@viewportai/daemon 0.2.0 → 0.3.0

package/node_modules/@viewportai/context-engine/src/protocol/schemas.js

@@ -0,0 +1,50 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const Ajv = require('ajv');
+
+const SCHEMA_DIR = path.join(__dirname, '..', '..', 'schemas');
+const SCHEMA_FILES = [
+  'context_key_grant_v1.schema.json',
+  'context_key_grant_hpke_draft_01.schema.json',
+  'context_event_v1.schema.json',
+  'context_bundle_manifest_v1.schema.json',
+  'context_profile_v1.schema.json',
+  'context_erase_receipt_v1.schema.json',
+];
+
+const SCHEMA_IDS = Object.freeze({
+  bundleManifest: 'urn:viewport:context_bundle_manifest:v1',
+  eraseReceipt: 'urn:viewport:context_erase_receipt:v1',
+  event: 'urn:viewport:context_event:v1',
+  keyGrant: 'urn:viewport:context_key_grant:v1',
+  keyGrantHpkeDraft: 'urn:viewport:context_key_grant:hpke_draft_01',
+  profile: 'urn:viewport:context_profile:v1',
+});
+
+function loadSchema(name) {
+  return JSON.parse(fs.readFileSync(path.join(SCHEMA_DIR, name), 'utf8'));
+}
+
+function createProtocolValidator() {
+  const ajv = new Ajv({ allErrors: true, strict: false });
+  for (const schemaName of SCHEMA_FILES) {
+    const schema = loadSchema(schemaName);
+    ajv.addSchema(schema, schema.$id);
+  }
+
+  return {
+    ajv,
+    validateBundleManifest: ajv.getSchema(SCHEMA_IDS.bundleManifest),
+    validateEraseReceipt: ajv.getSchema(SCHEMA_IDS.eraseReceipt),
+    validateEvent: ajv.getSchema(SCHEMA_IDS.event),
+    validateKeyGrant: ajv.getSchema(SCHEMA_IDS.keyGrant),
+    validateKeyGrantHpkeDraft: ajv.getSchema(SCHEMA_IDS.keyGrantHpkeDraft),
+    validateProfile: ajv.getSchema(SCHEMA_IDS.profile),
+  };
+}
+
+module.exports = {
+  SCHEMA_IDS,
+  createProtocolValidator,
+  loadSchema,
+};

package/node_modules/@viewportai/context-engine/src/repo/access-model.js

@@ -0,0 +1,170 @@
+const { createRepoKey } = require('../crypto/keys');
+const { readJson, writeJson } = require('./files');
+const { repoPaths } = require('./paths');
+
+function grantDecision({ allowed, pending = false, reason, epochs = [] }) {
+  return { allowed, pending, reason, epochs };
+}
+
+class ContextAccessModel {
+  constructor({ peerVault, repoId, peerActorName }) {
+    this.peerVault = peerVault;
+    this.repoId = repoId;
+    this.peerActorName = peerActorName;
+    this.members = new Map();
+    this.devices = new Map();
+  }
+
+  addMember(userName, { history = 'full' } = {}) {
+    const metadata = this.peerVault.getRepoMetadata(this.repoId);
+    const joinedEpoch = history === 'join_date'
+      ? this.rotateEpoch(`member.joined:${userName}`)
+      : metadata.currentKeyEpoch;
+
+    this.members.set(userName, {
+      active: true,
+      history,
+      joinedEpoch,
+    });
+
+    return this.members.get(userName);
+  }
+
+  removeMember(userName) {
+    const member = this.members.get(userName);
+    if (!member) {
+      throw new Error(`Unknown member: ${userName}`);
+    }
+
+    member.active = false;
+    return this.rotateEpoch(`member.removed:${userName}`);
+  }
+
+  importDeviceIdentity(devicePublicIdentity) {
+    this.peerVault.importPublicIdentity(devicePublicIdentity);
+  }
+
+  approveDevice({ userName, deviceName, devicePublicIdentity = null }) {
+    if (devicePublicIdentity) {
+      this.importDeviceIdentity(devicePublicIdentity);
+    }
+
