auramaxx 0.0.17 → 0.0.19

package/src/server/lib/notifications.ts

@@ -15,18 +15,28 @@ interface NotificationAction {
 
 interface CreateNotificationParams {
   type: 'pending_approval' | 'info' | 'warning' | 'success' | 'error' | 'system';
-  category?: 'transaction' | 'security' | 'token' | 'wallet' | 'general';
+  category?: 'transaction' | 'security' | 'token' | 'wallet' | 'general' | 'social';
   title: string;
   message: string;
   actions?: NotificationAction[];
   metadata?: Record<string, unknown>;
   humanActionId?: string;
+  hash?: string;
   expiresAt?: Date;
   source?: 'system' | 'agent' | 'user';
   agentId?: string;
 }
 
 export async function createNotification(params: CreateNotificationParams) {
+  // If hash is provided, skip if notification with this hash already exists (dedup)
+  if (params.hash) {
+    const existing = await prisma.notification.findUnique({
+      where: { hash: params.hash },
+      select: { id: true },
+    });
+    if (existing) return null;
+  }
+
   return prisma.notification.create({
     data: {
       type: params.type,
@@ -36,6 +46,7 @@ export async function createNotification(params: CreateNotificationParams) {
       actions: params.actions ? JSON.stringify(params.actions) : null,
       metadata: params.metadata ? JSON.stringify(params.metadata) : null,
       humanActionId: params.humanActionId,
+      hash: params.hash,
       expiresAt: params.expiresAt,
       source: params.source || 'system',
       agentId: params.agentId,

package/src/server/lib/permissions.ts

@@ -63,6 +63,14 @@ export type Permission =
   | 'secret:write'           // Create/update/delete credentials in the agent
   | 'totp:read'              // Generate TOTP codes from credential secrets
 
+  // Social operations
+  | 'social:read'            // Read feed, messages, followers, following, sync status
+  | 'social:write'           // Create posts, reactions, follows, profile updates, removals
+
+  // Verified credential operations
+  | 'credential:read'        // View verified credentials and verification status
+  | 'credential:write'       // Initiate new credential verifications
+
   // Compound permissions (expand to multiple permissions)
   | 'trade:all'             // All trading permissions + apikey:get + strategy:read
   | 'wallet:write'          // All wallet write operations
@@ -88,6 +96,8 @@ const COMPOUND_PERMISSIONS: Record<string, Permission[]> = {
     'app:storage', 'app:storage:all', 'app:accesskey',
     'adapter:manage',
     'addressbook:write', 'bookmark:write',
+    'social:read', 'social:write',
+    'credential:read', 'credential:write',
   ],
   'trade:all': [
     'wallet:list',

package/src/server/lib/project-scope.ts

@@ -190,7 +190,20 @@ export function evaluateProjectScopeAccess(input: {
 
   const cwd = input.cwd || process.cwd();
   const { projectRoot, auraPath } = resolveAuraPath({ cwd, projectRootOverride: input.projectRootOverride });
-  if (!auraPath || !fs.existsSync(auraPath)) {
+  const auraExists = Boolean(auraPath && fs.existsSync(auraPath));
+  const auraIsFile = auraExists
+    ? (() => {
+        try {
+          return fs.statSync(auraPath!).isFile();
+        } catch {
+          return false;
+        }
+      })()
+    : false;
+
+  const auraFilePath = auraExists && auraIsFile && auraPath ? auraPath : null;
+
+  if (!auraFilePath) {
     if (projectScopeMode === 'auto') {
       return {
         allowed: true,
@@ -203,10 +216,13 @@ export function evaluateProjectScopeAccess(input: {
         allowedCandidates: input.candidates,
       };
     }
+    const auraWrongType = auraExists && !auraIsFile;
     return {
       allowed: false,
-      code: 'PROJECT_SCOPE_MISSING_AURA',
-      remediation: 'Add a .aura file in the project root (or set AURA_PROJECT_ROOT / --project-root).',
+      code: auraWrongType ? 'PROJECT_SCOPE_INVALID_AURA' : 'PROJECT_SCOPE_MISSING_AURA',
+      remediation: auraWrongType
+        ? '.aura must be a file (not a directory). Use ENV=@agent/name/field or ENV=name/field lines.'
+        : 'Add a .aura file in the project root (or set AURA_PROJECT_ROOT / --project-root).',
       projectScopeMode,
       normalizedIdentity,
       projectRoot,
@@ -218,10 +234,22 @@ export function evaluateProjectScopeAccess(input: {
   let refs: ParsedRef[];
   let auraFingerprint: string;
   try {
-    const content = fs.readFileSync(auraPath, 'utf-8');
+    const content = fs.readFileSync(auraFilePath, 'utf-8');
     auraFingerprint = fingerprint(content);
-    refs = parseAuraAllowlist(auraPath);
+    refs = parseAuraAllowlist(auraFilePath);
   } catch {
+    if (projectScopeMode === 'auto') {
+      return {
+        allowed: true,
+        code: null,
+        remediation: '',
+        projectScopeMode,
+        normalizedIdentity,
+        projectRoot,
+        auraFingerprint: null,
+        allowedCandidates: input.candidates,
+      };
+    }
     return {
       allowed: false,
       code: 'PROJECT_SCOPE_INVALID_AURA',

package/src/server/lib/social/create.ts

@@ -0,0 +1,176 @@
+/**
+ * Social message creation -- sign + INSERT into SocialMessage.
+ *
+ * Each wrapper: look up auraId -> build MessageData -> sign -> INSERT.
+ * Returns immediately; caller can trigger async hub submit and cron retries remain as fallback.
+ */
+
+import type { SocialMessage } from '@prisma/client';
+import { prisma } from '../db';
+import { signMessage, type MessageData } from './sign';
+
+export interface CreatePostOpts {
+  embeds?: string[];
+  parentPostHash?: string;
+  mentions?: number[];
+}
+
+// --- Internal helpers ---
+
+async function getOrDerivePublicKeyHex(agentId: string, mnemonic: string): Promise<string> {
+  const profile = await prisma.agentProfile.findUnique({ where: { agentId } });
+  if (profile?.publicKeyHex) return profile.publicKeyHex;
+
+  // Derive and cache
+  const { deriveSigningSeed } = await import('./sign');
+  const { ed25519 } = await import('@noble/curves/ed25519.js');
+  const seed = deriveSigningSeed(mnemonic);
+  const pubKey = Buffer.from(ed25519.getPublicKey(seed)).toString('hex');
+
+  await prisma.agentProfile.upsert({
+    where: { agentId },
+    update: { publicKeyHex: pubKey },
+    create: { agentId, publicKeyHex: pubKey },
+  });
+
+  return pubKey;
+}
+
+async function createMessage(
+  agentId: string,
+  mnemonic: string,
+  type: string,
+  body: Record<string, unknown>,
+  hubUrl: string = '',
+): Promise<SocialMessage> {
+  await getOrDerivePublicKeyHex(agentId, mnemonic);
+
+  const data: MessageData = {
+    type,
+    timestamp: Math.floor(Date.now() / 1000),
+    network: 'mainnet',
+    body,
+  };
+
+  const envelope = signMessage(data, mnemonic);
+
+  const insertData = {
+    agentId,
+    hash: envelope.hash,
+    type,
+    body: JSON.stringify(body),
+    timestamp: data.timestamp,
+    network: data.network,
+    signature: envelope.signature,
+    signer: envelope.signer,
+    syncStatus: 'pending' as const,
+    hubUrl,
+  };
+
+  try {
+    return await prisma.socialMessage.create({ data: insertData });
+  } catch (error) {
+    // Idempotent write: if the same signed payload was already inserted,
+    // return that existing row instead of surfacing a unique-hash error.
+    const isUniqueViolation =
+      typeof error === 'object'
+      && error !== null
+      && 'code' in error
+      && (error as { code?: string }).code === 'P2002';
+
+    if (!isUniqueViolation) throw error;
+
+    const existing = await prisma.socialMessage.findUnique({
+      where: { hash: envelope.hash },
+    });
+    if (existing) return existing;
+    throw error;
+  }
+}
+
+// --- Public wrappers ---
+
+export async function createPost(
+  agentId: string,
+  mnemonic: string,
+  text: string,
+  opts?: CreatePostOpts & { hubUrl?: string },
+): Promise<SocialMessage> {
+  const body: Record<string, unknown> = { text };
+  if (opts?.embeds?.length) body.embeds = opts.embeds;
+  if (opts?.parentPostHash) body.parentPostHash = opts.parentPostHash;
+  if (opts?.mentions?.length) body.mentions = opts.mentions;
+  return createMessage(agentId, mnemonic, 'post_add', body, opts?.hubUrl);
+}
+
+export async function createReaction(
+  agentId: string,
+  mnemonic: string,
+  postHash: string,
+  reactionType: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'reaction_add', {
+    postHash,
+    reactionType,
+  }, hubUrl);
+}
+
+export async function createFollow(
+  agentId: string,
+  mnemonic: string,
+  targetPublicKey: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'link_add', {
+    followeePublicKey: targetPublicKey,
+    linkType: 'follow',
+  }, hubUrl);
+}
+
+export async function createUnfollow(
+  agentId: string,
+  mnemonic: string,
+  targetPublicKey: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'link_remove', {
+    followeePublicKey: targetPublicKey,
+    linkType: 'follow',
+  }, hubUrl);
+}
+
+export async function createPostRemove(
+  agentId: string,
+  mnemonic: string,
+  targetPostHash: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'post_remove', { targetPostHash }, hubUrl);
+}
+
+export async function createReactionRemove(
+  agentId: string,
+  mnemonic: string,
+  postHash: string,
+  reactionType: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'reaction_remove', {
+    postHash,
+    reactionType,
+  }, hubUrl);
+}
+
+export async function createProfileUpdate(
+  agentId: string,
+  mnemonic: string,
+  field: string,
+  value: string,
+  hubUrl?: string,
+): Promise<SocialMessage> {
+  return createMessage(agentId, mnemonic, 'user_data_add', {
+    type: field,
+    value,
+  }, hubUrl);
+}

