@wipcomputer/memory-crystal 0.7.34-alpha.2 → 0.7.34-alpha.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE +1 -1
- package/dist/bridge.js +64 -7
- package/dist/bulk-copy.js +67 -16
- package/dist/cc-hook.js +2163 -62
- package/dist/cc-poller.js +1967 -70
- package/dist/cli.js +4538 -139
- package/dist/core.js +1789 -6
- package/dist/crypto.js +153 -14
- package/dist/crystal-serve.js +64 -12
- package/dist/doctor.js +517 -52
- package/dist/dream-weaver.js +1755 -7
- package/dist/file-sync.js +407 -9
- package/dist/installer.js +840 -145
- package/dist/ldm.js +231 -16
- package/dist/mcp-server.js +1882 -17
- package/dist/migrate.js +1707 -11
- package/dist/mirror-sync.js +2052 -34
- package/dist/openclaw.js +1895 -84
- package/dist/pair.js +112 -16
- package/dist/poller.js +2275 -80
- package/dist/role.js +159 -7
- package/dist/staging.js +235 -10
- package/dist/summarize.js +142 -5
- package/package.json +7 -4
- package/dist/chunk-25LXQJ4Z.js +0 -110
- package/dist/chunk-2DRXIRQW.js +0 -97
- package/dist/chunk-2GBYLMEF.js +0 -1385
- package/dist/chunk-2ZNH5F6E.js +0 -1281
- package/dist/chunk-3G3SFYYI.js +0 -288
- package/dist/chunk-3RG5ZIWI.js +0 -10
- package/dist/chunk-3S6TI23B.js +0 -97
- package/dist/chunk-3VFIJYS4.js +0 -818
- package/dist/chunk-437F27T6.js +0 -97
- package/dist/chunk-52QE3YI3.js +0 -1169
- package/dist/chunk-57RP3DIN.js +0 -1205
- package/dist/chunk-5HSZ4W2P.js +0 -62
- package/dist/chunk-5I7GMRDN.js +0 -146
- package/dist/chunk-645IPXW3.js +0 -290
- package/dist/chunk-7A7ELD4C.js +0 -1205
- package/dist/chunk-7FYY4GZM.js +0 -1205
- package/dist/chunk-7IUE7ODU.js +0 -254
- package/dist/chunk-7RMLKZIS.js +0 -108
- package/dist/chunk-AA3OPP4Z.js +0 -432
- package/dist/chunk-AEWLSYPH.js +0 -72
- package/dist/chunk-ASSZDR6I.js +0 -108
- package/dist/chunk-AYRJVWUC.js +0 -1205
- package/dist/chunk-CCYI5O3D.js +0 -148
- package/dist/chunk-CGIDSAJB.js +0 -288
- package/dist/chunk-D3I3ZSE2.js +0 -411
- package/dist/chunk-D3MACYZ4.js +0 -108
- package/dist/chunk-DACSKLY6.js +0 -219
- package/dist/chunk-DFQ72B7M.js +0 -248
- package/dist/chunk-DW5B4BL7.js +0 -108
- package/dist/chunk-EKSACBTJ.js +0 -1070
- package/dist/chunk-EXEZZADG.js +0 -248
- package/dist/chunk-F3Y7EL7K.js +0 -83
- package/dist/chunk-FBQWSDPC.js +0 -1328
- package/dist/chunk-FHRZNOMW.js +0 -1205
- package/dist/chunk-IM7N24MT.js +0 -129
- package/dist/chunk-IPNYIXFK.js +0 -1178
- package/dist/chunk-J7MRSZIO.js +0 -167
- package/dist/chunk-JITKI2OI.js +0 -106
- package/dist/chunk-JWZXYVET.js +0 -1068
- package/dist/chunk-KCQUXVYT.js +0 -108
- package/dist/chunk-KOQ43OX6.js +0 -1281
- package/dist/chunk-KYVWO6ZM.js +0 -1069
- package/dist/chunk-L3VHARQH.js +0 -413
- package/dist/chunk-LBWDS6BE.js +0 -288
- package/dist/chunk-LOVAHSQV.js +0 -411
- package/dist/chunk-LQOYCAGG.js +0 -446
- package/dist/chunk-LWAIPJ2W.js +0 -146
- package/dist/chunk-M5DHKW7M.js +0 -127
- package/dist/chunk-MBKCIJHM.js +0 -1328
- package/dist/chunk-MK42FMEG.js +0 -147
- package/dist/chunk-MOBMYHKL.js +0 -1205
- package/dist/chunk-MPLTNMRG.js +0 -67
