@mushi-mushi/core 1.20.0 → 1.20.2

package/CONTRIBUTING.md

@@ -70,7 +70,7 @@ packages/
   react-native/  React Native SDK (MIT)
   cli/           CLI tool (MIT)
   mcp/           MCP server for coding agents (MIT)
-  server/        Supabase Edge Functions (AGPLv3)
+  server/        Supabase Edge Functions (AGPLv3; ee/ is commercial)
   agents/        Agentic fix pipeline (AGPLv3)
   verify/        Fix verification (AGPLv3)
 apps/
@@ -211,7 +211,7 @@ chore: bump dependencies
 ## License
 
 - SDK packages are MIT — your contributions will be MIT-licensed
-- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3
+- Server/agents/verify are AGPLv3 — contributions to those packages fall under AGPLv3. A [commercial license](./COMMERCIAL-LICENSE.md) is available for hosted-SaaS use cases that cannot publish modifications. The `packages/server/ee/` directory is source-available but commercial (production use needs a license); contributions there are accepted under the same EE terms.
 
 ## Questions?
 

package/SECURITY.md

@@ -113,7 +113,7 @@ What we treat as in-scope attacker capabilities, and what we don't.
 | Compromised Supabase service-role key | ❌ | Treated as a tier-0 incident; would require key rotation and audit-log forensics. Not defendable in software. |
 | Compromise of `kensaurus@gmail.com` | ❌ | Treated as a project-fork event; downstream consumers should pin to the last known-good version and follow the new release channel. |
 | Physical / OS-level attacker on an end-user device | ❌ | Out of scope. |
-| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT/BSL grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
+| Malicious fork using the Mushi name to ship malware | ❌ (technical) ✅ (legal) | The MIT / AGPLv3 grant lets the fork exist; the trademark policy (`TRADEMARK.md`) makes shipping it under the Mushi name an infringement we will pursue. |
 
 ## Data handling and PII
 

package/dist/index.cjs

@@ -42,6 +42,47 @@ function formatBytes(n) {
   return `${(n / (1024 * 1024)).toFixed(2)} MB`;
 }
 
+// src/digest.ts
+function getSubtle() {
+  try {
+    const g = globalThis;
+    const crypto2 = g["crypto"];
+    if (crypto2?.subtle) return crypto2.subtle;
+  } catch {
+  }
+  return null;
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+async function sha256Hex(value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const buffer = await subtle.digest("SHA-256", new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  return bytesToHex(sha256(new TextEncoder().encode(value)));
+}
+async function hmacSha256Hex(secret, value) {
+  const subtle = getSubtle();
+  if (subtle) {
+    const key = await subtle.importKey(
+      "raw",
+      new TextEncoder().encode(secret),
+      { name: "HMAC", hash: "SHA-256" },
+      false,
+      ["sign"]
+    );
+    const buffer = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+    return bytesToHex(new Uint8Array(buffer));
+  }
+  const { hmac } = await import('@noble/hashes/hmac.js');
+  const { sha256 } = await import('@noble/hashes/sha2.js');
+  const result = hmac(sha256, new TextEncoder().encode(secret), new TextEncoder().encode(value));
+  return bytesToHex(result);
+}
+
 // src/api-client.ts
 var _credWarningEmitted = false;
 var MUSHI_USER_TOKEN_HEADER = "X-Mushi-User-Token";
@@ -411,21 +452,6 @@ function createApiClient(options) {
     }
   };
 }
-async function sha256Hex(value) {
-  const buffer = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
-async function hmacSha256Hex(secret, value) {
-  const key = await crypto.subtle.importKey(
-    "raw",
-    new TextEncoder().encode(secret),
-    { name: "HMAC", hash: "SHA-256" },
-    false,
-    ["sign"]
-  );
-  const buffer = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value));
-  return Array.from(new Uint8Array(buffer)).map((b) => b.toString(16).padStart(2, "0")).join("");
-}
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }