@synoi/gateway-lite 0.1.0

package/LICENSE

@@ -0,0 +1,195 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship made available under
+      the License, as indicated by a copyright notice that is included in
+      or attached to the work (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean, as submitted to the Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal Entity
+      authorized to submit on behalf of the copyright owner. For the purposes
+      of this definition, "submitted" means any form of electronic, verbal,
+      or written communication sent to the Licensor or its representatives,
+      including but not limited to communication on electronic mailing lists,
+      source code control systems, and issue tracking systems that are managed
+      by, or on behalf of, the Licensor for the purpose of discussing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or designated in writing by the copyright owner as "Not a
+      Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor and included
+      within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by the combined work of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a cross-claim
+      or counterclaim in a lawsuit) alleging that the Work or any
+      Contribution embodied within the Work constitutes direct or contributory
+      patent infringement, then any patent licenses granted to You under
+      this License for that Work shall terminate as of the date such
+      litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, You must include a readable copy of the
+          attribution notices contained within such NOTICE file, in
+          at least one of the following places: within a NOTICE text
+          file distributed as part of the Derivative Works; within
+          the Source form or documentation, if provided along with the
+          Derivative Works; or, within a display generated by the
+          Derivative Works, if and wherever such third-party notices
+          normally appear. The contents of the NOTICE file are for
+          informational purposes only and do not modify the License.
+          You may add Your own attribution notices within Derivative
+          Works that You distribute, alongside or in addition to the
+          NOTICE text from the Work, provided that such additional
+          attribution notices cannot be construed as modifying the
+          License.
+
+      You may add Your own license statement for Your modifications and
+      may provide additional grant of rights to use, copy, modify, merge,
+      publish, distribute, sublicense, and/or sell copies of the
+      Contribution, either on an unapproved or approved basis, and you
+      may elect to apply the Apache License to such modifications.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or reproducing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or exemplary damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or all other
+      commercial damages or losses), even if such Contributor has been
+      advised of the possibility of such damages.
+
+   9. Accepting Warranty or Liability. While redistributing the Work or
+      Derivative Works thereof, You may choose to offer, and charge a fee
+      for, acceptance of support, warranty, indemnity, or other liability
+      obligations and/or rights consistent with this License. However, in
+      accepting such obligations, You may offer such conditions only on
+      Your own behalf and on Your sole responsibility, not on behalf of
+      any other Contributor, and only if You agree to indemnify, defend,
+      and hold each Contributor harmless for any liability incurred by,
+      or claims asserted against, such Contributor by reason of your
+      accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the format in use. Please consult an
+      EXPLANATION document at apache.org for clarification of the
+      specific license version.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,185 @@
+# @synoi/gateway-lite
+
+SynOI Gateway Lite: a self-hosted local daemon for governed-action approval with
+operator-owned, self-signed receipts. No account, no managed key custody, no
+network call required to run it.
+
+**Status: PARTIAL-against-test-keys, PARTIAL-pending-Security+Adversary-panel.**
+See "What gets signed, and by whom" and "Where the key lives, and who else can
+use it" below before relying on this for anything beyond local dogfood.
+
+## What this is
+
+A single process that:
+
+1. Accepts a governed action from your code (`gate()` via `@synoi/sdk` in local mode,
+   or a raw `POST /local/gate`).
+2. Shows it to you, the operator, in a local dashboard for approve/deny.
+3. Signs a receipt for the decision with a key generated once on your own machine
+   and never transmitted anywhere.
+
+It excludes, at the architecture level (not just by policy), every premium channel
+adapter (Composio, Slack, SMS, voice, n8n/Zapier, home automation, AR overlay, and
+the 23 MCP shim integrations), the control-plane / license client, and the KMS
+managed-custody signing tier (the AWS Secrets Manager-backed key provider the full
+gateway uses in production). Those are the paid, hosted product; this package
+literally cannot reach any of that code -- verified two ways in the source repo's
+CI, not by inspection: (1) a dependency-graph assertion over daemon.ts's actual
+TypeScript import graph, and (2) a byte-level content scan of the REAL packed
+tarball (the exact bytes `npm install @synoi/gateway-lite` would fetch) that fails if
+any shipped JavaScript (.js) file contains an AWS SDK reference anywhere,
+comments included. The
+KMS provider is a complete, working AWS Secrets Manager client -- it lives in its
+own source module, reached by the full gateway only through a runtime
+`require()` call, and that module is never compiled into this package: it is not
+merely unused, it is structurally absent from what you install.
