@securecoms/agent-bridge 0.3.1 → 0.4.0

package/dist/memory/hermes-provider.d.ts

@@ -0,0 +1,21 @@
+import type { MemoryProvider } from "./provider.js";
+import type { MemoryRecordInput, MemoryContextResult } from "@agentvault/connect-mls-store";
+/**
+ * Backs the MemoryProvider interface with Hermes's own ~/.hermes brain:
+ * context() reads state.db recent turns; record() writes voice turns back.
+ * Text records are no-ops (Hermes persists text natively). Fully fail-safe.
+ */
+export declare class HermesMemoryProvider implements MemoryProvider {
+    private readonly baseDir;
+    private readonly store;
+    private noSession;
+    private skipped;
+    private writeFailed;
+    constructor(baseDir: string);
+    record(input: MemoryRecordInput): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+    context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
+    stats(): Record<string, number>;
+}

package/dist/memory/hermes-session-map.d.ts

@@ -0,0 +1,8 @@
+/** Expand a leading ~ to the user's home dir. Absolute/relative paths pass through. */
+export declare function expandHome(p: string): string;
+/**
+ * Resolve a SecureComs DM channel to its Hermes state.db session id via
+ * sessions.json, or null. DM keys only (group keys are out of scope this slice).
+ * Fail-safe: any read/parse error returns null.
+ */
+export declare function resolveHermesSession(baseDir: string, conversationId: string): string | null;

package/dist/memory/hermes-store.d.ts

@@ -0,0 +1,32 @@
+export interface HermesTurn {
+    id: number;
+    role: "user" | "assistant";
+    content: string;
+    timestamp: number;
+}
+export declare class HermesStore {
+    private readonly dbPath;
+    constructor(baseDir: string);
+    /** Recent-K conversational turns for a session, chronological. Fail-safe → []. */
+    readRecent(sessionId: string, limit: number): HermesTurn[];
+    private open;
+    /**
+     * Append a voice turn to a session in one synchronous BEGIN IMMEDIATE block
+     * (no await between statements → atomic against Hermes and our own retries).
+     * Guards: skip when the session is absent/archived/ended; in-transaction dedup
+     * on (session_id, platform_message_id). Writes only `messages`. Fail-safe.
+     */
+    writeVoiceTurn(input: {
+        sessionId: string;
+        role: "user" | "assistant";
+        content: string;
+        dedupKey: string | null;
+        timestamp: number;
+    }): "written" | "deduped" | "skipped" | "failed";
+    /**
+     * Startup write-capability probe: insert a sentinel against any existing
+     * session inside a rolled-back transaction. Throws if the write path is broken
+     * (e.g. a schema regression). No-op when the db has no sessions.
+     */
+    probeWrite(): void;
+}

package/dist/memory/hermes-test-fixture.d.ts

@@ -0,0 +1,5 @@
+/** Build a state.db that mirrors the load-bearing parts of Hermes's schema. */
+export declare function makeHermesFixture(base: string, sessionId: string, opts?: {
+    archived?: number;
+    endedAt?: number | null;
+}): void;

package/dist/memory/openclaw-provider.d.ts

@@ -0,0 +1,24 @@
+import type { MemoryProvider } from "./provider.js";
+import type { SqliteMlsStateStore, MemoryRecordInput, MemoryContextResult } from "@agentvault/connect-mls-store";
+/**
+ * MemoryProvider for an OpenClaw-hosted agent (Cortina). context() merges
+ * OpenClaw's own text history (read-only, plain session .jsonl) with the
+ * SecureComs daemon-local voice turns, ordered on one wall-clock. record()
+ * stores voice turns in the SC store ([voice]-prefixed); text is a no-op
+ * (OpenClaw owns text). OpenClaw files are NEVER written. Fully fail-safe:
+ * any text-side failure degrades to voice-only.
+ */
+export declare class OpenClawMemoryProvider implements MemoryProvider {
+    private readonly store;
+    private readonly baseDir;
+    private readonly agent;
+    private noSession;
+    private readFailed;
+    constructor(store: SqliteMlsStateStore, baseDir: string, agent: string);
+    record(input: MemoryRecordInput): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+    context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
+    stats(): Record<string, number>;
+}

