@wipcomputer/memory-crystal 0.7.34-alpha.3 → 0.7.34-alpha.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (97) hide show
  1. package/package.json +7 -4
  2. package/dist/chunk-25LXQJ4Z.js +0 -110
  3. package/dist/chunk-2DRXIRQW.js +0 -97
  4. package/dist/chunk-2GBYLMEF.js +0 -1385
  5. package/dist/chunk-2ZNH5F6E.js +0 -1281
  6. package/dist/chunk-3G3SFYYI.js +0 -288
  7. package/dist/chunk-3RG5ZIWI.js +0 -10
  8. package/dist/chunk-3S6TI23B.js +0 -97
  9. package/dist/chunk-3VFIJYS4.js +0 -818
  10. package/dist/chunk-437F27T6.js +0 -97
  11. package/dist/chunk-52QE3YI3.js +0 -1169
  12. package/dist/chunk-57RP3DIN.js +0 -1205
  13. package/dist/chunk-5HSZ4W2P.js +0 -62
  14. package/dist/chunk-5I7GMRDN.js +0 -146
  15. package/dist/chunk-645IPXW3.js +0 -290
  16. package/dist/chunk-7A7ELD4C.js +0 -1205
  17. package/dist/chunk-7FYY4GZM.js +0 -1205
  18. package/dist/chunk-7IUE7ODU.js +0 -254
  19. package/dist/chunk-7RMLKZIS.js +0 -108
  20. package/dist/chunk-AA3OPP4Z.js +0 -432
  21. package/dist/chunk-AEWLSYPH.js +0 -72
  22. package/dist/chunk-ASSZDR6I.js +0 -108
  23. package/dist/chunk-AYRJVWUC.js +0 -1205
  24. package/dist/chunk-CCYI5O3D.js +0 -148
  25. package/dist/chunk-CGIDSAJB.js +0 -288
  26. package/dist/chunk-D3I3ZSE2.js +0 -411
  27. package/dist/chunk-D3MACYZ4.js +0 -108
  28. package/dist/chunk-DACSKLY6.js +0 -219
  29. package/dist/chunk-DFQ72B7M.js +0 -248
  30. package/dist/chunk-DW5B4BL7.js +0 -108
  31. package/dist/chunk-EKSACBTJ.js +0 -1070
  32. package/dist/chunk-EXEZZADG.js +0 -248
  33. package/dist/chunk-F3Y7EL7K.js +0 -83
  34. package/dist/chunk-FBQWSDPC.js +0 -1328
  35. package/dist/chunk-FHRZNOMW.js +0 -1205
  36. package/dist/chunk-IM7N24MT.js +0 -129
  37. package/dist/chunk-IPNYIXFK.js +0 -1178
  38. package/dist/chunk-J7MRSZIO.js +0 -167
  39. package/dist/chunk-JITKI2OI.js +0 -106
  40. package/dist/chunk-JWZXYVET.js +0 -1068
  41. package/dist/chunk-KCQUXVYT.js +0 -108
  42. package/dist/chunk-KOQ43OX6.js +0 -1281
  43. package/dist/chunk-KYVWO6ZM.js +0 -1069
  44. package/dist/chunk-L3VHARQH.js +0 -413
  45. package/dist/chunk-LBWDS6BE.js +0 -288
  46. package/dist/chunk-LOVAHSQV.js +0 -411
  47. package/dist/chunk-LQOYCAGG.js +0 -446
  48. package/dist/chunk-LWAIPJ2W.js +0 -146
  49. package/dist/chunk-M5DHKW7M.js +0 -127
  50. package/dist/chunk-MBKCIJHM.js +0 -1328
  51. package/dist/chunk-MK42FMEG.js +0 -147
  52. package/dist/chunk-MOBMYHKL.js +0 -1205
  53. package/dist/chunk-MPLTNMRG.js +0 -67
  54. package/dist/chunk-NIJCVN3O.js +0 -147
  55. package/dist/chunk-NX647OM3.js +0 -310
  56. package/dist/chunk-NZCFSZQ7.js +0 -1205
  57. package/dist/chunk-O2UITJGH.js +0 -465
  58. package/dist/chunk-OCRA44AZ.js +0 -108
  59. package/dist/chunk-P3KJR66H.js +0 -117
  60. package/dist/chunk-PEK6JH65.js +0 -432
  61. package/dist/chunk-PJ6FFKEX.js +0 -77
  62. package/dist/chunk-PLUBBZYR.js +0 -800
  63. package/dist/chunk-PNKVD2UK.js +0 -26
  64. package/dist/chunk-PSQZURHO.js +0 -229