- package/dist/chunk-NIJCVN3O.js +0 -147
- package/dist/chunk-NX647OM3.js +0 -310
- package/dist/chunk-NZCFSZQ7.js +0 -1205
- package/dist/chunk-O2UITJGH.js +0 -465
- package/dist/chunk-OCRA44AZ.js +0 -108
- package/dist/chunk-P3KJR66H.js +0 -117
- package/dist/chunk-PEK6JH65.js +0 -432
- package/dist/chunk-PJ6FFKEX.js +0 -77
- package/dist/chunk-PLUBBZYR.js +0 -800
- package/dist/chunk-PNKVD2UK.js +0 -26
- package/dist/chunk-PSQZURHO.js +0 -229
- package/dist/chunk-SGL6ISBJ.js +0 -1061
- package/dist/chunk-SJABZZT5.js +0 -97
- package/dist/chunk-TD3P3K32.js +0 -1199
- package/dist/chunk-TMDZJJKV.js +0 -288
- package/dist/chunk-UNHVZB5G.js +0 -411
- package/dist/chunk-VAFTWSTE.js +0 -1061
- package/dist/chunk-VNFXFQBB.js +0 -217
- package/dist/chunk-X3GVFKSJ.js +0 -1205
- package/dist/chunk-XZ3S56RQ.js +0 -1061
- package/dist/chunk-Y72C7F6O.js +0 -148
- package/dist/chunk-YLICP577.js +0 -1205
- package/dist/chunk-YX6AXLVK.js +0 -159
- package/dist/chunk-ZCQYHTNU.js +0 -146
- package/dist/cloud-crystal.js +0 -6
- package/dist/dev-update-SZ2Z4WCQ.js +0 -6
- package/dist/llm-XXLYPIOF.js +0 -16
- package/dist/mlx-setup-XKU67WCT.js +0 -289
- package/dist/search-pipeline-4K4OJSSS.js +0 -255
- package/dist/search-pipeline-4PRS6LI7.js +0 -280
- package/dist/search-pipeline-7UJMXPLO.js +0 -280
- package/dist/search-pipeline-CBV25NX7.js +0 -99
- package/dist/search-pipeline-DQTRLGBH.js +0 -74
- package/dist/search-pipeline-HNG37REH.js +0 -282
- package/dist/search-pipeline-IZFPLBUB.js +0 -280
- package/dist/search-pipeline-MID6F26Q.js +0 -73
- package/dist/search-pipeline-N52JZFNN.js +0 -282
- package/dist/search-pipeline-OPB2PRQQ.js +0 -280
- package/dist/search-pipeline-VXTE5HAD.js +0 -262
- package/dist/search-pipeline-XHFKADRG.js +0 -73
- package/dist/worker-demo.js +0 -186
- package/dist/worker-mcp.js +0 -404
- package/scripts/crystal-capture 2.sh +0 -29
- package/scripts/deploy-cloud 2.sh +0 -153
package/dist/chunk-7IUE7ODU.js
DELETED
|
@@ -1,254 +0,0 @@
|
|
|
1
|
-
// src/llm.ts
|
|
2
|
-
import { existsSync, readFileSync } from "fs";
|
|
3
|
-
import { join } from "path";
|
|
4
|
-
import { homedir } from "os";
|
|
5
|
-
import { execSync } from "child_process";
|
|
6
|
-
var samplingServer = null;
|
|
7
|
-
function setSamplingServer(server) {
|
|
8
|
-
samplingServer = server;
|
|
9
|
-
}
|
|
10
|
-
var expansionCache = /* @__PURE__ */ new Map();
|
|
11
|
-
var detectedProvider = null;
|
|
12
|
-
var detectionDone = false;
|
|
13
|
-
function getOpSecret(itemName, fieldLabel) {
|
|
14
|
-
try {
|
|
15
|
-
const saTokenPath = join(homedir(), ".openclaw/secrets/op-sa-token");
|
|
16
|
-
if (!existsSync(saTokenPath)) return void 0;
|
|
17
|
-
const saToken = readFileSync(saTokenPath, "utf-8").trim();
|
|
18
|
-
const result = execSync(
|
|
19
|
-
`OP_SERVICE_ACCOUNT_TOKEN="${saToken}" op item get "${itemName}" --vault "Agent Secrets" --fields "${fieldLabel}" --reveal`,
|
|
20
|
-
{ encoding: "utf-8", timeout: 5e3, stdio: ["pipe", "pipe", "pipe"] }
|
|
21
|
-
).trim();
|
|
22
|
-
return result || void 0;
