dscs-server 0.0.0-stage → 0.1.0

package/dist/shared/sealed-frame.js

@@ -0,0 +1,155 @@
+import { zstdCompressSync, zstdDecompressSync } from 'node:zlib';
+import { createCipheriv, createDecipheriv } from 'node:crypto';
+import { deriveSubkey, sha256, TAG_BYTES, KEY_BYTES, NONCE_BYTES } from './crypto.js';
+export const SEALED_MAGIC = Buffer.from('DSHF', 'ascii');
+export const SEALED_VERSION = 1;
+export const SEALED_VERSION_ZSTD = 2;
+export const KEY_ID_BYTES = 8;
+export const SEALED_HEADER_BYTES = 4 + 1 + 1 + KEY_ID_BYTES + NONCE_BYTES;
+const FIXED_NONCE = Buffer.alloc(NONCE_BYTES);
+export function sessionKeyOf(master, sessionId) {
+    return deriveSubkey(master, `v1|session:${sessionId}`);
+}
+export function frameKeyOf(sessionKey, chainHash, compression = 'none', compressedHash) {
+    if (compression === 'zstd') {
+        if (compressedHash === undefined || !/^[0-9a-f]{64}$/u.test(compressedHash)) {
+            throw new Error('zstd 帧缺少合法的 compressedHash');
+        }
+        return deriveSubkey(sessionKey, `v2|frame:zstd:${compressedHash}:${chainHash}`);
+    }
+    return deriveSubkey(sessionKey, `v1|frame:${chainHash}`);
+}
+export function keyIdOf(sessionKey) {
+    return deriveSubkey(sessionKey, 'v1|key-id').subarray(0, KEY_ID_BYTES);
+}
+const SEQ_HEADER = 0xffffffff;
+function buildAad(header, position) {
+    const session = Buffer.from(position.sessionId, 'utf8');
+    if (session.length > 0xffff) throw new Error('会话 id 过长，AAD 无法编码');
+    const tail = Buffer.alloc(2 + session.length + 8 + 4 + 4 + 32);
+    tail.writeUInt16BE(session.length, 0);
+    session.copy(tail, 2);
+    let offset = 2 + session.length;
+    tail.writeBigUInt64BE(BigInt(position.index), offset);
+    offset += 8;
+    tail.writeUInt32BE(position.seqFrom < 0 ? SEQ_HEADER : position.seqFrom, offset);
+    offset += 4;
+    tail.writeUInt32BE(position.seqTo < 0 ? SEQ_HEADER : position.seqTo, offset);
+    offset += 4;
+    Buffer.from(position.chainHash, 'hex').copy(tail, offset);
+    return Buffer.concat([
+        header,
+        tail
+    ]);
+}
+export function sealFrame(plain, position, sessionKey, options = {}) {
+    if (sessionKey.length !== KEY_BYTES) throw new Error(`会话密钥必须是 ${KEY_BYTES} 字节`);
+    if (!Number.isSafeInteger(position.index) || position.index < 0) throw new Error('帧下标必须是非负整数');
+    const compression = options.compression ?? 'none';
+    const chainHash = sha256(plain);
+    const payload = compression === 'zstd' ? zstdCompressSync(plain) : plain;
+    const compressedHash = compression === 'zstd' ? sha256(payload) : undefined;
+    const frameKey = frameKeyOf(sessionKey, chainHash, compression, compressedHash);
+    const keyId = keyIdOf(sessionKey);
+    const version = compression === 'zstd' ? SEALED_VERSION_ZSTD : SEALED_VERSION;
+    const header = Buffer.alloc(SEALED_HEADER_BYTES);
+    SEALED_MAGIC.copy(header, 0);
+    header.writeUInt8(version, 4);
+    header.writeUInt8(0, 5);
+    keyId.copy(header, 6);
+    FIXED_NONCE.copy(header, 14);
+    const aad = buildAad(header, {
+        ...position,
+        chainHash
+    });
+    const cipher = createCipheriv('aes-256-gcm', frameKey, FIXED_NONCE);
+    cipher.setAAD(aad);
+    const body = Buffer.concat([
+        cipher.update(payload),
+        cipher.final()
+    ]);
+    const bytes = Buffer.concat([
+        header,
+        body,
