@raviolelabs/engram-mcp 0.2.0

package/dist/cloud/crypto.d.ts

@@ -0,0 +1,42 @@
+export interface MasterKeyMaterial {
+    /** 32-byte derived key (XSalsa20-Poly1305 secret key) */
+    key: Uint8Array;
+    /** hex-encoded 32-byte salt — persisted in config.engramAccount.masterKeySalt */
+    saltHex: string;
+}
+/**
+ * Generate a fresh random salt (call at first pairing).
+ * The salt must be stored in config so it survives restarts.
+ */
+export declare function generateMasterKeySalt(): Promise<string>;
+/**
+ * Derive the 32-byte master key from passphrase + salt using scrypt.
+ * scrypt is memory-hard (equivalent security properties to Argon2id).
+ * The derived key is held in process memory only — never written to disk.
+ */
+export declare function deriveMasterKey(passphrase: string, saltHex: string): Promise<Uint8Array>;
+/**
+ * Encrypt a plaintext blob.
+ * Returns: nonce (24 bytes) || ciphertext — ready to upload to R2.
+ */
+export declare function encryptBlob(plaintext: Uint8Array, masterKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Decrypt a blob downloaded from R2.
+ * Input: nonce (24 bytes) || ciphertext (as produced by encryptBlob).
+ * Throws if authentication fails (tampered or wrong key).
+ */
+export declare function decryptBlob(wire: Uint8Array, masterKey: Uint8Array): Promise<Uint8Array>;
+/**
+ * Generate an ephemeral X25519 keypair for the Noise handshake.
+ * The PC uses this for each new bridge session.
+ */
+export declare function generateEphemeralKeypair(): Promise<{
+    publicKey: Uint8Array;
+    privateKey: Uint8Array;
+}>;
+/**
+ * Derive a shared session key from the PC's private key and the relay's
+ * ephemeral public key (X25519 DH).
+ */
+export declare function deriveSessionKey(myPrivateKey: Uint8Array, theirPublicKey: Uint8Array): Promise<Uint8Array>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/cloud/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AAsEA,MAAM,WAAW,iBAAiB;IAChC,yDAAyD;IACzD,GAAG,EAAE,UAAU,CAAC;IAChB,iFAAiF;IACjF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,MAAM,CAAC,CAG7D;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,UAAU,CAAC,CAcrB;AAMD;;;GAGG;AACH,wBAAsB,WAAW,CAC/B,SAAS,EAAE,UAAU,EACrB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CASrB;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAC/B,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,GACpB,OAAO,CAAC,UAAU,CAAC,CAkBrB;AAMD;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,SAAS,EAAE,UAAU,CAAC;IACtB,UAAU,EAAE,UAAU,CAAC;CACxB,CAAC,CAID;AAED;;;GAGG;AACH,wBAAsB,gBAAgB,CACpC,YAAY,EAAE,UAAU,EACxB,cAAc,EAAE,UAAU,GACzB,OAAO,CAAC,UAAU,CAAC,CAGrB"}

