devchain-cli 0.14.1 → 0.15.0

package/dist/server/modules/e2ee/controllers/e2ee-trust.controller.d.ts

@@ -0,0 +1,19 @@
+import { E2eeTrustService, type DeviceSafetyNumberResult, type DeviceTrustResult, type PairedDeviceSummary } from '../services/e2ee-trust.service';
+interface AdoptBody {
+    kid?: string;
+    publicKeyB64?: string;
+    label?: string;
+}
+export declare class E2eeTrustController {
+    private readonly trust;
+    constructor(trust: E2eeTrustService);
+    listDevices(): PairedDeviceSummary[];
+    safetyNumber(kid: string): Promise<DeviceSafetyNumberResult>;
+    verify(kid: string): DeviceTrustResult;
+    revokeDevice(kid: string): {
+        kid: string;
+        removed: boolean;
+    };
+    adopt(body: AdoptBody): DeviceTrustResult;
+}
+export {};

package/dist/server/modules/e2ee/controllers/e2ee-trust.controller.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E2eeTrustController = void 0;
+const common_1 = require("@nestjs/common");
+const error_types_1 = require("../../../common/errors/error-types");
+const e2ee_trust_service_1 = require("../services/e2ee-trust.service");
+let E2eeTrustController = class E2eeTrustController {
+    constructor(trust) {
+        this.trust = trust;
+    }
+    listDevices() {
+        return this.trust.listDevices();
+    }
+    async safetyNumber(kid) {
+        return this.trust.getSafetyNumber(kid);
+    }
+    verify(kid) {
+        return this.trust.verifyDevice(kid);
+    }
+    revokeDevice(kid) {
+        return this.trust.revokeDevice(kid);
+    }
+    adopt(body) {
+        if (!body?.kid || !body.publicKeyB64) {
+            throw new error_types_1.ValidationError('kid and publicKeyB64 are required');
+        }
+        return this.trust.adoptPeerKeyTofu({
+            kid: body.kid,
+            publicKeyB64: body.publicKeyB64,
+            ...(body.label !== undefined ? { label: body.label } : {}),
+        });
+    }
+};
+exports.E2eeTrustController = E2eeTrustController;
+__decorate([
+    (0, common_1.Get)(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Array)
+], E2eeTrustController.prototype, "listDevices", null);
+__decorate([
+    (0, common_1.Get)(':kid/safety-number'),
+    __param(0, (0, common_1.Param)('kid')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Promise)
+], E2eeTrustController.prototype, "safetyNumber", null);
+__decorate([
+    (0, common_1.Post)(':kid/verify'),
+    __param(0, (0, common_1.Param)('kid')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Object)
+], E2eeTrustController.prototype, "verify", null);
+__decorate([
+    (0, common_1.Delete)(':kid'),
+    __param(0, (0, common_1.Param)('kid')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", Object)
+], E2eeTrustController.prototype, "revokeDevice", null);
+__decorate([
+    (0, common_1.Post)('adopt'),
+    __param(0, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Object)
+], E2eeTrustController.prototype, "adopt", null);
+exports.E2eeTrustController = E2eeTrustController = __decorate([
+    (0, common_1.Controller)('api/e2ee/devices'),
+    __metadata("design:paramtypes", [e2ee_trust_service_1.E2eeTrustService])
+], E2eeTrustController);
+//# sourceMappingURL=e2ee-trust.controller.js.map

package/dist/server/modules/e2ee/controllers/e2ee-trust.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-trust.controller.js","sourceRoot":"","sources":["../../../../src/modules/e2ee/controllers/e2ee-trust.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAA4E;AAC5E,oEAAqE;AACrE,uEAKwC;AAmBjC,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAA6B,KAAuB;QAAvB,UAAK,GAAL,KAAK,CAAkB;IAAG,CAAC;IAGxD,WAAW;QACT,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,CAAC;IAGK,AAAN,KAAK,CAAC,YAAY,CAAe,GAAW;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAGD,MAAM,CAAe,GAAW;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAGD,YAAY,CAAe,GAAW;QACpC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC;IAGD,KAAK,CAAS,IAAe;QAC3B,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,6BAAe,CAAC,mCAAmC,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC;YACjC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAlCY,kDAAmB;AAI9B;IADC,IAAA,YAAG,GAAE;;;;sDAGL;AAGK;IADL,IAAA,YAAG,EAAC,oBAAoB,CAAC;IACN,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;uDAE/B;AAGD;IADC,IAAA,aAAI,EAAC,aAAa,CAAC;IACZ,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;iDAEnB;AAGD;IADC,IAAA,eAAM,EAAC,MAAM,CAAC;IACD,WAAA,IAAA,cAAK,EAAC,KAAK,CAAC,CAAA;;;;uDAEzB;AAGD;IADC,IAAA,aAAI,EAAC,OAAO,CAAC;IACP,WAAA,IAAA,aAAI,GAAE,CAAA;;;;gDASZ;8BAjCU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,kBAAkB,CAAC;qCAEO,qCAAgB;GADzC,mBAAmB,CAkC/B"}