|
|
23
|
-
} catch {
|
|
24
|
-
return void 0;
|
|
25
|
-
}
|
|
26
|
-
}
|
|
27
|
-
async function detectProvider() {
|
|
28
|
-
if (detectionDone && detectedProvider) return detectedProvider;
|
|
29
|
-
detectionDone = true;
|
|
30
|
-
if (samplingServer) {
|
|
31
|
-
detectedProvider = { provider: "sampling", baseURL: "", apiKey: "", model: "client-selected" };
|
|
32
|
-
process.stderr.write("[memory-crystal] LLM provider: MCP Sampling (via client)\n");
|
|
33
|
-
return detectedProvider;
|
|
34
|
-
}
|
|
35
|
-
try {
|
|
36
|
-
const resp = await fetch("http://localhost:8080/v1/models", { signal: AbortSignal.timeout(1e3) });
|
|
37
|
-
if (resp.ok) {
|
|
38
|
-
const data = await resp.json();
|
|
39
|
-
const model = data?.data?.[0]?.id || "default";
|
|
40
|
-
detectedProvider = { provider: "mlx", baseURL: "http://localhost:8080/v1", apiKey: "not-needed", model };
|
|
41
|
-
process.stderr.write(`[memory-crystal] LLM provider: MLX (${model})
|
|
42
|
-
`);
|
|
43
|
-
return detectedProvider;
|
|
44
|
-
}
|
|
45
|
-
} catch {
|
|
46
|
-
}
|
|
47
|
-
try {
|
|
48
|
-
const resp = await fetch("http://localhost:11434/api/tags", { signal: AbortSignal.timeout(1e3) });
|
|
49
|
-
if (resp.ok) {
|
|
50
|
-
const data = await resp.json();
|
|
51
|
-
const models = data?.models || [];
|
|
52
|
-
const embeddingOnly = ["nomic-embed-text", "mxbai-embed", "all-minilm", "snowflake-arctic-embed"];
|
|
53
|
-
const chatModel = models.find((m) => !embeddingOnly.some((e) => m.name.startsWith(e)));
|
|
54
|
-
if (chatModel) {
|
|
55
|
-
detectedProvider = { provider: "ollama", baseURL: "http://localhost:11434/v1", apiKey: "ollama", model: chatModel.name };
|
|
56
|
-
process.stderr.write(`[memory-crystal] LLM provider: Ollama (${chatModel.name})
|
|
57
|
-
`);
|
|
58
|
-
return detectedProvider;
|
|
59
|
-
}
|
|
60
|
-
}
|
|
61
|
-
} catch {
|
|
62
|
-
}
|
|
63
|
-
const openaiKey = process.env.OPENAI_API_KEY || getOpSecret("OpenAI API", "api key");
|
|
64
|
-
if (openaiKey) {
|
|
65
|
-
detectedProvider = { provider: "openai", baseURL: "https://api.openai.com/v1", apiKey: openaiKey, model: "gpt-4o-mini" };
|
|
66
|
-
process.stderr.write("[memory-crystal] LLM provider: OpenAI API\n");
|
|
67
|
-
return detectedProvider;
|
|
68
|
-
}
|
|
69
|
-
const anthropicKey = process.env.ANTHROPIC_API_KEY || getOpSecret("Anthropic Auth Token - remote bunkers", "Auth Token");
|
|
70
|
-
if (anthropicKey && !anthropicKey.startsWith("sk-ant-oat")) {
|
|
71
|
-
detectedProvider = { provider: "anthropic", baseURL: "https://api.anthropic.com", apiKey: anthropicKey, model: "claude-haiku-4-5-20251001" };
|
|
72
|
-
process.stderr.write("[memory-crystal] LLM provider: Anthropic API\n");
|
|
73
|
-
return detectedProvider;
|
|
74
|
-
}
|
|
75
|
-
detectedProvider = { provider: "none", baseURL: "", apiKey: "", model: "" };
|
|
76
|
-
process.stderr.write("[memory-crystal] LLM provider: none (deep search unavailable)\n");
|
|
77
|
-
return detectedProvider;
|
|
78
|
-
}
|
|
79
|
-
async function chatComplete(config, messages, maxTokens = 300) {