package/dist/cloud/crypto.js

@@ -0,0 +1,146 @@
+/**
+ * src/cloud/crypto.ts
+ *
+ * Cryptographic helpers for the cloud transit E2E layer.
+ *
+ * Master key: scrypt from user passphrase + random 32-byte salt.
+ *   - Salt is stored in config.engramAccount.masterKeySalt (hex).
+ *   - Passphrase is NEVER stored — prompted at startup or pairing time.
+ *   - Derived key is held in memory only for the process lifetime.
+ *
+ * Note: The plan spec calls for Argon2id (libsodium crypto_pwhash), which
+ * requires libsodium-wrappers-sumo (the "full" build). The base
+ * libsodium-wrappers package omits pwhash. We use Node.js built-in
+ * crypto.scrypt instead — it is also memory-hard (Colin Percival's scrypt,
+ * the predecessor to Argon2id) and available everywhere Node ≥ 10 runs.
+ * When libsodium-wrappers-sumo becomes available, swap deriveMasterKey's
+ * implementation to crypto_pwhash with no other changes needed.
+ *
+ * Blob encryption (Plan J mobile side + PC side both use this scheme):
+ *   secretbox: XSalsa20-Poly1305 (libsodium crypto_secretbox_easy).
+ *   Nonce: random 24 bytes, prepended to ciphertext.
+ *   Wire format: nonce (24 bytes) || ciphertext.
+ */
+import sodium from 'libsodium-wrappers';
+import { randomBytes } from 'crypto';
+import { scrypt as scryptCallback } from 'crypto';
+import { createLogger } from '../logger.js';
+const log = createLogger('cloud:crypto');
+/** Promise wrapper for crypto.scrypt with options */
+function scryptAsync(password, salt, keylen, options) {
+    return new Promise((resolve, reject) => {
+        scryptCallback(password, salt, keylen, options, (err, derivedKey) => {
+            if (err)
+                reject(err);
+            else
+                resolve(derivedKey);
+        });
+    });
+}
+let _sodiumReady = false;
+async function ensureSodium() {
+    if (!_sodiumReady) {
+        await sodium.ready;
+        _sodiumReady = true;
+    }
+}
+// scrypt parameters — memory-hard equivalent to Argon2id-interactive.
+// N=2^14 (16 MiB total with r=8), r=8, p=1.
+// OpenSSL default maxmem is 32 MiB; 128*N*r = 128*16384*8 = 16 MiB — fits comfortably.
+// Override via env for stronger hardening: ENGRAM_SCRYPT_N (power of 2, max 32768).
+const SCRYPT_N = process.env.ENGRAM_SCRYPT_N
+    ? parseInt(process.env.ENGRAM_SCRYPT_N, 10)
+    : 1 << 14; // 16384 → 16 MiB
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const SALT_BYTES = 32;
+const KEY_BYTES = 32; // 256-bit key for XSalsa20
+/**
+ * Generate a fresh random salt (call at first pairing).
+ * The salt must be stored in config so it survives restarts.
+ */
+export async function generateMasterKeySalt() {
+    const salt = randomBytes(SALT_BYTES);
+    return salt.toString('hex');
+}
+/**
+ * Derive the 32-byte master key from passphrase + salt using scrypt.
+ * scrypt is memory-hard (equivalent security properties to Argon2id).
+ * The derived key is held in process memory only — never written to disk.
+ */
+export async function deriveMasterKey(passphrase, saltHex) {
+    const salt = Buffer.from(saltHex, 'hex');
+    if (salt.length !== SALT_BYTES) {
+        throw new Error(`Invalid salt length: expected ${SALT_BYTES}, got ${salt.length}`);
+    }
+    const keyBuf = (await scryptAsync(passphrase, salt, KEY_BYTES, {
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+    }));
+    log.debug('Master key derived (scrypt)');
+    return new Uint8Array(keyBuf);
+}
+// ---------------------------------------------------------------------------
+// Blob encryption / decryption (libsodium XSalsa20-Poly1305)
+// ---------------------------------------------------------------------------
+/**
+ * Encrypt a plaintext blob.
+ * Returns: nonce (24 bytes) || ciphertext — ready to upload to R2.
+ */
+export async function encryptBlob(plaintext, masterKey) {
+    await ensureSodium();
+    const NONCE_BYTES = sodium.crypto_secretbox_NONCEBYTES; // 24
+    const nonce = sodium.randombytes_buf(NONCE_BYTES);
+    const ciphertext = sodium.crypto_secretbox_easy(plaintext, nonce, masterKey);
+    const wire = new Uint8Array(nonce.length + ciphertext.length);
+    wire.set(nonce, 0);
+    wire.set(ciphertext, nonce.length);
+    return wire;
+}
+/**
+ * Decrypt a blob downloaded from R2.
+ * Input: nonce (24 bytes) || ciphertext (as produced by encryptBlob).
+ * Throws if authentication fails (tampered or wrong key).
+ */
+export async function decryptBlob(wire, masterKey) {
+    await ensureSodium();
+    const NONCE_BYTES = sodium.crypto_secretbox_NONCEBYTES; // 24
+    if (wire.length <= NONCE_BYTES) {
+        throw new Error('Ciphertext too short to contain a nonce');
+    }
+    const nonce = wire.slice(0, NONCE_BYTES);
+    const ciphertext = wire.slice(NONCE_BYTES);
+    let plaintext;
+    try {
+        plaintext = sodium.crypto_secretbox_open_easy(ciphertext, nonce, masterKey);
+    }
+    catch {
+        throw new Error('Decryption failed — wrong key or tampered ciphertext');
+    }
+    if (!plaintext) {
+        throw new Error('Decryption failed — wrong key or tampered ciphertext');
+    }
+    return plaintext;
+}
+// ---------------------------------------------------------------------------
+// Noise-inspired handshake helpers for Bridge Relay (Plan J Noise protocol)
+// ---------------------------------------------------------------------------
+/**
+ * Generate an ephemeral X25519 keypair for the Noise handshake.
+ * The PC uses this for each new bridge session.
+ */
+export async function generateEphemeralKeypair() {
+    await ensureSodium();
+    const kp = sodium.crypto_box_keypair();
+    return { publicKey: kp.publicKey, privateKey: kp.privateKey };
+}
+/**
+ * Derive a shared session key from the PC's private key and the relay's
+ * ephemeral public key (X25519 DH).
+ */
+export async function deriveSessionKey(myPrivateKey, theirPublicKey) {
+    await ensureSodium();
+    return sodium.crypto_scalarmult(myPrivateKey, theirPublicKey);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/cloud/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/cloud/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,MAAM,IAAI,cAAc,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,GAAG,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;AAEzC,qDAAqD;AACrD,SAAS,WAAW,CAClB,QAAyB,EACzB,IAAY,EACZ,MAAc,EACd,OAA4C;IAE5C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,cAAc,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAClE,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,YAAY,GAAG,KAAK,CAAC;AAEzB,KAAK,UAAU,YAAY;IACzB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,MAAM,CAAC,KAAK,CAAC;QACnB,YAAY,GAAG,IAAI,CAAC;IACtB,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,4CAA4C;AAC5C,uFAAuF;AACvF,oFAAoF;AACpF,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;IAC1C,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,iBAAiB;AAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,2BAA2B;AAajD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACzC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,UAAkB,EAClB,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,UAAU,SAAS,IAAI,CAAC,MAAM,EAAE,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,WAAW,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;QAC7D,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;KACZ,CAAC,CAAW,CAAC;IACd,GAAG,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACzC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,8EAA8E;AAC9E,6DAA6D;AAC7D,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,SAAqB,EACrB,SAAqB;IAErB,MAAM,YAAY,EAAE,CAAC;IACrB,MAAM,WAAW,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC,KAAK;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;IAClD,MAAM,UAAU,GAAG,MAAM,CAAC,qBAAqB,CAAC,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACnB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,IAAgB,EAChB,SAAqB;IAErB,MAAM,YAAY,EAAE,CAAC;IACrB,MAAM,WAAW,GAAG,MAAM,CAAC,2BAA2B,CAAC,CAAC,KAAK;IAC7D,IAAI,IAAI,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC3C,IAAI,SAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,CAAC,0BAA0B,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAI5C,MAAM,YAAY,EAAE,CAAC;IACrB,MAAM,EAAE,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;IACvC,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,YAAwB,EACxB,cAA0B;IAE1B,MAAM,YAAY,EAAE,CAAC;IACrB,OAAO,MAAM,CAAC,iBAAiB,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC"}