package/dist/server/modules/e2ee/e2ee.module.d.ts

@@ -0,0 +1,2 @@
+export declare class E2eeModule {
+}

package/dist/server/modules/e2ee/e2ee.module.js

@@ -0,0 +1,27 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E2eeModule = void 0;
+const common_1 = require("@nestjs/common");
+const e2ee_keypair_service_1 = require("./services/e2ee-keypair.service");
+const e2ee_device_store_service_1 = require("./services/e2ee-device-store.service");
+const e2ee_pairing_service_1 = require("./services/e2ee-pairing.service");
+const e2ee_trust_service_1 = require("./services/e2ee-trust.service");
+const e2ee_pairing_controller_1 = require("./controllers/e2ee-pairing.controller");
+const e2ee_trust_controller_1 = require("./controllers/e2ee-trust.controller");
+let E2eeModule = class E2eeModule {
+};
+exports.E2eeModule = E2eeModule;
+exports.E2eeModule = E2eeModule = __decorate([
+    (0, common_1.Module)({
+        controllers: [e2ee_pairing_controller_1.E2eePairingController, e2ee_trust_controller_1.E2eeTrustController],
+        providers: [e2ee_keypair_service_1.E2eeKeypairService, e2ee_device_store_service_1.E2eeDeviceStoreService, e2ee_pairing_service_1.E2eePairingService, e2ee_trust_service_1.E2eeTrustService],
+        exports: [e2ee_keypair_service_1.E2eeKeypairService, e2ee_device_store_service_1.E2eeDeviceStoreService, e2ee_pairing_service_1.E2eePairingService, e2ee_trust_service_1.E2eeTrustService],
+    })
+], E2eeModule);
+//# sourceMappingURL=e2ee.module.js.map

package/dist/server/modules/e2ee/e2ee.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee.module.js","sourceRoot":"","sources":["../../../src/modules/e2ee/e2ee.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,0EAAqE;AACrE,oFAA8E;AAC9E,0EAAqE;AACrE,sEAAiE;AACjE,mFAA8E;AAC9E,+EAA0E;AAgBnE,IAAM,UAAU,GAAhB,MAAM,UAAU;CAAG,CAAA;AAAb,gCAAU;qBAAV,UAAU;IALtB,IAAA,eAAM,EAAC;QACN,WAAW,EAAE,CAAC,+CAAqB,EAAE,2CAAmB,CAAC;QACzD,SAAS,EAAE,CAAC,yCAAkB,EAAE,kDAAsB,EAAE,yCAAkB,EAAE,qCAAgB,CAAC;QAC7F,OAAO,EAAE,CAAC,yCAAkB,EAAE,kDAAsB,EAAE,yCAAkB,EAAE,qCAAgB,CAAC;KAC5F,CAAC;GACW,UAAU,CAAG"}

package/dist/server/modules/e2ee/services/e2ee-device-store.service.d.ts

@@ -0,0 +1,29 @@
+import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import { type E2eeTrustStatus, type E2eeVerificationMethod, type E2eeAdoptionMethod, type IncomingPeerKey } from '@devchain/shared';
+export interface E2eePeerDevice {
+    kid: string;
+    publicKeyB64: string;
+    addedAt: string;
+    trust: E2eeTrustStatus;
+    adoptedVia?: E2eeAdoptionMethod;
+    verifiedVia?: E2eeVerificationMethod;
+    verifiedAt?: string;
+    label?: string;
+}
+export declare class E2eeDeviceStoreService {
+    private readonly db;
+    private sqlite;
+    constructor(db: BetterSQLite3Database);
+    add(device: Omit<E2eePeerDevice, 'addedAt' | 'trust'> & {
+        addedAt?: string;
+        trust?: E2eeTrustStatus;
+    }): E2eePeerDevice;
+    reconcile(incoming: IncomingPeerKey, now?: string): E2eePeerDevice;
+    markVerified(kid: string, now?: string): E2eePeerDevice | null;
+    private toDevice;
+    get(kid: string): E2eePeerDevice | null;
+    revoke(kid: string): boolean;
+    list(): E2eePeerDevice[];
+    private load;
+    private save;
+}