+        cipher.getAuthTag()
+    ]);
+    return {
+        bytes,
+        ref: {
+            index: position.index,
+            chainHash,
+            blobSha256: sha256(bytes),
+            bytes: bytes.length,
+            sealedVersion: version,
+            keyId: keyId.toString('hex'),
+            seqFrom: position.seqFrom,
+            seqTo: position.seqTo,
+            ...compression === 'zstd' ? {
+                compression: 'zstd',
+                compressedHash: compressedHash
+            } : {}
+        }
+    };
+}
+export function parseSealedHeader(sealed) {
+    if (sealed.length < SEALED_HEADER_BYTES + TAG_BYTES) throw new Error('封帧字节被截断');
+    if (!sealed.subarray(0, 4).equals(SEALED_MAGIC)) throw new Error('不是 DSHF 封帧');
+    const version = sealed.readUInt8(4);
+    if (version !== SEALED_VERSION && version !== SEALED_VERSION_ZSTD) {
+        throw new Error(`不支持的封帧版本：${version}`);
+    }
+    return {
+        version,
+        flags: sealed.readUInt8(5),
+        keyId: sealed.subarray(6, 6 + KEY_ID_BYTES),
+        nonce: sealed.subarray(14, 14 + NONCE_BYTES)
+    };
+}
+export function openSealedFrame(sealed, position, sessionKey) {
+    const header = parseSealedHeader(sealed);
+    const expectedKeyId = keyIdOf(sessionKey);
+    if (!header.keyId.equals(expectedKeyId)) {
+        throw new Error('封帧的 keyId 与当前密钥不符（请确认各设备同步口令、服务端地址与 salt 一致）');
+    }
+    const compression = header.version === SEALED_VERSION_ZSTD ? 'zstd' : 'none';
+    if (compression === 'zstd') {
+        if (position.compression !== 'zstd' || position.compressedHash === undefined) {
+            throw new Error('zstd 封帧缺少压缩元数据');
+        }
+    } else if (position.compression !== undefined || position.compressedHash !== undefined) {
+        throw new Error('未压缩封帧不应带压缩元数据');
+    }
+    const headerBytes = sealed.subarray(0, SEALED_HEADER_BYTES);
+    const aad = buildAad(headerBytes, position);
+    const body = sealed.subarray(SEALED_HEADER_BYTES, sealed.length - TAG_BYTES);
+    const tag = sealed.subarray(sealed.length - TAG_BYTES);
+    const frameKey = frameKeyOf(sessionKey, position.chainHash, compression, position.compressedHash);
+    const decipher = createDecipheriv('aes-256-gcm', frameKey, header.nonce);
+    decipher.setAAD(aad);
+    decipher.setAuthTag(tag);
+    let payload;
+    try {
+        payload = Buffer.concat([
+            decipher.update(body),
+            decipher.final()
+        ]);
+    } catch  {
+        throw new Error('封帧认证失败（密文、AAD 或密钥不匹配）');
+    }
+    if (compression === 'zstd') {
+        if (sha256(payload) !== position.compressedHash) throw new Error('压缩明文哈希与清单不符');
+        let plain;
+        try {
+            plain = zstdDecompressSync(payload);
+        } catch  {
+            throw new Error('zstd 解压失败');
+        }
+        if (sha256(plain) !== position.chainHash) throw new Error('解压后的明文哈希与清单不符');
+        return plain;
+    }
+    if (sha256(payload) !== position.chainHash) throw new Error('明文哈希与清单不符');
+    return payload;
+}
+
+
+//# sourceURL=sealed-frame.ts

package/dist/shared/vault.js

@@ -0,0 +1,210 @@
+import { createCipheriv, createDecipheriv, createHmac } from 'node:crypto';
+import { stableStringify } from './chain.js';
+import { deriveSubkey, KEY_BYTES, NONCE_BYTES, sha256, TAG_BYTES } from './crypto.js';
+export const VAULT_SCHEMA = 'dsh-session-cloudsync/vault/1';