  65. package/dist/chunk-SGL6ISBJ.js +0 -1061
  66. package/dist/chunk-SJABZZT5.js +0 -97
  67. package/dist/chunk-TD3P3K32.js +0 -1199
  68. package/dist/chunk-TMDZJJKV.js +0 -288
  69. package/dist/chunk-UNHVZB5G.js +0 -411
  70. package/dist/chunk-VAFTWSTE.js +0 -1061
  71. package/dist/chunk-VNFXFQBB.js +0 -217
  72. package/dist/chunk-X3GVFKSJ.js +0 -1205
  73. package/dist/chunk-XZ3S56RQ.js +0 -1061
  74. package/dist/chunk-Y72C7F6O.js +0 -148
  75. package/dist/chunk-YLICP577.js +0 -1205
  76. package/dist/chunk-YX6AXLVK.js +0 -159
  77. package/dist/chunk-ZCQYHTNU.js +0 -146
  78. package/dist/cloud-crystal.js +0 -6
  79. package/dist/dev-update-SZ2Z4WCQ.js +0 -6
  80. package/dist/llm-XXLYPIOF.js +0 -16
  81. package/dist/mlx-setup-XKU67WCT.js +0 -289
  82. package/dist/search-pipeline-4K4OJSSS.js +0 -255
  83. package/dist/search-pipeline-4PRS6LI7.js +0 -280
  84. package/dist/search-pipeline-7UJMXPLO.js +0 -280
  85. package/dist/search-pipeline-CBV25NX7.js +0 -99
  86. package/dist/search-pipeline-DQTRLGBH.js +0 -74
  87. package/dist/search-pipeline-HNG37REH.js +0 -282
  88. package/dist/search-pipeline-IZFPLBUB.js +0 -280
  89. package/dist/search-pipeline-MID6F26Q.js +0 -73
  90. package/dist/search-pipeline-N52JZFNN.js +0 -282
  91. package/dist/search-pipeline-OPB2PRQQ.js +0 -280
  92. package/dist/search-pipeline-VXTE5HAD.js +0 -262
  93. package/dist/search-pipeline-XHFKADRG.js +0 -73
  94. package/dist/worker-demo.js +0 -186
  95. package/dist/worker-mcp.js +0 -404
  96. package/scripts/crystal-capture 2.sh +0 -29
  97. package/scripts/deploy-cloud 2.sh +0 -153
@@ -1,411 +0,0 @@
1
- // src/core.ts
2
- import * as lancedb from "@lancedb/lancedb";
3
- import Database from "better-sqlite3";
4
- import { readFileSync, existsSync, mkdirSync } from "fs";
5
- import { execSync } from "child_process";
6
- import { join } from "path";
7
- import http from "http";
8
- import https from "https";
9
- async function embedOpenAI(texts, apiKey, model) {
10
- return new Promise((resolve, reject) => {
11
- const body = JSON.stringify({ input: texts, model });
12
- const req = https.request({
13
- hostname: "api.openai.com",
14
- path: "/v1/embeddings",
15
- method: "POST",
16
- headers: {
17
- "Content-Type": "application/json",
18
- "Authorization": `Bearer ${apiKey}`,
19
- "Content-Length": Buffer.byteLength(body)
20
- },
21
- timeout: 3e4
22
- }, (res) => {
23
- let data = "";
24
- res.on("data", (chunk) => data += chunk);
25
- res.on("end", () => {
26
- if (res.statusCode !== 200) {
27
- reject(new Error(`OpenAI API error ${res.statusCode}: ${data.slice(0, 200)}`));
28
- return;
29
- }
30
- const parsed = JSON.parse(data);
31
- resolve(parsed.data.map((d) => d.embedding));
32
- });
33
- });
34
- req.on("error", reject);
35
- req.on("timeout", () => {
36
- req.destroy();
37
- reject(new Error("OpenAI timeout"));
38
- });
39
- req.write(body);
40
- req.end();
41
- });
42
- }
43
- async function embedOllama(texts, host, model) {
44