package/dist/memory/openclaw-session-log.d.ts

@@ -0,0 +1,15 @@
+export interface OpenClawTurn {
+    role: "peer" | "agent";
+    text: string;
+    ts: number;
+}
+/**
+ * Read the last K conversational turns from the agent's owner-DM session log,
+ * the CLEAN plain <baseDir>/agents/<agent>/sessions/<sessionId>.jsonl (NEVER the
+ * .trajectory.jsonl, a .reset.* snapshot, or the `main` log). Ordering uses the
+ * top-level ISO `timestamp`; the inner message.timestamp is unreliable and unused.
+ * Normalization is an allowlist gated on role: keep user (string) and assistant
+ * (joined `text` blocks only); skip every other role and empty (tool-only)
+ * assistant turns. Fail-safe: any read/parse error returns [].
+ */
+export declare function readRecentTurns(baseDir: string, agent: string, sessionId: string, k: number): OpenClawTurn[];

package/dist/memory/openclaw-session-map.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Resolve the agent's single OpenClaw owner-DM session id from sessions.json.
+ * OpenClaw collapses every owner DM into one `…:direct:…:owner` session and
+ * discards the SecureComs channel id, so the SC conversationId is NOT used here.
+ * Fail-safe: any read/parse error, or no owner-direct key, returns null.
+ */
+export declare function resolveOwnerDmSession(baseDir: string, agent: string): string | null;

package/dist/memory/provider.d.ts

@@ -0,0 +1,29 @@
+import type { SqliteMlsStateStore, MemoryRecordInput, MemoryContextResult } from "@agentvault/connect-mls-store";
+export interface MemoryProvider {
+    record(input: MemoryRecordInput): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+    context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
+    /** Optional adapter counters surfaced on the daemon healthcheck. */
+    stats?(): Record<string, number>;
+}
+/** Default: the SecureComs-owned, daemon-local store (encrypted at rest). */
+export declare class SecureComsLocalMemory implements MemoryProvider {
+    private readonly store;
+    constructor(store: SqliteMlsStateStore);
+    record(input: MemoryRecordInput): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+    context(conversationId: string, limit?: number): Promise<MemoryContextResult>;
+}
+/** BYO / disabled: the harness owns memory; SecureComs keeps none. */
+export declare class NullMemory implements MemoryProvider {
+    record(): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+    context(): Promise<MemoryContextResult>;
+}
+export declare function createMemoryProvider(provider: "securecoms" | "none" | "hermes" | "openclaw", store: SqliteMlsStateStore, baseDir?: string, agent?: string): MemoryProvider;

package/dist/memory-taps.d.ts

@@ -0,0 +1,13 @@
+import type { MemoryRecordInput } from "@agentvault/connect-mls-store";
+interface MemorySink {
+    record(input: MemoryRecordInput): Promise<{
+        seq: number;
+        deduped: boolean;
+    }>;
+}
+/** Record an inbound (peer) text turn the agent actually consumed. Best-effort:
+ *  never throws, so a memory failure can't break message delivery. */
+export declare function recordInboundMemory(sink: MemorySink, channelId: string, senderId: string, text: string, messageId: string): Promise<void>;
+/** Record the agent's own outbound text reply. Best-effort. */
+export declare function recordOutboundMemory(sink: MemorySink, channelId: string, text: string, messageId: string): Promise<void>;
+export {};

package/dist/preflight-modern.cjs

@@ -0,0 +1,35 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/preflight-modern.cts
+var preflight_modern_exports = {};
+__export(preflight_modern_exports, {
+  passThrough: () => passThrough
+});
+module.exports = __toCommonJS(preflight_modern_exports);
+var path = require("node:path");
+function passThrough() {
+  const binPath = path.join(__dirname, "bin.js");
+  process.argv[1] = binPath;
+  return import(binPath);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  passThrough
+});

package/dist/preflight-modern.d.cts

@@ -0,0 +1 @@
+export declare function passThrough(): Promise<unknown>;

