@orbitmem/sdk 0.1.0

package/src/data/__tests__/pricing.test.ts

@@ -0,0 +1,73 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+
+import { hasOrbitDbNativeSupport } from "../../__tests__/orbitdb-availability.js";
+
+const orbitdbAvailable = hasOrbitDbNativeSupport();
+
+describe.skipIf(!orbitdbAvailable)("Vault Pricing", () => {
+  let vault: any;
+  let pricing: any;
+  let cleanup: () => Promise<void>;
+
+  beforeAll(async () => {
+    const { createOrbitDBInstance, createVault } = await import("../index.js");
+    const { createVaultPricing } = await import("../pricing.js");
+    const { orbitdb, cleanup: c } = await createOrbitDBInstance({
+      directory: "./.test-orbitdb-pricing",
+    });
+    cleanup = c;
+    vault = await createVault(orbitdb, {});
+    pricing = createVaultPricing(vault.metaDb);
+  });
+
+  afterAll(async () => {
+    await vault?.close?.();
+    await cleanup?.();
+  });
+
+  test("getPrice returns null when no price set and no default", async () => {
+    const price = await pricing.getPrice("some/path");
+    expect(price).toBeNull();
+  });
+
+  test("setPrice and getPrice round-trip", async () => {
+    await pricing.setPrice("agent/memory", { amount: "0.005", currency: "USDC" });
+    const price = await pricing.getPrice("agent/memory");
+    expect(price).toEqual({ amount: "0.005", currency: "USDC" });
+  });
+
+  test("getPrice falls back to _default", async () => {
+    await pricing.setPrice("_default", { amount: "0.001", currency: "USDC" });
+    const price = await pricing.getPrice("unpriced/path");
+    expect(price).toEqual({ amount: "0.001", currency: "USDC" });
+  });
+
+  test("per-path price overrides _default", async () => {
+    const price = await pricing.getPrice("agent/memory");
+    expect(price).toEqual({ amount: "0.005", currency: "USDC" });
+  });
+
+  test("removePrice reverts to _default", async () => {
+    await pricing.removePrice("agent/memory");
+    const price = await pricing.getPrice("agent/memory");
+    expect(price).toEqual({ amount: "0.001", currency: "USDC" });
+  });
+
+  test("removePrice with no _default returns null", async () => {
+    await pricing.removePrice("_default");
+    const price = await pricing.getPrice("agent/memory");
+    expect(price).toBeNull();
+  });
+
+  test("listPrices returns all priced paths", async () => {
+    await pricing.setPrice("a", { amount: "0.01", currency: "USDC" });
+    await pricing.setPrice("b", { amount: "0.02", currency: "USDC" });
+    const list = await pricing.listPrices();
+    expect(list).toEqual(
+      expect.arrayContaining([
+        { path: "a", amount: "0.01", currency: "USDC" },
+        { path: "b", amount: "0.02", currency: "USDC" },
+      ]),
+    );
+  });
+});