+    this.devices.set(deviceName, {
+      userName,
+      approved: true,
+    });
+
+    return this.devices.get(deviceName);
+  }
+
+  denyDevice({ userName, deviceName }) {
+    this.devices.set(deviceName, {
+      userName,
+      approved: false,
+    });
+
+    return this.devices.get(deviceName);
+  }
+
+  accessDecision({ userName, deviceName }) {
+    const member = this.members.get(userName);
+    if (!member?.active) {
+      return grantDecision({ allowed: false, reason: 'acl_denied' });
+    }
+
+    const device = this.devices.get(deviceName);
+    if (!device || device.userName !== userName) {
+      return grantDecision({ allowed: false, reason: 'device_unknown' });
+    }
+
+    if (!device.approved) {
+      return grantDecision({ allowed: false, reason: 'device_not_approved' });
+    }
+
+    const epochs = this.allowedEpochs(member);
+    const missingEpochs = epochs.filter((epoch) => !this.hasGrant({ userName, keyEpoch: epoch }));
+
+    if (missingEpochs.length > 0) {
+      return grantDecision({
+        allowed: true,
+        pending: true,
+        reason: 'key_delivery_pending',
+        epochs: missingEpochs,
+      });
+    }
+
+    return grantDecision({
+      allowed: true,
+      reason: 'ready',
+      epochs,
+    });
+  }
+
+  async ensureAccess({ userName, deviceName }) {
+    const decision = this.accessDecision({ userName, deviceName });
+    if (!decision.allowed) {
+      return decision;
+    }
+
+    for (const epoch of decision.epochs) {
+      await this.grantEpochToUser({ userName, keyEpoch: epoch });
+    }
+
+    return this.accessDecision({ userName, deviceName });
+  }
+
+  allowedEpochs(member) {
+    const metadata = this.peerVault.getRepoMetadata(this.repoId);
+    const start = member.history === 'full' ? 1 : member.joinedEpoch;
+    const epochs = [];
+    for (let epoch = start; epoch <= metadata.currentKeyEpoch; epoch += 1) {
+      epochs.push(epoch);
+    }
+
+    return epochs;
+  }
+
+  hasGrant({ userName, keyEpoch }) {
+    return this.peerVault.activeRecipients(this.repoId).has(userName)
+      && this.grantEventsFor({ userName, keyEpoch }).length > 0;
+  }
+
+  grantEventsFor({ userName, keyEpoch }) {
+    const { listJsonFiles, readJson: readEvent } = require('./files');
+    return listJsonFiles(repoPaths(this.peerVault.home, this.repoId).eventsDir)
+      .map((file) => readEvent(file))
+      .filter((event) => (
+        ['repo.created', 'member.granted', 'key.rotated'].includes(event.type)
+        && event.grant?.recipientName === userName
+        && event.grant?.keyEpoch === keyEpoch
+      ));
+  }
+
+  async grantEpochToUser({ userName, keyEpoch }) {
+    return this.peerVault.appendGrantEventHpke({
+      repoId: this.repoId,
+      actorName: this.peerActorName,
+      recipient: this.peerVault.getKnownIdentity(userName),
+      keyEpoch,
+      repoKey: this.peerVault.getRepoKey(this.repoId, keyEpoch),
+      eventType: 'member.granted',
+    });
+  }
+
+  rotateEpoch(reason) {
+    const paths = repoPaths(this.peerVault.home, this.repoId);
+    const metadata = this.peerVault.getRepoMetadata(this.repoId);
+    const nextEpoch = metadata.currentKeyEpoch + 1;
+    const keys = readJson(paths.keys, { epochs: {} });
+    keys.epochs[String(nextEpoch)] = createRepoKey().toString('base64');
+    writeJson(paths.keys, keys);