package/dist/server/modules/e2ee/services/e2ee-device-store.service.js

@@ -0,0 +1,138 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E2eeDeviceStoreService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const better_sqlite3_1 = require("drizzle-orm/better-sqlite3");
+const shared_1 = require("@devchain/shared");
+const db_provider_1 = require("../../storage/db/db.provider");
+const sqlite_raw_1 = require("../../storage/db/sqlite-raw");
+const logger_1 = require("../../../common/logging/logger");
+const logger = (0, logger_1.createLogger)('E2eeDeviceStore');
+const SETTINGS_KEY = 'cloud.e2ee.devices';
+const STORE_VERSION = 1;
+let E2eeDeviceStoreService = class E2eeDeviceStoreService {
+    constructor(db) {
+        this.db = db;
+        this.sqlite = (0, sqlite_raw_1.getRawSqliteClient)(this.db);
+    }
+    add(device) {
+        const dir = this.load();
+        const record = {
+            kid: device.kid,
+            publicKeyB64: device.publicKeyB64,
+            addedAt: device.addedAt ?? new Date().toISOString(),
+            trust: device.trust ?? 'unverified',
+            ...(device.adoptedVia !== undefined ? { adoptedVia: device.adoptedVia } : {}),
+            ...(device.verifiedVia !== undefined ? { verifiedVia: device.verifiedVia } : {}),
+            ...(device.verifiedAt !== undefined ? { verifiedAt: device.verifiedAt } : {}),
+            ...(device.label !== undefined ? { label: device.label } : {}),
+        };
+        dir.devices[record.kid] = record;
+        this.save(dir);
+        logger.info({ kid: record.kid, trust: record.trust }, 'Peer E2EE device public key added');
+        return record;
+    }
+    reconcile(incoming, now = new Date().toISOString()) {
+        const dir = this.load();
+        const existing = (dir.devices[incoming.kid] ?? null);
+        const prior = existing ??
+            Object.values(dir.devices).find((d) => d.publicKeyB64 === incoming.publicKeyB64) ??
+            null;
+        const reconciled = (0, shared_1.reconcilePeerKey)(prior, incoming, now);
+        const record = this.toDevice(reconciled);
+        dir.devices[record.kid] = record;
+        this.save(dir);
+        logger.info({ kid: record.kid, trust: record.trust, adoptedVia: record.adoptedVia }, 'Peer E2EE device reconciled (TOFU adopt / rotation)');
+        return record;
+    }
+    markVerified(kid, now = new Date().toISOString()) {
+        const dir = this.load();
+        const existing = dir.devices[kid];
+        if (!existing)
+            return null;
+        const record = this.toDevice((0, shared_1.markVerifiedViaSafetyNumber)(existing, now));
+        dir.devices[kid] = record;
+        this.save(dir);
+        logger.info({ kid }, 'Peer E2EE device marked VERIFIED via safety-number');
+        return record;
+    }
+    toDevice(rec) {
+        return {
+            kid: rec.kid,
+            publicKeyB64: rec.publicKeyB64,
+            addedAt: rec.addedAt,
+            trust: rec.trust,
+            ...(rec.adoptedVia !== undefined ? { adoptedVia: rec.adoptedVia } : {}),
+            ...(rec.verifiedVia !== undefined ? { verifiedVia: rec.verifiedVia } : {}),
+            ...(rec.verifiedAt !== undefined ? { verifiedAt: rec.verifiedAt } : {}),
+            ...(rec.label !== undefined ? { label: rec.label } : {}),
+        };
+    }
+    get(kid) {
+        return this.load().devices[kid] ?? null;
+    }
+    revoke(kid) {
+        const dir = this.load();
+        if (!dir.devices[kid])
+            return false;
+        delete dir.devices[kid];
+        this.save(dir);
+        logger.info({ kid }, 'Peer E2EE device public key revoked');
+        return true;
+    }
+    list() {
+        return Object.values(this.load().devices);
+    }
+    load() {
+        const row = this.sqlite
+            .prepare('SELECT value FROM settings WHERE key = ?')
+            .get(SETTINGS_KEY);
+        if (!row)
+            return { v: STORE_VERSION, devices: {} };
+        try {
+            const parsed = JSON.parse(row.value);
+            if (parsed.v !== STORE_VERSION || typeof parsed.devices !== 'object') {
+                logger.warn('E2EE device directory has unexpected shape — resetting');
+                return { v: STORE_VERSION, devices: {} };
+            }
+            for (const rec of Object.values(parsed.devices)) {
+                if (rec && typeof rec === 'object' && rec.trust === undefined) {
+                    rec.trust = 'unverified';
+                }
+            }
+            return parsed;
+        }
+        catch {
+            logger.warn('Failed to parse E2EE device directory — resetting');
+            return { v: STORE_VERSION, devices: {} };
+        }
+    }
+    save(dir) {
+        const now = new Date().toISOString();
+        this.sqlite
+            .prepare(`INSERT INTO settings (id, key, value, created_at, updated_at)
+         VALUES (?, ?, ?, ?, ?)
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+            .run((0, crypto_1.randomUUID)(), SETTINGS_KEY, JSON.stringify(dir), now, now);
+    }
+};
+exports.E2eeDeviceStoreService = E2eeDeviceStoreService;
+exports.E2eeDeviceStoreService = E2eeDeviceStoreService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(db_provider_1.DB_CONNECTION)),
+    __metadata("design:paramtypes", [better_sqlite3_1.BetterSQLite3Database])
+], E2eeDeviceStoreService);
+//# sourceMappingURL=e2ee-device-store.service.js.map