+export const VAULT_FORMAT_VERSION = 1;
+export const VAULT_KEY_ID_BYTES = 8;
+export const WORKSPACE_KEY_CHARS = 24;
+export const VAULT_GENESIS_HASH = null;
+const FIXED_NONCE = Buffer.alloc(NONCE_BYTES);
+const HASH_PATTERN = /^[0-9a-f]{64}$/u;
+const KEY_ID_PATTERN = /^[0-9a-f]{16}$/u;
+const KIND_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/u;
+export function vaultKeyOf(master) {
+    assertKey(master, 'masterKey');
+    return deriveSubkey(master, 'dsh-sync/vault/v1');
+}
+export function vaultKeyIdOf(vaultKey) {
+    assertKey(vaultKey, 'vaultKey');
+    return deriveSubkey(vaultKey, 'v1|key-id').subarray(0, VAULT_KEY_ID_BYTES).toString('hex');
+}
+export function workspaceKeyOf(vaultKey, canonicalPath) {
+    assertKey(vaultKey, 'vaultKey');
+    if (canonicalPath.trim() === '') throw new Error('canonical workspace path 不能为空');
+    return createHmac('sha256', vaultKey).update(`workspace|${canonicalPath}`, 'utf8').digest('base64url').slice(0, WORKSPACE_KEY_CHARS);
+}
+export function sealVaultRecord(input) {
+    assertKey(input.vaultKey, 'vaultKey');
+    assertWriter(input.writer);
+    assertSeq(input.seq);
+    assertPrevHash(input.seq, input.prevHash);
+    assertTimestamp(input.createdAt, 'createdAt');
+    assertKind(input.kind);
+    assertEntity(input.entity);
+    assertTimestamp(input.at, 'at');
+    if (input.data === undefined) throw new Error('Vault data 不能是 undefined');
+    const payload = {
+        schema: VAULT_SCHEMA,
+        kind: input.kind,
+        entity: input.entity,
+        at: input.at,
+        data: input.data
+    };
+    const plain = Buffer.from(stableStringify(payload), 'utf8');
+    const keyId = vaultKeyIdOf(input.vaultKey);
+    const key = recordKeyOf(input.vaultKey, input.writer, input.seq);
+    const aad = aadOf(input.writer, input.seq, input.prevHash, VAULT_SCHEMA);
+    const cipher = createCipheriv('aes-256-gcm', key, FIXED_NONCE);
+    cipher.setAAD(aad);
+    const body = Buffer.concat([
+        cipher.update(plain),
+        cipher.final()
+    ]);
+    const bytes = Buffer.concat([
+        body,
+        cipher.getAuthTag()
+    ]);
+    const sealed = {
+        formatVersion: VAULT_FORMAT_VERSION,
+        keyId
+    };
+    const blobSha256 = sha256(bytes);
+    const ref = {
+        v: VAULT_FORMAT_VERSION,
+        writer: input.writer,
+        seq: input.seq,
+        prevHash: input.prevHash,
+        blobSha256,
+        bytes: bytes.length,
+        createdAt: input.createdAt,
+        sealed,
+        recordHash: vaultRecordHashOf({
+            v: VAULT_FORMAT_VERSION,
+            writer: input.writer,
+            seq: input.seq,
+            prevHash: input.prevHash,
+            blobSha256,
+            bytes: bytes.length,
+            createdAt: input.createdAt,
+            sealed
+        })
+    };
+    return {
+        ref,
+        bytes
+    };
+}
+export function openVaultRecord(record, vaultKey) {
+    assertKey(vaultKey, 'vaultKey');
+    assertVaultRecordRef(record.ref);
+    if (!Buffer.isBuffer(record.bytes)) throw new Error('Vault 密文必须是 Buffer');
+    if (record.bytes.length !== record.ref.bytes) throw new Error('Vault 密文字节数与索引不一致');
+    if (sha256(record.bytes) !== record.ref.blobSha256) throw new Error('Vault 密文哈希与索引不一致');
+    if (vaultKeyIdOf(vaultKey) !== record.ref.sealed.keyId) throw new Error('Vault keyId 不匹配');