+    writeJson(paths.metadata, {
+      ...metadata,
+      currentKeyEpoch: nextEpoch,
+    });
+
+    return nextEpoch;
+  }
+}
+
+module.exports = { ContextAccessModel };

package/node_modules/@viewportai/context-engine/src/repo/bundles.js

@@ -0,0 +1,180 @@
+const crypto = require('node:crypto');
+const { canonicalize } = require('../crypto/canonical');
+const { digest } = require('../crypto/envelope');
+const {
+  EMBEDDING_MODEL_DIGEST,
+  EMBEDDING_MODEL_ID,
+  rankEntries,
+} = require('../store/local-semantic');
+
+const RESOLVER = Object.freeze({
+  kind: 'context-vault-poc',
+  version: '0.0.1',
+  vectorIndexEngine: 'sqlite-fts5+local-hash-embeddings',
+  embeddingModelId: EMBEDDING_MODEL_ID,
+  embeddingModelDigest: EMBEDDING_MODEL_DIGEST,
+});
+
+class ResolverPinMismatchError extends Error {
+  constructor(mismatches) {
+    super(`Context resolver pin mismatch: ${mismatches.map(({ field }) => field).join(', ')}`);
+    this.name = 'ResolverPinMismatchError';
+    this.code = 'CONTEXT_RESOLVER_PIN_MISMATCH';
+    this.mismatches = mismatches;
+  }
+}
+
+function resolverPinMismatches(pins) {
+  const expected = {
+    resolverVersion: RESOLVER.version,
+    vectorIndexEngine: RESOLVER.vectorIndexEngine,
+    embeddingModelId: RESOLVER.embeddingModelId,
+    embeddingModelDigest: RESOLVER.embeddingModelDigest,
+  };
+
+  return Object.entries(expected)
+    .filter(([field]) => Object.hasOwn(pins, field) && pins[field] !== expected[field])
+    .map(([field, actual]) => ({
+      field,
+      expected: pins[field],
+      actual,
+    }));
+}
+
+function selectRows({ rows, query, maxItems }) {
+  const rankedRows = query ? rankEntries(rows, query) : rows.map((entry) => ({ entry, score: null }));
+  return rankedRows
+    .filter(({ score }) => score === null || score > 0)
+    .slice(0, maxItems ?? rankedRows.length)
+    .map(({ entry, score }) => ({
+      ...entry,
+      retrieval_score: score,
+    }));
+}
+
+function manifestItemForEntry(entry) {
+  if (entry.scope === 'private') {
+    return {
+      entry_id: entry.id,
+      version_id: entry.version_id,
+      source: 'private://redacted',
+      trust: entry.trust_state,
+      scope: entry.scope,
+      body_mode: 'redacted',
+      title: 'Private context item',
+      retrieval_score: entry.retrieval_score,
+    };
+  }
+
+  return {
+    entry_id: entry.id,
+    version_id: entry.version_id,
+    source: entry.source,
+    trust: entry.trust_state,
+    scope: entry.scope,
+    body_mode: 'included',
+    title: entry.title,
+    retrieval_score: entry.retrieval_score,
+  };
+}
+
+function normalizeBundleManifestForDigest(manifest) {
+  const {
+    digest: _digest,
+    ...withoutDigest
+  } = manifest;
+
+  return {
+    ...withoutDigest,
+    bundle_id: 'deterministic',
+    resolved_at: 'deterministic',
+    override: manifest.override ? {
+      ...manifest.override,
+      created_at: 'deterministic',
+    } : undefined,
+  };
+}
+
+function digestBundleManifest(manifest) {
+  return digest(canonicalize(normalizeBundleManifestForDigest(manifest)));
+}
+
+function buildContextBundle({
+  actorName,
+  rows,
+  packs,
+  target,
+  includePrivate,
+  pins,
+  override,
+  query,
+  maxItems,
+  offline,
+  lastSyncAt,
+  profileDescriptor = null,
+}) {
+  const mismatches = resolverPinMismatches(pins);
