@steve02081504/fount-p2p 0.0.4 → 0.0.5

package/core/bytes_codec.mjs

@@ -2,18 +2,6 @@
  * Base64 / hex / bytes 互转（无 Node 依赖，浏览器与 Node 共用）。
  */
 
-/**
- * @param {ArrayBuffer} buffer 原始二进制缓冲
- * @returns {string} 标准 Base64 文本
- */
-export function arrayBufferToBase64(buffer) {
-	let binary = ''
-	const bytes = new Uint8Array(buffer)
-	for (let index = 0; index < bytes.byteLength; index++)
-		binary += String.fromCharCode(bytes[index])
-	return btoa(binary)
-}
-
 /**
  * @param {Uint8Array} u8 原始字节
  * @returns {string} 标准 Base64 文本
@@ -34,18 +22,3 @@ export function b64ToU8(b64) {
 	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i)
 	return out
 }
-
-/**
- * @param {string} hex 十六进制文本（可带 0x 前缀，长度须为 2×nBytes）
- * @param {number} nBytes 目标字节数
- * @returns {Uint8Array} 解析得到的字节数组
- */
-export function hexToNBytes(hex, nBytes) {
-	const normalizedHex = String(hex).replace(/^0x/iu, '').trim()
-	if (normalizedHex.length !== nBytes * 2 || !/^[\da-f]+$/iu.test(normalizedHex))
-		throw new RangeError('invalid hex length or characters')
-	const out = new Uint8Array(nBytes)
-	for (let index = 0; index < nBytes; index++)
-		out[index] = parseInt(normalizedHex.slice(index * 2, index * 2 + 2), 16)
-	return out
-}

package/core/constants.mjs

@@ -1,33 +1,5 @@
-import { resolveFederationFanoutTopK } from '../trust_graph/resolve.mjs'
 import trustGraphTunables from '../trust_graph/tunables.json' with { type: 'json' }
 
-/** @type {readonly string[]} 权限键注册表顺序（运算期 BigInt 编码用） */
-export const PERMISSION_REGISTRY_ORDER = Object.freeze([
-	'VIEW_CHANNEL',
-	'SEND_MESSAGES',
-	'SEND_STICKERS',
-	'ADD_REACTIONS',
-	'MANAGE_MESSAGES',
-	'MANAGE_CHANNELS',
-	'KICK_MEMBERS',
-	'BAN_MEMBERS',
-	'MANAGE_ROLES',
-	'MANAGE_ADMINS',
-	'INVITE_MEMBERS',
-	'STREAM',
-	'CREATE_THREADS',
-	'UPLOAD_FILES',
-	'MANAGE_FILES',
-	'PIN_MESSAGES',
-	'SET_WORLD',
-	'ADMIN',
-	'BYPASS_RATE_LIMIT',
-])
-
-/**
- * 默认晚消息冻结时间（毫秒）
- */
-export const DEFAULT_LATE_MESSAGE_FREEZE_MS = 30_000
 /**
  * 占位 `message` 无 `message_edit` 终稿时的空闲截断（毫秒）；§6.4 `streamGeneratingIdleMs` 默认。
  */
@@ -46,8 +18,5 @@ export const EPOCH_CHAIN_MAX = 256
 /** 群文件经联邦复制的单块上限（字节，§10.2） */
 export const FEDERATION_CHUNK_MAX_BYTES = trustGraphTunables.federationChunkMaxBytes
 
-/** TrustGraph fanout 参考 Top-K（N=8 roster 时的缩放值；运行时请用 resolveFederationFanoutTopK） */
-export const FEDERATION_FANOUT_TOP_K = resolveFederationFanoutTopK(8, trustGraphTunables)
-
 /** 全局 fed_chunk_get miss 时 fanout 邻居数 */
 export const FEDERATION_CHUNK_FETCH_FANOUT_K = trustGraphTunables.federationChunkFetchFanoutK

package/core/hexIds.mjs

@@ -58,16 +58,3 @@ export function assertHex64(value, label = 'hex64') {
 export function isSignatureHex128(value) {
 	return SIGNATURE_HEX_128.test(String(value ?? '').trim())
 }
-
-/**
- * 外部入站专用：断言 128 位签名 hex。
- * @param {unknown} value 原始值
- * @param {string} [label='signature'] 字段名
- * @returns {string} 签名 hex
- */
-export function assertSignatureHex128(value, label = 'signature') {
-	const normalized = String(value ?? '').trim().toLowerCase()
-	if (!SIGNATURE_HEX_128.test(normalized))
-		throw new Error(`${label} must be 128 hex characters`)
-	return normalized
-}

package/crypto/key.mjs

@@ -66,18 +66,6 @@ function toHBuf(H) {
 
 // ─── 密钥推导 ─────────────────────────────────────────────────────────────────
 
-/**
- * 推导群内两两直连额外隔离密钥：`KDF(H, "dm", sorted(a,b).join(":"))`（§11.1）
- * @param {string | Buffer} H 群秘密
- * @param {string} pubKeyHashA 第一方 pubKeyHash
- * @param {string} pubKeyHashB 第二方 pubKeyHash
- * @returns {Buffer} 32 字节 AES-256 密钥
- */
-export function derivePairKey(H, pubKeyHashA, pubKeyHashB) {
-	const sorted = [pubKeyHashA, pubKeyHashB].sort().join(':')
-	return kdf(toHBuf(H), 'dm', sorted)
-}
-
 /**
  * 推导群文件加密密钥：`KDF(H, "file", fileId)`（§10.3、§6.3）
  * @param {string | Buffer} H 群秘密
@@ -327,16 +315,27 @@ export function encryptConvergentPlaintext(plaintext) {
  * @returns {{ contentHash: string, ciphertextHash: string, contentKey: Buffer, raw: Buffer }} 哈希、随机密钥与密文
  */
 export function encryptRandomPlaintext(plaintext) {
+	const contentKey = randomBytes(32)
+	const enc = encryptRandomPlaintextWithKey(plaintext, contentKey)
+	return { ...enc, contentKey }
+}
+
+/**
+ * 用已有 contentKey 加密一块明文（多块 random 文件共用一把 key）。
+ * @param {Buffer | Uint8Array} plaintext 明文字节
+ * @param {Buffer | Uint8Array} contentKey 32 字节
+ * @returns {{ contentHash: string, ciphertextHash: string, raw: Buffer }} 哈希与密文
+ */
+export function encryptRandomPlaintextWithKey(plaintext, contentKey) {
 	const plain = Buffer.from(plaintext)
 	const contentHash = createHash('sha256').update(plain).digest('hex')
-	const contentKey = randomBytes(32)
 	const iv = randomBytes(12)
-	const cipher = createCipheriv('aes-256-gcm', contentKey, iv)
+	const cipher = createCipheriv('aes-256-gcm', Buffer.from(contentKey), iv)
 	const ciphertext = Buffer.concat([cipher.update(plain), cipher.final()])
 	const authTag = cipher.getAuthTag()
 	const raw = Buffer.concat([iv, authTag, ciphertext])
 	const ciphertextHash = createHash('sha256').update(raw).digest('hex')
-	return { contentHash, ciphertextHash, contentKey, raw }
+	return { contentHash, ciphertextHash, raw }
 }
 
 /**

package/dag/index.mjs

@@ -4,15 +4,12 @@ import { createHash } from 'node:crypto'
 
 import { canonicalStringify } from '../core/canonical_json.mjs'
 import { HEX_ID_64 } from '../core/hexIds.mjs'
-import { HLC } from '../core/hlc.mjs'
-import { sign, verify } from '../crypto/crypto.mjs'
 
 /**
  * 重导出 64 位十六进制事件 ID 正则（`HEX_ID_64` 别名）。
  */
 export { HEX_ID_64 as EVENT_ID_HEX }
 const EVENT_ID_HEX = HEX_ID_64
-const HEX_PAIR = /^[\da-f]{2}$/iu
 
 /**
  * 对事件 id 列表做二叉 Merkle 根（字典序叶子，§7 checkpoint）。
@@ -241,76 +238,6 @@ export function topologicalCanonicalOrder(metas) {
 	return ordered
 }
 
-/**
- * @param {string} hex 十六进制串
- * @param {number} expectedByteLength 期望字节长度
- * @returns {Uint8Array | null} 解析后的字节
- */
-function parseHexBytes(hex, expectedByteLength) {
-	if (!hex || hex.length !== expectedByteLength * 2 || hex.length % 2 !== 0) return null
-	const bytes = hex.match(/.{2}/g)
-	if (!bytes?.every(pair => HEX_PAIR.test(pair))) return null
-	return new Uint8Array(bytes.map(byte => Number.parseInt(byte, 16)))
-}
-
-/**
- * 签名事件（签名为不含 id 的 canonical body）
- * @param {object} event 含完整字段；可含占位 id
- * @param {Uint8Array} privateKey 私钥
- * @returns {Promise<string>} 十六进制签名
- */
-export async function signEvent(event, privateKey) {
-	const body = eventBodyForSign(event)
-	const signature = await sign(signPayloadBytes(body), privateKey)
-	return Array.from(signature).map(byte => byte.toString(16).padStart(2, '0')).join('')
-}
-
-/**
- * 验证事件签名
- * @param {object} event 含 signature、sender 与正文字段的完整事件
- * @returns {Promise<boolean>} 验签是否通过
- */
-export async function verifyEventSignature(event) {
-	try {
-		const signature = parseHexBytes(event?.signature, 64)
-		const publicKey = parseHexBytes(event?.sender, 32)
-		if (!signature || !publicKey) return false
-		return await verify(signature, signPayloadBytes(eventBodyForSign(event)), publicKey)
-	}
-	catch (error) {
-		console.error('Signature verification failed:', error)
-		return false
-	}
-}
-
-/**
- * 创建新事件
- * @param {object} params 事件字段与签名私钥等构造参数
- * @param {string[]} [params.prev_event_ids] 父事件 id；根事件 `[]`
- * @returns {Promise<object>} 含 id、signature 的完整事件对象
- */
-export async function createEvent(params) {
-	const {
-		type, groupId, channelId, sender, charId, content, prev_event_ids, privateKey, hlc,
-	} = params
-
-	const event = {
-		type,
-		groupId,
-		channelId: channelId || null,
-		sender,
-		charId: charId || null,
-		timestamp: Date.now(),
-		hlc: hlc || HLC.now(),
-		prev_event_ids: sortedPrevEventIds(prev_event_ids),
-		content,
-	}
-
-	event.id = computeEventId(eventBodyForSign(event))
-	event.signature = await signEvent(event, privateKey)
-	return event
-}
-
 /**
  * @param {object[]} events DAG 事件行
  * @returns {Array<{ id: string, prev_event_ids?: unknown, hlc?: object, node_id?: string, sender?: string }>} 拓扑 meta 列表

package/dag/storage.mjs

@@ -196,17 +196,6 @@ export async function readJsonlTipId(filePath) {
 	}
 }
 
-/**
- * 将单个 JSON 对象作为一行追加写入 JSONL（必要时创建父目录）。
- * @param {string} filePath 目标文件路径
- * @param {object} record 要序列化写入的对象
- * @returns {Promise<void>}
- */
-export async function appendJsonl(filePath, record) {
-	await mkdir(dirname(filePath), { recursive: true })
-	await appendFile(filePath, `${JSON.stringify(record)}\n`, 'utf8')
-}
-
 /**
  * 流式重写 JSONL（临时文件 + rename），避免大数组 join 的内存峰值。
  * @param {string} filePath 目标路径
@@ -244,17 +233,6 @@ export async function writeJsonlSynced(filePath, records) {
 	return withAsyncMutex(jsonlMutexKey(filePath), () => writeJsonl(filePath, records))
 }
 
-/**
- * 在 per-file 互斥锁内过滤重写 JSONL。
- * @param {string} filePath 目标路径
- * @param {(row: object) => boolean} keep 保留谓词
- * @param {{ sanitize?: (row: object) => object }} [options] 读行净化
- * @returns {Promise<{ kept: number, dropped: number }>} 统计
- */
-export async function rewriteJsonlKeepingSynced(filePath, keep, options = {}) {
-	return withAsyncMutex(jsonlMutexKey(filePath), () => rewriteJsonlKeeping(filePath, keep, options))
-}
-
 /**
  * 追加一行 JSONL 并 `fsync`。
  * @param {string} filePath 目标路径

package/federation/entity_key_chain.mjs

@@ -63,15 +63,6 @@ export function resolveActiveKeyAtGeneration(keyHistory, generation) {
 	return entry?.activePubKeyHex ?? null
 }
 
-/**
- * @param {EntityKeyHistoryEntry[]} keyHistory 密钥历史
- * @returns {number} 最新代际，无则 -1
- */
-export function resolveLatestActiveGeneration(keyHistory) {
-	if (!keyHistory?.length) return -1
-	return Math.max(...keyHistory.map(row => row.generation))
-}
-
 /**
  * @param {EntityKeyHistoryEntry[]} keyHistory 密钥历史
  * @param {number} generation 代际

package/federation/topo_order_memo.mjs

@@ -1,21 +1,6 @@
-import { eventsToMetas, topologicalCanonicalOrder } from '../dag/index.mjs'
-
 /** @type {Map<string, { fp: string, order: string[] }>} */
 const memoByKey = new Map()
 
-/**
- * 进程内拓扑序 memo（key 由调用方提供，如 username:groupId）。
- * @param {string} memoKey 缓存键
- * @param {string} fingerprint 文件 stat + 事件数指纹
- * @param {object[]} events 全量事件
- * @param {{ force?: boolean }} [opts] 强制重算
- * @returns {string[]} 拓扑序 event id
- */
-export function resolveTopologicalOrderMemo(memoKey, fingerprint, events, opts = {}) {
-	return resolveTopologicalOrderMemoCached(memoKey, fingerprint, () =>
-		topologicalCanonicalOrder(eventsToMetas(events)), opts)
-}
-
 /**
  * 进程内拓扑序 memo；`resolveOrder` 可接入磁盘缓存等实现。
  * @param {string} memoKey 缓存键

package/files/assemble.mjs

@@ -1,11 +1,12 @@
 import { Buffer } from 'node:buffer'
-import { createHash } from 'node:crypto'
+import { createHash, randomBytes } from 'node:crypto'
 import { setImmediate } from 'node:timers'
 
 import { FEDERATION_CHUNK_MAX_BYTES } from '../core/constants.mjs'
 import {
 	encryptConvergentPlaintext,
 	encryptRandomPlaintext,
+	encryptRandomPlaintextWithKey,
 	wrapContentKey,
 } from '../crypto/key.mjs'
 
@@ -48,17 +49,57 @@ function encryptionStrategyFor(ceMode) {
 	return strategy
 }
 
+/**
+ * @param {{ contentHash: string, ciphertextHash: string, raw: Buffer }} enc 分块加密结果
+ * @param {CeMode} ceMode 模式
+ * @returns {{ hash: string, size: number, raw: Buffer, contentHash?: string }} manifest part
+ */
+function partFromEnc(enc, ceMode) {
+	/** @type {{ hash: string, size: number, raw: Buffer, contentHash?: string }} */
+	const part = { hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw }
+	if (ceMode === 'convergent' || ceMode === 'plain')
+		part.contentHash = enc.contentHash
+	return part
+}
+
+/**
+ * 加密单个分块（random 模式复用调用方提供的 contentKey）。
+ * @param {Buffer | Uint8Array} slice 明文分块
+ * @param {CeMode} ceMode 模式
+ * @param {Buffer | null} [contentKey] random 模式密钥
+ * @returns {{ hash: string, size: number, raw: Buffer, contentHash?: string }} manifest part
+ */
+export function encryptSliceToPart(slice, ceMode, contentKey = null) {
+	const enc = ceMode === 'random'
+		? encryptRandomPlaintextWithKey(slice, contentKey)
+		: encryptionStrategyFor(ceMode)(slice)
+	return partFromEnc(enc, ceMode)
+}
+
+/**
+ * @param {Array<{ hash: string, size: number, contentHash?: string }>} parts 分块
+ * @returns {Array<{ hash: string, size: number, contentHash?: string }>} 写入 manifest 的 parts
+ */
+export function manifestPartsForPersist(parts) {
+	return parts.map(part => {
+		/** @type {{ hash: string, size: number, contentHash?: string }} */
+		const out = { hash: part.hash, size: part.size }
+		if (part.contentHash) out.contentHash = part.contentHash
+		return out
+	})
+}
+
 /**
  * @param {Buffer | Uint8Array} plaintext 明文
  * @param {CeMode} ceMode 模式
- * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer }>, contentKey?: Buffer }} 加密结果
+ * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer, contentHash?: string }>, contentKey?: Buffer }} 加密结果
  */
 export function encryptPlaintextToParts(plaintext, ceMode = 'convergent') {
 	const plain = Buffer.from(plaintext)
 	const enc = encryptionStrategyFor(ceMode)(plain)
 	return {
 		contentHash: enc.contentHash,
-		parts: [{ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw }],
+		parts: [partFromEnc(enc, ceMode)],
 		contentKey: enc.contentKey,
 	}
 }
@@ -67,7 +108,7 @@ export function encryptPlaintextToParts(plaintext, ceMode = 'convergent') {
  * 将明文拆分为多块加密（大文件）。
  * @param {Buffer | Uint8Array} plaintext 明文
  * @param {CeMode} ceMode 模式
- * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer }>, contentKey?: Buffer }} 分块加密结果
+ * @returns {{ contentHash: string, parts: Array<{ hash: string, size: number, raw: Buffer, contentHash?: string }>, contentKey?: Buffer }} 分块加密结果
  */
 export function encryptPlaintextToMultiParts(plaintext, ceMode = 'convergent') {
 	const plain = Buffer.from(plaintext)
@@ -75,15 +116,11 @@ export function encryptPlaintextToMultiParts(plaintext, ceMode = 'convergent') {
 	if (plain.length <= FEDERATION_CHUNK_MAX_BYTES)
 		return encryptPlaintextToParts(plain, ceMode)
 
-	/** @type {Array<{ hash: string, size: number, raw: Buffer }>} */
+	/** @type {Array<{ hash: string, size: number, raw: Buffer, contentHash?: string }>} */
 	const parts = []
-	let contentKey = null
-	for (let offset = 0; offset < plain.length; offset += FEDERATION_CHUNK_MAX_BYTES) {
-		const slice = plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES)
-		const enc = encryptionStrategyFor(ceMode)(slice)
-		if (ceMode === 'random') contentKey = enc.contentKey
-		parts.push({ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw })
-	}
+	const contentKey = ceMode === 'random' ? randomBytes(32) : null
+	for (let offset = 0; offset < plain.length; offset += FEDERATION_CHUNK_MAX_BYTES)
+		parts.push(encryptSliceToPart(plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES), ceMode, contentKey))
 	return { contentHash, parts, contentKey: contentKey || undefined }
 }
 
@@ -99,15 +136,12 @@ export async function encryptPlaintextToMultiPartsAsync(plaintext, ceMode = 'con
 	if (plain.length <= FEDERATION_CHUNK_MAX_BYTES)
 		return encryptPlaintextToParts(plain, ceMode)
 
-	/** @type {Array<{ hash: string, size: number, raw: Buffer }>} */
+	/** @type {Array<{ hash: string, size: number, raw: Buffer, contentHash?: string }>} */
 	const parts = []
-	let contentKey = null
+	const contentKey = ceMode === 'random' ? randomBytes(32) : null
 	for (let offset = 0; offset < plain.length; offset += FEDERATION_CHUNK_MAX_BYTES) {
 		if (offset > 0) await new Promise(resolve => setImmediate(resolve))
-		const slice = plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES)
-		const enc = encryptionStrategyFor(ceMode)(slice)
-		if (ceMode === 'random') contentKey = enc.contentKey
-		parts.push({ hash: enc.ciphertextHash, size: enc.raw.length, raw: enc.raw })
+		parts.push(encryptSliceToPart(plain.subarray(offset, offset + FEDERATION_CHUNK_MAX_BYTES), ceMode, contentKey))
 	}
 	return { contentHash, parts, contentKey: contentKey || undefined }
 }
@@ -144,7 +178,7 @@ export function buildFileManifest(params) {
 		size: Buffer.from(plaintext).length,
 		contentHash: enc.contentHash,
 		ceMode,
-		parts: enc.parts.map(part => ({ hash: part.hash, size: part.size })),
+		parts: manifestPartsForPersist(enc.parts),
 		transferKeyDescriptor: transferKeyDescriptor || publicTransferKeyDescriptor(),
 		meta,
 	})
@@ -155,7 +189,7 @@ export function buildFileManifest(params) {
 /**
  * 由已加密分块构建 manifest（vault / file-master-key-wrap 等需自定义 transferKeyDescriptor）。
  * @param {object} params 与 buildFileManifest 相同字段（不含 plaintext 重加密）
- * @param {{ contentHash: string, parts: Array<{ hash: string, size: number, raw?: Buffer }> }} enc 加密结果
+ * @param {{ contentHash: string, parts: Array<{ hash: string, size: number, raw?: Buffer, contentHash?: string }> }} enc 加密结果
  * @returns {FileManifest} manifest
  */
 export function buildFileManifestFromEnc(params, enc) {
@@ -177,7 +211,7 @@ export function buildFileManifestFromEnc(params, enc) {
 		size: Buffer.from(plaintext).length,
 		contentHash: enc.contentHash,
 		ceMode,
-		parts: enc.parts.map(part => ({ hash: part.hash, size: part.size })),
+		parts: manifestPartsForPersist(enc.parts),
 		transferKeyDescriptor: transferKeyDescriptor || publicTransferKeyDescriptor(),
 		meta,
 	})
@@ -185,24 +219,6 @@ export function buildFileManifestFromEnc(params, enc) {
 	return manifest
 }
 
-/**
- * @param {string} groupId 群 ID
- * @param {Buffer} contentKey 随机 contentKey
- * @param {Buffer | string} H 群/vault 秘密
- * @param {string} fileId 文件 ID
- * @param {number} keyGeneration 密钥代次
- * @returns {import('./manifest.mjs').TransferKeyDescriptor} 传输密钥描述
- */
-export function fileMasterKeyWrapDescriptor(groupId, fileId, contentKey, H, keyGeneration = 0) {
-	return {
-		type: 'file-master-key-wrap',
-		groupId,
-		fileId,
-		keyGeneration,
-		wrappedKey: wrapContentKey(contentKey, H, fileId),
-	}
-}
-
 /**
  * @param {string} entityHash 所有者
  * @param {string} fileId 文件 ID