+    const key = recordKeyOf(vaultKey, record.ref.writer, record.ref.seq);
+    if (record.bytes.length < TAG_BYTES) throw new Error('Vault 密文过短');
+    const body = record.bytes.subarray(0, record.bytes.length - TAG_BYTES);
+    const tag = record.bytes.subarray(record.bytes.length - TAG_BYTES);
+    const decipher = createDecipheriv('aes-256-gcm', key, FIXED_NONCE);
+    decipher.setAAD(aadOf(record.ref.writer, record.ref.seq, record.ref.prevHash, VAULT_SCHEMA));
+    decipher.setAuthTag(tag);
+    let parsed;
+    try {
+        const plain = Buffer.concat([
+            decipher.update(body),
+            decipher.final()
+        ]);
+        parsed = JSON.parse(plain.toString('utf8'));
+    } catch (error) {
+        throw new Error(`Vault 记录解密失败：${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error('Vault 载荷不是对象');
+    const payload = parsed;
+    if (payload['schema'] !== VAULT_SCHEMA) throw new Error(`未知 Vault schema：${String(payload['schema'])}`);
+    if (typeof payload['kind'] !== 'string' || !KIND_PATTERN.test(payload['kind'])) throw new Error('Vault kind 非法');
+    if (typeof payload['entity'] !== 'string' || payload['entity'].trim() === '') throw new Error('Vault entity 非法');
+    if (!Number.isSafeInteger(payload['at'])) throw new Error('Vault at 非法');
+    if (payload['data'] === undefined) throw new Error('Vault data 缺失');
+    return {
+        schema: payload['schema'],
+        kind: payload['kind'],
+        entity: payload['entity'],
+        at: payload['at'],
+        data: payload['data']
+    };
+}
+export function assertVaultRecordRef(ref) {
+    if (ref.v !== VAULT_FORMAT_VERSION) throw new Error(`Vault 记录版本非法：${String(ref.v)}`);
+    assertWriter(ref.writer);
+    assertSeq(ref.seq);
+    assertPrevHash(ref.seq, ref.prevHash);
+    if (!HASH_PATTERN.test(ref.blobSha256)) throw new Error('Vault blobSha256 非法');
+    if (!Number.isSafeInteger(ref.bytes) || ref.bytes <= 0) throw new Error('Vault bytes 非法');
+    assertTimestamp(ref.createdAt, 'createdAt');
+    if (ref.sealed === null || typeof ref.sealed !== 'object') throw new Error('Vault sealed 非法');
+    if (ref.sealed.formatVersion !== VAULT_FORMAT_VERSION) throw new Error('Vault sealed.formatVersion 非法');
+    if (!KEY_ID_PATTERN.test(ref.sealed.keyId)) throw new Error('Vault sealed.keyId 非法');
+    if (!HASH_PATTERN.test(ref.recordHash)) throw new Error('Vault recordHash 非法');
+    const expected = vaultRecordHashOf(ref);
+    if (expected !== ref.recordHash) throw new Error('Vault recordHash 与索引内容不一致');
+}
+export function verifyVaultChain(records) {
+    let previous;
+    records.forEach((ref, index)=>{
+        const expectedSeq = index + 1;
+        if (ref.seq !== expectedSeq) throw new Error(`Vault seq 应为 ${expectedSeq}，实际是 ${ref.seq}`);
+        assertVaultRecordRef(ref);
+        if (previous === undefined) {
+            if (ref.prevHash !== VAULT_GENESIS_HASH) throw new Error('Vault 链首条记录的 prevHash 必须为 null');
+        } else {
+            if (ref.writer !== previous.writer) throw new Error('Vault 链混用了不同 writer');
+            if (ref.prevHash !== previous.recordHash) throw new Error(`Vault 第 ${ref.seq} 条的 prevHash 不匹配`);
+        }
+        previous = ref;
+    });
+}
+function recordKeyOf(vaultKey, writer, seq) {
+    return deriveSubkey(vaultKey, `v1|vault-record:${writer}:${seq}`);
+}