package/dist/server/modules/e2ee/services/e2ee-device-store.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-device-store.service.js","sourceRoot":"","sources":["../../../../src/modules/e2ee/services/e2ee-device-store.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAoC;AACpC,+DAAmE;AAEnE,6CAQ0B;AAC1B,8DAA6D;AAC7D,4DAAiE;AACjE,2DAA8D;AAE9D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,iBAAiB,CAAC,CAAC;AAE/C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAkC1C,MAAM,aAAa,GAAG,CAAC,CAAC;AAUjB,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAGjC,YAAoD,EAAyB;QAAzB,OAAE,GAAF,EAAE,CAAuB;QAC3E,IAAI,CAAC,MAAM,GAAG,IAAA,+BAAkB,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAOD,GAAG,CACD,MAGC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,MAAM,GAAmB;YAC7B,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnD,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;YACnC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,mCAAmC,CAAC,CAAC;QAC3F,OAAO,MAAM,CAAC;IAChB,CAAC;IAUD,SAAS,CAAC,QAAyB,EAAE,MAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,IAAI,CAA2B,CAAC;QAG/E,MAAM,KAAK,GACT,QAAQ;YACR,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,YAAY,CAAC;YAChF,IAAI,CAAC;QACP,MAAM,UAAU,GAAG,IAAA,yBAAgB,EAAC,KAA+B,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACzC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CACT,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EACvE,qDAAqD,CACtD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAMD,YAAY,CAAC,GAAW,EAAE,MAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAA,oCAA2B,EAAC,QAA2B,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5F,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,oDAAoD,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;IAGO,QAAQ,CAAC,GAAoB;QACnC,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;IACJ,CAAC;IAGD,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC;IAC1C,CAAC;IAGD,MAAM,CAAC,GAAW;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACpC,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC5D,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,IAAI;QACF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,IAAI;QACV,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,YAAY,CAAkC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAoB,CAAC;YACxD,IAAI,MAAM,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACrE,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;gBACtE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC3C,CAAC;YAGD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;oBAC9D,GAAG,CAAC,KAAK,GAAG,YAAY,CAAC;gBAC3B,CAAC;YACH,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,GAAoB;QAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;aACR,OAAO,CACN;;iGAEyF,CAC1F;aACA,GAAG,CAAC,IAAA,mBAAU,GAAE,EAAE,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;CACF,CAAA;AAnJY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAIE,WAAA,IAAA,eAAM,EAAC,2BAAa,CAAC,CAAA;qCAAsB,sCAAqB;GAHlE,sBAAsB,CAmJlC"}