|
|
80
|
-
if (config.provider === "sampling") {
|
|
81
|
-
return samplingComplete(messages, maxTokens);
|
|
82
|
-
}
|
|
83
|
-
if (config.provider === "anthropic") {
|
|
84
|
-
return anthropicComplete(config, messages, maxTokens);
|
|
85
|
-
}
|
|
86
|
-
const resp = await fetch(`${config.baseURL}/chat/completions`, {
|
|
87
|
-
method: "POST",
|
|
88
|
-
headers: {
|
|
89
|
-
"Content-Type": "application/json",
|
|
90
|
-
"Authorization": `Bearer ${config.apiKey}`
|
|
91
|
-
},
|
|
92
|
-
body: JSON.stringify({
|
|
93
|
-
model: config.model,
|
|
94
|
-
messages,
|
|
95
|
-
max_tokens: maxTokens,
|
|
96
|
-
temperature: 0.7
|
|
97
|
-
})
|
|
98
|
-
});
|
|
99
|
-
if (!resp.ok) throw new Error(`LLM request failed: ${resp.status}`);
|
|
100
|
-
const data = await resp.json();
|
|
101
|
-
return data.choices?.[0]?.message?.content || "";
|
|
102
|
-
}
|
|
103
|
-
async function anthropicComplete(config, messages, maxTokens) {
|
|
104
|
-
const systemMsg = messages.find((m) => m.role === "system");
|
|
105
|
-
const userMessages = messages.filter((m) => m.role !== "system");
|
|
106
|
-
const body = {
|
|
107
|
-
model: config.model,
|
|
108
|
-
max_tokens: maxTokens,
|
|
109
|
-
messages: userMessages
|
|
110
|
-
};
|
|
111
|
-
if (systemMsg) body.system = systemMsg.content;
|
|
112
|
-
const resp = await fetch("https://api.anthropic.com/v1/messages", {
|
|
113
|
-
method: "POST",
|
|
114
|
-
headers: {
|
|
115
|
-
"Content-Type": "application/json",
|
|
116
|
-
"x-api-key": config.apiKey,
|
|
117
|
-
"anthropic-version": "2023-06-01"
|
|
118
|
-
},
|
|
119
|
-
body: JSON.stringify(body)
|
|
120
|
-
});
|
|
121
|
-
if (!resp.ok) throw new Error(`Anthropic request failed: ${resp.status}`);
|
|
122
|
-
const data = await resp.json();
|
|
123
|
-
return data.content?.[0]?.text || "";
|
|
124
|
-
}
|
|
125
|
-
async function samplingComplete(messages, maxTokens) {
|
|
126
|
-
if (!samplingServer) throw new Error("MCP sampling server not set");
|
|
127
|
-
const systemMsg = messages.find((m) => m.role === "system");
|
|
128
|
-
const userMessages = messages.filter((m) => m.role !== "system");
|
|
129
|
-
const result = await samplingServer.createMessage({
|
|
130
|
-
messages: userMessages.map((m) => ({
|
|
131
|
-
role: m.role,
|
|
132
|
-
content: { type: "text", text: m.content }
|
|
133
|
-
})),
|
|
134
|
-
systemPrompt: systemMsg?.content,
|
|
135
|
-
maxTokens,
|
|
136
|
-
modelPreferences: {
|
|
137
|
-
// Request cheap, fast model (Haiku-class). We don't need Opus for query expansion.
|
|
138
|
-
costPriority: 0.9,
|
|
139
|
-
speedPriority: 0.8,
|
|
140
|
-
intelligencePriority: 0.3,
|
|
141
|
-
hints: [{ name: "haiku" }]
|
|
142
|
-
}
|
|
143
|
-
});
|
|
144
|
-
if (result?.content?.type === "text") return result.content.text;
|
|
145
|
-
if (typeof result?.content === "string") return result.content;
|
|
146
|
-
return "";
|
|
147
|
-
}
|
|
148
|
-
var EXPAND_PROMPT = `You are a search query expander. Given a search query, generate exactly 3 variations to improve search recall.
