@tpsdev-ai/flair 0.21.0 → 0.22.1

package/dist/resources/IngestEvents.js

@@ -1,162 +0,0 @@
-/**
- * IngestEvents.ts — Observatory ingestion endpoint.
- *
- * POST /IngestEvents
- * Auth: TPS-Ed25519 signed by the office's private key (verified against
- *       ObsOffice.publicKey stored at registration time).
- *
- * Body: {
- *   officeId: string;
- *   events:   OrgEventRecord[];
- *   agents:   AgentStatus[];
- *   syncedAt: string;
- * }
- *
- * Actions:
- *   1. Verify Ed25519 signature against stored office public key
- *   2. Upsert ObsAgentSnapshot for each agent
- *   3. Insert ObsEventFeed for each new event (30-day TTL)
- *   4. Update ObsOffice.lastSeen + agentCount
- *
- * Rate limit: 1 call / 10s per office (enforced by createdAt delta check)
- * Batch limit: 100 events per call
- */
-import { Resource, databases } from "@harperfast/harper";
-import { createPublicKey, verify } from "node:crypto";
-const BATCH_LIMIT = 100;
-const RATE_LIMIT_MS = 10_000;
-const EVENT_TTL_DAYS = 30;
-function verifyEd25519Signature(publicKeyHex, authHeader, officeId) {
-    try {
-        // Header format: TPS-Ed25519 officeId:ts:nonce:sig
-        const prefix = "TPS-Ed25519 ";
-        if (!authHeader.startsWith(prefix))
-            return false;
-        const parts = authHeader.slice(prefix.length).split(":");
-        if (parts.length < 4)
-            return false;
-        const [id, ts, nonce, ...sigParts] = parts;
-        const sig = sigParts.join(":");
-        if (id !== officeId)
-            return false;
-        // Replay protection: reject signatures older than 5 minutes
-        const age = Date.now() - Number(ts);
-        if (age > 5 * 60 * 1000 || age < -30_000)
-            return false;
-        const pubKeyBytes = Buffer.from(publicKeyHex.replace(/=\s*/g, ""), "hex");
-        const spkiHeader = Buffer.from("302a300506032b6570032100", "hex");
-        const pubKey = createPublicKey({ key: Buffer.concat([spkiHeader, pubKeyBytes]), format: "der", type: "spki" });
-        const payload = Buffer.from(`${id}:${ts}:${nonce}:POST:/IngestEvents`);
-        const sigBuf = Buffer.from(sig, "base64");
-        return verify(null, payload, pubKey, sigBuf);
-    }
-    catch {
-        return false;
-    }
-}
-export class IngestEvents extends Resource {
-    // Public POST by design: the handler self-verifies the OFFICE's Ed25519
-    // signature against ObsOffice.publicKey (not an agent identity), so it can't use
-    // agent auth. allowCreate=true lets the request reach post() where that
-    // verification happens — same self-gating pattern as FederationPair/FederationSync.
-    allowCreate() {
-        return true;
-    }
-    async post(body, context) {
-        // Harper v5 does not populate this.request on Resource subclasses —
-        // getContext() is the only reliable path (the previous
-        // `(this as any).request` read was always undefined, so authHeader was
-        // always undefined and every request 401'd before reaching the office
-        // Ed25519 signature check below).
-        const ctx = this.getContext?.();
-        const request = ctx?.request ?? ctx;
-        const authHeader = request?.headers?.get?.("authorization") ?? request?.headers?.authorization;
-        // Parse and validate body
-        let payload;
-        try {
-            payload = (typeof body === "string" ? JSON.parse(body) : body);
-        }
-        catch {
-            return new Response(JSON.stringify({ error: "invalid JSON" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-        const { officeId, events = [], agents = [], syncedAt } = payload;
-        if (!officeId) {