+function aadOf(writer, seq, prevHash, schema) {
+    return Buffer.from(stableStringify({
+        v: VAULT_FORMAT_VERSION,
+        writer,
+        seq,
+        prevHash,
+        schema
+    }), 'utf8');
+}
+export function vaultRecordHashOf(ref) {
+    return sha256(stableStringify({
+        v: ref.v,
+        writer: ref.writer,
+        seq: ref.seq,
+        prevHash: ref.prevHash,
+        blobSha256: ref.blobSha256,
+        bytes: ref.bytes,
+        createdAt: ref.createdAt,
+        sealed: ref.sealed
+    }));
+}
+function assertKey(key, name) {
+    if (!Buffer.isBuffer(key) || key.length !== KEY_BYTES) throw new Error(`${name} 必须是 ${KEY_BYTES} 字节`);
+}
+function assertWriter(writer) {
+    if (typeof writer !== 'string' || writer.length === 0 || writer.length > 128) throw new Error('Vault writer 非法');
+    for (const character of writer){
+        if (character.charCodeAt(0) < 0x21 || character.charCodeAt(0) > 0x7e) throw new Error('Vault writer 含非法字符');
+    }
+}
+function assertSeq(seq) {
+    if (!Number.isSafeInteger(seq) || seq < 1) throw new Error('Vault seq 必须是正整数');
+}
+function assertPrevHash(seq, prevHash) {
+    if (seq === 1) {
+        if (prevHash !== VAULT_GENESIS_HASH) throw new Error('Vault seq=1 的 prevHash 必须为 null');
+        return;
+    }
+    if (prevHash === null || !HASH_PATTERN.test(prevHash)) throw new Error('Vault prevHash 非法');
+}
+function assertTimestamp(value, name) {
+    if (!Number.isSafeInteger(value) || value < 0) throw new Error(`Vault ${name} 非法`);
+}
+function assertKind(kind) {
+    if (typeof kind !== 'string' || !KIND_PATTERN.test(kind)) throw new Error('Vault kind 非法');
+}
+function assertEntity(entity) {
+    if (typeof entity !== 'string' || entity.trim() === '' || entity.length > 512) throw new Error('Vault entity 非法');
+}
+
+
+//# sourceURL=vault.ts

package/dist/shared/wire.js

@@ -0,0 +1,25 @@
+export const ERROR_STATUS = {
+    unauthorized: 401,
+    'bad-request': 400,
+    'not-found': 404,
+    conflict: 409,
+    diverged: 409,
+    'lease-held': 409,
+    gone: 410,
+    quota: 507,
+    'rate-limited': 429
+};
+export function statusOf(code) {
+    return ERROR_STATUS[code];
+}
+export class SyncError extends Error {
+    code;
+    constructor(code, message){
+        super(message);
+        this.name = 'SyncError';
+        this.code = code;
+    }
+}
+
+
+//# sourceURL=wire.ts

package/dist/vault.js

@@ -0,0 +1,147 @@
+import { readFileSync } from 'node:fs';
+import { SyncError } from './shared/wire.js';
+import { assertVaultRecordRef, vaultRecordHashOf } from './shared/vault.js';
+import { blobPath } from './blobs.js';
+import { DEFAULT_DATASET, bumpRevision, readRevision, withTransaction } from './db.js';
+import { requireLease, vaultResource } from './leases.js';
+export const MAX_VAULT_RECORD_BYTES = 1024 * 1024;
+const HASH_PATTERN = /^[0-9a-f]{64}$/u;
+const KEY_ID_PATTERN = /^[0-9a-f]{16}$/u;
+function viewOf(row) {
+    let sealed;
+    try {
+        sealed = JSON.parse(row.sealed_json);
+    } catch  {
+        throw new SyncError('bad-request', 'Vault sealed_json 损坏');
+    }
+    const ref = {
+        v: 1,
+        writer: row.writer,
+        seq: row.seq,
+        prevHash: row.prev_hash,
+        blobSha256: row.blob_sha256,
+        bytes: row.bytes,
+        createdAt: row.created_at,
+        sealed,
+        recordHash: row.record_hash