- const results = [];
45
- for (const text of texts) {
46
- const result = await new Promise((resolve, reject) => {
47
- const url = new URL("/api/embeddings", host);
48
- const body = JSON.stringify({ model, prompt: text });
49
- const req = http.request({
50
- hostname: url.hostname,
51
- port: url.port,
52
- path: url.pathname,
53
- method: "POST",
54
- headers: {
55
- "Content-Type": "application/json",
56
- "Content-Length": Buffer.byteLength(body)
57
- },
58
- timeout: 15e3
59
- }, (res) => {
60
- let data = "";
61
- res.on("data", (chunk) => data += chunk);
62
- res.on("end", () => {
63
- if (res.statusCode !== 200) {
64
- reject(new Error(`Ollama error ${res.statusCode}: ${data.slice(0, 200)}`));
65
- return;
66
- }
67
- resolve(JSON.parse(data).embedding);
68
- });
69
- });
70
- req.on("error", reject);
71
- req.on("timeout", () => {
72
- req.destroy();
73
- reject(new Error("Ollama timeout"));
74
- });
75
- req.write(body);
76
- req.end();
77
- });
78
- results.push(result);
79
- }
80
- return results;
81
- }
82
- async function embedGoogle(texts, apiKey, model) {
83
- return new Promise((resolve, reject) => {
84
- const body = JSON.stringify({
85
- requests: texts.map((text) => ({ model: `models/${model}`, content: { parts: [{ text }] } }))
86
- });
87
- const req = https.request({
88
- hostname: "generativelanguage.googleapis.com",
89
- path: `/v1beta/models/${model}:batchEmbedContents?key=${apiKey}`,
90
- method: "POST",
91
- headers: {
92
- "Content-Type": "application/json",
93
- "Content-Length": Buffer.byteLength(body)
94
- },
95
- timeout: 3e4
96
- }, (res) => {
97
- let data = "";
98
- res.on("data", (chunk) => data += chunk);
99
- res.on("end", () => {
100
- if (res.statusCode !== 200) {
101
- reject(new Error(`Google API error ${res.statusCode}: ${data.slice(0, 200)}`));
102
- return;
103
- }
104
- const parsed = JSON.parse(data);
105
- resolve(parsed.embeddings.map((e) => e.values));
106
- });
107
- });
108
- req.on("error", reject);
109
- req.on("timeout", () => {
110
- req.destroy();
111
- reject(new Error("Google timeout"));
112
- });
113
- req.write(body);
114
- req.end();
115
- });
116
- }
117
- var Crystal = class {
118
- config;
119
- lanceDb = null;
120
- sqliteDb = null;
121
- chunksTable = null;
122
- constructor(config) {
123
- this.config = config;
124
- if (!existsSync(config.dataDir)) {
125
- mkdirSync(config.dataDir, { recursive: true });
126
- }
127
- }
128
- // ── Initialization ──
129
- async init() {
130
- const lanceDir = join(this.config.dataDir, "lance");
131
- const sqlitePath = join(this.config.dataDir, "crystal.db");
132
- if (!existsSync(lanceDir)) mkdirSync(lanceDir, { recursive: true });
133
- this.lanceDb = await lancedb.connect(lanceDir);
134
- this.sqliteDb = new Database(sqlitePath);
135
- this.sqliteDb.pragma("journal_mode = WAL");
136
- this.initSqliteTables();
137
- await this.initLanceTables();
138
- }
139
- initSqliteTables() {
140
- const db = this.sqliteDb;
141
- db.exec(`
142
