enigma-memory 0.1.0

package/package.json

@@ -0,0 +1,196 @@
+{
+  "name": "enigma-memory",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "Provider-agnostic AI memory passport and offline-verifiable proof layer.",
+  "license": "Apache-2.0",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Enigma-Memory/enigma-memory.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [
+    "ai-memory",
+    "memory-optimization",
+    "memory-passport",
+    "mcp",
+    "offline-verification",
+    "provenance",
+    "receipts",
+    "zero-trust"
+  ],
+  "sideEffects": false,
+  "files": [
+    "apps/cli/bin/",
+    "apps/native-host/bin/",
+    "apps/native-host/README.md",
+    "apps/native-host/manifests/",
+    "apps/desktop/src/",
+    "apps/gateway/bin/",
+    "apps/gateway/src/",
+    "apps/relay/src/",
+    "apps/relay/bin/",
+    "apps/verifier/bin/",
+    "packages/adapters/src/",
+    "packages/adapters/PACKAGE_CONTRACT.md",
+    "packages/boundary/src/",
+    "packages/connectors/src/",
+    "packages/core/src/",
+    "packages/enterprise/src/",
+    "packages/importers/src/",
+    "packages/optimizer/src/",
+    "packages/mcp-server/bin/",
+    "packages/mcp-server/src/",
+    "packages/mesh/src/",
+    "packages/metering/src/",
+    "packages/metering/PACKAGE_CONTRACT.md",
+    "packages/settlement/src/",
+    "packages/settlement/PACKAGE_CONTRACT.md",
+    "packages/passport/src/",
+    "packages/storage/src/",
+    "packages/storage/PACKAGE_CONTRACT.md",
+    "packages/vault/src/",
+    "deploy/docker-compose.production.example.yml",
+    "deploy/kubernetes/enigma-backend.example.yaml",
+    "scripts/check.mjs",
+    "scripts/install-enigma-local.mjs",
+    "scripts/build-production-readiness-manifest.mjs",
+    "scripts/build-production-backend-env-kit.mjs",
+    "scripts/cloudflare-secret-env.mjs",
+    "scripts/cloudflare-ops.mjs",
+    "scripts/build-cloudflare-pages-release-packet.mjs",
+    "scripts/build-cloudflare-token-policy.mjs",
+    "scripts/build-cloudflare-token-request.mjs",
+    "scripts/build-production-handoff-packet.mjs",
+    "scripts/build-goal-completion-audit.mjs",
+    "scripts/build-production-dependency-report.mjs",
+    "scripts/build-production-workplan.mjs",
+    "scripts/build-production-status-board.mjs",
+    "scripts/build-ai-orchestration-plan.mjs",
+    "scripts/validate-cloudflare-credentials.mjs",
+    "scripts/run-backend-readiness-smoke.mjs",
+    "scripts/validate-hosted-backend-live.mjs",
+    "scripts/monitor-live-endpoints.mjs",
+    "scripts/collect-hosted-backend-live-evidence.mjs",
+    "scripts/build-hosted-probe-worker.mjs",
+    "scripts/build-edge-backend-workers.mjs",
+    "scripts/validate-cloudflare-worker-inspect.mjs",
+    "scripts/validate-production-manifests.mjs",
+    "scripts/build-production-storage-migration.mjs",
+    "scripts/validate-operator-acceptance.mjs",
+    "scripts/build-operator-acceptance-packet.mjs",
+    "scripts/build-operator-evidence-starter.mjs",
+    "scripts/validate-backup-restore-drill.mjs",
+    "scripts/validate-incident-drill.mjs",
+    "scripts/validate-support-sla.mjs",
+    "scripts/validate-legal-compliance-approval.mjs",
+    "scripts/validate-monitoring-alerting.mjs",
+    "scripts/validate-network-access-policy.mjs",
+    "scripts/validate-kms-custody.mjs",
+    "scripts/validate-tenant-policy-approval.mjs",
+    "scripts/validate-usage-metering.mjs",
+    "scripts/validate-service-settlement.mjs",
+    "scripts/validate-public-site-security.mjs",
+    "scripts/validate-domain-tls.mjs",
+    "scripts/validate-whitepaper-claims.mjs",
+    "scripts/validate-security-threat-model.mjs",
+    "scripts/infrastructure-readiness.mjs",
+    "scripts/memory-optimization-benchmark.mjs",