package/src/server/lib/social/global-aura-id.ts

@@ -0,0 +1,115 @@
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { prisma } from '../db';
+import { log } from '../pino';
+import { deriveSigningSeed } from './sign';
+
+const DEFAULT_GLOBAL_HUB_URL = 'https://hub.auramaxx.now';
+const IDENTITY_MAP_PATH = '/api/identity-map';
+const LOOKUP_TIMEOUT_MS = 2_500;
+
+interface IdentityMapResponse {
+  auraId?: unknown;
+  found?: unknown;
+}
+
+function getGlobalHubUrl(): string {
+  const raw = process.env.GLOBAL_AURA_HUB_URL;
+  if (typeof raw === 'string' && raw.trim()) {
+    return raw.trim().replace(/\/+$/, '');
+  }
+  return DEFAULT_GLOBAL_HUB_URL;
+}
+
+function parseAuraId(value: unknown): number | null {
+  if (typeof value === 'number' && Number.isFinite(value) && value > 0) {
+    return Math.floor(value);
+  }
+  if (typeof value === 'string') {
+    const parsed = Number.parseInt(value, 10);
+    if (Number.isFinite(parsed) && parsed > 0) {
+      return parsed;
+    }
+  }
+  return null;
+}
+
+function derivePublicKeys(mnemonic: string): { publicKeyHex: string; publicKeyBase64: string } {
+  const seed = deriveSigningSeed(mnemonic);
+  const pubKeyBytes = ed25519.getPublicKey(seed);
+  return {
+    publicKeyHex: Buffer.from(pubKeyBytes).toString('hex'),
+    publicKeyBase64: Buffer.from(pubKeyBytes).toString('base64'),
+  };
+}
+
+async function cachePublicKey(agentId: string, publicKeyHex: string): Promise<void> {
+  await prisma.agentProfile.upsert({
+    where: { agentId },
+    create: { agentId, publicKeyHex },
+    update: { publicKeyHex },
+  });
+}
+
+async function fetchGlobalAuraId(publicKeyBase64: string): Promise<number | null> {
+  const endpoint = new URL(IDENTITY_MAP_PATH, `${getGlobalHubUrl()}/`);
+  endpoint.searchParams.set('address', publicKeyBase64);
+
+  const response = await fetch(endpoint.toString(), {
+    method: 'GET',
+    signal: AbortSignal.timeout(LOOKUP_TIMEOUT_MS),
+  });
+
+  if (!response.ok) return null;
+
+  const payload = await response.json() as IdentityMapResponse;
+  const found = payload.found;
+  if (found === false) return null;
+  return parseAuraId(payload.auraId);
+}
+
+/**
+ * Best-effort sync of the global auraId from hub.auramaxx.now.
+ * - Caches pubkey locally always
+ * - Caches auraId locally only when remote lookup succeeds
+ * - Never throws (safe to call during login / register flows)
+ */
+export async function syncGlobalAuraIdForAgent(agentId: string, mnemonic: string): Promise<number | null> {
+  const { publicKeyHex, publicKeyBase64 } = derivePublicKeys(mnemonic);
+
+  try {
+    await cachePublicKey(agentId, publicKeyHex);
+  } catch (error) {
+    log.debug({ agentId, error }, 'Failed to cache agent public key while syncing global auraId');
+    return null;
+  }
+
+  // Keep tests deterministic and offline.
+  if (process.env.NODE_ENV === 'test') {
+    return null;
+  }
+
+  let auraId: number | null = null;
+  try {
+    auraId = await fetchGlobalAuraId(publicKeyBase64);
+  } catch (error) {
+    log.debug({ agentId, error }, 'Global auraId lookup failed');
+    return null;
+  }
+
+  if (!auraId) {
+    return null;
+  }
+
+  try {
+    await prisma.agentProfile.upsert({
+      where: { agentId },
+      create: { agentId, publicKeyHex, auraId },
+      update: { publicKeyHex, auraId },
+    });
+    return auraId;
+  } catch (error) {
+    // auraId has a unique constraint; ignore conflicts across agents.
+    log.warn({ agentId, auraId, error }, 'Failed to cache global auraId locally');
+    return null;
+  }
+}