package/dist/cloud/endpoints.d.ts

@@ -0,0 +1,26 @@
+/**
+ * src/cloud/endpoints.ts
+ *
+ * HARDCODED cloud endpoints. NOT configurable from ~/.engram/config.json
+ * or any env var. Forks attempting to redirect engram-mcp to a self-hosted
+ * cloud must modify and recompile from source — this is intentional.
+ *
+ * Why hardcoded:
+ *   - Pair flow, billing, sync — all require our backend to validate
+ *     subscriptions and route relays. Allowing override would let bad actors
+ *     stand up clone clouds and bypass payments.
+ *   - The cloud client logic itself lives in src/private/ (gitignored,
+ *     closed-source). Modifying these URLs in source without the private
+ *     client implementation produces a non-functional binary.
+ *
+ * Local-only usage (Free tier, no cloud at all) is fully supported via the
+ * core MemoryStore — these endpoints are only touched when the user pairs
+ * their account.
+ */
+/** Cloud API base — bridge relay, auth, billing, embeddings, whisper, memories endpoints */
+export declare const ENGRAM_API_BASE = "https://api.engram-mcp.com";
+/** Web app base — pair page, dashboard, marketing */
+export declare const ENGRAM_APP_BASE = "https://engram-mcp.com";
+/** Installer worker — `installer.engram-mcp.com/mcp` exposes install tools for agents */
+export declare const ENGRAM_INSTALLER_BASE = "https://installer.engram-mcp.com";
+//# sourceMappingURL=endpoints.d.ts.map

package/dist/cloud/endpoints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.d.ts","sourceRoot":"","sources":["../../src/cloud/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,4FAA4F;AAC5F,eAAO,MAAM,eAAe,+BAA+B,CAAC;AAE5D,qDAAqD;AACrD,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,yFAAyF;AACzF,eAAO,MAAM,qBAAqB,qCAAqC,CAAC"}

package/dist/cloud/endpoints.js

@@ -0,0 +1,26 @@
+/**
+ * src/cloud/endpoints.ts
+ *
+ * HARDCODED cloud endpoints. NOT configurable from ~/.engram/config.json
+ * or any env var. Forks attempting to redirect engram-mcp to a self-hosted
+ * cloud must modify and recompile from source — this is intentional.
+ *
+ * Why hardcoded:
+ *   - Pair flow, billing, sync — all require our backend to validate
+ *     subscriptions and route relays. Allowing override would let bad actors
+ *     stand up clone clouds and bypass payments.
+ *   - The cloud client logic itself lives in src/private/ (gitignored,
+ *     closed-source). Modifying these URLs in source without the private
+ *     client implementation produces a non-functional binary.
+ *
+ * Local-only usage (Free tier, no cloud at all) is fully supported via the
+ * core MemoryStore — these endpoints are only touched when the user pairs
+ * their account.
+ */
+/** Cloud API base — bridge relay, auth, billing, embeddings, whisper, memories endpoints */
+export const ENGRAM_API_BASE = 'https://api.engram-mcp.com';
+/** Web app base — pair page, dashboard, marketing */
+export const ENGRAM_APP_BASE = 'https://engram-mcp.com';
+/** Installer worker — `installer.engram-mcp.com/mcp` exposes install tools for agents */
+export const ENGRAM_INSTALLER_BASE = 'https://installer.engram-mcp.com';
+//# sourceMappingURL=endpoints.js.map

package/dist/cloud/endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"endpoints.js","sourceRoot":"","sources":["../../src/cloud/endpoints.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,4BAA4B,CAAC;AAE5D,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAExD,yFAAyF;AACzF,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC"}