-            return new Response(JSON.stringify({ error: "officeId required" }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-        // Look up the office
-        const office = await databases.flair.ObsOffice.get(officeId).catch(() => null);
-        if (!office) {
-            return new Response(JSON.stringify({ error: "office not registered — POST /ObsOffice first" }), { status: 403, headers: { "Content-Type": "application/json" } });
-        }
-        // Verify Ed25519 signature
-        if (!authHeader || !verifyEd25519Signature(String(office.publicKey), authHeader, officeId)) {
-            return new Response(JSON.stringify({ error: "invalid signature" }), { status: 401, headers: { "Content-Type": "application/json" } });
-        }
-        // Rate limit check
-        if (office.lastSeen) {
-            const msSinceLastSync = Date.now() - new Date(office.lastSeen).getTime();
-            if (msSinceLastSync < RATE_LIMIT_MS) {
-                return new Response(JSON.stringify({ error: "rate limit: 1 call per 10s" }), { status: 429, headers: { "Content-Type": "application/json" } });
-            }
-        }
-        // Batch limit
-        if (events.length > BATCH_LIMIT) {
-            return new Response(JSON.stringify({ error: `batch limit: max ${BATCH_LIMIT} events` }), { status: 400, headers: { "Content-Type": "application/json" } });
-        }
-        const now = new Date().toISOString();
-        const expiresAt = new Date(Date.now() + EVENT_TTL_DAYS * 24 * 60 * 60 * 1000).toISOString();
-        // Upsert agent snapshots
-        for (const agent of agents) {
-            if (!agent.agentId)
-                continue;
-            const snapshotId = `${officeId}:${agent.agentId}`;
-            await databases.flair.ObsAgentSnapshot.put({
-                id: snapshotId,
-                officeId,
-                agentId: agent.agentId,
-                name: agent.name ?? agent.agentId,
-                role: agent.role,
-                status: agent.status ?? "unknown",
-                model: agent.model,
-                lastActivity: agent.lastSeen ?? now,
-                lastHeartbeat: now,
-                updatedAt: now,
-            }).catch((e) => console.warn(`[IngestEvents] snapshot upsert failed for ${snapshotId}: ${e.message}`));
-        }
-        // Insert event feed entries (skip duplicates)
-        let inserted = 0;
-        for (const ev of events) {
-            if (!ev.id || !ev.kind)
-                continue;
-            const feedId = `${officeId}:${ev.id}`;
-            const existing = await databases.flair.ObsEventFeed.get(feedId).catch(() => null);
-            if (existing)
-                continue;
-            await databases.flair.ObsEventFeed.put({
-                id: feedId,
-                officeId,
-                kind: ev.kind,
-                authorId: ev.authorId,
-                summary: ev.summary,
-                refId: ev.refId,
-                scope: ev.scope,
-                createdAt: ev.createdAt,
-                receivedAt: now,
-                expiresAt,
-            }).catch((e) => console.warn(`[IngestEvents] event insert failed for ${feedId}: ${e.message}`));
-            inserted++;
-        }
-        // Update office lastSeen + agentCount
-        await databases.flair.ObsOffice.put({
-            ...office,
-            status: "online",
-            lastSeen: now,
-            agentCount: agents.length,
-            updatedAt: now,
-        }).catch(() => { });
-        return new Response(JSON.stringify({ ok: true, events: inserted, agents: agents.length }), {
-            status: 200,
-            headers: { "Content-Type": "application/json" },
-        });
-    }
-}