+  if (mismatches.length > 0 && !override?.reason) {
+    throw new ResolverPinMismatchError(mismatches);
+  }
+
+  const selectedRows = selectRows({ rows, query, maxItems });
+  const items = selectedRows
+    .map((entry) => manifestItemForEntry(entry))
+    .sort((a, b) => `${a.entry_id}:${a.version_id}`.localeCompare(`${b.entry_id}:${b.version_id}`));
+
+  const manifest = {
+    apiVersion: 'viewport.context_bundle_manifest/v1',
+    bundle_id: `ctxb_${crypto.randomUUID()}`,
+    resolved_at: new Date().toISOString(),
+    resolver: {
+      kind: RESOLVER.kind,
+      version: RESOLVER.version,
+    },
+    index: {
+      engine: RESOLVER.vectorIndexEngine,
+      embedding_model_id: RESOLVER.embeddingModelId,
+      embedding_model_digest: RESOLVER.embeddingModelDigest,
+    },
+    request: { packs, target, include_private: includePrivate, pins, query, max_items: maxItems },
+    profile: profileDescriptor,
+    retrieval: {
+      mode: query ? 'local-semantic' : 'all-approved',
+      local_only: true,
+      remote_plaintext_calls: 0,
+    },
+    offline: {
+      active: Boolean(offline),
+      last_sync_at: lastSyncAt,
+    },
+    override: override?.reason ? {
+      reason: override.reason,
+      actor_name: actorName,
+      created_at: new Date().toISOString(),
+      mismatches,
+    } : undefined,
+    items,
+  };
+  manifest.digest = digestBundleManifest(manifest);
+
+  return {
+    manifest,
+    delivery: {
+      items: selectedRows.map((entry) => ({
+        id: entry.id,
+        title: entry.title,
+        body: entry.body,
+        scope: entry.scope,
+        trust: entry.trust_state,
+      })),
+    },
+  };
+}
+
+module.exports = {
+  RESOLVER,
+  ResolverPinMismatchError,
+  buildContextBundle,
+  digestBundleManifest,
+  normalizeBundleManifestForDigest,
+};

package/node_modules/@viewportai/context-engine/src/repo/candidates.js

@@ -0,0 +1,205 @@
+function candidatePriority(options) {
+  const sourceKind = options.sourceKind ?? 'integration';
+  const source = options.source ?? '';
+  let score = 10;
+
+  if (sourceKind === 'workflow') {
+    score += 40;
+  }
+
+  if (sourceKind === 'plan') {
+    score += 30;
+  }
+
+  if (sourceKind === 'integration') {
+    score += 20;
+  }
+
+  if (source.includes('blocks-run') || source.includes('approval-gate')) {
+    score += 30;
+  }
+
+  return score;
+}
+
+function proposeEntry(vault, options) {
+  const payload = {
+    id: options.id ?? `ctxc_${cryptoRandomUuid()}`,
+    title: options.title,
+    body: options.body,
+    source: options.source ?? 'integration://unknown',
+    sourceKind: options.sourceKind ?? 'integration',
+    trustState: 'candidate',
+    status: 'created',
+    priorityScore: options.priorityScore ?? candidatePriority(options),
+    createdAt: options.createdAt ?? new Date().toISOString(),
+  };
+
+  return vault.appendSharedEvent({
+    repoId: options.repoId,
+    actorName: options.actorName,
+    type: 'entry.proposed',
+    payload,
+    contextResourceId: options.contextResourceId ?? null,
+  });
+}
+
+function approveCandidate(
+  vault,
+  { repoId, actorName, candidateId, title, body, source, review = null, contextResourceId = null },
+) {
+  const approved = vault.appendSharedEvent({
+    repoId,
+    actorName,
+    type: 'candidate.approved',
+    payload: {
+      id: candidateId,
