/could not read/.test(e.message), e.message));
-        globalThis.fetch = async () => ({ status: 200, ok: true, arrayBuffer: async () => new TextEncoder().encode("{not json").buffer });
-        await readManifest({ ns: "x", workerUrl: "http://w", owner }).then(
-            () => { throw new Error("corrupt JSON must raise — an empty manifest re-mints every uid"); },
-            (e) => assert(/corrupt/.test(e.message), e.message));
-
-        // The empty read must not be a shared object two callers can edit.
-        globalThis.fetch = async () => ({ status: 404 });
-        const a = await readManifest({ ns: "x", workerUrl: "http://w", owner });
-        a.files.poisoned = true;
-        assert(!(await readManifest({ ns: "x", workerUrl: "http://w", owner })).files.poisoned,
-            "the empty manifest must be a fresh object");
-    } finally { globalThis.fetch = real; }
-
-    // A tree with no resourceId is a free catalog entry, not a price with
-    // nothing behind it.
-    const built = manifestFromTree(
-        [{ path: "a.mp4", resourceId: "0xabc", chunks: 2, price: 500 }, { path: "b.txt" }, { bad: 1 }],
-        { newUid: () => "uid" });
-    assert(Object.keys(built).length === 2, "a node with no path is not a file");
-    assert(built["a.mp4"].published.resourceId === "0xabc" && built["a.mp4"].price === "500", "a sold file keeps its pointer");
-    assert(built["b.txt"].forSale === false && !built["b.txt"].published, "no resourceId means a free catalog entry");
-
-    console.log("manifest.js self-check ok — key pinned + ns-scoped, 404 vs failure, corrupt read raises, free entries");
-}