package/src/server/lib/social/hub-rpc-client.ts

@@ -0,0 +1,99 @@
+/**
+ * Typed RPC client for hub communication.
+ *
+ * Replaces per-file fetch() calls with a single `call(method, params)`.
+ * Envelope: { method, params } → { ok: true, result } | { ok: false, error, detail }
+ */
+
+export class HubRpcError extends Error {
+  readonly code: string;
+  readonly detail: string;
+  readonly statusCode: number;
+
+  constructor(code: string, detail: string, statusCode = 400) {
+    super(`${code}: ${detail}`);
+    this.name = 'HubRpcError';
+    this.code = code;
+    this.detail = detail;
+    this.statusCode = statusCode;
+  }
+}
+
+export interface HubRpcCallOptions {
+  /** Override default timeout (ms). Default: 15_000. */
+  timeoutMs?: number;
+  /** AbortSignal to cancel the request. */
+  signal?: AbortSignal;
+  /** Override bearer token for this call only. */
+  bearerToken?: string;
+}
+
+export interface HubRpcClientOptions {
+  /** Optional bearer token sent as Authorization header. */
+  bearerToken?: string;
+}
+
+export class HubRpcClient {
+  private bearerToken?: string;
+
+  constructor(private readonly hubUrl: string, opts?: HubRpcClientOptions) {
+    this.bearerToken = opts?.bearerToken;
+  }
+
+  setBearerToken(token: string | undefined): void {
+    this.bearerToken = token;
+  }
+
+  /**
+   * Call an RPC method on the hub. Returns the `result` on success.
+   * Throws `HubRpcError` on RPC-level errors, or a plain `Error` on network failure.
+   */
+  async call<R = unknown>(
+    method: string,
+    params: Record<string, unknown> = {},
+    opts?: HubRpcCallOptions,
+  ): Promise<R> {
+    const timeoutMs = opts?.timeoutMs ?? 15_000;
+    const signal = opts?.signal ?? AbortSignal.timeout(timeoutMs);
+    const bearerToken = opts?.bearerToken ?? this.bearerToken;
+    const headers: Record<string, string> = { 'Content-Type': 'application/json' };
+    if (bearerToken) {
+      headers.Authorization = `Bearer ${bearerToken}`;
+    }
+
+    const res = await fetch(`${this.hubUrl}/rpc`, {
+      method: 'POST',
+      headers,
+      body: JSON.stringify({ method, params }),
+      signal,
+    });
+
+    const json = (await res.json()) as Record<string, unknown>;
+
+    if (!json.ok) {
+      throw new HubRpcError(
+        (json.error as string) ?? 'unknown_error',
+        (json.detail as string) ?? 'Hub returned an error',
+        res.status,
+      );
+    }
+
+    return json.result as R;
+  }
+
+  /**
+   * Like `call()` but returns `null` instead of throwing on any error.
+   * Useful for cron jobs and graceful degradation paths.
+   */
+  async tryCall<R = unknown>(
+    method: string,
+    params: Record<string, unknown> = {},
+    opts?: HubRpcCallOptions,
+  ): Promise<R | null> {
+    try {
+      return await this.call<R>(method, params, opts);
+    } catch {
+      return null;
+    }
+  }
+}

package/src/server/lib/social/hub-session.ts

@@ -0,0 +1,6 @@
+export {
+  callHubWithSessionAuth,
+  getHubSessionToken,
+  invalidateHubSessionToken,
+  tryCallHubWithSessionAuth,
+} from '../hub-auth';

package/src/server/lib/social/public-key.ts

@@ -0,0 +1,32 @@
+/**
+ * Public-key format helpers for hub RPC interoperability.
+ *
+ * AuraWallet stores signer keys as 32-byte hex.
+ * AuraHub identity/publicKey fields are base64.
+ */
+
+const HEX_ED25519_RE = /^[0-9a-f]{64}$/i;
+
+export function normalizeHubPublicKey(publicKey: string): string {
+  const trimmed = publicKey.trim();
+  if (!trimmed) return '';
+  if (HEX_ED25519_RE.test(trimmed)) {
+    return Buffer.from(trimmed.toLowerCase(), 'hex').toString('base64');
+  }
+  return trimmed;
+}
+
+export function normalizeFollowBodyForHub(
+  type: string,
+  body: Record<string, unknown>,
+): Record<string, unknown> {
+  if (type !== 'link_add' && type !== 'link_remove') return body;
+
+  const followee = body.followeePublicKey;
+  if (typeof followee !== 'string') return body;
+
+  const normalized = normalizeHubPublicKey(followee);
+  if (!normalized || normalized === followee) return body;
+  return { ...body, followeePublicKey: normalized };
+}
+