+      reviewedBy: actorName,
+      reviewedAt: new Date().toISOString(),
+      review,
+    },
+    contextResourceId,
+  });
+
+  const entry = vault.addEntry({
+    id: `ctxe_from_${candidateId}`,
+    repoId,
+    actorName,
+    scope: 'resource',
+    title,
+    body,
+    source: source ?? `candidate://${candidateId}`,
+    sourceKind: 'human',
+    trustState: 'approved',
+    review,
+    contextResourceId,
+  });
+
+  return { approved, entry };
+}
+
+function assignCandidate(
+  vault,
+  { repoId, actorName, candidateId, reviewerName },
+) {
+  return vault.appendSharedEvent({
+    repoId,
+    actorName,
+    type: 'candidate.assigned',
+    payload: {
+      id: candidateId,
+      assignedTo: reviewerName,
+      reviewedAt: new Date().toISOString(),
+    },
+  });
+}
+
+function rejectCandidate(vault, { repoId, actorName, candidateId, reason }) {
+  return vault.appendSharedEvent({
+    repoId,
+    actorName,
+    type: 'candidate.rejected',
+    payload: {
+      id: candidateId,
+      reviewedBy: actorName,
+      reviewReason: reason,
+      reviewedAt: new Date().toISOString(),
+    },
+  });
+}
+
+function tombstoneCandidate(vault, { repoId, actorName, candidateId, reason }) {
+  return vault.appendSharedEvent({
+    repoId,
+    actorName,
+    type: 'candidate.tombstoned',
+    payload: {
+      id: candidateId,
+      reviewedBy: actorName,
+      reviewReason: reason,
+      tombstonedAt: new Date().toISOString(),
+    },
+  });
+}
+
+function batchAssignCandidates(
+  vault,
+  { repoId, actorName, candidateIds, reviewerName },
+) {
+  return candidateIds.map((candidateId) =>
+    assignCandidate(vault, {
+      repoId,
+      actorName,
+      candidateId,
+      reviewerName,
+    }),
+  );
+}
+
+function batchRejectCandidates(
+  vault,
+  { repoId, actorName, candidateIds, reason },
+) {
+  return candidateIds.map((candidateId) =>
+    rejectCandidate(vault, {
+      repoId,
+      actorName,
+      candidateId,
+      reason,
+    }),
+  );
+}
+
+function batchTombstoneCandidates(
+  vault,
+  { repoId, actorName, candidateIds, reason },
+) {
+  return candidateIds.map((candidateId) =>
+    tombstoneCandidate(vault, {
+      repoId,
+      actorName,
+      candidateId,
+      reason,
+    }),
+  );
+}
+
+function decayCandidates(
+  vault,
+  { repoId, actorName, staleAfterDays = 14, now = new Date() },
+) {
+  const candidates = vault.allCandidates({ repoId, actorName });
+  const cutoffMs = now.getTime() - staleAfterDays * 24 * 60 * 60 * 1000;
+  const staleCandidateIds = candidates
+    .filter((candidate) => ['created', 'assigned'].includes(candidate.status))
+    .filter((candidate) => new Date(candidate.created_at).getTime() < cutoffMs)
+    .map((candidate) => candidate.id);
+
+  if (staleCandidateIds.length === 0) {
+    return [];
+  }
+
+  return batchTombstoneCandidates(vault, {
+    repoId,
+    actorName,
+    candidateIds: staleCandidateIds,
+    reason: `Candidate exceeded ${staleAfterDays} day review SLA.`,
+  });
+}
+
+function cryptoRandomUuid() {
+  return require('node:crypto').randomUUID();
+}
+
+module.exports = {
+  approveCandidate,
+  assignCandidate,
+  batchAssignCandidates,
+  batchRejectCandidates,
+  batchTombstoneCandidates,
+  candidatePriority,
+  decayCandidates,
+  proposeEntry,
+  rejectCandidate,
+  tombstoneCandidate,
+};