@viewportai/daemon 0.2.0 → 0.3.0

package/node_modules/@viewportai/context-engine/src/repo/devices.js

@@ -0,0 +1,141 @@
+const crypto = require('node:crypto');
+const { createIdentity: createCryptoIdentity } = require('../crypto/keys');
+const { openBytesWithHpke, sealBytesWithHpke } = require('../crypto/hpke-grants');
+const { signEnvelope, verifyEnvelope } = require('../crypto/signatures');
+const {
+  exportPublicIdentity,
+  getIdentity,
+  importPublicIdentity,
+  updateIdentity,
+} = require('./identities');
+const { recoverUserIdentity } = require('./users');
+
+const DEVICE_APPROVAL_PURPOSE = 'viewport-context-device-approval-v1';
+
+function codeDigest(code) {
+  return `sha256:${crypto.createHash('sha256').update(String(code), 'utf8').digest('hex')}`;
+}
+
+function createDeviceApprovalRequest(home, { deviceName, code, keyStore = null }) {
+  const identity = createCryptoIdentity(deviceName);
+  updateIdentity(home, deviceName, {
+    ...identity,
+    deviceName,
+    deviceState: 'pending_approval',
+  }, { keyStore });
+
+  return {
+    version: 'viewport.context_device_approval_request/v1',
+    deviceName,
+    codeDigest: codeDigest(code),
+    devicePublicIdentity: exportPublicIdentity(home, deviceName),
+    createdAt: new Date().toISOString(),
+  };
+}
+
+function userDecryptionCapability(userIdentity) {
+  return {
+    userName: userIdentity.name,
+    signingPublicKey: userIdentity.signingPublicKey ?? userIdentity.publicKey,
+    encryptionPublicKey: userIdentity.encryptionPublicKey,
+    encryptionPrivateKey: userIdentity.encryptionPrivateKey,
+    hpkePublicKey: userIdentity.hpkePublicKey,
+    hpkePrivateKey: userIdentity.hpkePrivateKey,
+  };
+}
+
+async function approveDeviceRequest(home, {
+  userName,
+  request,
+  passphrase,
+  recoveryCode,
+  code,
+}) {
+  if (request.codeDigest !== codeDigest(code)) {
+    throw new Error('Device approval code mismatch');
+  }
+
+  const userIdentity = recoverUserIdentity(home, { userName, passphrase, recoveryCode });
+  const capability = userDecryptionCapability(userIdentity);
+  const envelope = await sealBytesWithHpke(
+    Buffer.from(JSON.stringify(capability), 'utf8'),
+    request.devicePublicIdentity,
+    {
+      purpose: DEVICE_APPROVAL_PURPOSE,
+      context: {
+        codeDigest: request.codeDigest,
+        deviceName: request.deviceName,
+        userName,
+      },
+    },
+  );
+
+  const unsignedApproval = {
+    version: 'viewport.context_device_approval/v1',
+    userName,
+    deviceName: request.deviceName,
+    envelope,
+    approvedAt: new Date().toISOString(),
+  };
+
+  return {
+    ...unsignedApproval,
+    signature: signEnvelope(unsignedApproval, userIdentity),
+  };
+}
+
+async function acceptDeviceApproval(home, { userName, deviceName, approval, code, keyStore = null }) {
+  if (approval.userName !== userName || approval.deviceName !== deviceName) {
+    throw new Error('Device approval target mismatch');
+  }
+
+  if (approval.envelope.context?.codeDigest !== codeDigest(code)) {
+    throw new Error('Device approval code mismatch');
+  }
+
+  const deviceIdentity = getIdentity(home, deviceName, { keyStore });
+  if (!deviceIdentity?.hpkePrivateKey) {
+    throw new Error(`Unknown pending device: ${deviceName}`);
+  }
+
+  const plaintext = await openBytesWithHpke(approval.envelope, deviceIdentity, {
+    expectedPurpose: DEVICE_APPROVAL_PURPOSE,
+  });
+  const capability = JSON.parse(plaintext.toString('utf8'));
+  if (capability.userName !== userName) {
+    throw new Error('Device approval capability user mismatch');
+  }
+  if (!verifyEnvelope(approval, capability.signingPublicKey)) {
+    throw new Error('Device approval signature invalid');
+  }
+
+  updateIdentity(home, deviceName, {
+    ...deviceIdentity,
+    deviceState: 'approved',
+    approvedAt: new Date().toISOString(),
+    grantRecipientName: userName,
+    userSigningPublicKey: capability.signingPublicKey,
+    grantEncryptionPublicKey: capability.encryptionPublicKey,
+    grantEncryptionPrivateKey: capability.encryptionPrivateKey,
+    grantHpkePublicKey: capability.hpkePublicKey,
+    grantHpkePrivateKey: capability.hpkePrivateKey,
+  }, { keyStore });
+
+  importPublicIdentity(home, {
+    name: userName,
+    publicKey: capability.signingPublicKey,
+    signingPublicKey: capability.signingPublicKey,
+    encryptionPublicKey: capability.encryptionPublicKey,
+    hpkePublicKey: capability.hpkePublicKey,
+  });
+
+  return getIdentity(home, deviceName, { keyStore });
+}
+
+module.exports = {
+  DEVICE_APPROVAL_PURPOSE,
+  acceptDeviceApproval,
+  approveDeviceRequest,
+  codeDigest,
+  createDeviceApprovalRequest,
+};