+    };
+    assertVaultRecordRef(ref);
+    return {
+        ...ref,
+        revision: row.revision
+    };
+}
+function lastRow(db, writer) {
+    return db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? ORDER BY seq DESC LIMIT 1').get(DEFAULT_DATASET, writer);
+}
+function rowAt(db, writer, seq) {
+    return db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? AND seq = ?').get(DEFAULT_DATASET, writer, seq);
+}
+function validateInput(input) {
+    if (input.writer !== input.deviceId) throw new SyncError('bad-request', 'writer 必须等于当前 deviceId');
+    if (!Number.isSafeInteger(input.seq) || input.seq < 1) throw new SyncError('bad-request', 'Vault seq 必须是正整数');
+    if (!Number.isSafeInteger(input.createdAt) || input.createdAt < 0) throw new SyncError('bad-request', 'Vault createdAt 非法');
+    if (!HASH_PATTERN.test(input.blobSha256)) throw new SyncError('bad-request', 'Vault blobSha256 非法');
+    if (!Number.isSafeInteger(input.bytes) || input.bytes <= 0 || input.bytes > MAX_VAULT_RECORD_BYTES) {
+        throw new SyncError('bad-request', 'Vault bytes 非法或超过 1 MiB');
+    }
+    if (input.sealed === null || typeof input.sealed !== 'object') throw new SyncError('bad-request', 'Vault sealed 非法');
+    if (input.sealed.formatVersion !== 1) throw new SyncError('bad-request', 'Vault sealed.formatVersion 必须是 1');
+    if (!KEY_ID_PATTERN.test(input.sealed.keyId)) throw new SyncError('bad-request', 'Vault sealed.keyId 非法');
+    if (input.seq === 1 && input.prevHash !== null) throw new SyncError('bad-request', 'Vault seq=1 的 prevHash 必须为 null');
+    if (input.seq > 1 && (input.prevHash === null || !HASH_PATTERN.test(input.prevHash))) {
+        throw new SyncError('bad-request', 'Vault prevHash 非法');
+    }
+    const fields = {
+        v: 1,
+        writer: input.writer,
+        seq: input.seq,
+        prevHash: input.prevHash,
+        blobSha256: input.blobSha256,
+        bytes: input.bytes,
+        createdAt: input.createdAt,
+        sealed: {
+            formatVersion: input.sealed.formatVersion,
+            keyId: input.sealed.keyId
+        }
+    };
+    const ref = {
+        ...fields,
+        recordHash: vaultRecordHashOf(fields)
+    };
+    assertVaultRecordRef(ref);
+    return ref;
+}
+function sameRow(row, ref) {
+    return row.prev_hash === ref.prevHash && row.blob_sha256 === ref.blobSha256 && row.bytes === ref.bytes && row.created_at === ref.createdAt && row.record_hash === ref.recordHash && row.sealed_json === JSON.stringify(ref.sealed);
+}
+export function appendVaultRecord(db, dataDir, input, now = Date.now()) {
+    const ref = validateInput(input);
+    const existing = rowAt(db, input.writer, input.seq);
+    if (existing !== undefined) {
+        if (sameRow(existing, ref)) return {
+            record: viewOf(existing),
+            dedup: true
+        };
+        throw new SyncError('conflict', `Vault writer ${input.writer} 的 seq ${input.seq} 已有不同内容`);
+    }
+    return withTransaction(db, ()=>{
+        requireLease(db, vaultResource(input.writer), input.deviceId, input.clientId, now);
+        const raced = rowAt(db, input.writer, input.seq);
+        if (raced !== undefined) {
+            if (sameRow(raced, ref)) return {
+                record: viewOf(raced),
+                dedup: true
+            };
+            throw new SyncError('conflict', `Vault writer ${input.writer} 的 seq ${input.seq} 已有不同内容`);