|
|
149
|
-
|
|
150
|
-
Output exactly 3 lines in this format (no other text):
|
|
151
|
-
lex: <keyword-focused variation for full-text search>
|
|
152
|
-
vec: <semantic variation rephrased for embedding similarity>
|
|
153
|
-
hyde: <hypothetical document snippet that would answer this query>
|
|
154
|
-
|
|
155
|
-
Rules:
|
|
156
|
-
- Each variation must contain at least one term from the original query
|
|
157
|
-
- Keep variations concise (under 30 words each)
|
|
158
|
-
- lex should use specific keywords and synonyms
|
|
159
|
-
- vec should rephrase the intent naturally
|
|
160
|
-
- hyde should be a short passage as if answering the query`;
|
|
161
|
-
async function expandQuery(query) {
|
|
162
|
-
const cached = expansionCache.get(query);
|
|
163
|
-
if (cached) return cached;
|
|
164
|
-
const config = await detectProvider();
|
|
165
|
-
if (config.provider === "none") return [];
|
|
166
|
-
try {
|
|
167
|
-
const result = await chatComplete(config, [
|
|
168
|
-
{ role: "system", content: EXPAND_PROMPT },
|
|
169
|
-
{ role: "user", content: query }
|
|
170
|
-
], 300);
|
|
171
|
-
const lines = result.trim().split("\n");
|
|
172
|
-
const queryLower = query.toLowerCase();
|
|
173
|
-
const queryTerms = queryLower.replace(/[^a-z0-9\s]/g, " ").split(/\s+/).filter(Boolean);
|
|
174
|
-
const hasQueryTerm = (text) => {
|
|
175
|
-
const lower = text.toLowerCase();
|
|
176
|
-
if (queryTerms.length === 0) return true;
|
|
177
|
-
return queryTerms.some((term) => lower.includes(term));
|
|
178
|
-
};
|
|
179
|
-
const variations = lines.map((line) => {
|
|
180
|
-
const colonIdx = line.indexOf(":");
|
|
181
|
-
if (colonIdx === -1) return null;
|
|
182
|
-
const type = line.slice(0, colonIdx).trim();
|
|
183
|
-
if (type !== "lex" && type !== "vec" && type !== "hyde") return null;
|
|
184
|
-
const text = line.slice(colonIdx + 1).trim();
|
|
185
|
-
if (!text || !hasQueryTerm(text)) return null;
|
|
186
|
-
return { type, text };
|
|
187
|
-
}).filter((v) => v !== null);
|
|
188
|
-
if (variations.length > 0) {
|
|
189
|
-
expansionCache.set(query, variations);
|
|
190
|
-
return variations;
|
|
191
|
-
}
|
|
192
|
-
} catch (err) {
|
|
193
|
-
process.stderr.write(`[memory-crystal] Query expansion failed: ${err.message}
|
|
194
|
-
`);
|
|
195
|
-
}
|
|
196
|
-
const fallback = [
|
|
197
|
-
{ type: "lex", text: query },
|
|
198
|
-
{ type: "vec", text: query },
|
|
199
|
-
{ type: "hyde", text: `Information about ${query}` }
|
|
200
|
-
];
|
|
201
|
-
return fallback;
|
|
202
|
-
}
|
|
203
|
-
var RERANK_PROMPT = `You are a search result re-ranker. Given a query and a list of text passages, rate each passage's relevance to the query.
|
|
204
|
-
|
|
205
|
-
Output one line per passage in this exact format:
|
|
206
|
-
<index>: <score>
|
|
207
|
-
|
|
208
|
-
Where index is the passage number (0-based) and score is a float from 0.0 to 1.0.