package/dist/cloud/pairing.d.ts

@@ -0,0 +1,30 @@
+/**
+ * src/cloud/pairing.ts
+ *
+ * Pairing flow: open browser → engram-mcp.com/pair/<token> → user logs in →
+ * app redirects to localhost callback → JWT + API key received → saved.
+ *
+ * The localhost callback server uses the built-in Node.js `http` module
+ * (no extra deps). It binds to 127.0.0.1 only.
+ */
+export interface PairingResult {
+    jwt: string;
+    refreshToken: string;
+    apiKey: string;
+    expiresAt: number;
+}
+export interface StartPairingOptions {
+    /** Plan J / I base URL (default prod) */
+    baseUrl?: string;
+}
+/**
+ * Full pairing flow:
+ * 1. Generate token
+ * 2. Start callback server
+ * 3. Open browser
+ * 4. Wait for callback
+ * 5. Save tokens
+ * Returns the received tokens.
+ */
+export declare function startPairing(opts?: StartPairingOptions): Promise<PairingResult>;
+//# sourceMappingURL=pairing.d.ts.map

package/dist/cloud/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/cloud/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAeH,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAqHD,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CA8BzF"}

package/dist/cloud/pairing.js

@@ -0,0 +1,157 @@
+/**
+ * src/cloud/pairing.ts
+ *
+ * Pairing flow: open browser → engram-mcp.com/pair/<token> → user logs in →
+ * app redirects to localhost callback → JWT + API key received → saved.
+ *
+ * The localhost callback server uses the built-in Node.js `http` module
+ * (no extra deps). It binds to 127.0.0.1 only.
+ */
+import { ENGRAM_APP_BASE } from './endpoints.js';
+import http from 'http';
+import { randomBytes } from 'crypto';
+import { execSync } from 'child_process';
+import { URL } from 'url';
+import { createLogger } from '../logger.js';
+import { saveTokens, parseJwtExpiry } from './auth.js';
+const log = createLogger('cloud:pairing');
+const CALLBACK_PORT = 7778;
+const PAIRING_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+/**
+ * Generate a URL-safe base64 pairing token (32 random bytes = 43 chars).
+ */
+function generatePairingToken() {
+    return randomBytes(32).toString('base64url');
+}
+/**
+ * Open a URL in the default system browser (cross-platform).
+ */
+function openBrowser(url) {
+    const platform = process.platform;
+    try {
+        if (platform === 'darwin') {
+            execSync(`open "${url}"`);
+        }
+        else if (platform === 'win32') {
+            execSync(`start "" "${url}"`);
+        }
+        else {
+            execSync(`xdg-open "${url}"`);
+        }
+        log.info(`Browser opened to ${url}`);
+    }
+    catch (e) {
+        // Don't throw — user can copy-paste the URL
+        log.warn(`Could not auto-open browser: ${e instanceof Error ? e.message : String(e)}`);
+        // eslint-disable-next-line no-console
+        console.log(`\nOpen this URL manually:\n  ${url}\n`);
+    }
+}
+/**
+ * Start the localhost callback HTTP server.
+ * Returns a promise that resolves when the callback arrives (with tokens)
+ * or rejects on timeout / error.
+ */
+function startCallbackServer() {
+    return new Promise((resolve, reject) => {
+        const server = http.createServer((req, res) => {
+            if (!req.url?.startsWith('/callback')) {
+                res.writeHead(404);
+                res.end('Not found');
+                return;
+            }
+            const parsed = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
+            const jwt = parsed.searchParams.get('jwt') ?? '';
+            const refreshToken = parsed.searchParams.get('refreshToken') ?? '';
+            const apiKey = parsed.searchParams.get('apiKey') ?? '';