- CREATE TABLE IF NOT EXISTS sources (
143
- id INTEGER PRIMARY KEY AUTOINCREMENT,
144
- type TEXT NOT NULL,
145
- uri TEXT NOT NULL,
146
- title TEXT,
147
- agent_id TEXT NOT NULL,
148
- metadata TEXT DEFAULT '{}',
149
- ingested_at TEXT NOT NULL,
150
- chunk_count INTEGER DEFAULT 0
151
- );
152
-
153
- CREATE TABLE IF NOT EXISTS capture_state (
154
- agent_id TEXT NOT NULL,
155
- source_id TEXT NOT NULL,
156
- last_message_count INTEGER DEFAULT 0,
157
- capture_count INTEGER DEFAULT 0,
158
- last_capture_at TEXT,
159
- PRIMARY KEY (agent_id, source_id)
160
- );
161
-
162
- CREATE TABLE IF NOT EXISTS memories (
163
- id INTEGER PRIMARY KEY AUTOINCREMENT,
164
- text TEXT NOT NULL,
165
- category TEXT NOT NULL DEFAULT 'fact',
166
- confidence REAL NOT NULL DEFAULT 1.0,
167
- source_ids TEXT DEFAULT '[]',
168
- status TEXT NOT NULL DEFAULT 'active',
169
- created_at TEXT NOT NULL,
170
- updated_at TEXT NOT NULL
171
- );
172
-
173
- CREATE TABLE IF NOT EXISTS entities (
174
- id INTEGER PRIMARY KEY AUTOINCREMENT,
175
- name TEXT NOT NULL UNIQUE,
176
- type TEXT NOT NULL DEFAULT 'concept',
177
- description TEXT,
178
- properties TEXT DEFAULT '{}',
179
- created_at TEXT NOT NULL,
180
- updated_at TEXT NOT NULL
181
- );
182
-
183
- CREATE TABLE IF NOT EXISTS relationships (
184
- id INTEGER PRIMARY KEY AUTOINCREMENT,
185
- source_id INTEGER NOT NULL REFERENCES entities(id),
186
- target_id INTEGER NOT NULL REFERENCES entities(id),
187
- type TEXT NOT NULL,
188
- description TEXT,
189
- weight REAL DEFAULT 1.0,
190
- valid_from TEXT NOT NULL,
191
- valid_until TEXT,
192
- created_at TEXT NOT NULL
193
- );
194
-
195
- CREATE INDEX IF NOT EXISTS idx_sources_agent ON sources(agent_id);
196
- CREATE INDEX IF NOT EXISTS idx_memories_status ON memories(status);
197
- CREATE INDEX IF NOT EXISTS idx_entities_name ON entities(name);
198
- CREATE INDEX IF NOT EXISTS idx_relationships_source ON relationships(source_id);
199
- CREATE INDEX IF NOT EXISTS idx_relationships_target ON relationships(target_id);
200
- `);
201
- }
202
- async initLanceTables() {
203
- const db = this.lanceDb;
204
- const tableNames = await db.tableNames();
205
- if (tableNames.includes("chunks")) {
206
- this.chunksTable = await db.openTable("chunks");
207
- }
208
- }
209
- // ── Embedding ──
210
- async embed(texts) {
211
- if (texts.length === 0) return [];
212
- const cfg = this.config;
213
- switch (cfg.embeddingProvider) {
214
- case "openai":
215
- if (!cfg.openaiApiKey) throw new Error("OpenAI API key required");
216
- return embedOpenAI(texts, cfg.openaiApiKey, cfg.openaiModel || "text-embedding-3-small");
217
- case "ollama":
218
- return embedOllama(texts, cfg.ollamaHost || "http://localhost:11434", cfg.ollamaModel || "nomic-embed-text");
219
- case "google":
220
- if (!cfg.googleApiKey) throw new Error("Google API key required");
221
- return embedGoogle(texts, cfg.googleApiKey, cfg.googleModel || "text-embedding-004");
222
- default:
223
- throw new Error(`Unknown embedding provider: ${cfg.embeddingProvider}`);
