dscs-server 0.0.0-stage → 0.0.1

package/dist/vault.js

@@ -0,0 +1,147 @@
+import { readFileSync } from 'node:fs';
+import { SyncError } from './shared/wire.js';
+import { assertVaultRecordRef, vaultRecordHashOf } from './shared/vault.js';
+import { blobPath } from './blobs.js';
+import { DEFAULT_DATASET, bumpRevision, readRevision, withTransaction } from './db.js';
+import { requireLease, vaultResource } from './leases.js';
+export const MAX_VAULT_RECORD_BYTES = 1024 * 1024;
+const HASH_PATTERN = /^[0-9a-f]{64}$/u;
+const KEY_ID_PATTERN = /^[0-9a-f]{16}$/u;
+function viewOf(row) {
+    let sealed;
+    try {
+        sealed = JSON.parse(row.sealed_json);
+    } catch  {
+        throw new SyncError('bad-request', 'Vault sealed_json 损坏');
+    }
+    const ref = {
+        v: 1,
+        writer: row.writer,
+        seq: row.seq,
+        prevHash: row.prev_hash,
+        blobSha256: row.blob_sha256,
+        bytes: row.bytes,
+        createdAt: row.created_at,
+        sealed,
+        recordHash: row.record_hash
+    };
+    assertVaultRecordRef(ref);
+    return {
+        ...ref,
+        revision: row.revision
+    };
+}
+function lastRow(db, writer) {
+    return db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? ORDER BY seq DESC LIMIT 1').get(DEFAULT_DATASET, writer);
+}
+function rowAt(db, writer, seq) {
+    return db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? AND seq = ?').get(DEFAULT_DATASET, writer, seq);
+}
+function validateInput(input) {
+    if (input.writer !== input.deviceId) throw new SyncError('bad-request', 'writer 必须等于当前 deviceId');
+    if (!Number.isSafeInteger(input.seq) || input.seq < 1) throw new SyncError('bad-request', 'Vault seq 必须是正整数');
+    if (!Number.isSafeInteger(input.createdAt) || input.createdAt < 0) throw new SyncError('bad-request', 'Vault createdAt 非法');
+    if (!HASH_PATTERN.test(input.blobSha256)) throw new SyncError('bad-request', 'Vault blobSha256 非法');
+    if (!Number.isSafeInteger(input.bytes) || input.bytes <= 0 || input.bytes > MAX_VAULT_RECORD_BYTES) {
+        throw new SyncError('bad-request', 'Vault bytes 非法或超过 1 MiB');
+    }
+    if (input.sealed === null || typeof input.sealed !== 'object') throw new SyncError('bad-request', 'Vault sealed 非法');
+    if (input.sealed.formatVersion !== 1) throw new SyncError('bad-request', 'Vault sealed.formatVersion 必须是 1');
+    if (!KEY_ID_PATTERN.test(input.sealed.keyId)) throw new SyncError('bad-request', 'Vault sealed.keyId 非法');
+    if (input.seq === 1 && input.prevHash !== null) throw new SyncError('bad-request', 'Vault seq=1 的 prevHash 必须为 null');
+    if (input.seq > 1 && (input.prevHash === null || !HASH_PATTERN.test(input.prevHash))) {
+        throw new SyncError('bad-request', 'Vault prevHash 非法');
+    }
+    const fields = {
+        v: 1,
+        writer: input.writer,
+        seq: input.seq,
+        prevHash: input.prevHash,
+        blobSha256: input.blobSha256,
+        bytes: input.bytes,
+        createdAt: input.createdAt,
+        sealed: {
+            formatVersion: input.sealed.formatVersion,
+            keyId: input.sealed.keyId
+        }
+    };
+    const ref = {
+        ...fields,
+        recordHash: vaultRecordHashOf(fields)
+    };
+    assertVaultRecordRef(ref);
+    return ref;
+}
+function sameRow(row, ref) {
+    return row.prev_hash === ref.prevHash && row.blob_sha256 === ref.blobSha256 && row.bytes === ref.bytes && row.created_at === ref.createdAt && row.record_hash === ref.recordHash && row.sealed_json === JSON.stringify(ref.sealed);
+}