+            if (!jwt || !refreshToken || !apiKey) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end('<p>Pairing failed — missing parameters. Close this tab and try again.</p>');
+                reject(new Error('Callback missing jwt, refreshToken, or apiKey'));
+                server.close();
+                return;
+            }
+            let expiresAt;
+            try {
+                expiresAt = parseJwtExpiry(jwt);
+            }
+            catch {
+                expiresAt = Date.now() + 3600_000; // fallback: 1h
+            }
+            res.writeHead(200, { 'Content-Type': 'text/html' });
+            res.end(`<!DOCTYPE html>
+<html>
+<head>
+  <title>EngramMCP Paired</title>
+  <meta charset="utf-8">
+  <style>
+    body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+           background: #09090b; color: #f4f4f5; display: flex; align-items: center;
+           justify-content: center; height: 100vh; margin: 0; }
+    .card { text-align: center; padding: 48px 40px; border-radius: 16px;
+            background: rgba(255,255,255,0.05); border: 1px solid rgba(255,255,255,0.1);
+            backdrop-filter: blur(12px); max-width: 360px; }
+    .check { font-size: 3rem; margin-bottom: 16px; }
+    h2 { margin: 0 0 8px; font-size: 1.4rem; font-weight: 600; }
+    p { margin: 0; color: #a1a1aa; font-size: 0.9rem; }
+    .countdown { font-size: 0.75rem; color: #52525b; margin-top: 16px; }
+  </style>
+</head>
+<body>
+  <div class="card">
+    <div class="check">✓</div>
+    <h2>Paired successfully!</h2>
+    <p>Your PC is now connected to your Engram account.</p>
+    <p class="countdown">This tab will close automatically…</p>
+  </div>
+  <script>setTimeout(() => { try { window.close(); } catch(e) {} }, 2000);</script>
+</body>
+</html>`);
+            server.close();
+            resolve({ jwt, refreshToken, apiKey, expiresAt });
+        });
+        server.listen(CALLBACK_PORT, '127.0.0.1', () => {
+            log.info(`Pairing callback server listening on http://127.0.0.1:${CALLBACK_PORT}`);
+        });
+        server.on('error', (err) => {
+            reject(new Error(`Pairing callback server error: ${err.message}`));
+        });
+        // Timeout guard
+        setTimeout(() => {
+            server.close();
+            reject(new Error(`Pairing timed out after ${PAIRING_TIMEOUT_MS / 60_000} minutes`));
+        }, PAIRING_TIMEOUT_MS);
+    });
+}
+/**
+ * Full pairing flow:
+ * 1. Generate token
+ * 2. Start callback server
+ * 3. Open browser
+ * 4. Wait for callback
+ * 5. Save tokens
+ * Returns the received tokens.
+ */
+export async function startPairing(opts = {}) {
+    const baseUrl = opts.baseUrl ?? ENGRAM_APP_BASE;
+    const pairingToken = generatePairingToken();
+    const callbackUrl = encodeURIComponent(`http://localhost:${CALLBACK_PORT}/callback`);
+    const pairingUrl = `${baseUrl}/pair/${pairingToken}?callback=${callbackUrl}`;
+    /* eslint-disable no-console */
+    console.log('\n  Linking your account to engram-mcp.com…\n');
+    /* eslint-enable no-console */
+    const callbackPromise = startCallbackServer();
+    /* eslint-disable no-console */
+    console.log(`  Opening browser to: ${pairingUrl}\n`);
+    /* eslint-enable no-console */
+    openBrowser(pairingUrl);
+    /* eslint-disable no-console */
+    console.log('  Waiting for authorization in your browser…');
+    console.log('  (You have 5 minutes. Press Ctrl+C to cancel.)\n');
+    /* eslint-enable no-console */
+    const result = await callbackPromise;
+    saveTokens(result);
+    log.info('Pairing complete — tokens saved to oauth_tokens');
+    return result;
+}
+//# sourceMappingURL=pairing.js.map