+        }
+        const last = lastRow(db, input.writer);
+        if (last === undefined) {
+            if (ref.seq !== 1 || ref.prevHash !== null) throw new SyncError('conflict', 'Vault 首条必须从 seq=1 / prevHash=null 开始');
+        } else {
+            if (ref.seq !== last.seq + 1) throw new SyncError('conflict', `Vault 下一条 seq 应为 ${last.seq + 1}`);
+            if (ref.prevHash !== last.record_hash) throw new SyncError('conflict', 'Vault prevHash 与当前链不匹配');
+        }
+        let blob;
+        try {
+            blob = readBlobSync(dataDir, ref.blobSha256);
+        } catch  {
+            throw new SyncError('bad-request', `Vault blob 尚未上传：${ref.blobSha256}`);
+        }
+        if (blob.length !== ref.bytes) throw new SyncError('bad-request', 'Vault blob 字节数与索引不一致');
+        const revision = bumpRevision(db);
+        db.handle.prepare('INSERT INTO vault_records (dataset, writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)').run(DEFAULT_DATASET, ref.writer, ref.seq, ref.prevHash, ref.blobSha256, ref.bytes, ref.createdAt, JSON.stringify(ref.sealed), ref.recordHash, revision);
+        return {
+            record: {
+                ...ref,
+                revision
+            },
+            dedup: false
+        };
+    });
+}
+function readBlobSync(dataDir, sha256) {
+    return readFileSync(blobPath(dataDir, sha256));
+}
+export function readVaultCursor(db, since, limit) {
+    const rows = db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND revision > ? ORDER BY revision ASC LIMIT ?').all(DEFAULT_DATASET, since, limit + 1);
+    return {
+        revision: readRevision(db),
+        records: rows.slice(0, limit).map(viewOf),
+        hasMore: rows.length > limit
+    };
+}
+export function readVaultStream(db, writer, from, limit) {
+    const rows = db.handle.prepare('SELECT writer, seq, prev_hash, blob_sha256, bytes, created_at, sealed_json, record_hash, revision FROM vault_records WHERE dataset = ? AND writer = ? AND seq >= ? ORDER BY seq ASC LIMIT ?').all(DEFAULT_DATASET, writer, from, limit + 1);
+    return {
+        writer,
+        records: rows.slice(0, limit).map(viewOf),
+        hasMore: rows.length > limit
+    };
+}
+export function validVaultWriter(writer) {
+    return /^[A-Za-z0-9._:-]{1,128}$/u.test(writer);
+}
+
+
+//# sourceURL=vault.ts

package/package.json

@@ -1,6 +1,45 @@
 {
   "name": "dscs-server",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "private": false,
+  "type": "module",
+  "description": "DSH Session CloudSync self-hosted server.",
+  "license": "AGPL-3.0-only",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/xfy2412/dsh-session-cloudsync.git",
+    "directory": "packages/server"
+  },
+  "homepage": "https://github.com/xfy2412/dsh-session-cloudsync#readme",
+  "bugs": {
+    "url": "https://github.com/xfy2412/dsh-session-cloudsync/issues"
+  },
+  "keywords": [
+    "dsh",
+    "deepseek-harness",
+    "session",
+    "sync",
+    "self-hosted",
+    "e2ee",
+    "sqlite"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "bin": {
+    "dscs-server": "dist/index.js"
+  },
+  "files": [
+    "dist",
+    "web",
+    "LICENSE",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "node scripts/build.mjs",
+    "prepack": "node scripts/build.mjs"
+  },
+  "engines": {
+    "node": ">=24"
+  }
+}