package/node_modules/@viewportai/context-engine/src/repo/events.js

@@ -0,0 +1,87 @@
+const crypto = require('node:crypto');
+const path = require('node:path');
+const { canonicalize } = require('../crypto/canonical');
+const { digest, encryptJson } = require('../crypto/envelope');
+const { signEnvelope } = require('../crypto/signatures');
+const { listJsonFiles, readJson, writeJson } = require('./files');
+const { repoPaths } = require('./paths');
+
+function appendSharedEvent(vault, { repoId, actorName, type, payload, contextResourceId = null }) {
+  const metadata = vault.getRepoMetadata(repoId);
+  const repoKey = vault.getRepoKey(repoId, metadata.currentKeyEpoch);
+  const encrypted = encryptJson(payload, repoKey);
+  return appendUnsignedEvent(vault, {
+    repoId,
+    actor: vault.getIdentity(actorName),
+    type,
+    keyEpoch: metadata.currentKeyEpoch,
+    visibility: 'shared',
+    encrypted,
+    payloadDigest: digest(canonicalize(payload)),
+    contextResourceId,
+  });
+}
+
+function appendPrivateEvent(vault, { repoId, actorName, type, payload, contextResourceId = null }) {
+  const identity = vault.getIdentity(actorName);
+  const encrypted = encryptJson(payload, Buffer.from(identity.personalKey, 'base64'));
+  return appendUnsignedEvent(vault, {
+    repoId,
+    actor: identity,
+    type,
+    keyEpoch: 0,
+    visibility: 'private',
+    encrypted,
+    payloadDigest: digest(canonicalize(payload)),
+    contextResourceId,
+  });
+}
+
+function appendUnsignedEvent(
+  vault,
+  {
+    repoId,
+    actor,
+    type,
+    keyEpoch,
+    visibility,
+    encrypted = null,
+    grant = null,
+    payloadDigest = null,
+    contextResourceId = null,
+  },
+) {
+  const event = {
+    id: `evt_${crypto.randomUUID()}`,
+    repoId,
+    type,
+    actorName: actor.name,
+    keyEpoch,
+    visibility,
+    createdAt: new Date().toISOString(),
+    parentIds: latestEventIds(vault.home, repoId).slice(-2),
+    ...(contextResourceId ? { contextResourceId } : {}),
+    encrypted,
+    grant,
+    payloadDigest,
+    schemaVersion: 'viewport.context_event/v1',
+  };
+
+  const signature = signEnvelope(event, actor);
+  const signed = { ...event, signature };
+  const sequence = latestEventIds(vault.home, repoId).length + 1;
+  const fileName = `${String(sequence).padStart(8, '0')}-${signed.id}.json`;
+  writeJson(path.join(repoPaths(vault.home, repoId).eventsDir, fileName), signed);
+  return signed;
+}
+
+function latestEventIds(home, repoId) {
+  return listJsonFiles(repoPaths(home, repoId).eventsDir).map((file) => readJson(file).id);
+}
+
+module.exports = {
+  appendPrivateEvent,
+  appendSharedEvent,
+  appendUnsignedEvent,
+  latestEventIds,
+};