package/dist/cloud/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/cloud/pairing.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEvD,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE1C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,kBAAkB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAStD;;GAEG;AACH,SAAS,oBAAoB;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,QAAQ,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;QAC5B,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,qBAAqB,GAAG,EAAE,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,4CAA4C;QAC5C,GAAG,CAAC,IAAI,CAAC,gCAAgC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvF,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,gCAAgC,GAAG,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,mBAAmB;IAC1B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,oBAAoB,aAAa,EAAE,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAEvD,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,2EAA2E,CAAC,CAAC;gBACrF,MAAM,CAAC,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC,CAAC;gBACnE,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO;YACT,CAAC;YAED,IAAI,SAAiB,CAAC;YACtB,IAAI,CAAC;gBACH,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC,eAAe;YACpD,CAAC;YAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,GAAG,CAAC,GAAG,CACL;;;;;;;;;;;;;;;;;;;;;;;;;;;QA2BA,CACD,CAAC;YAEF,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC7C,GAAG,CAAC,IAAI,CAAC,yDAAyD,aAAa,EAAE,CAAC,CAAC;QACrF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACrE,CAAC,CAAC,CAAC;QAEH,gBAAgB;QAChB,UAAU,CAAC,GAAG,EAAE;YACd,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,kBAAkB,GAAG,MAAM,UAAU,CAAC,CAAC,CAAC;QACtF,CAAC,EAAE,kBAAkB,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAA4B,EAAE;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,eAAe,CAAC;IAChD,MAAM,YAAY,GAAG,oBAAoB,EAAE,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CACpC,oBAAoB,aAAa,WAAW,CAC7C,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,OAAO,SAAS,YAAY,aAAa,WAAW,EAAE,CAAC;IAE7E,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,8BAA8B;IAE9B,MAAM,eAAe,GAAG,mBAAmB,EAAE,CAAC;IAE9C,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,yBAAyB,UAAU,IAAI,CAAC,CAAC;IACrD,8BAA8B;IAE9B,WAAW,CAAC,UAAU,CAAC,CAAC;IAExB,+BAA+B;IAC/B,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACjE,8BAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;IACrC,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnB,GAAG,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cloud/transit-poller.d.ts

@@ -0,0 +1,35 @@
+import { MemoryStore } from '../memory/core/store.js';
+import type { EngramConfig } from '../config/schema.js';
+export interface TransitItem {
+    id: string;
+    type: 'voice' | 'doc' | 'text';
+    /** Signed R2 URL to download encrypted blob */
+    downloadUrl: string;
+    /** ISO timestamp of when the item was uploaded */
+    createdAt: string;
+    /** Blob MIME type hint (e.g., 'audio/webm', 'application/pdf', 'text/plain') */
+    mimeType: string;
+    /** Original filename if any */
+    filename?: string;
+    /** Byte size of encrypted blob */
+    sizeBytes: number;
+}
+export interface TransitPollerOptions {
+    store: MemoryStore;
+    config: EngramConfig;
+    /** In-process master key (Uint8Array, 32 bytes). Held in memory, never stored. */
+    masterKey: Uint8Array;
+}
+export declare function pollOnce(opts: TransitPollerOptions): Promise<{
+    processed: number;
+    errors: number;
+}>;
+/**
+ * Start the transit poller cron job.
+ * Returns a stop function to cancel the cron.
+ * Safe to call multiple times — only starts if engramAccount is configured.
+ */
+export declare function startTransitPoller(opts: TransitPollerOptions): {
+    stop: () => void;
+};
+//# sourceMappingURL=transit-poller.d.ts.map

package/dist/cloud/transit-poller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transit-poller.d.ts","sourceRoot":"","sources":["../../src/cloud/transit-poller.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAoCxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,CAAC;IAC/B,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,kDAAkD;IAClD,SAAS,EAAE,MAAM,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,CAAC;IACjB,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAmLD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,WAAW,CAAC;IACnB,MAAM,EAAE,YAAY,CAAC;IACrB,kFAAkF;IAClF,SAAS,EAAE,UAAU,CAAC;CACvB;AAED,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAkEhD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,oBAAoB,GAAG;IAAE,IAAI,EAAE,MAAM,IAAI,CAAA;CAAE,CAkBnF"}