224
- }
225
- }
226
- // ── Chunking ──
227
- chunkText(text, targetTokens = 400, overlapTokens = 80) {
228
- const targetChars = targetTokens * 4;
229
- const overlapChars = overlapTokens * 4;
230
- const chunks = [];
231
- let start = 0;
232
- while (start < text.length) {
233
- let end = Math.min(start + targetChars, text.length);
234
- if (end < text.length) {
235
- const minBreak = start + Math.floor(targetChars * 0.5);
236
- const paraBreak = text.lastIndexOf("\n\n", end);
237
- if (paraBreak > minBreak) {
238
- end = paraBreak;
239
- } else {
240
- const sentBreak = text.lastIndexOf(". ", end);
241
- if (sentBreak > minBreak) {
242
- end = sentBreak + 1;
243
- }
244
- }
245
- }
246
- const chunk = text.slice(start, end).trim();
247
- if (chunk.length > 0) chunks.push(chunk);
248
- if (end >= text.length) break;
249
- start = end - overlapChars;
250
- if (start <= (chunks.length > 0 ? end - targetChars : 0)) {
251
- start = end;
252
- }
253
- }
254
- return chunks;
255
- }
256
- // ── Ingest ──
257
- async ingest(chunks) {
258
- if (chunks.length === 0) return 0;
259
- const texts = chunks.map((c) => c.text);
260
- const embeddings = await this.embed(texts);
261
- const records = chunks.map((chunk, i) => ({
262
- text: chunk.text,
263
- vector: embeddings[i],
264
- role: chunk.role,
265
- source_type: chunk.source_type,
266
- source_id: chunk.source_id,
267
- agent_id: chunk.agent_id,
268
- token_count: chunk.token_count,
269
- created_at: chunk.created_at || (/* @__PURE__ */ new Date()).toISOString()
270
- }));
271
- if (!this.chunksTable) {
272
- this.chunksTable = await this.lanceDb.createTable("chunks", records);
273
- } else {
274
- await this.chunksTable.add(records);
275
- }
276
- return records.length;
277
- }
278
- // ── Search ──
279
- async search(query, limit = 5, filter) {
280
- if (!this.chunksTable) return [];
281
- const [embedding] = await this.embed([query]);
282
- let queryBuilder = this.chunksTable.search(embedding).distanceType("cosine").limit(limit);
283
- if (filter?.agent_id) {
284
- queryBuilder = queryBuilder.where(`agent_id = '${filter.agent_id}'`);
285
- }
286
- if (filter?.source_type) {
287
- queryBuilder = queryBuilder.where(`source_type = '${filter.source_type}'`);
288
- }
289
- const results = await queryBuilder.toArray();
290
- return results.map((row) => ({
291
- text: row.text,
292
- role: row.role,
293
- score: row._distance != null ? 1 - row._distance : 0,
294
- source_type: row.source_type,
295
- source_id: row.source_id,
296
- agent_id: row.agent_id,
297
- created_at: row.created_at
298
- }));
299
- }
300
- // ── Remember (explicit fact storage) ──
301
- async remember(text, category = "fact") {
302
- const db = this.sqliteDb;
303
- const now = (/* @__PURE__ */ new Date()).toISOString();
304
- const stmt = db.prepare(`
305
- INSERT INTO memories (text, category, confidence, source_ids, status, created_at, updated_at)
306
- VALUES (?, ?, 1.0, '[]', 'active', ?, ?)