+    "scripts/release-audit.mjs",
+    "scripts/release-provenance.mjs",
+    "scripts/build-review-packet.mjs",
+    "scripts/build-demo-assets.mjs",
+    "specs/"
+  ],
+  "bin": {
+    "enigma": "apps/cli/bin/enigma.mjs",
+    "enigma-verify": "apps/verifier/bin/enigma-verify.mjs",
+    "enigma-mcp": "packages/mcp-server/bin/enigma-mcp.mjs",
+    "enigma-relay": "apps/relay/bin/enigma-relay.mjs",
+    "enigma-gateway": "apps/gateway/bin/enigma-gateway.mjs",
+    "enigma-native-host": "apps/native-host/bin/enigma-native-host.mjs"
+  },
+  "scripts": {
+    "check": "node scripts/check.mjs",
+    "test": "node --test test/*.test.mjs",
+    "install:local": "node scripts/install-enigma-local.mjs",
+    "boundary": "node harnesses/boundary-sim/boundary_harness.mjs",
+    "release:audit": "node scripts/release-audit.mjs",
+    "provenance:local": "node scripts/release-provenance.mjs",
+    "review:packet": "node scripts/build-review-packet.mjs",
+    "demo:assets": "node scripts/build-demo-assets.mjs",
+    "cloudflare:ops": "node scripts/cloudflare-ops.mjs",
+    "cloudflare:pages:packet": "node scripts/build-cloudflare-pages-release-packet.mjs",
+    "cloudflare:token-policy": "node scripts/build-cloudflare-token-policy.mjs",
+    "cloudflare:token-request": "node scripts/build-cloudflare-token-request.mjs",
+    "infrastructure:readiness": "node scripts/infrastructure-readiness.mjs",
+    "memory:benchmark": "node scripts/memory-optimization-benchmark.mjs",
+    "production:manifest": "node scripts/build-production-readiness-manifest.mjs",
+    "production:backend-env": "node scripts/build-production-backend-env-kit.mjs",
+    "production:storage": "node scripts/build-production-storage-migration.mjs",
+    "production:acceptance": "node scripts/validate-operator-acceptance.mjs",
+    "production:acceptance:packet": "node scripts/build-operator-acceptance-packet.mjs",
+    "production:evidence-starter": "node scripts/build-operator-evidence-starter.mjs",
+    "production:handoff": "node scripts/build-production-handoff-packet.mjs",
+    "production:goal-audit": "node scripts/build-goal-completion-audit.mjs",
+    "production:dependencies": "node scripts/build-production-dependency-report.mjs",
+    "production:workplan": "node scripts/build-production-workplan.mjs",
+    "production:status": "node scripts/build-production-status-board.mjs",
+    "production:orchestration": "node scripts/build-ai-orchestration-plan.mjs",
+    "production:manifests": "node scripts/validate-production-manifests.mjs",
+    "production:backend-smoke": "node scripts/run-backend-readiness-smoke.mjs",
+    "production:hosted-live": "node scripts/validate-hosted-backend-live.mjs",
+    "production:live-monitor": "node scripts/monitor-live-endpoints.mjs",
+    "production:live-monitor:dry-run": "node scripts/monitor-live-endpoints.mjs --dry-run",
+    "production:live-monitor:help": "node scripts/monitor-live-endpoints.mjs --help",
+    "production:hosted-collect": "node scripts/collect-hosted-backend-live-evidence.mjs",
+    "production:hosted-probe": "node scripts/build-hosted-probe-worker.mjs",
+    "production:edge-backend": "node scripts/build-edge-backend-workers.mjs",
+    "production:edge-deploy": "node scripts/deploy-edge-backend-workers.mjs",
+    "production:edge-live": "node scripts/collect-edge-backend-bootstrap-evidence.mjs",
+    "production:ref-draft": "node scripts/build-hosted-ref-draft.mjs",
+    "production:storage-bootstrap": "node scripts/cloudflare-storage-bootstrap.mjs",
+    "production:worker-inspect": "node scripts/validate-cloudflare-worker-inspect.mjs",
+    "production:cloudflare-credentials": "node scripts/validate-cloudflare-credentials.mjs",
+    "production:backup-drill": "node scripts/validate-backup-restore-drill.mjs",