package/src/data/__tests__/vault-encryption.test.ts

@@ -0,0 +1,346 @@
+import { describe, expect, test } from "bun:test";
+
+import { AESEngine } from "../../encryption/aes.js";
+import { isSerializedEncrypted } from "../serialization.js";
+import { createVault } from "../vault.js";
+
+/** In-memory mock OrbitDB for unit tests (no network/native deps) */
+function createMockOrbitDB() {
+  const stores = new Map<string, Map<string, any>>();
+  return {
+    async open(name: string) {
+      if (!stores.has(name)) stores.set(name, new Map());
+      const store = stores.get(name)!;
+      return {
+        async put(key: string, value: any) {
+          store.set(key, value);
+          return `hash-${key}`;
+        },
+        async get(key: string) {
+          return store.get(key);
+        },
+        async del(key: string) {
+          store.delete(key);
+        },
+        async all() {
+          const obj: Record<string, any> = {};
+          for (const [k, v] of store) obj[k] = v;
+          return obj;
+        },
+        async close() {},
+        events: { on() {}, off() {} },
+      };
+    },
+  };
+}
+
+async function deriveTestKey(aes: AESEngine) {
+  const raw = crypto.getRandomValues(new Uint8Array(32));
+  return aes.deriveKey({ type: "raw", key: raw });
+}
+
+describe("Vault Encryption", () => {
+  test("private+aes: put encrypts, get auto-decrypts", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(key);
+
+    const entry = await vault.put("secrets/password", "hunter2", { visibility: "private" });
+    expect(entry.value).toBe("hunter2");
+    expect(entry.encrypted).toBe(true);
+    expect(entry.encryptionEngine).toBe("aes");
+
+    // Raw OrbitDB value should be an encrypted blob, not plaintext
+    const raw = await vault.db.get("secrets/password");
+    expect(raw).not.toBe("hunter2");
+    expect(isSerializedEncrypted(raw)).toBe(true);
+
+    // get() should auto-decrypt
+    const retrieved = await vault.get("secrets/password");
+    expect(retrieved).not.toBeNull();
+    expect(retrieved!.value).toBe("hunter2");
+    expect(retrieved!.encrypted).toBe(true);
+  });
+
+  test("private+aes: works with object values", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(key);
+
+    const data = { vegan: true, allergies: ["peanuts"] };
+    await vault.put("travel/dietary", data, { visibility: "private" });
+
+    const retrieved = await vault.get("travel/dietary");
+    expect(retrieved).not.toBeNull();
+    expect(retrieved!.value).toEqual(data);
+  });
+
+  test("public: stores and retrieves plaintext", async () => {
+    const vault = await createVault(createMockOrbitDB(), {});
+
+    await vault.put("profile/name", "Alice", { visibility: "public" });
+
+    const raw = await vault.db.get("profile/name");
+    expect(raw).toBe("Alice");
+
+    const retrieved = await vault.get("profile/name");
+    expect(retrieved!.value).toBe("Alice");
+    expect(retrieved!.encrypted).toBe(false);
+  });
+
+  test("private without aesEngine: throws", async () => {
+    const vault = await createVault(createMockOrbitDB(), {});
+
+    await expect(vault.put("secret", "data", { visibility: "private" })).rejects.toThrow(
+      /AES engine not configured/,
+    );
+  });
+
+  test("private without defaultKey: throws", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    // setDefaultKey not called
+
+    await expect(vault.put("secret", "data", { visibility: "private" })).rejects.toThrow(
+      /No default key/,
+    );
+  });
+
+  test("shared+aes: encrypts, get returns encrypted blob", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const defaultKey = await deriveTestKey(aes);
+    const sharedRaw = crypto.getRandomValues(new Uint8Array(32));
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(defaultKey);
+
+    await vault.put(
+      "shared/data",
+      { score: 42 },
+      {
+        visibility: "shared",
+        engine: "aes",
+        sharedKeySource: { type: "raw", key: sharedRaw },
+      },
+    );
+
+    // get() cannot auto-decrypt shared data (no shared key internally)
+    const retrieved = await vault.get("shared/data");
+    expect(retrieved).not.toBeNull();
+    expect(isSerializedEncrypted(retrieved!.value)).toBe(true);
+  });
+
+  test("insert encrypts all leaves for private visibility", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(key);
+
+    await vault.insert({ prefs: { diet: "vegan", budget: 5000 } }, { visibility: "private" });
+
+    // Raw storage should be encrypted
+    const rawDiet = await vault.db.get("prefs/diet");
+    expect(isSerializedEncrypted(rawDiet)).toBe(true);
+
+    const rawBudget = await vault.db.get("prefs/budget");
+    expect(isSerializedEncrypted(rawBudget)).toBe(true);
+
+    // get() should auto-decrypt
+    const diet = await vault.get("prefs/diet");
+    expect(diet!.value).toBe("vegan");
+
+    const budget = await vault.get("prefs/budget");
+    expect(budget!.value).toBe(5000);
+  });
+
+  test("insert with public visibility stores plaintext", async () => {
+    const vault = await createVault(createMockOrbitDB(), {});
+
+    await vault.insert({ profile: { name: "Bob" } }, { visibility: "public" });
+
+    const raw = await vault.db.get("profile/name");
+    expect(raw).toBe("Bob");
+  });
+
+  test("backward compat: no encryption config + public works", async () => {
+    const vault = await createVault(createMockOrbitDB(), {});
+
+    await vault.put("hello", "world", { visibility: "public" });
+    const entry = await vault.get("hello");
+    expect(entry!.value).toBe("world");
+  });
+
+  test("del removes encrypted data", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(key);
+
+    await vault.put("temp", 42, { visibility: "private" });