package/dist/preflight-upgrade.d.cts

@@ -0,0 +1,30 @@
+export declare function parseShasums(text: string, arch: string): {
+    filename: string;
+    sha256: string;
+} | null;
+export declare function sha256Hex(buf: Buffer): string;
+export declare function promptYesNo(question: string, deps: {
+    isTTY: boolean;
+    ask: (q: string) => Promise<string>;
+    stderr: (s: string) => void;
+}): Promise<boolean>;
+export interface UpgradeDeps {
+    platform: string;
+    arch: string;
+    isTTY: boolean;
+    stderr: (s: string) => void;
+    ask: (q: string) => Promise<string>;
+    hasBrew: () => boolean;
+    runBrew: () => number;
+    fetchText: (url: string) => Promise<string>;
+    fetchBinary: (url: string, destPath: string) => Promise<void>;
+    fileSha256: (p: string) => string;
+    runSudoInstaller: (pkgPath: string) => number;
+    tmpdir: () => string;
+    cleanup: (p: string) => void;
+    resolveNewNode: () => string | null;
+    reexec: (nodePath: string) => boolean;
+}
+export declare function guidedUpgrade(deps: UpgradeDeps): Promise<boolean>;
+export declare function resolveNewNodeFrom(probe: (p: string) => string | null, candidates?: string[]): string | null;
+export declare function realUpgradeDeps(originalArgv: string[]): UpgradeDeps;