307
- `);
308
- const result = stmt.run(text, category, now, now);
309
- await this.ingest([{
310
- text,
311
- role: "system",
312
- source_type: "manual",
313
- source_id: `memory:${result.lastInsertRowid}`,
314
- agent_id: "system",
315
- token_count: Math.ceil(text.length / 4),
316
- created_at: now
317
- }]);
318
- return result.lastInsertRowid;
319
- }
320
- // ── Forget (deprecate a memory) ──
321
- forget(memoryId) {
322
- const db = this.sqliteDb;
323
- const now = (/* @__PURE__ */ new Date()).toISOString();
324
- const result = db.prepare(`
325
- UPDATE memories SET status = 'deprecated', updated_at = ? WHERE id = ? AND status = 'active'
326
- `).run(now, memoryId);
327
- return result.changes > 0;
328
- }
329
- // ── Status ──
330
- async status() {
331
- const db = this.sqliteDb;
332
- let chunks = 0;
333
- let oldestChunk = null;
334
- let newestChunk = null;
335
- const agents = [];
336
- if (this.chunksTable) {
337
- chunks = await this.chunksTable.countRows();
338
- try {
339
- const sample = await this.chunksTable.search([]).limit(1).toArray();
340
- } catch {
341
- }
342
- }
343
- const memories = db.prepare("SELECT COUNT(*) as count FROM memories WHERE status = ?").get("active")?.count || 0;
344
- const sources = db.prepare("SELECT COUNT(*) as count FROM sources").get()?.count || 0;
345
- const agentRows = db.prepare("SELECT DISTINCT agent_id FROM sources").all();
346
- agents.push(...agentRows.map((r) => r.agent_id));
347
- return {
348
- chunks,
349
- memories,
350
- sources,
351
- agents,
352
- oldestChunk,
353
- newestChunk,
354
- embeddingProvider: this.config.embeddingProvider,
355
- dataDir: this.config.dataDir
356
- };
357
- }
358
- // ── Capture State (for incremental ingestion) ──
359
- getCaptureState(agentId, sourceId) {
360
- const db = this.sqliteDb;
361
- const row = db.prepare("SELECT last_message_count, capture_count FROM capture_state WHERE agent_id = ? AND source_id = ?").get(agentId, sourceId);
362
- return row || { lastMessageCount: 0, captureCount: 0 };
363
- }
364
- setCaptureState(agentId, sourceId, messageCount, captureCount) {
365
- const db = this.sqliteDb;
366
- db.prepare(`
367
- INSERT OR REPLACE INTO capture_state (agent_id, source_id, last_message_count, capture_count, last_capture_at)
368
- VALUES (?, ?, ?, ?, ?)
369
- `).run(agentId, sourceId, messageCount, captureCount, (/* @__PURE__ */ new Date()).toISOString());
370
- }
371
- // ── Cleanup ──
372
- close() {
373
- this.sqliteDb?.close();
374
- }
375
- };
376
- function resolveConfig(overrides) {
377
- const openclawHome = process.env.OPENCLAW_HOME || join(process.env.HOME || "/Users/lesa", ".openclaw");
378
- const dataDir = overrides?.dataDir || join(openclawHome, "memory-crystal");
379
- let openaiApiKey = overrides?.openaiApiKey || process.env.OPENAI_API_KEY;
380
- if (!openaiApiKey) {
381
- try {
382
- const saTokenPath = join(openclawHome, "secrets", "op-sa-token");
383
- if (existsSync(saTokenPath)) {
384
- const saToken = readFileSync(saTokenPath, "utf8").trim();
385
- openaiApiKey = execSync('op read "op://Agent Secrets/OpenAI API/api key"', {
386
- encoding: "utf8",
387
- env: { ...process.env, OP_SERVICE_ACCOUNT_TOKEN: saToken },
388
- timeout: 1e4
389
- }).trim();
390
- }
391
- } catch {
392
- }
393
- }
394
- return {
395
- dataDir,
396
- embeddingProvider: overrides?.embeddingProvider || process.env.CRYSTAL_EMBEDDING_PROVIDER || "openai",
397
- openaiApiKey,
398
- openaiModel: overrides?.openaiModel || process.env.CRYSTAL_OPENAI_MODEL || "text-embedding-3-small",
399
- ollamaHost: overrides?.ollamaHost || process.env.CRYSTAL_OLLAMA_HOST || "http://localhost:11434",
400
- ollamaModel: overrides?.ollamaModel || process.env.CRYSTAL_OLLAMA_MODEL || "nomic-embed-text",
401
- googleApiKey: overrides?.googleApiKey || process.env.GOOGLE_API_KEY,
402
- googleModel: overrides?.googleModel || process.env.CRYSTAL_GOOGLE_MODEL || "text-embedding-004",
403
- remoteUrl: overrides?.remoteUrl || process.env.CRYSTAL_REMOTE_URL,
404
- remoteToken: overrides?.remoteToken || process.env.CRYSTAL_REMOTE_TOKEN