package/dist/server/modules/e2ee/services/e2ee-keypair.service.d.ts

@@ -0,0 +1,21 @@
+import { BetterSQLite3Database } from 'drizzle-orm/better-sqlite3';
+import { type E2eeKeyPair } from '@devchain/shared';
+export interface E2eePublicKeyExport {
+    kid: string;
+    publicKeyB64: string;
+}
+export declare class E2eeKeypairService {
+    private readonly db;
+    private sqlite;
+    private encryptionKey;
+    private cache;
+    constructor(db: BetterSQLite3Database);
+    getOrCreate(): Promise<E2eeKeyPair>;
+    exportPublic(): Promise<E2eePublicKeyExport>;
+    private persist;
+    private retrieve;
+    private getEncryptionKey;
+    private getOrCreateSecret;
+    private encrypt;
+    private decrypt;
+}

package/dist/server/modules/e2ee/services/e2ee-keypair.service.js

@@ -0,0 +1,152 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E2eeKeypairService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+const better_sqlite3_1 = require("drizzle-orm/better-sqlite3");
+const shared_1 = require("@devchain/shared");
+const db_provider_1 = require("../../storage/db/db.provider");
+const sqlite_raw_1 = require("../../storage/db/sqlite-raw");
+const logger_1 = require("../../../common/logging/logger");
+const logger = (0, logger_1.createLogger)('E2eeKeypair');
+const SETTINGS_KEY = 'cloud.e2ee.keypair';
+const APP_SALT = Buffer.from('devchain-e2ee-keypair-store-v1-salt', 'utf8');
+const STORE_VERSION = 1;
+const SECRET_DIR = (0, path_1.join)((0, os_1.homedir)(), '.devchain', 'cloud');
+const SECRET_FILE = (0, path_1.join)(SECRET_DIR, 'secret.key');
+const SECRET_LENGTH = 32;
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const SCRYPT_COST = 16384;
+const SCRYPT_BLOCK_SIZE = 8;
+const SCRYPT_PARALLELIZATION = 1;
+let E2eeKeypairService = class E2eeKeypairService {
+    constructor(db) {
+        this.db = db;
+        this.encryptionKey = null;
+        this.cache = null;
+        this.sqlite = (0, sqlite_raw_1.getRawSqliteClient)(this.db);
+    }
+    async getOrCreate() {
+        if (this.cache)
+            return this.cache;
+        const stored = this.retrieve();
+        if (stored) {
+            this.cache = stored;
+            return stored;
+        }
+        const generated = (0, shared_1.generateX25519KeyPair)((n) => (0, crypto_1.randomBytes)(n));
+        this.persist(generated.privateKey);
+        this.cache = generated;
+        logger.info('Generated new X25519 E2EE keypair');
+        return generated;
+    }
+    async exportPublic() {
+        const kp = await this.getOrCreate();
+        return {
+            kid: kp.kid,
+            publicKeyB64: Buffer.from(kp.publicKey).toString('base64'),
+        };
+    }
+    persist(privateKey) {
+        const record = {
+            v: STORE_VERSION,
+            priv: Buffer.from(privateKey).toString('base64'),
+        };
+        const encrypted = this.encrypt(JSON.stringify(record));
+        const now = new Date().toISOString();
+        this.sqlite
+            .prepare(`INSERT INTO settings (id, key, value, created_at, updated_at)
+         VALUES (lower(hex(randomblob(16))), ?, ?, ?, ?)
+         ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`)
+            .run(SETTINGS_KEY, encrypted, now, now);
+    }
+    retrieve() {
+        const row = this.sqlite