package/dist/preflight.cjs

@@ -0,0 +1,277 @@
+#!/usr/bin/env node
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/preflight-upgrade.cts
+var preflight_upgrade_exports = {};
+__export(preflight_upgrade_exports, {
+  guidedUpgrade: () => guidedUpgrade,
+  parseShasums: () => parseShasums,
+  promptYesNo: () => promptYesNo,
+  realUpgradeDeps: () => realUpgradeDeps,
+  resolveNewNodeFrom: () => resolveNewNodeFrom,
+  sha256Hex: () => sha256Hex
+});
+function parseShasums(text, arch) {
+  const want = "-darwin-" + arch + ".pkg";
+  const lines = String(text).split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const m = lines[i].trim().match(/^([0-9a-f]{6,64})\s+(\S+)$/);
+    if (m && m[2].indexOf(want) !== -1 && m[2].indexOf("node-v24.") === 0) {
+      return { filename: m[2], sha256: m[1] };
+    }
+  }
+  return null;
+}
+function sha256Hex(buf) {
+  const crypto = require("crypto");
+  return crypto.createHash("sha256").update(buf).digest("hex");
+}
+async function promptYesNo(question, deps) {
+  if (!deps.isTTY) return false;
+  const a = (await deps.ask(question)).trim().toLowerCase();
+  return a === "y" || a === "yes";
+}
+async function guidedUpgrade(deps) {
+  if (deps.platform !== "darwin") return false;
+  try {
+    const viaBrew = deps.hasBrew();
+    const source = viaBrew ? "Homebrew (brew install node \u2014 user-space, no sudo)" : "the official installer from " + DIST_BASE + " (needs your admin password)";
+    const ok = await promptYesNo(
+      "[bridge] Node 24 LTS is required. Install it now via " + source + "? [y/N] ",
+      deps
+    );
+    if (!ok) return false;
+    if (viaBrew) {
+      deps.stderr("[bridge] running: brew install node\n");
+      if (deps.runBrew() !== 0) return false;
+    } else {
+      const shasums = await deps.fetchText(DIST_BASE + "/SHASUMS256.txt");
+      const entry = parseShasums(shasums, deps.arch);
+      if (!entry) return false;
+      const dest = deps.tmpdir() + "/" + entry.filename;
+      deps.stderr("[bridge] downloading " + DIST_BASE + "/" + entry.filename + "\n");
+      try {
+        await deps.fetchBinary(DIST_BASE + "/" + entry.filename, dest);
+        if (deps.fileSha256(dest) !== entry.sha256) {
+          deps.stderr("[bridge] checksum mismatch \u2014 aborting install (file discarded)\n");
+          return false;
+        }
+        deps.stderr("[bridge] running: sudo installer -pkg " + entry.filename + " -target /\n");
+        if (deps.runSudoInstaller(dest) !== 0) return false;
+      } finally {
+        deps.cleanup(dest);
+      }
+    }
+    const fresh = deps.resolveNewNode();
+    if (!fresh) return false;
+    deps.stderr("[bridge] Node 24 installed \u2014 continuing under " + fresh + "\n");
+    return deps.reexec(fresh);
+  } catch {
+    return false;
+  }
+}
+function resolveNewNodeFrom(probe, candidates) {
+  const list = candidates || NODE_CANDIDATES;
+  for (let i = 0; i < list.length; i++) {
+    const v = probe(list[i]);
+    if (v && Number(String(v).replace(/^v/, "").split(".")[0]) >= 24) return list[i];
+  }
+  return null;
+}
+function realUpgradeDeps(originalArgv) {
+  const { spawnSync, execFileSync } = require("child_process");
+  const { createWriteStream, readFileSync, rmSync } = require("fs");
+  const os = require("os");
+  const https = require("https");
+  const readline = require("readline");
+  function fetch(url, redirects) {
+    return new Promise((resolve, reject) => {
+      https.get(url, (res) => {
+        if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location && redirects > 0) {
+          res.resume();
+          fetch(res.headers.location, redirects - 1).then(resolve, reject);
+        } else if (res.statusCode !== 200) {
+          res.resume();
+          reject(new Error("HTTP " + res.statusCode + " for " + url));
+        } else resolve(res);
+      }).on("error", reject);
+    });
+  }
+  return {
+    platform: process.platform,
+    arch: process.arch,
+    isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    stderr: (s) => process.stderr.write(s),
+    ask: (q) => new Promise((resolve) => {
+      const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+      rl.question(q, (a) => {
+        rl.close();
+        resolve(a);
+      });
+    }),
+    hasBrew: () => spawnSync("brew", ["--version"], { stdio: "ignore" }).status === 0,
+    runBrew: () => {
+      var _a;
+      return (_a = spawnSync("brew", ["install", "node"], { stdio: "inherit" }).status) != null ? _a : 1;
+    },
+    fetchText: async (url) => {