+    "production:incident-drill": "node scripts/validate-incident-drill.mjs",
+    "production:whitepaper": "node scripts/validate-whitepaper-claims.mjs",
+    "production:sla": "node scripts/validate-support-sla.mjs",
+    "production:legal": "node scripts/validate-legal-compliance-approval.mjs",
+    "production:monitoring": "node scripts/validate-monitoring-alerting.mjs",
+    "production:network": "node scripts/validate-network-access-policy.mjs",
+    "production:kms": "node scripts/validate-kms-custody.mjs",
+    "production:tenant-policy": "node scripts/validate-tenant-policy-approval.mjs",
+    "production:usage": "node scripts/validate-usage-metering.mjs",
+    "production:settlement": "node scripts/validate-service-settlement.mjs",
+    "production:site": "node scripts/validate-public-site-security.mjs",
+    "production:domain": "node scripts/validate-domain-tls.mjs",
+    "production:threat-model": "node scripts/validate-security-threat-model.mjs"
+  },
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    "./adapters": "./packages/adapters/src/index.js",
+    ".": "./packages/core/src/index.js",
+    "./boundary": "./packages/boundary/src/index.js",
+    "./connectors": "./packages/connectors/src/index.js",
+    "./core": "./packages/core/src/index.js",
+    "./desktop": "./apps/desktop/src/app.js",
+    "./enterprise": "./packages/enterprise/src/index.js",
+    "./gateway": "./apps/gateway/src/server.mjs",
+    "./importers": "./packages/importers/src/index.js",
+    "./mcp-server": "./packages/mcp-server/src/index.js",
+    "./mesh": "./packages/mesh/src/index.js",
+    "./metering": "./packages/metering/src/index.js",
+    "./optimizer": "./packages/optimizer/src/index.js",
+    "./settlement": "./packages/settlement/src/index.js",
+    "./storage": "./packages/storage/src/index.js",
+    "./package.json": "./package.json",
+    "./passport": "./packages/passport/src/index.js",
+    "./relay": "./apps/relay/src/server.mjs",
+    "./vault": "./packages/vault/src/index.js"
+  }
+}

package/packages/adapters/PACKAGE_CONTRACT.md

@@ -0,0 +1,47 @@
+# Production dependency adapters contract
+
+`@enigma-ai/enigma/adapters` is a pure local evidence-normalization package. It does not provision cloud resources, open sockets, read environment variables, or load secrets.
+
+## Purpose
+
+The package turns operator/provider references into public-safe readiness evidence for:
+
+- `backend_host`
+- `dns_tls`
+- `durable_storage`
+- `kms_or_secret_custody`
+- `backup_restore`
+- `monitoring`
+- `siem_or_log_sink`
+- `operator_acceptance`
+- `runtime_auth`
+- `admin_auth`
+- `data_plane_auth`
+- `network_access_policy`
+- `kms_custody`
+- `tenant_policy_approval`
+- `usage_metering`
+- `service_settlement`
+- `monitoring_alerting`
+- `public_site_security`
+- `security_threat_model`
+- `legal_compliance_approval`
+- `support_sla`
+- `incident_drill`
+- `backup_restore_drill`
+
+## Hard boundary
+
+Evidence refs are pointers only: ARNs, dashboard IDs, deployment IDs, URLs without credentials, runbook refs, or restore-test refs. They are not proof by themselves that hosted infrastructure is live.
+
+The package rejects:
+- bearer/basic credentials,
+- API keys or token-looking strings,
+- private-key PEM blocks,
+- URLs with embedded username/password,
+- password/token/private-key/plaintext/raw-memory/prompt/transcript/completion fields,
+- raw-memory-looking values.
+
+## Hosted readiness
+
+`normalizeDependencyEvidence(...)` can show which dependency categories have safe references and which are still missing. `hosted_live_ready` must remain false until runtime `/readyz` probes, dependency-specific checks, operator acceptance, and external-blocker checks also pass.

