@viewportai/daemon 0.2.0 → 0.3.0

package/node_modules/@viewportai/context-engine/src/repo/sync.js

@@ -0,0 +1,163 @@
+const fs = require('node:fs');
+const path = require('node:path');
+const { createProtocolValidator } = require('../protocol/schemas');
+const { ensureDir, listJsonFiles, readJson, writeJson } = require('./files');
+const { repoPaths } = require('./paths');
+
+const protocol = createProtocolValidator();
+
+function assertValidSyncEvent(event, file) {
+  if (!protocol.validateEvent(event)) {
+    throw new Error(`Invalid context event schema in ${file}: ${JSON.stringify(protocol.validateEvent.errors)}`);
+  }
+
+  if (event.grant?.wrappedRepoKeyEnvelope) {
+    const grant = event.grant.wrappedRepoKeyEnvelope;
+    const validLegacyGrant = protocol.validateKeyGrant(grant);
+    const validHpkeGrant = protocol.validateKeyGrantHpkeDraft(grant);
+    if (!validLegacyGrant && !validHpkeGrant) {
+      throw new Error(`Invalid context key grant schema in ${file}: ${JSON.stringify({
+        legacy: protocol.validateKeyGrant.errors,
+        hpke: protocol.validateKeyGrantHpkeDraft.errors,
+      })}`);
+    }
+  }
+}
+
+function ensureMetadataFromEvents(paths, repoId, events) {
+  if (readJson(paths.metadata, null)) {
+    return;
+  }
+
+  const repoCreated = events.find(({ event }) => event.type === 'repo.created')?.event;
+  const currentKeyEpoch = events.reduce((max, { event }) => Math.max(
+    max,
+    Number(event.grant?.nextKeyEpoch ?? event.grant?.keyEpoch ?? event.keyEpoch ?? 1),
+  ), 1);
+
+  writeJson(paths.metadata, {
+    repoId,
+    createdAt: repoCreated?.createdAt ?? new Date().toISOString(),
+    currentKeyEpoch,
+    ownerName: repoCreated?.grant?.recipientName ?? repoCreated?.actorName ?? 'unknown',
+    erasedActors: {},
+    grantProtocol: events.some(({ event }) => (
+      event.grant?.wrappedRepoKeyEnvelope?.version === 'viewport.context_key_grant/hpke-draft-01'
+    )) ? 'hpke-draft-01' : 'legacy-poc',
+  });
+}
+
+function exportSync(home, { repoId, outDir }) {
+  const paths = repoPaths(home, repoId);
+  ensureDir(outDir);
+  const copied = [];
+
+  for (const eventFile of listJsonFiles(paths.eventsDir)) {
+    const event = readJson(eventFile);
+    assertValidSyncEvent(event, eventFile);
+
+    if (event.visibility === 'private') {
+      continue;
+    }
+
+    const target = path.join(outDir, path.basename(eventFile));
+    fs.copyFileSync(eventFile, target);
+    copied.push(target);
+  }
+
+  return copied;
+}
+
+function listSyncEvents(home, { repoId }) {
+  const paths = repoPaths(home, repoId);
+
+  return listJsonFiles(paths.eventsDir)
+    .map((eventFile) => {
+      const event = readJson(eventFile);
+      assertValidSyncEvent(event, eventFile);
+
+      return event;
+    })
+    .filter((event) => event.visibility !== 'private');
+}
+
+async function importSyncEvents(vault, { repoId, events, actorName }) {
+  const paths = repoPaths(vault.home, repoId);
+  ensureDir(paths.eventsDir);
+
+  for (const event of events) {
+    assertValidSyncEvent(event, event.id ?? '<event>');
+  }
+
+  const existingEventIds = new Set(listJsonFiles(paths.eventsDir).map((eventFile) => readJson(eventFile).id));
+  let sequence = listJsonFiles(paths.eventsDir).length;
+  const imported = [];
+
+  for (const event of events) {
+    if (existingEventIds.has(event.id)) {
+      continue;
+    }
+
+    sequence += 1;
+    const fileName = `${String(sequence).padStart(8, '0')}-${event.id}.json`;
+    writeJson(path.join(paths.eventsDir, fileName), event);
+    imported.push(event);
+  }
+
+  ensureMetadataFromEvents(paths, repoId, events.map((event) => ({ event })));
+
+  const materialized = await vault.materializeHpke({ repoId, actorName });
+
+  return {
+    imported,
+    materialized,
+  };
+}
+
+function importSync(vault, { repoId, inDir, actorName }) {
+  const paths = repoPaths(vault.home, repoId);
+  ensureDir(paths.eventsDir);
+  const events = listJsonFiles(inDir).map((eventFile) => ({
+    eventFile,
+    event: readJson(eventFile),
+  }));
+
+  for (const { eventFile, event } of events) {
+    assertValidSyncEvent(event, eventFile);
+  }
+
+  for (const { eventFile } of events) {
+    const target = path.join(paths.eventsDir, path.basename(eventFile));
+    if (!fs.existsSync(target)) {
+      fs.copyFileSync(eventFile, target);
+    }
+  }
+  ensureMetadataFromEvents(paths, repoId, events);
+
+  return vault.materialize({ repoId, actorName });
+}
+
+async function importSyncAsync(vault, { repoId, inDir, actorName }) {
+  const paths = repoPaths(vault.home, repoId);
+  ensureDir(paths.eventsDir);
+  const events = listJsonFiles(inDir).map((eventFile) => ({
+    eventFile,
+    event: readJson(eventFile),
+  }));
+
+  for (const { eventFile, event } of events) {
+    assertValidSyncEvent(event, eventFile);
+  }
+
+  for (const { eventFile } of events) {
+    const target = path.join(paths.eventsDir, path.basename(eventFile));
+    if (!fs.existsSync(target)) {
+      fs.copyFileSync(eventFile, target);
+    }
+  }
+  ensureMetadataFromEvents(paths, repoId, events);
+
+  return vault.materializeHpke({ repoId, actorName });
+}
+
+module.exports = { exportSync, importSync, importSyncAsync, importSyncEvents, listSyncEvents };