+      const res = await fetch(url, 3);
+      let out = "";
+      for await (const chunk of res) out += chunk;
+      return out;
+    },
+    fetchBinary: async (url, destPath) => {
+      const res = await fetch(url, 3);
+      await new Promise((resolve, reject) => {
+        const ws = createWriteStream(destPath);
+        res.pipe(ws);
+        ws.on("finish", resolve);
+        ws.on("error", reject);
+        res.on("error", reject);
+      });
+    },
+    fileSha256: (p) => sha256Hex(readFileSync(p)),
+    runSudoInstaller: (pkgPath) => {
+      var _a;
+      return (_a = spawnSync("sudo", ["installer", "-pkg", pkgPath, "-target", "/"], { stdio: "inherit" }).status) != null ? _a : 1;
+    },
+    tmpdir: () => os.tmpdir(),
+    cleanup: (p) => {
+      try {
+        rmSync(p, { force: true });
+      } catch {
+      }
+    },
+    resolveNewNode: () => resolveNewNodeFrom((p) => {
+      try {
+        return String(execFileSync(p, ["--version"], { encoding: "utf8" })).trim();
+      } catch {
+        return null;
+      }
+    }),
+    reexec: (nodePath) => {
+      const child = spawnSync(nodePath, originalArgv.slice(1), { stdio: "inherit" });
+      process.exit(child.status !== null && child.status !== void 0 ? child.status : child.signal ? 130 : 1);
+    }
+  };
+}
+var DIST_BASE, NODE_CANDIDATES;
+var init_preflight_upgrade = __esm({
+  "src/preflight-upgrade.cts"() {
+    "use strict";
+    DIST_BASE = "https://nodejs.org/dist/latest-v24.x";
+    NODE_CANDIDATES = [
+      "/usr/local/bin/node",
+      // nodejs.org pkg (stable across upgrades)
+      "/opt/homebrew/bin/node",
+      // brew symlink (Apple Silicon)
+      "/opt/homebrew/opt/node/bin/node"
+    ];
+  }
+});
+
+// src/preflight.cts
+var preflight_exports = {};
+__export(preflight_exports, {
+  effectiveVersion: () => effectiveVersion,
+  instructionsBlock: () => instructionsBlock,
+  meetsFloor: () => meetsFloor,
+  parseNodeMajor: () => parseNodeMajor,
+  runPreflight: () => runPreflight
+});
+module.exports = __toCommonJS(preflight_exports);
+var NODE_FLOOR = 24;
+var FLOOR_REASON = "requires >= 24 (node:sqlite stable API)";
+function parseNodeMajor(version) {
+  const n = Number(String(version).split(".")[0]);
+  return Number.isFinite(n) && n > 0 ? n : 0;
+}
+function meetsFloor(version) {
+  return parseNodeMajor(version) >= NODE_FLOOR;
+}
+function effectiveVersion(real, faked) {
+  if (!faked) return real;
+  const f = parseNodeMajor(faked);
+  if (f >= 1 && f < parseNodeMajor(real)) return faked;
+  return real;
+}
+function instructionsBlock(platform, current) {
+  const lines = [
+    "[bridge] Node " + current + " is too old \u2014 SecureComs " + FLOOR_REASON + ".",
+    "",
+    "How to get Node 24 LTS:",
+    "  1. Official installer (recommended): https://nodejs.org \u2014 download the",
+    "     Node 24 LTS installer for your platform and run it."
+  ];
+  if (platform === "darwin") {
+    lines.push("  2. Homebrew: brew install node");
+  }
+  lines.push("  " + (platform === "darwin" ? "3" : "2") + ". nvm:      nvm install 24 && nvm use 24");
+  lines.push(
+    "",
+    "Then re-run the install command. (Always re-run the install command after",
+    "upgrading Node \u2014 the background service pins the Node path it was",
+    "installed with.)"
+  );
+  return lines.join("\n") + "\n";
+}
+async function runPreflight(deps) {
+  if (meetsFloor(deps.version)) {
+    await deps.delegate();
+    return 0;
+  }
+  if (deps.upgrade) {
+    if (await deps.upgrade()) return 0;
+  }
+  deps.stderr(instructionsBlock(deps.platform, deps.version));
+  return 1;
+}
+if (require.main === module) {
+  const version = effectiveVersion(
+    process.versions.node,
+    process.env.SECURECOMS_PREFLIGHT_FAKE_NODE_VERSION
+  );
+  runPreflight({
+    version,
+    platform: process.platform,
+    isTTY: Boolean(process.stdin.isTTY && process.stdout.isTTY),
+    stderr: (s) => process.stderr.write(s),
+    // The modern half is only ever require()d here, AFTER the gate passed —
+    // old Node never parses its dynamic-import syntax.
+    delegate: () => require("./preflight-modern.cjs").passThrough(),
+    upgrade: () => {
+      const up = (init_preflight_upgrade(), __toCommonJS(preflight_upgrade_exports));
+      return up.guidedUpgrade(up.realUpgradeDeps(process.argv));
+    }
+  }).then((code) => {
+    if (code !== 0) process.exit(code);
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  effectiveVersion,
+  instructionsBlock,
+  meetsFloor,
+  parseNodeMajor,
+  runPreflight
+});