package/packages/adapters/src/index.js

@@ -0,0 +1,183 @@
+export const PRODUCTION_DEPENDENCY_EVIDENCE_SCHEMA = 'enigma.production_dependency_evidence.v1';
+
+export const PRODUCTION_DEPENDENCY_KEYS = Object.freeze([
+  'backend_host',
+  'dns_tls',
+  'durable_storage',
+  'kms_or_secret_custody',
+  'backup_restore',
+  'monitoring',
+  'siem_or_log_sink',
+  'operator_acceptance',
+  'runtime_auth',
+  'admin_auth',
+  'data_plane_auth',
+  'network_access_policy',
+  'kms_custody',
+  'tenant_policy_approval',
+  'usage_metering',
+  'service_settlement',
+  'monitoring_alerting',
+  'public_site_security',
+  'security_threat_model',
+  'legal_compliance_approval',
+  'support_sla',
+  'incident_drill',
+  'backup_restore_drill',
+]);
+
+export const HOSTED_READINESS_REQUIRED_DEPENDENCIES = Object.freeze([
+  'backend_host',
+  'dns_tls',
+  'durable_storage',
+  'kms_or_secret_custody',
+  'backup_restore',
+  'monitoring',
+  'siem_or_log_sink',
+  'operator_acceptance',
+  'runtime_auth',
+  'network_access_policy',
+  'kms_custody',
+  'tenant_policy_approval',
+  'usage_metering',
+  'service_settlement',
+  'monitoring_alerting',
+  'public_site_security',
+  'security_threat_model',
+  'legal_compliance_approval',
+  'support_sla',
+  'incident_drill',
+  'backup_restore_drill',
+]);
+const KEY_SET = new Set(PRODUCTION_DEPENDENCY_KEYS);
+const SAFE_STATUS = new Set(['declared', 'observed', 'verified', 'go']);
+const SECRET_FIELD_RE = /(?:password|passwd|pwd|token|api[_-]?key|private[_-]?key|client[_-]?secret|raw[_-]?memory|plaintext|plain[_-]?text|prompt|completion|transcript|cookie|session)/iu;
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{16,})/u;
+const URL_WITH_CREDENTIALS_RE = /^[a-z][a-z0-9+.-]*:\/\/[^\s/@]+:[^\s/@]+@/iu;
+const RAW_MEMORY_VALUE_RE = /(?:raw memory|private prompt|full transcript|decrypted capsule|customer note|launch-code phrase)/iu;
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function assertDependencyKey(key) {
+  if (!KEY_SET.has(key)) throw new Error(`Unknown production dependency key: ${key}`);
+}
+
+function assertSafeString(value, path) {
+  if (typeof value !== 'string') return;
+  if (SECRET_VALUE_RE.test(value)) throw new Error(`Production evidence ${path} appears to contain a secret.`);
+  if (URL_WITH_CREDENTIALS_RE.test(value)) throw new Error(`Production evidence ${path} must not contain URL credentials.`);
+  if (RAW_MEMORY_VALUE_RE.test(value)) throw new Error(`Production evidence ${path} appears to contain raw memory.`);
+}
+
+export function assertNoSecretEvidence(value, path = 'evidence') {
+  if (typeof value === 'string') {
+    assertSafeString(value, path);
+    return true;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertNoSecretEvidence(item, `${path}[${index}]`));
+    return true;
+  }
+  if (!isPlainObject(value)) return true;
+  for (const [key, child] of Object.entries(value)) {
+    const childPath = `${path}.${key}`;
+    if (SECRET_FIELD_RE.test(key)) throw new Error(`Production evidence ${childPath} uses a forbidden secret/plaintext field name.`);
+    assertNoSecretEvidence(child, childPath);
+  }
+  return true;
+}
+
+function safeString(value, field, maxLength = 512) {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value !== 'string') throw new Error(`${field} must be a string.`);
+  const trimmed = value.trim();
+  if (trimmed.length === 0) throw new Error(`${field} must be non-empty.`);
+  if (trimmed.length > maxLength) throw new Error(`${field} is too long for public readiness evidence.`);
+  assertSafeString(trimmed, field);
+  return trimmed;
+}
+
+function safeMetadata(metadata) {
+  if (metadata === undefined || metadata === null) return {};
+  if (!isPlainObject(metadata)) throw new Error('metadata must be an object when provided.');
+  assertNoSecretEvidence(metadata, 'metadata');
+  const out = {};
+  for (const [key, value] of Object.entries(metadata)) {