+export function appendVaultRecord(db, dataDir, input, now = Date.now()) {
+    const ref = validateInput(input);
+    const existing = rowAt(db, input.writer, input.seq);
+    if (existing !== undefined) {
+        if (sameRow(existing, ref)) return {
+            record: viewOf(existing),
+            dedup: true
+        };
+        throw new SyncError('conflict', `Vault writer ${input.writer} 的 seq ${input.seq} 已有不同内容`);
+    }
+    return withTransaction(db, ()=>{
+        requireLease(db, vaultResource(input.writer), input.deviceId, input.clientId, now);
+        const raced = rowAt(db, input.writer, input.seq);
+        if (raced !== undefined) {
+            if (sameRow(raced, ref)) return {
+                record: viewOf(raced),
+                dedup: true
+            };
+            throw new SyncError('conflict', `Vault writer ${input.writer} 的 seq ${input.seq} 已有不同内容`);
+        }
+        const last = lastRow(db, input.writer);
+        if (last === undefined) {
+            if (ref.seq !== 1 || ref.prevHash !== null) throw new SyncError('conflict', 'Vault 首条必须从 seq=1 / prevHash=null 开始');
+        } else {
+            if (ref.seq !== last.seq + 1) throw new SyncError('conflict', `Vault 下一条 seq 应为 ${last.seq + 1}`);
+            if (ref.prevHash !== last.record_hash) throw new SyncError('conflict', 'Vault prevHash 与当前链不匹配');
+        }
+        let blob;
+        try {
+            blob = readBlobSync(dataDir, ref.blobSha256);
+        } catch  {
+            throw new SyncError('bad-request', `Vault blob 尚未上传：${ref.blobSha256}`);
+        }
+        if (blob.length !== ref.bytes) throw new SyncError('bad-request', 'Vault blob 字节数与索引不一致');
+        const revision = bumpRevision(db);
+        db.handle.prepare('INSERT INTO vault_records (dataset, writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(DEFAULT_DATASET, ref.writer, ref.seq, ref.prevHash, ref.blobSha256, ref.bytes, ref.createdAt, JSON.stringify(ref.sealed), ref.recordHash, revision);
+        return {
+            record: {
+                ...ref,
+                revision
+            },
+            dedup: false
+        };
+    });
+}
+function readBlobSync(dataDir, sha256) {
+    return readFileSync(blobPath(dataDir, sha256));
+}
+export function readVaultCursor(db, since, limit) {
+    const rows = db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND revision > ? ORDER BY revision ASC LIMIT ?').all(DEFAULT_DATASET, since, limit + 1);
+    return {
+        revision: readRevision(db),
+        records: rows.slice(0, limit).map(viewOf),
+        hasMore: rows.length > limit
+    };
+}
+export function readVaultStream(db, writer, from, limit) {
+    const rows = db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? AND seq >= ? ORDER BY seq ASC LIMIT ?').all(DEFAULT_DATASET, writer, from, limit + 1);
+    return {
+        writer,
+        records: rows.slice(0, limit).map(viewOf),
+        hasMore: rows.length > limit
+    };
+}
+export function validVaultWriter(writer) {
+    return /^[A-Za-z0-9._:-]{1,128}$/u.test(writer);
+}
+
+
+//# sourceURL=vault.ts

package/package.json

@@ -1,6 +1,24 @@
 {
   "name": "dscs-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.0.1",
+  "private": false,
+  "type": "module",
+  "description": "DSH Session CloudSync self-hosted server.",
+  "license": "AGPL-3.0-only",
+  "bin": {
+    "dscs-server": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "web",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "prepack": "node scripts/build.mjs"
+  },
+  "engines": {
+    "node": ">=24"
+  }
+}