+            .prepare('SELECT value FROM settings WHERE key = ?')
+            .get(SETTINGS_KEY);
+        if (!row)
+            return null;
+        try {
+            const record = JSON.parse(this.decrypt(row.value));
+            if (record.v !== STORE_VERSION || typeof record.priv !== 'string') {
+                logger.warn('E2EE keypair record has unexpected shape — will regenerate');
+                return null;
+            }
+            const privateKey = Buffer.from(record.priv, 'base64');
+            if (privateKey.length !== shared_1.X25519_PRIVATE_KEY_BYTES) {
+                logger.warn('E2EE private key has wrong byte length — will regenerate');
+                return null;
+            }
+            return (0, shared_1.fromX25519PrivateKey)(new Uint8Array(privateKey));
+        }
+        catch {
+            logger.warn('Failed to decrypt E2EE keypair — will regenerate');
+            return null;
+        }
+    }
+    getEncryptionKey() {
+        if (this.encryptionKey)
+            return this.encryptionKey;
+        const secret = this.getOrCreateSecret();
+        const machineComponent = Buffer.from(`${(0, os_1.hostname)()}:${(0, os_1.userInfo)().username}`, 'utf8');
+        const password = Buffer.concat([secret, machineComponent]);
+        this.encryptionKey = (0, crypto_1.scryptSync)(password, APP_SALT, KEY_LENGTH, {
+            N: SCRYPT_COST,
+            r: SCRYPT_BLOCK_SIZE,
+            p: SCRYPT_PARALLELIZATION,
+        });
+        return this.encryptionKey;
+    }
+    getOrCreateSecret() {
+        if ((0, fs_1.existsSync)(SECRET_FILE))
+            return (0, fs_1.readFileSync)(SECRET_FILE);
+        if (!(0, fs_1.existsSync)(SECRET_DIR))
+            (0, fs_1.mkdirSync)(SECRET_DIR, { recursive: true, mode: 0o700 });
+        const secret = (0, crypto_1.randomBytes)(SECRET_LENGTH);
+        (0, fs_1.writeFileSync)(SECRET_FILE, secret, { mode: 0o600 });
+        (0, fs_1.chmodSync)(SECRET_FILE, 0o600);
+        return secret;
+    }
+    encrypt(plaintext) {
+        const key = this.getEncryptionKey();
+        const iv = (0, crypto_1.randomBytes)(IV_LENGTH);
+        const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', key, iv, { authTagLength: AUTH_TAG_LENGTH });
+        const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+        const authTag = cipher.getAuthTag();
+        return Buffer.concat([iv, authTag, encrypted]).toString('base64');
+    }
+    decrypt(ciphertext) {
+        const key = this.getEncryptionKey();
+        const data = Buffer.from(ciphertext, 'base64');
+        const iv = data.subarray(0, IV_LENGTH);
+        const authTag = data.subarray(IV_LENGTH, IV_LENGTH + AUTH_TAG_LENGTH);
+        const encrypted = data.subarray(IV_LENGTH + AUTH_TAG_LENGTH);
+        const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', key, iv, { authTagLength: AUTH_TAG_LENGTH });
+        decipher.setAuthTag(authTag);
+        return decipher.update(encrypted) + decipher.final('utf8');
+    }
+};
+exports.E2eeKeypairService = E2eeKeypairService;
+exports.E2eeKeypairService = E2eeKeypairService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(db_provider_1.DB_CONNECTION)),
+    __metadata("design:paramtypes", [better_sqlite3_1.BetterSQLite3Database])
+], E2eeKeypairService);
+//# sourceMappingURL=e2ee-keypair.service.js.map