package/node_modules/@viewportai/context-engine/src/repo/files.js

@@ -0,0 +1,33 @@
+const fs = require('node:fs');
+const path = require('node:path');
+
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true });
+}
+
+function readJson(file, fallback = null) {
+  if (!fs.existsSync(file)) {
+    return fallback;
+  }
+
+  return JSON.parse(fs.readFileSync(file, 'utf8'));
+}
+
+function writeJson(file, value) {
+  ensureDir(path.dirname(file));
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function listJsonFiles(dir) {
+  if (!fs.existsSync(dir)) {
+    return [];
+  }
+
+  return fs
+    .readdirSync(dir)
+    .filter((file) => file.endsWith('.json'))
+    .sort()
+    .map((file) => path.join(dir, file));
+}
+
+module.exports = { ensureDir, listJsonFiles, readJson, writeJson };

package/node_modules/@viewportai/context-engine/src/repo/identities.js

@@ -0,0 +1,128 @@
+const path = require('node:path');
+const { createIdentity: createCryptoIdentity } = require('../crypto/keys');
+const { listJsonFiles, readJson, writeJson } = require('./files');
+const {
+  hasIdentitySecrets,
+  mergeIdentitySecrets,
+  splitIdentitySecrets,
+} = require('./key-store');
+
+function createIdentity(home, name, { keyStore = null } = {}) {
+  const identity = createCryptoIdentity(name);
+  writeIdentity(home, name, identity, { keyStore });
+  return identity;
+}
+
+function getIdentity(home, name, { keyStore = null } = {}) {
+  const publicRecord = readJson(identityPath(home, name));
+  if (!publicRecord) {
+    throw new Error(`Unknown identity: ${name}`);
+  }
+
+  const identity = keyStore
+    ? mergeIdentitySecrets(publicRecord, keyStore.getIdentitySecrets(name))
+    : publicRecord;
+
+  if (!identity?.privateKey) {
+    throw new Error(`Unknown identity: ${name}`);
+  }
+  return identity;
+}
+
+function getKnownIdentity(home, name) {
+  const identity = readJson(identityPath(home, name));
+  if (!identity?.publicKey) {
+    throw new Error(`Unknown identity: ${name}`);
+  }
+  return identity;
+}
+
+function exportPublicIdentity(home, name) {
+  const identity = getKnownIdentity(home, name);
+  return {
+    name: identity.name,
+    publicKey: identity.signingPublicKey ?? identity.publicKey,
+    signingPublicKey: identity.signingPublicKey ?? identity.publicKey,
+    encryptionPublicKey: identity.encryptionPublicKey,
+    hpkePublicKey: identity.hpkePublicKey,
+  };
+}
+
+function importPublicIdentity(home, identity, { allowKeyRotation = false } = {}) {
+  const existing = readJson(identityPath(home, identity.name), {});
+  const nextSigningKey = identity.signingPublicKey ?? identity.publicKey;
+
+  if (existing.signingPublicKey && existing.signingPublicKey !== nextSigningKey) {
+    throw new Error(`Identity signing key changed for ${identity.name}; explicit key rotation is required`);
+  }
+
+  if (!allowKeyRotation && existing.encryptionPublicKey && existing.encryptionPublicKey !== identity.encryptionPublicKey) {
+    throw new Error(`Identity encryption key changed for ${identity.name}; explicit key rotation is required`);
+  }
+
+  if (!allowKeyRotation && existing.hpkePublicKey && existing.hpkePublicKey !== identity.hpkePublicKey) {
+    throw new Error(`Identity HPKE key changed for ${identity.name}; explicit key rotation is required`);
+  }
+
+  writeJson(identityPath(home, identity.name), {
+    ...existing,
+    name: identity.name,
+    publicKey: nextSigningKey,
+    signingPublicKey: nextSigningKey,
+    encryptionPublicKey: identity.encryptionPublicKey,
+    hpkePublicKey: identity.hpkePublicKey,
+    grantRecipientName: identity.grantRecipientName ?? existing.grantRecipientName,
+  });
+}
+
+function updateIdentity(home, name, patch, { keyStore = null } = {}) {
+  let current = {};
+  try {
+    current = getIdentity(home, name, { keyStore });
+  } catch (error) {
+    if (!(error instanceof Error) || !error.message.startsWith('Unknown identity:')) {
+      throw error;
+    }
+  }
+  const next = { ...current, ...patch };
+  writeIdentity(home, name, next, { keyStore });
+  return getIdentity(home, name, { keyStore });
+}
+
+function writeIdentity(home, name, identity, { keyStore = null } = {}) {
+  if (!keyStore) {
+    writeJson(identityPath(home, name), identity);
+    return;
+  }
+
+  const { publicRecord, secrets } = splitIdentitySecrets(identity);
+  if (hasIdentitySecrets(secrets)) {
+    keyStore.setIdentitySecrets(name, secrets);
+  }
+  writeJson(identityPath(home, name), publicRecord);
+}
+
+function identityPath(home, name) {
+  return path.join(home, 'identities', `${name}.json`);
+}
+
+function loadPublicKeys(home) {
+  const publicKeys = new Map();
+  for (const file of listJsonFiles(path.join(home, 'identities'))) {
+    const identity = readJson(file);
+    publicKeys.set(identity.name, identity.signingPublicKey ?? identity.publicKey);
+  }
+  return publicKeys;
+}
+
+module.exports = {
+  createIdentity,
+  exportPublicIdentity,
+  getIdentity,
+  getKnownIdentity,
+  identityPath,
+  importPublicIdentity,
+  loadPublicKeys,
+  updateIdentity,
+  writeIdentity,
+};