+    await vault.del("temp");
+    const result = await vault.get("temp");
+    expect(result).toBeNull();
+  });
+
+  test("setAuthSig enables Lit auto-decryption in get()", async () => {
+    const mockEncryptionLayer = {
+      encrypt: async (_data: any, opts: any) => ({
+        engine: "lit" as const,
+        ciphertext: new TextEncoder().encode("encrypted"),
+        dataToEncryptHash: "hash123",
+        accessControlConditions: opts.accessConditions ?? [],
+        chain: "base" as const,
+      }),
+      decrypt: async (_encrypted: any, opts: any) => {
+        if (!opts?.authSig) throw new Error("No authSig");
+        return new TextEncoder().encode(JSON.stringify("decrypted-value"));
+      },
+    };
+
+    const vault = await createVault(createMockOrbitDB(), {
+      encryptionLayer: mockEncryptionLayer as any,
+    });
+
+    const authSig = {
+      sig: "0xsig",
+      derivedVia: "web3.eth.personal.sign",
+      signedMessage: "test",
+      address: "0xABCD",
+    };
+    vault.setAuthSig(authSig);
+
+    // Put with Lit encryption
+    await vault.put("shared/secret", "my-data", {
+      visibility: "shared",
+      engine: "lit",
+      accessConditions: [],
+    });
+
+    // get() should auto-decrypt using stored authSig
+    const entry = await vault.get("shared/secret");
+    expect(entry).not.toBeNull();
+    expect(entry!.value).toBe("decrypted-value");
+  });
+
+  test("updateAccess: decrypt → re-encrypt → store with new conditions", async () => {
+    let lastEncryptConditions: any[] = [];
+    const mockEncryptionLayer = {
+      encrypt: async (_data: any, opts: any) => {
+        lastEncryptConditions = opts.accessConditions ?? [];
+        return {
+          engine: "lit" as const,
+          ciphertext: new TextEncoder().encode("encrypted"),
+          dataToEncryptHash: "hash-new",
+          accessControlConditions: opts.accessConditions ?? [],
+          chain: "base" as const,
+        };
+      },
+      decrypt: async (_encrypted: any, opts: any) => {
+        if (!opts?.authSig) throw new Error("No authSig");
+        return new TextEncoder().encode(JSON.stringify("secret-data"));
+      },
+    };
+
+    const vault = await createVault(createMockOrbitDB(), {
+      encryptionLayer: mockEncryptionLayer as any,
+    });
+
+    const authSig = {
+      sig: "0xsig",
+      derivedVia: "web3.eth.personal.sign",
+      signedMessage: "test",
+      address: "0xABCD",
+    };
+    vault.setAuthSig(authSig);
+
+    // Store with initial conditions
+    await vault.put("gated/data", "secret-data", {
+      visibility: "shared",
+      engine: "lit",
+      accessConditions: [
+        {
+          conditionType: "evmBasic",
+          contractAddress: "",
+          standardContractType: "",
+          chain: "base-sepolia",
+          method: "",
+          parameters: [":userAddress"],
+          returnValueTest: { comparator: "=", value: "0xOLD" },
+        },
+      ],
+    });
+
+    // Update access to a new address
+    const newConditions = [
+      {
+        conditionType: "evmBasic" as const,
+        contractAddress: "" as any,
+        standardContractType: "" as const,
+        chain: "base-sepolia" as const,
+        method: "",
+        parameters: [":userAddress"],
+        returnValueTest: { comparator: "=" as const, value: "0xNEW" },
+      },
+    ];
+
+    const entry = await vault.updateAccess("gated/data", newConditions);
+    expect(entry.value).toBe("secret-data");
+    expect(entry.encrypted).toBe(true);
+    expect(entry.encryptionEngine).toBe("lit");
+
+    // Verify the re-encrypt call received the new conditions
+    expect(lastEncryptConditions).toEqual(newConditions);
+  });
+
+  test("updateAccess: throws for non-Lit entry", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const mockEncLayer = {
+      encrypt: async () => ({}),
+      decrypt: async () => new Uint8Array(),
+    };
+    const vault = await createVault(createMockOrbitDB(), {
+      aesEngine: aes,
+      encryptionLayer: mockEncLayer as any,
+    });
+    vault.setDefaultKey(key);
+    vault.setAuthSig({ sig: "0x", derivedVia: "test", signedMessage: "t", address: "0x1" });
+
+    await vault.put("private/data", "hello", { visibility: "private" });
+    await expect(vault.updateAccess("private/data", [])).rejects.toThrow(/not Lit-encrypted/);
+  });
+
+  test("updateAccess: throws for missing path", async () => {
+    const vault = await createVault(createMockOrbitDB(), {
+      encryptionLayer: { encrypt: async () => ({}), decrypt: async () => new Uint8Array() } as any,
+    });
+    vault.setAuthSig({ sig: "0x", derivedVia: "test", signedMessage: "t", address: "0x1" });
+
+    await expect(vault.updateAccess("nonexistent", [])).rejects.toThrow(/Not found/);
+  });
+
+  test("updateAccess: throws without authSig", async () => {
+    const vault = await createVault(createMockOrbitDB(), {
+      encryptionLayer: { encrypt: async () => ({}), decrypt: async () => new Uint8Array() } as any,
+    });
+
+    await expect(vault.updateAccess("some/path", [])).rejects.toThrow(/authSig/);
+  });
+
+  test("query auto-decrypts private entries", async () => {
+    const aes = new AESEngine({ kdf: "hkdf-sha256" });
+    const key = await deriveTestKey(aes);
+    const vault = await createVault(createMockOrbitDB(), { aesEngine: aes });
+    vault.setDefaultKey(key);
+
+    await vault.put("search/a", "alpha", { visibility: "private" });
+    await vault.put("search/b", "beta", { visibility: "private" });
+
+    const results = await vault.query({ prefix: "search/" });
+    expect(results).toHaveLength(2);
+    const values = results.map((r: any) => r.value);
+    expect(values).toContain("alpha");
+    expect(values).toContain("beta");
+  });
+});