|
|
209
|
-
- 1.0 = perfectly relevant, directly answers the query
|
|
210
|
-
- 0.7 = highly relevant, closely related
|
|
211
|
-
- 0.4 = somewhat relevant, tangentially related
|
|
212
|
-
- 0.1 = barely relevant
|
|
213
|
-
- 0.0 = not relevant at all
|
|
214
|
-
|
|
215
|
-
Rate ALL passages. Output nothing else.`;
|
|
216
|
-
async function rerankResults(query, passages) {
|
|
217
|
-
const config = await detectProvider();
|
|
218
|
-
if (config.provider === "none") {
|
|
219
|
-
return passages.map((_, i) => ({ index: i, score: 1 - i * 0.01 }));
|
|
220
|
-
}
|
|
221
|
-
try {
|
|
222
|
-
const passageList = passages.map((p, i) => `[${i}] ${p.slice(0, 500)}`).join("\n\n");
|
|
223
|
-
const result = await chatComplete(config, [
|
|
224
|
-
{ role: "system", content: RERANK_PROMPT },
|
|
225
|
-
{ role: "user", content: `Query: ${query}
|
|
226
|
-
|
|
227
|
-
Passages:
|
|
228
|
-
${passageList}` }
|
|
229
|
-
], 200);
|
|
230
|
-
const results = [];
|
|
231
|
-
for (const line of result.trim().split("\n")) {
|
|
232
|
-
const match = line.match(/^(\d+):\s*([\d.]+)/);
|
|
233
|
-
if (match) {
|
|
234
|
-
results.push({ index: parseInt(match[1]), score: parseFloat(match[2]) });
|
|
235
|
-
}
|
|
236
|
-
}
|
|
237
|
-
const scored = new Set(results.map((r) => r.index));
|
|
238
|
-
for (let i = 0; i < passages.length; i++) {
|
|
239
|
-
if (!scored.has(i)) results.push({ index: i, score: 0 });
|
|
240
|
-
}
|
|
241
|
-
return results.sort((a, b) => b.score - a.score);
|
|
242
|
-
} catch (err) {
|
|
243
|
-
process.stderr.write(`[memory-crystal] Reranking failed: ${err.message}
|
|
244
|
-
`);
|
|
245
|
-
return passages.map((_, i) => ({ index: i, score: 1 - i * 0.01 }));
|
|
246
|
-
}
|
|
247
|
-
}
|
|
248
|
-
|
|
249
|
-
export {
|
|
250
|
-
setSamplingServer,
|
|
251
|
-
detectProvider,
|
|
252
|
-
expandQuery,
|
|
253
|
-
rerankResults
|
|
254
|
-
};
|
package/dist/chunk-7RMLKZIS.js
DELETED
|
@@ -1,108 +0,0 @@
|
|
|
1
|
-
import {
|
|
2
|
-
resolveSecretPath
|
|
3
|
-
} from "./chunk-DACSKLY6.js";
|
|
4
|
-
|
|
5
|
-
// src/crypto.ts
|
|
6
|
-
import { readFileSync, existsSync } from "fs";
|
|
7
|
-
import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
|
|
8
|
-
import { createHash } from "crypto";
|
|
9
|
-
var KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || resolveSecretPath("crystal-relay-key");
|
|
10
|
-
function loadRelayKey() {
|
|
11
|
-
if (!existsSync(KEY_PATH)) {
|
|
12
|
-
throw new Error(
|
|
13
|
-
`Relay key not found at ${KEY_PATH}
|
|
14
|
-
Generate one: mkdir -p ~/.ldm/secrets && openssl rand -base64 32 > ~/.ldm/secrets/crystal-relay-key && chmod 600 ~/.ldm/secrets/crystal-relay-key
|
|
15
|
-
Or run: crystal pair`
|
|
16
|
-
);
|
|
17
|
-
}
|
|
18
|
-
const raw = readFileSync(KEY_PATH, "utf-8").trim();
|
|
19
|
-
const key = Buffer.from(raw, "base64");
|
|
20
|
-
if (key.length !== 32) {
|
|
21
|
-
throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
|
|
22
|
-
}
|
|
23
|
-
return key;
|
|
24
|
-
}
|
|
25
|
-
function deriveSigningKey(masterKey) {
|
|
26
|
-
return Buffer.from(hkdfSync("sha256", masterKey, "", "crystal-relay-sign", 32));
|
|
27
|
-
}
|
|
28
|
-
function encrypt(plaintext, masterKey) {
|
|
29
|
-
const nonce = randomBytes(12);
|
|
30
|
-