package/node_modules/@viewportai/context-engine/src/repo/key-store.js

@@ -0,0 +1,126 @@
+const { spawnSync } = require('node:child_process');
+
+const PRIVATE_IDENTITY_FIELDS = [
+  'privateKey',
+  'signingPrivateKey',
+  'encryptionPrivateKey',
+  'hpkePrivateKey',
+  'personalKey',
+  'grantEncryptionPrivateKey',
+  'grantHpkePrivateKey',
+];
+
+function splitIdentitySecrets(identity) {
+  const publicRecord = { ...identity };
+  const secrets = {};
+
+  for (const field of PRIVATE_IDENTITY_FIELDS) {
+    if (publicRecord[field] !== undefined) {
+      secrets[field] = publicRecord[field];
+      delete publicRecord[field];
+    }
+  }
+
+  return { publicRecord, secrets };
+}
+
+function hasIdentitySecrets(secrets) {
+  return Object.keys(secrets).length > 0;
+}
+
+function mergeIdentitySecrets(publicRecord, secrets = {}) {
+  return { ...publicRecord, ...secrets };
+}
+
+class MemoryIdentitySecretStore {
+  constructor() {
+    this.records = new Map();
+  }
+
+  setIdentitySecrets(name, secrets) {
+    this.records.set(name, { ...secrets });
+  }
+
+  getIdentitySecrets(name) {
+    const secrets = this.records.get(name);
+    if (!secrets) {
+      throw new Error(`Missing identity secrets for ${name}`);
+    }
+    return { ...secrets };
+  }
+
+  deleteIdentitySecrets(name) {
+    this.records.delete(name);
+  }
+}
+
+class MacOsKeychainIdentitySecretStore {
+  constructor({ service = 'ai.viewport.context-engine', namespace = 'default' } = {}) {
+    this.service = service;
+    this.namespace = namespace;
+  }
+
+  setIdentitySecrets(name, secrets) {
+    const account = this.account(name);
+    runSecurity(['delete-generic-password', '-a', account, '-s', this.service], {
+      allowFailure: true,
+    });
+    runSecurity([
+      'add-generic-password',
+      '-a',
+      account,
+      '-s',
+      this.service,
+      '-w',
+      JSON.stringify(secrets),
+      '-U',
+    ]);
+  }
+
+  getIdentitySecrets(name) {
+    const result = runSecurity([
+      'find-generic-password',
+      '-a',
+      this.account(name),
+      '-s',
+      this.service,
+      '-w',
+    ]);
+    return JSON.parse(result.stdout.trim());
+  }
+
+  deleteIdentitySecrets(name) {
+    runSecurity(['delete-generic-password', '-a', this.account(name), '-s', this.service], {
+      allowFailure: true,
+    });
+  }
+
+  account(name) {
+    return `${this.namespace}:${name}`;
+  }
+}
+
+function runSecurity(args, { allowFailure = false } = {}) {
+  if (process.platform !== 'darwin') {
+    throw new Error('macOS Keychain context key store is only available on darwin');
+  }
+
+  const result = spawnSync('security', args, {
+    encoding: 'utf8',
+  });
+
+  if (result.status !== 0 && !allowFailure) {
+    const detail = (result.stderr || result.stdout || '').trim();
+    throw new Error(`macOS Keychain command failed: ${detail || `security ${args[0]}`}`);
+  }
+
+  return result;
+}
+
+module.exports = {
+  MacOsKeychainIdentitySecretStore,
+  MemoryIdentitySecretStore,
+  hasIdentitySecrets,
+  mergeIdentitySecrets,
+  splitIdentitySecrets,
+};