package/dist/preflight.d.cts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+export declare function parseNodeMajor(version: string): number;
+export declare function meetsFloor(version: string): boolean;
+export declare function effectiveVersion(real: string, faked: string | undefined): string;
+export declare function instructionsBlock(platform: string, current: string): string;
+export interface PreflightDeps {
+    version: string;
+    platform: string;
+    isTTY: boolean;
+    stderr: (s: string) => void;
+    delegate: () => Promise<unknown>;
+    upgrade: (() => Promise<boolean>) | null;
+}
+export declare function runPreflight(deps: PreflightDeps): Promise<number>;

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@securecoms/agent-bridge",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "type": "module",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "bin": {
-    "agent-bridge": "dist/bin.js"
+    "agent-bridge": "dist/preflight.cjs"
   },
   "exports": {
     ".": {
@@ -17,13 +17,11 @@
     "dist",
     "README.md"
   ],
-  "engines": {
-    "node": ">=24"
-  },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
+    "prepack": "npm run build",
     "build": "tsc && node esbuild.config.mjs",
     "test": "vitest run",
     "test:watch": "vitest"

package/dist/attachments.js

@@ -1,49 +0,0 @@
-import { basename } from "node:path";
-/** Reduce any name to a safe basename inside the target dir. Strips path
- *  separators and `..`; falls back when nothing usable remains. */
-export function sanitizeFilename(name, fallback) {
-    const base = basename(name ?? "");
-    const cleaned = base.replace(/[/\\]/g, "").replace(/^\.+$/, "");
-    return cleaned.length > 0 ? cleaned : fallback;
-}
-const MIME_BY_EXT = {
-    png: "image/png", jpg: "image/jpeg", jpeg: "image/jpeg", gif: "image/gif",
-    webp: "image/webp", svg: "image/svg+xml", pdf: "application/pdf",
-    txt: "text/plain", md: "text/markdown", json: "application/json",
-    csv: "text/csv", html: "text/html", mp4: "video/mp4", mp3: "audio/mpeg",
-    zip: "application/zip", wav: "audio/wav",
-};
-export function mimeForName(name) {
-    const dot = name.lastIndexOf(".");
-    if (dot < 0 || dot === name.length - 1)
-        return "application/octet-stream";
-    return MIME_BY_EXT[name.slice(dot + 1).toLowerCase()] ?? "application/octet-stream";
-}
-export async function prepareAttachment(filePath, caption, channelId, deps) {
-    const bytes = await deps.readFile(filePath);
-    const name = basename(filePath);
-    const { encryptedData, fileKey, fileNonce, digest } = deps.encryptFile(bytes);
-    const blobId = await deps.uploadBlob(encryptedData, channelId);
-    const body = {
-        v: 1, type: "artifact_share", name, mime: mimeForName(name), size: bytes.length,
-        blobId, fileKey: deps.bytesToBase64(fileKey), fileNonce: deps.bytesToBase64(fileNonce), digest,
-    };
-    if (caption)
-        body.text = caption;
-    return body;
-}
-export async function materializeAttachment(body, ctx, deps) {
-    const ciphertext = await deps.downloadBlob(body.blobId);
-    // Verify digest on ciphertext BEFORE decrypting — tampered blobs fail here.
-    const sha256 = deps.computeFileDigest(ciphertext);
-    if (sha256 !== body.digest) {
-        throw new Error(`attachment digest mismatch for blob ${body.blobId}`);
-    }
-    const plain = deps.decryptFile(ciphertext, deps.base64ToBytes(body.fileKey), deps.base64ToBytes(body.fileNonce));
-    const safeName = sanitizeFilename(body.name, ctx.messageId);
-    const dir = `${ctx.attachmentsDir}/${ctx.channelId}`;
-    const path = `${dir}/${ctx.messageId}-${safeName}`;
-    await deps.mkdirp(dir);
-    await deps.writeFile(path, plain);
-    return { filename: safeName, mime: body.mime, size: plain.length, path, sha256 };
-}

package/dist/auth.js

@@ -1,56 +0,0 @@
-import { randomBytes, timingSafeEqual } from "node:crypto";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { isLoopback } from "./config.js";
-export function resolveToken(opts) {
-    if (opts.token)
-        return opts.token;
-    const f = opts.tokenFile;
-    if (f && existsSync(f))
-        return readFileSync(f, "utf8").trim();
-    const tok = randomBytes(32).toString("base64url");
-    if (f)
-        writeFileSync(f, tok, { mode: 0o600 });
-    return tok;
-}
-export function tokenMatches(provided, expected) {
-    if (!provided)
-        return false;
-    const a = Buffer.from(provided);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(a, b);
-}
-export function bearerFrom(header) {
-    if (!header)
-        return undefined;
-    const m = /^Bearer (.+)$/i.exec(header.trim());
-    return m ? m[1] : undefined;
-}
-function hostnameOf(hostHeader) {
-    if (!hostHeader)
-        return undefined;
-    // Strip an optional :port (but keep [::1] intact).
-    if (hostHeader.startsWith("["))
-        return hostHeader.slice(0, hostHeader.indexOf("]") + 1);
-    const i = hostHeader.lastIndexOf(":");
-    return i > 0 ? hostHeader.slice(0, i) : hostHeader;
-}
-export function originHostAllowed(headers, allowOrigins) {
-    // Host must be a loopback name (blocks the DNS-rebind target Host: evil.com).
-    const host = hostnameOf(headers.host);
-    if (host && !isLoopback(host) && !isLoopback(`[${host}]`))
-        return false;
-    // Origin: absent → allow (non-browser). Present → must be loopback or allow-listed.
-    const origin = headers.origin;
-    if (!origin)
-        return true;
-    if (allowOrigins.includes(origin))
-        return true;
-    try {
-        return isLoopback(new URL(origin).hostname);
-    }
-    catch {
-        return false;
-    }
-}