package/dist/resources/IssueTokens.js

@@ -1,19 +0,0 @@
-import { Resource, databases } from "@harperfast/harper";
-export class IssueTokens extends Resource {
-    static loadAsInstance = false;
-    async get(_target) {
-        const { refresh_token: refreshToken, operation_token: jwt } = await databases.system.hdb_user.operation({ operation: "create_authentication_tokens" }, this.getContext());
-        return { refreshToken, jwt };
-    }
-    async post(_target, data) {
-        if (!data?.username || !data?.password) {
-            throw new Error("username and password are required");
-        }
-        const { refresh_token: refreshToken, operation_token: jwt } = await databases.system.hdb_user.operation({
-            operation: "create_authentication_tokens",
-            username: data.username,
-            password: data.password,
-        });
-        return { refreshToken, jwt };
-    }
-}

package/dist/resources/ObsAgentSnapshot.js

@@ -1,13 +0,0 @@
-import { databases } from "@harperfast/harper";
-import { allowVerified, allowAdmin } from "./agent-auth.js";
-/**
- * ObsAgentSnapshot — observatory per-agent snapshot read-model. Writes are
- * system-driven (internal sync); agents may read. See ObsOffice for the
- * allowRead=allowVerified security default (flag for Sherlock).
- */
-export class ObsAgentSnapshot extends databases.flair.ObsAgentSnapshot {
-    allowRead() { return allowVerified(this.getContext?.()); }
-    allowCreate() { return allowAdmin(this.getContext?.()); }
-    allowUpdate() { return allowAdmin(this.getContext?.()); }
-    allowDelete() { return allowAdmin(this.getContext?.()); }
-}

package/dist/resources/ObsEventFeed.js

@@ -1,13 +0,0 @@
-import { databases } from "@harperfast/harper";
-import { allowVerified, allowAdmin } from "./agent-auth.js";
-/**
- * ObsEventFeed — observatory event-feed read-model. Writes are system-driven
- * (internal sync); agents may read. See ObsOffice for the allowRead=allowVerified
- * security default (flag for Sherlock).
- */
-export class ObsEventFeed extends databases.flair.ObsEventFeed {
-    allowRead() { return allowVerified(this.getContext?.()); }
-    allowCreate() { return allowAdmin(this.getContext?.()); }
-    allowUpdate() { return allowAdmin(this.getContext?.()); }
-    allowDelete() { return allowAdmin(this.getContext?.()); }
-}

package/dist/resources/ObsOffice.js

@@ -1,19 +0,0 @@
-import { databases } from "@harperfast/harper";
-import { allowVerified, allowAdmin } from "./agent-auth.js";
-/**
- * ObsOffice — observatory office-layout read-model. Writes are system-driven
- * (internal sync); agents may read. Self-authorizes now that the global gate is
- * non-rejecting.
- *
- * SECURITY DEFAULT (flag for Sherlock): allowRead is allowVerified (anonymous
- * denied). The ObservationCenter HTML shell is public but its data API calls
- * authenticate (admin-pass). If the public Office Space renderer needs anonymous
- * Obs reads, relax to allowRead=true WITH field-allowlisting (as Presence.get does)
- * — do NOT expose raw rows publicly.
- */
-export class ObsOffice extends databases.flair.ObsOffice {
-    allowRead() { return allowVerified(this.getContext?.()); }
-    allowCreate() { return allowAdmin(this.getContext?.()); }
-    allowUpdate() { return allowAdmin(this.getContext?.()); }
-    allowDelete() { return allowAdmin(this.getContext?.()); }
-}

package/dist/resources/ObservationCenter.js

@@ -1,23 +0,0 @@
-import { Resource } from "@harperfast/harper";
-import { readFileSync } from "node:fs";
-import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
-const HERE = dirname(fileURLToPath(import.meta.url));
-const HTML_PATH = resolve(HERE, "..", "..", "ui", "observation-center.html");
-const HTML = readFileSync(HTML_PATH, "utf8");
-/**
- * GET /ObservationCenter — serves the read-only dashboard shell.
- * The HTML handles its own Basic-auth prompt and polls authenticated JSON endpoints.
- */
-export class ObservationCenter extends Resource {
-    // The dashboard shell is just HTML + inline JS; the JS prompts the user
-    // for admin-pass and authenticates each API call. The shell itself is
-    // intentionally public so it can render before auth happens.
-    allowRead() { return true; }
-    async get() {
-        return new Response(HTML, {
-            status: 200,
-            headers: { "content-type": "text/html; charset=utf-8" },
-        });
-    }
-}