package/src/data/__tests__/vault.test.ts

@@ -0,0 +1,75 @@
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+
+import { hasOrbitDbNativeSupport } from "../../__tests__/orbitdb-availability.js";
+
+// Skip if native OrbitDB dependencies are unavailable (e.g. CI without the compiled binary)
+const orbitdbAvailable = hasOrbitDbNativeSupport();
+
+describe.skipIf(!orbitdbAvailable)("DataLayer — Vault", () => {
+  let vault: any;
+  let cleanup: () => Promise<void>;
+
+  beforeAll(async () => {
+    const { createOrbitDBInstance, createVault } = await import("../index.js");
+    const { orbitdb, cleanup: c } = await createOrbitDBInstance({ directory: "./.test-orbitdb" });
+    cleanup = c;
+    vault = await createVault(orbitdb, {});
+  });
+
+  afterAll(async () => {
+    await vault?.close?.();
+    await cleanup?.();
+  });
+
+  test("put and get a public value", async () => {
+    const entry = await vault.put("test/greeting", "hello", { visibility: "public" });
+    expect(entry.value).toBe("hello");
+    expect(entry.visibility).toBe("public");
+    expect(entry.encrypted).toBe(false);
+
+    const retrieved = await vault.get("test/greeting");
+    expect(retrieved).not.toBeNull();
+    expect(retrieved!.value).toBe("hello");
+  });
+
+  test("put and get nested path", async () => {
+    await vault.put("travel/dietary", "vegan", { visibility: "public" });
+    await vault.put("travel/budget", 3000, { visibility: "public" });
+
+    const travel = await vault.get("travel");
+    expect(travel).not.toBeNull();
+    expect(travel!.value).toMatchObject({ dietary: "vegan", budget: 3000 });
+  });
+
+  test("insert merges nested object", async () => {
+    await vault.insert(
+      {
+        profile: { name: "Alice", interests: ["travel"] },
+      },
+      { visibility: "public" },
+    );
+
+    const profile = await vault.get("profile");
+    expect(profile).not.toBeNull();
+    expect(profile!.value).toMatchObject({ name: "Alice", interests: ["travel"] });
+  });
+
+  test("del removes a path", async () => {
+    await vault.put("temp/data", 42, { visibility: "public" });
+    await vault.del("temp/data");
+    const result = await vault.get("temp/data");
+    expect(result).toBeNull();
+  });
+
+  test("keys returns all leaf paths", async () => {
+    const allKeys = await vault.keys();
+    expect(allKeys).toContain("test/greeting");
+    expect(allKeys).toContain("travel/dietary");
+  });
+
+  test("all returns full nested object", async () => {
+    const everything = await vault.all();
+    expect(everything).toHaveProperty("test");
+    expect(everything).toHaveProperty("travel");
+  });
+});

package/src/data/index.ts

@@ -0,0 +1,8 @@
+export { createOrbitDBInstance } from "./orbitdb.js";
+export {
+  deserializeEncrypted,
+  isSerializedEncrypted,
+  serializeEncrypted,
+} from "./serialization.js";
+export { createVault } from "./vault.js";
+export { createVaultPricing } from "./pricing.js";