package/dist/server/modules/e2ee/services/e2ee-keypair.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2ee-keypair.service.js","sourceRoot":"","sources":["../../../../src/modules/e2ee/services/e2ee-keypair.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,mCAAmF;AACnF,2BAAmF;AACnF,+BAA4B;AAC5B,2BAAiD;AACjD,+DAAmE;AAEnE,6CAK0B;AAC1B,8DAA6D;AAC7D,4DAAiE;AACjE,2DAA8D;AAE9D,MAAM,MAAM,GAAG,IAAA,qBAAY,EAAC,aAAa,CAAC,CAAC;AAM3C,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAC1C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,qCAAqC,EAAE,MAAM,CAAC,CAAC;AAC5E,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;AACzD,MAAM,WAAW,GAAG,IAAA,WAAI,EAAC,UAAU,EAAE,YAAY,CAAC,CAAC;AACnD,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAC3B,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAC5B,MAAM,sBAAsB,GAAG,CAAC,CAAC;AA2B1B,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAK7B,YAAmC,EAA0C;QAAzB,OAAE,GAAF,EAAE,CAAuB;QAHrE,kBAAa,GAAkB,IAAI,CAAC;QACpC,UAAK,GAAuB,IAAI,CAAC;QAGvC,IAAI,CAAC,MAAM,GAAG,IAAA,+BAAkB,EAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5C,CAAC;IAMD,KAAK,CAAC,WAAW;QACf,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC;YACpB,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,8BAAqB,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,SAAS,CAAC;IACnB,CAAC;IAGD,KAAK,CAAC,YAAY;QAChB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO;YACL,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SAC3D,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,UAAsB;QACpC,MAAM,MAAM,GAAsB;YAChC,CAAC,EAAE,aAAa;YAChB,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACjD,CAAC;QACF,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;aACR,OAAO,CACN;;iGAEyF,CAC1F;aACA,GAAG,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAEO,QAAQ;QACd,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM;aACpB,OAAO,CAAC,0CAA0C,CAAC;aACnD,GAAG,CAAC,YAAY,CAAkC,CAAC;QACtD,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAsB,CAAC;YACxE,IAAI,MAAM,CAAC,CAAC,KAAK,aAAa,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAClE,MAAM,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;gBAC1E,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACtD,IAAI,UAAU,CAAC,MAAM,KAAK,iCAAwB,EAAE,CAAC;gBACnD,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,IAAA,6BAAoB,EAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAEO,gBAAgB;QACtB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,IAAA,aAAQ,GAAE,IAAI,IAAA,aAAQ,GAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;QACrF,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;YAC9D,CAAC,EAAE,WAAW;YACd,CAAC,EAAE,iBAAiB;YACpB,CAAC,EAAE,sBAAsB;SAC1B,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAA,eAAU,EAAC,WAAW,CAAC;YAAE,OAAO,IAAA,iBAAY,EAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC;YAAE,IAAA,cAAS,EAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrF,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,aAAa,CAAC,CAAC;QAC1C,IAAA,kBAAa,EAAC,WAAW,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAA,cAAS,EAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,SAAS,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACpC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACpE,CAAC;IAEO,OAAO,CAAC,UAAkB;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,aAAa,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9F,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7D,CAAC;CACF,CAAA;AApHY,gDAAkB;6BAAlB,kBAAkB;IAD9B,IAAA,mBAAU,GAAE;IAME,WAAA,IAAA,eAAM,EAAC,2BAAa,CAAC,CAAA;qCAAsB,sCAAqB;GALlE,kBAAkB,CAoH9B"}

package/dist/server/modules/e2ee/services/e2ee-pairing.service.d.ts

@@ -0,0 +1,28 @@
+import { type E2eeTrustStatus } from '@devchain/shared';
+import { E2eeKeypairService } from './e2ee-keypair.service';
+import { E2eeDeviceStoreService } from './e2ee-device-store.service';
+export interface BeginQrPairingResult {
+    pcEncPubKey: string;
+    pcEncKid: string;
+    pairingSecret: string;
+}
+export interface CompleteQrPairingInput {
+    channelId: string;
+    deviceEncPubKey: string;
+    deviceEncKid: string;
+    pairingMac: string;
+    label?: string;
+}
+export interface CompleteQrPairingResult {
+    kid: string;
+    trust: E2eeTrustStatus;
+}
+export declare class E2eePairingService {
+    private readonly keypair;
+    private readonly deviceStore;
+    private readonly pending;
+    constructor(keypair: E2eeKeypairService, deviceStore: E2eeDeviceStoreService);
+    beginQrPairing(channelId: string): Promise<BeginQrPairingResult>;
+    completeQrPairing(input: CompleteQrPairingInput): Promise<CompleteQrPairingResult>;
+    private evictExpired;
+}