+    if (!/^[a-z][a-z0-9_.-]{0,63}$/iu.test(key)) throw new Error(`metadata key ${key} is not safe for public evidence.`);
+    if (typeof value === 'string') out[key] = safeString(value, `metadata.${key}`, 256);
+    else if (typeof value === 'number' && Number.isFinite(value)) out[key] = value;
+    else if (typeof value === 'boolean') out[key] = value;
+    else if (Array.isArray(value) && value.every((item) => typeof item === 'string')) out[key] = value.map((item, index) => safeString(item, `metadata.${key}[${index}]`, 128));
+    else throw new Error(`metadata.${key} must be a primitive public value.`);
+  }
+  return out;
+}
+
+export function normalizeEvidenceRef(input, options = {}) {
+  const key = options.key ?? input?.key;
+  assertDependencyKey(key);
+  const source = typeof input === 'string' ? { ref: input } : input;
+  if (!isPlainObject(source)) throw new Error(`Production dependency ${key} evidence must be a string or object.`);
+  assertNoSecretEvidence(source, key);
+  const status = source.status ?? options.status ?? 'declared';
+  if (!SAFE_STATUS.has(status)) throw new Error(`Production dependency ${key} status is unsupported.`);
+  const ref = safeString(source.ref ?? source.arn ?? source.url ?? source.id, `${key}.ref`);
+  const provider = safeString(source.provider ?? options.provider ?? 'operator', `${key}.provider`, 80);
+  const observedAt = safeString(source.observed_at ?? source.observedAt ?? options.observed_at ?? options.observedAt ?? new Date(0).toISOString(), `${key}.observed_at`, 64);
+  if (Number.isNaN(Date.parse(observedAt))) throw new Error(`Production dependency ${key} observed_at must be an ISO timestamp.`);
+  return Object.freeze({
+    key,
+    status,
+    provider,
+    ref,
+    observed_at: observedAt,
+    metadata: safeMetadata(source.metadata),
+  });
+}
+
+export function normalizeDependencyEvidence(evidence = {}, options = {}) {
+  if (!isPlainObject(evidence)) throw new Error('Production dependency evidence must be an object.');
+  const normalized = {};
+  for (const key of Object.keys(evidence).sort()) {
+    assertDependencyKey(key);
+    normalized[key] = normalizeEvidenceRef(evidence[key], { key, observed_at: options.observed_at ?? options.observedAt });
+  }
+  const requiredKeys = options.required_keys ?? options.requiredKeys ?? HOSTED_READINESS_REQUIRED_DEPENDENCIES;
+  const missing_keys = missingProductionDependencies(normalized, requiredKeys);
+  return Object.freeze({
+    schema: PRODUCTION_DEPENDENCY_EVIDENCE_SCHEMA,
+    generated_at: safeString(options.generated_at ?? options.generatedAt ?? new Date(0).toISOString(), 'generated_at', 64),
+    ok: missing_keys.length === 0,
+    evidence: Object.freeze(normalized),
+    missing_keys: Object.freeze(missing_keys),
+    claim_boundary: Object.freeze([
+      'Production dependency evidence is public-safe reference material only.',
+      'It is not secret custody, backup restore, monitoring delivery, operator acceptance, or hosted readiness by itself.',
+      'hosted_live_ready remains false until runtime probes and operator acceptance also pass.',
+    ]),
+  });
+}
+
+export function missingProductionDependencies(evidence = {}, requiredKeys = HOSTED_READINESS_REQUIRED_DEPENDENCIES) {
+  if (!isPlainObject(evidence)) throw new Error('evidence must be an object.');
+  const missing = [];
+  for (const key of requiredKeys) {
+    assertDependencyKey(key);
+    const item = evidence[key];
+    if (!item || item.status === 'declared') missing.push(key);
+  }
+  return missing;
+}
+
+export function readinessEvidenceRefs(evidence = {}) {
+  if (!isPlainObject(evidence)) throw new Error('evidence must be an object.');
+  const refs = {};
+  for (const key of Object.keys(evidence).sort()) {
+    const normalized = normalizeEvidenceRef(evidence[key], { key });
+    refs[key] = normalized.ref;
+  }
+  assertNoSecretEvidence(refs, 'readiness_refs');
+  return Object.freeze(refs);
+}