package/src/data/orbitdb.ts

@@ -0,0 +1,47 @@
+// oxlint-disable-next-line typescript/triple-slash-reference
+/// <reference path="../types/orbitdb.d.ts" />
+
+import { gossipsub } from "@chainsafe/libp2p-gossipsub";
+import { noise } from "@chainsafe/libp2p-noise";
+import { yamux } from "@chainsafe/libp2p-yamux";
+import { identify } from "@libp2p/identify";
+import { tcp } from "@libp2p/tcp";
+import { createOrbitDB, useDatabaseType } from "@orbitdb/core";
+import { Nested } from "@orbitdb/nested-db";
+import { LevelBlockstore } from "blockstore-level";
+import { createHelia } from "helia";
+import { createLibp2p } from "libp2p";
+
+// Register the Nested database type (must happen before createOrbitDB)
+useDatabaseType(Nested);
+
+export async function createOrbitDBInstance(opts: {
+  directory?: string;
+  listenAddrs?: string[];
+}): Promise<{ orbitdb: any; ipfs: any; libp2p: any; cleanup: () => Promise<void> }> {
+  const blockstore = new LevelBlockstore(opts.directory ?? "./orbitdb/blocks");
+
+  const libp2p = await createLibp2p({
+    addresses: { listen: opts.listenAddrs ?? ["/ip4/0.0.0.0/tcp/0"] },
+    transports: [tcp()],
+    connectionEncrypters: [noise()],
+    streamMuxers: [yamux()],
+    services: {
+      identify: identify(),
+      pubsub: gossipsub({ allowPublishToZeroTopicPeers: true }),
+    },
+  });
+
+  const ipfs = await createHelia({ libp2p, blockstore });
+  const orbitdb = await createOrbitDB({ ipfs });
+
+  return {
+    orbitdb,
+    ipfs,
+    libp2p,
+    cleanup: async () => {
+      await orbitdb.stop();
+      await ipfs.stop();
+    },
+  };
+}

package/src/data/pricing.ts

@@ -0,0 +1,63 @@
+import type { IVaultPricing, VaultPricing } from "../types.js";
+
+const PRICING_PREFIX = "pricing/";
+const DEFAULT_KEY = "pricing/_default";
+
+/**
+ * Create pricing CRUD methods backed by a vault's `-meta` OrbitDB store.
+ * Pricing keys live under the `pricing/` prefix in metadata.
+ */
+export function createVaultPricing(metaDb: any): IVaultPricing {
+  return {
+    async setPrice(path: string, pricing: VaultPricing): Promise<void> {
+      const key = path === "_default" ? DEFAULT_KEY : `${PRICING_PREFIX}${path}`;
+      await metaDb.put(key, { amount: pricing.amount, currency: pricing.currency });
+    },
+
+    async getPrice(path: string): Promise<VaultPricing | null> {
+      // Try per-path price first
+      const key = `${PRICING_PREFIX}${path}`;
+      const perPath = await metaDb.get(key);
+      if (perPath?.amount != null) {
+        return { amount: perPath.amount, currency: perPath.currency };
+      }
+
+      // Fall back to _default
+      const fallback = await metaDb.get(DEFAULT_KEY);
+      if (fallback?.amount != null) {
+        return { amount: fallback.amount, currency: fallback.currency };
+      }
+
+      return null;
+    },
+
+    async removePrice(path: string): Promise<void> {
+      const key = path === "_default" ? DEFAULT_KEY : `${PRICING_PREFIX}${path}`;
+      await metaDb.del(key);
+    },
+
+    async listPrices(): Promise<Array<{ path: string } & VaultPricing>> {
+      const all = await metaDb.all();
+      const results: Array<{ path: string } & VaultPricing> = [];
+
+      // Navigate into the "pricing" subtree of the nested OrbitDB
+      const pricingTree = all?.pricing;
+      if (!pricingTree || typeof pricingTree !== "object") return results;
+
+      // Walk the pricing subtree to find all pricing entries (may be nested)
+      const walk = (obj: any, prefix: string) => {
+        for (const [k, v] of Object.entries(obj)) {
+          const path = prefix ? `${prefix}/${k}` : k;
+          if (v && typeof v === "object" && "amount" in (v as any) && "currency" in (v as any)) {
+            results.push({ path, ...(v as VaultPricing) });
+          } else if (v && typeof v === "object") {
+            walk(v, path);
+          }
+        }
+      };
+
+      walk(pricingTree, "");
+      return results;
+    },
+  };
+}