+
+## Quickstart
+
+```bash
+npm i @synoi/sdk
+npx @synoi/gateway-lite
+```
+
+The daemon listens on `http://127.0.0.1:8787` by default (override with
+`SYNOI_LITE_PORT`). Open `http://127.0.0.1:8787/local/dashboard` in a browser to
+enroll your operator identity (a keypair generated in the browser via the Web
+Crypto API; the private key never leaves it) and approve/deny pending actions.
+
+From your application:
+
+```ts
+import { gate } from '@synoi/sdk'
+
+await gate({
+  action_kind: 'command',
+  args: { to: 'ops@example.com', subject: 'deploy complete' },
+  daemonUrl: 'http://127.0.0.1:8787', // or SYNOI_DAEMON_URL env
+}, async () => {
+  // runs only if the operator approves
+  await sendEmail(...)
+})
+```
+
+## What gets signed, and by whom
+
+The first time the daemon runs, it generates a single Ed25519 keypair for you, the
+operator. Every decision receipt after that is self-signed with that SAME key using
+`@synoi/gap`'s `receipt()` one-liner -- the single-Ed25519 self-sign CDRO shape,
+`receipt_scheme: "synoi.receipt/gap-selfsign"`. Verify any receipt offline with the
+published `@synoi/verify` package:
+
+```ts
+import { verifyReceiptByScheme } from '@synoi/verify'
+
+const result = await verifyReceiptByScheme({
+  receipt,                 // fetched from GET /local/receipts/:oid
+  gap_ed25519_pub: pubkey, // the 32-byte raw public key (see "Where the key lives" below)
+})
+// result.valid === true, result.scheme === 'gap-selfsign'
+```
+
+**Honest disclosure:** this proves the receipt was signed by, and has not been
+altered since, the key on YOUR machine. It does not yet prove that key belongs to
+a trustworthy party to anyone else -- a neutral, third-party-hosted resolver
+(`oid.synoi.systems`) is planned but not live. Do not describe a self-signed
+receipt as "independently verified."
+
+### Where the key lives, and who else can use it
+
+**Any process running as your OS user account can sign as the operator using this
+key. This key has no managed custody and no account recovery: if it is lost, it is
+gone, and there is no SynOI-side way to get it back or re-sign past receipts under
+a continuous identity.** This is the tradeoff of self-hosting with no managed
+service in the loop; it is not a bug to be fixed later, it is what "no account, no
+network call" means.
+
+The daemon tries to reduce the blast radius of that tradeoff by wrapping the key
+with your OS's own credential store where one is available:
+
+- **Windows** -- DPAPI (`System.Security.Cryptography.ProtectedData`,
+  current-user scope). The private key is written to
+  `SYNOI_DATA_DIR/lite-signing-key.dpapi` as ciphertext only your Windows user
+  account can decrypt; `SYNOI_DATA_DIR/lite-signing-key.json` holds only the
+  public key and metadata.
+- **macOS** -- the system Keychain, via the `security` command-line tool every
+  macOS install ships with (implemented per documented behavior; not yet
+  executable-tested on this platform; the daemon prints the actual path
+  taken, and any fallback, on every boot).
+- **Linux** -- `secret-tool` (libsecret / gnome-keyring). Requires a running
+  secret-service provider, which is normal on a desktop session and often ABSENT
+  on a minimal/headless/server install -- that is an expected reason to hit the
+  fallback below, not a bug (implemented per documented behavior; not yet
+  executable-tested on this platform; the daemon prints the actual path
+  taken, and any fallback, on every boot).
+
+**Important:** the OS keystore protects the key from OTHER user accounts on the
+same machine. It does NOT protect the key from other processes running as YOUR
+OWN account -- any of those can still ask the OS to unwrap it, same as they could
+read any other file you own. Treat the machine and your OS login as the trust
+boundary, not this daemon.
+
+If no OS keystore is available (or it fails), the daemon falls back to a plaintext
+JSON file at `SYNOI_DATA_DIR/lite-signing-key.json` (`private_key_hex` present
+directly), protected by whatever your OS's own file permissions provide: POSIX
+mode `0600` on macOS/Linux (kernel-enforced), or a Windows ACL restricted to your
+account only (`icacls ... /grant:r <you>:F`, applied automatically -- note that
+POSIX mode bits like `0600` are silently a no-op on Windows NTFS, which is why
+this is a real ACL call, not just a mode flag). The daemon prints which path it
+took, and any fallback reason, on every boot.