405
- };
406
- }
407
-
408
- export {
409
- Crystal,
410
- resolveConfig
411
- };
@@ -1,108 +0,0 @@
1
- import {
2
- resolveSecretPath
3
- } from "./chunk-DFQ72B7M.js";
4
-
5
- // src/crypto.ts
6
- import { readFileSync, existsSync } from "fs";
7
- import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
8
- import { createHash } from "crypto";
9
- var KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || resolveSecretPath("crystal-relay-key");
10
- function loadRelayKey() {
11
- if (!existsSync(KEY_PATH)) {
12
- throw new Error(
13
- `Relay key not found at ${KEY_PATH}
14
- Generate one: mkdir -p ~/.ldm/secrets && openssl rand -base64 32 > ~/.ldm/secrets/crystal-relay-key && chmod 600 ~/.ldm/secrets/crystal-relay-key
15
- Or run: crystal pair`
16
- );
17
- }
18
- const raw = readFileSync(KEY_PATH, "utf-8").trim();
19
- const key = Buffer.from(raw, "base64");
20
- if (key.length !== 32) {
21
- throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
22
- }
23
- return key;
24
- }
25
- function deriveSigningKey(masterKey) {
26
- return Buffer.from(hkdfSync("sha256", masterKey, "", "crystal-relay-sign", 32));
27
- }
28
- function encrypt(plaintext, masterKey) {
29
- const nonce = randomBytes(12);
30
- const cipher = createCipheriv("aes-256-gcm", masterKey, nonce);
31
- const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
32
- const tag = cipher.getAuthTag();
33
- const signingKey = deriveSigningKey(masterKey);
34
- const hmacData = Buffer.concat([nonce, ciphertext, tag]);
35
- const hmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
36
- return {
37
- v: 1,
38
- nonce: nonce.toString("base64"),
39
- ciphertext: ciphertext.toString("base64"),
40
- tag: tag.toString("base64"),
41
- hmac
42
- };
43
- }
44
- function decrypt(payload, masterKey) {
45
- if (payload.v !== 1) {
46
- throw new Error(`Unknown payload version: ${payload.v}`);
47
- }
48
- const nonce = Buffer.from(payload.nonce, "base64");
49
- const ciphertext = Buffer.from(payload.ciphertext, "base64");
50
- const tag = Buffer.from(payload.tag, "base64");
51
- const signingKey = deriveSigningKey(masterKey);
52
- const hmacData = Buffer.concat([nonce, ciphertext, tag]);
53
- const expectedHmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
54
- if (payload.hmac !== expectedHmac) {
55
- throw new Error("HMAC verification failed \u2014 blob rejected (tampered or wrong key)");
56
- }
57
- const decipher = createDecipheriv("aes-256-gcm", masterKey, nonce);
58
- decipher.setAuthTag(tag);
59
- return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
60
- }
61
- function encryptJSON(data, masterKey) {
62
- const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
63
- return encrypt(plaintext, masterKey);
64
- }
65
- function decryptJSON(payload, masterKey) {
66
- const plaintext = decrypt(payload, masterKey);
67
- return JSON.parse(plaintext.toString("utf-8"));
68
- }
69
- function encryptFile(filePath, masterKey) {
70
- const plaintext = readFileSync(filePath);
71
- return encrypt(plaintext, masterKey);
72
- }
73
- var RELAY_KEY_PATH = KEY_PATH;
74
- function generateRelayKey() {
75
- return randomBytes(32);
76
- }
77
- function encodePairingString(key) {
78
- if (key.length !== 32) throw new Error("Key must be 32 bytes");
79
- return `mc1:${key.toString("base64")}`;
80
- }
81
- function decodePairingString(str) {
82
- const trimmed = str.trim();
83
- if (!trimmed.startsWith("mc1:")) {
84
- throw new Error("Invalid pairing string (expected mc1: prefix)");
85
- }
86
- const key = Buffer.from(trimmed.slice(4), "base64");
87
- if (key.length !== 32) {
88
- throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
89
- }
90
- return key;
91
- }
92
- function hashBuffer(data) {
93
- return createHash("sha256").update(data).digest("hex");
94
- }
95
-
96
- export {
97
- loadRelayKey,
98
- encrypt,
99
- decrypt,
100
- encryptJSON,
101
- decryptJSON,
102
- encryptFile,
103
- RELAY_KEY_PATH,
104
- generateRelayKey,
105
- encodePairingString,
106
- decodePairingString,
107
- hashBuffer
108
- };