const cipher = createCipheriv("aes-256-gcm", masterKey, nonce);
|
|
31
|
-
const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
|
|
32
|
-
const tag = cipher.getAuthTag();
|
|
33
|
-
const signingKey = deriveSigningKey(masterKey);
|
|
34
|
-
const hmacData = Buffer.concat([nonce, ciphertext, tag]);
|
|
35
|
-
const hmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
|
|
36
|
-
return {
|
|
37
|
-
v: 1,
|
|
38
|
-
nonce: nonce.toString("base64"),
|
|
39
|
-
ciphertext: ciphertext.toString("base64"),
|
|
40
|
-
tag: tag.toString("base64"),
|
|
41
|
-
hmac
|
|
42
|
-
};
|
|
43
|
-
}
|
|
44
|
-
function decrypt(payload, masterKey) {
|
|
45
|
-
if (payload.v !== 1) {
|
|
46
|
-
throw new Error(`Unknown payload version: ${payload.v}`);
|
|
47
|
-
}
|
|
48
|
-
const nonce = Buffer.from(payload.nonce, "base64");
|
|
49
|
-
const ciphertext = Buffer.from(payload.ciphertext, "base64");
|
|
50
|
-
const tag = Buffer.from(payload.tag, "base64");
|
|
51
|
-
const signingKey = deriveSigningKey(masterKey);
|
|
52
|
-
const hmacData = Buffer.concat([nonce, ciphertext, tag]);
|
|
53
|
-
const expectedHmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
|
|
54
|
-
if (payload.hmac !== expectedHmac) {
|
|
55
|
-
throw new Error("HMAC verification failed \u2014 blob rejected (tampered or wrong key)");
|
|
56
|
-
}
|
|
57
|
-
const decipher = createDecipheriv("aes-256-gcm", masterKey, nonce);
|
|
58
|
-
decipher.setAuthTag(tag);
|
|
59
|
-
return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
|
|
60
|
-
}
|
|
61
|
-
function encryptJSON(data, masterKey) {
|
|
62
|
-
const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
|
|
63
|
-
return encrypt(plaintext, masterKey);
|
|
64
|
-
}
|
|
65
|
-
function decryptJSON(payload, masterKey) {
|
|
66
|
-
const plaintext = decrypt(payload, masterKey);
|
|
67
|
-
return JSON.parse(plaintext.toString("utf-8"));
|
|
68
|
-
}
|
|
69
|
-
function encryptFile(filePath, masterKey) {
|
|
70
|
-
const plaintext = readFileSync(filePath);
|
|
71
|
-
return encrypt(plaintext, masterKey);
|
|
72
|
-
}
|
|
73
|
-
var RELAY_KEY_PATH = KEY_PATH;
|
|
74
|
-
function generateRelayKey() {
|
|
75
|
-
return randomBytes(32);
|
|
76
|
-
}
|
|
77
|
-
function encodePairingString(key) {
|
|
78
|
-
if (key.length !== 32) throw new Error("Key must be 32 bytes");
|
|
79
|
-
return `mc1:${key.toString("base64")}`;
|
|
80
|
-
}
|
|
81
|
-
function decodePairingString(str) {
|
|
82
|
-
const trimmed = str.trim();
|
|
83
|
-
if (!trimmed.startsWith("mc1:")) {
|
|
84
|
-
throw new Error("Invalid pairing string (expected mc1: prefix)");
|
|
85
|
-
}
|
|
86
|
-
const key = Buffer.from(trimmed.slice(4), "base64");
|
|
87
|
-
if (key.length !== 32) {
|
|
88
|
-
throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
|
|
89
|
-
}
|
|
90
|
-
return key;
|
|
91
|
-
}
|
|
92
|
-
function hashBuffer(data) {
|
|
93
|
-
return createHash("sha256").update(data).digest("hex");
|
|
94
|
-
}
|
|
95
|
-
|
|
96
|
-
export {
|
|
97
|
-
loadRelayKey,
|
|
98
|
-
encrypt,
|
|
99
|
-
decrypt,
|
|
100
|
-
encryptJSON,
|
|
101
|
-
decryptJSON,
|
|
102
|
-
encryptFile,
|
|
103
|
-
RELAY_KEY_PATH,
|
|
104
|
-
generateRelayKey,
|
|
105
|
-
encodePairingString,
|
|
106
|
-
decodePairingString,
|
|
107
|
-
hashBuffer
|
|
108
|
-
};
|