+
+## Environment variables
+
+| Variable | Purpose | Default |
+|---|---|---|
+| `SYNOI_LITE_PORT` / `PORT` | Listen port | `8787` |
+| `SYNOI_DATA_DIR` | Where the operator signing key, enrollment record, and SQLite store live | `~/.synoi` |
+| `SYNOI_ALLOW_EPHEMERAL_KEYS` | Currently required for `POST /local/gate` to accept the bootstrap hero-bundle OID `capbundle/1` without a real capability-grant record (lite has no grant-issuance ceremony yet). NOT needed for key generation, receipt signing, or the operator-enrollment record, which survive a restart on the persisted operator key regardless of this variable. Set `true`; this requirement is expected to be removed once a real grant ceremony ships. | required for `POST /local/gate`, no default |
+| `SYNOI_DASHBOARD_DIR` | Serve a built portal SPA instead of the built-in self-contained HTML dashboard | unset (uses the built-in dashboard) |
+
+The daemon boots with zero AWS credentials, zero control-plane URL, and zero
+license key -- there is nothing in the shipped package that could reach any of
+those: no reachable import, and (independently checked) no AWS-SDK-related byte
+sequence anywhere in the packed tarball (enforced by CI, see "Architecture"
+below).
+
+## Architecture (why this is small)
+
+This package is NOT a slice of the full SynOI gateway shipped to a subdirectory.
+It bundles only the source files `src/daemon.ts` actually imports, transitively,
+in the gateway's monorepo -- 18 files, six runtime npm dependencies (`express`,
+`better-sqlite3`, `@synoi/gap`, `@synoi/sraid`, `@noble/curves`,
+`@noble/post-quantum`), no channel adapters, no license client, no cloud SDK of
+any kind. The gateway repo's CI checks this two ways, both required to pass
+before a build is produced:
+
+1. A dependency-graph assertion over `daemon.ts`'s real TypeScript import graph
+   (`ts.createProgram`, not a regex), asserting it never reaches the channel
+   adapters, the license client, the KMS-hybrid signing tier, or the AWS
+   Secrets Manager key provider module.
+2. A byte-level content scan of the ACTUAL packed tarball (a real `npm pack`,
+   extracted and read file by file, not `--dry-run`'s file-name listing):
+   fails if any shipped `.js` file contains an AWS-SDK-related string anywhere,
+   including inside comments. This is the check that would have caught what
+   the dependency-graph assertion alone could not: a file can be legitimately
+   reachable (this package's own key-provider module is; it backs the
+   self-host key-generation path) while a DIFFERENT class defined in the same
+   file carries a cloud-SDK reference that a pure import-graph walk cannot
+   see. The fix was to move that class into its own module, reached only by
+   a runtime `require()` the static graph walk does not follow -- so its
+   compiled output, and the SDK reference inside it, never enter this
+   package's `dist/` at all.
+
+This package's own build step refuses to produce a build if either assertion
+would fail.
+
+## Repository
+
+This package currently lives in `packages/gateway-lite/` of the `synoi-gateway`
+repository (private) pending extraction to a dedicated public repository before
+first publish. That extraction, and the first `npm publish`, are human-gated
+steps not taken by this build.
+
+## License
+
+Apache-2.0

package/bin/synoi-gateway-lite.js

@@ -0,0 +1,22 @@
+#!/usr/bin/env node
+'use strict'
+
+/**
+ * bin/synoi-gateway-lite.js -- the `npx @synoi/gateway-lite` / `synoi-gateway-lite` entrypoint.
+ *
+ * Calls startLiteDaemon() explicitly rather than relying on dist/daemon.js's
+ * `if (require.main === module)` guard: that guard is true only when
+ * dist/daemon.js itself is the process's initially-run script, which is NOT
+ * the case here -- this bin wrapper is the initially-run script, and it
+ * require()s daemon.js as a module. Same reason src/index.ts's equivalent
+ * guard does not fire when the gateway is required as a library (embed.ts).
+ *
+ * No em dashes. No AI attribution.
+ */
+
+const { startLiteDaemon } = require('../dist/daemon.js')
+
+startLiteDaemon().catch((err) => {
+  process.stderr.write(`[synoi-gateway-lite] FATAL: ${err && err.stack ? err.stack : String(err)}\n`)
+  process.exit(1)
+})