package/node_modules/@viewportai/context-engine/src/repo/users.js

@@ -0,0 +1,134 @@
+const crypto = require('node:crypto');
+const path = require('node:path');
+const { createIdentity: createCryptoIdentity } = require('../crypto/keys');
+const { ensureDir, readJson, writeJson } = require('./files');
+const { importPublicIdentity } = require('./identities');
+
+const USER_KEY_BLOB_VERSION = 'viewport.context_user_key_blob/v1';
+
+function usersDir(home) {
+  return path.join(home, 'users');
+}
+
+function userPath(home, userName) {
+  return path.join(usersDir(home), `${userName}.json`);
+}
+
+function deriveRecoveryKey({ passphrase, recoveryCode, salt }) {
+  return crypto.scryptSync(
+    `${passphrase}:${recoveryCode}`,
+    Buffer.from(salt, 'base64'),
+    32,
+    { N: 16384, r: 8, p: 1 },
+  );
+}
+
+function encryptUserIdentity(identity, { passphrase, recoveryCode }) {
+  const salt = crypto.randomBytes(16).toString('base64');
+  const iv = crypto.randomBytes(12);
+  const key = deriveRecoveryKey({ passphrase, recoveryCode, salt });
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  const plaintext = Buffer.from(JSON.stringify(identity), 'utf8');
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+
+  return {
+    version: USER_KEY_BLOB_VERSION,
+    kdf: 'scrypt-n16384-r8-p1-sha256',
+    salt,
+    iv: iv.toString('base64'),
+    ciphertext: ciphertext.toString('base64'),
+    tag: cipher.getAuthTag().toString('base64'),
+  };
+}
+
+function decryptUserIdentity(blob, { passphrase, recoveryCode }) {
+  if (blob.version !== USER_KEY_BLOB_VERSION) {
+    throw new Error(`Unsupported user key blob version: ${blob.version}`);
+  }
+
+  const key = deriveRecoveryKey({ passphrase, recoveryCode, salt: blob.salt });
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(blob.iv, 'base64'));
+  decipher.setAuthTag(Buffer.from(blob.tag, 'base64'));
+  const plaintext = Buffer.concat([
+    decipher.update(Buffer.from(blob.ciphertext, 'base64')),
+    decipher.final(),
+  ]);
+
+  return JSON.parse(plaintext.toString('utf8'));
+}
+
+function publicUserIdentity(identity) {
+  return {
+    name: identity.name,
+    publicKey: identity.signingPublicKey ?? identity.publicKey,
+    signingPublicKey: identity.signingPublicKey ?? identity.publicKey,
+    encryptionPublicKey: identity.encryptionPublicKey,
+    hpkePublicKey: identity.hpkePublicKey,
+  };
+}
+
+function createUser(home, { userName, passphrase, recoveryCode }) {
+  ensureDir(usersDir(home));
+  const identity = createCryptoIdentity(userName);
+  const record = {
+    userName,
+    createdAt: new Date().toISOString(),
+    signingPublicKey: identity.signingPublicKey,
+    encryptionPublicKey: identity.encryptionPublicKey,
+    hpkePublicKey: identity.hpkePublicKey,
+    encryptedUserKeyBlob: encryptUserIdentity(identity, { passphrase, recoveryCode }),
+  };
+
+  writeJson(userPath(home, userName), record);
+  importPublicIdentity(home, publicUserIdentity(identity));
+  return record;
+}
+
+function rotateUserDecryptionIdentity(home, { userName, passphrase, recoveryCode }) {
+  const current = recoverUserIdentity(home, { userName, passphrase, recoveryCode });
+  const nextEncryption = createCryptoIdentity(userName);
+  const rotated = {
+    ...current,
+    encryptionPublicKey: nextEncryption.encryptionPublicKey,
+    encryptionPrivateKey: nextEncryption.encryptionPrivateKey,
+    hpkePublicKey: nextEncryption.hpkePublicKey,
+    hpkePrivateKey: nextEncryption.hpkePrivateKey,
+  };
+  const existing = getUser(home, userName);
+  const record = {
+    ...existing,
+    rotatedAt: new Date().toISOString(),
+    encryptionPublicKey: rotated.encryptionPublicKey,
+    hpkePublicKey: rotated.hpkePublicKey,
+    encryptedUserKeyBlob: encryptUserIdentity(rotated, { passphrase, recoveryCode }),
+  };
+
+  writeJson(userPath(home, userName), record);
+  importPublicIdentity(home, publicUserIdentity(rotated), { allowKeyRotation: true });
+  return record;
+}
+
+function getUser(home, userName) {
+  const record = readJson(userPath(home, userName));
+  if (!record?.encryptedUserKeyBlob) {
+    throw new Error(`Unknown user: ${userName}`);
+  }
+
+  return record;
+}
+
+function recoverUserIdentity(home, { userName, passphrase, recoveryCode }) {
+  const record = getUser(home, userName);
+  return decryptUserIdentity(record.encryptedUserKeyBlob, { passphrase, recoveryCode });
+}
+
+module.exports = {
+  createUser,
+  decryptUserIdentity,
+  encryptUserIdentity,
+  getUser,
+  publicUserIdentity,
+  recoverUserIdentity,
+  rotateUserDecryptionIdentity,
+  userPath,
+};