package/dist/server/modules/e2ee/services/e2ee-pairing.service.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.E2eePairingService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const shared_1 = require("@devchain/shared");
+const error_types_1 = require("../../../common/errors/error-types");
+const logger_1 = require("../../../common/logging/logger");
+const e2ee_keypair_service_1 = require("./e2ee-keypair.service");
+const e2ee_device_store_service_1 = require("./e2ee-device-store.service");
+const logger = (0, logger_1.createLogger)('E2eePairing');
+const PENDING_TTL_MS = 5 * 60 * 1000;
+let E2eePairingService = class E2eePairingService {
+    constructor(keypair, deviceStore) {
+        this.keypair = keypair;
+        this.deviceStore = deviceStore;
+        this.pending = new Map();
+    }
+    async beginQrPairing(channelId) {
+        if (!channelId)
+            throw new error_types_1.ValidationError('channelId is required');
+        this.evictExpired();
+        const pub = await this.keypair.exportPublic();
+        const secret = Uint8Array.from((0, crypto_1.randomBytes)(shared_1.PAIRING_SECRET_BYTES));
+        this.pending.set(channelId, { secret, createdAt: Date.now() });
+        return {
+            pcEncPubKey: pub.publicKeyB64,
+            pcEncKid: pub.kid,
+            pairingSecret: (0, shared_1.bytesToBase64)(secret),
+        };
+    }
+    async completeQrPairing(input) {
+        this.evictExpired();
+        const pending = this.pending.get(input.channelId);
+        if (!pending) {
+            throw new error_types_1.NotFoundError('Pairing session', input.channelId);
+        }
+        if (!input.deviceEncPubKey || !input.deviceEncKid || !input.pairingMac) {
+            throw new error_types_1.ValidationError('deviceEncPubKey, deviceEncKid and pairingMac are required');
+        }
+        let devicePublicKey;
+        let mac;
+        try {
+            devicePublicKey = (0, shared_1.base64ToBytes)(input.deviceEncPubKey);
+            mac = (0, shared_1.base64ToBytes)(input.pairingMac);
+        }
+        catch {
+            throw new error_types_1.ValidationError('deviceEncPubKey / pairingMac are not valid base64');
+        }
+        if (devicePublicKey.length !== shared_1.X25519_PUBLIC_KEY_BYTES) {
+            throw new error_types_1.ValidationError(`deviceEncPubKey must decode to ${shared_1.X25519_PUBLIC_KEY_BYTES} bytes`);
+        }
+        if ((0, shared_1.deriveKid)(devicePublicKey) !== input.deviceEncKid) {
+            this.pending.delete(input.channelId);
+            logger.warn({ channelId: input.channelId, suppliedKid: input.deviceEncKid }, 'E2EE QR pairing rejected — deviceEncKid does not match deviceEncPubKey (possible substitution)');
+            throw new error_types_1.ForbiddenError('E2EE pairing verification failed');
+        }
+        const pc = await this.keypair.getOrCreate();
+        const transcript = (0, shared_1.buildPairingTranscript)({
+            pcPublicKey: pc.publicKey,
+            pcKid: pc.kid,
+            mobilePublicKey: devicePublicKey,
+            mobileKid: input.deviceEncKid,
+            channelId: input.channelId,
+        });
+        if (!(0, shared_1.verifyPairingMac)(pending.secret, transcript, mac)) {
+            this.pending.delete(input.channelId);
+            logger.warn({ channelId: input.channelId, deviceKid: input.deviceEncKid }, 'E2EE QR pairing MAC verification failed — rejecting (possible key-substituting relay)');
+            throw new error_types_1.ForbiddenError('E2EE pairing verification failed');
+        }
+        (0, shared_1.deriveSharedKey)(pc.privateKey, devicePublicKey);
+        const record = this.deviceStore.add({
+            kid: input.deviceEncKid,
+            publicKeyB64: input.deviceEncPubKey,
+            trust: 'verified',
+            verifiedVia: 'qr',
+            verifiedAt: new Date().toISOString(),
+            ...(input.label !== undefined ? { label: input.label } : {}),
+        });
+        this.pending.delete(input.channelId);
+        logger.info({ channelId: input.channelId, deviceKid: record.kid }, 'E2EE QR pairing verified — peer device marked VERIFIED');
+        return { kid: record.kid, trust: record.trust };
+    }
+    evictExpired() {
+        const cutoff = Date.now() - PENDING_TTL_MS;
+        for (const [channelId, entry] of this.pending) {
+            if (entry.createdAt < cutoff)
+                this.pending.delete(channelId);
+        }
+    }
+};
+exports.E2eePairingService = E2eePairingService;
+exports.E2eePairingService = E2eePairingService = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [e2ee_keypair_service_1.E2eeKeypairService,
+        e2ee_device_store_service_1.E2eeDeviceStoreService])
+], E2eePairingService);
+//# sourceMappingURL=e2ee-pairing.service.js.map