memory-crystal 0.2.0

package/dist/chunk-F3Y7EL7K.js

@@ -0,0 +1,83 @@
+// src/crypto.ts
+import { readFileSync, existsSync } from "fs";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
+import { join } from "path";
+import { createHash } from "crypto";
+var HOME = process.env.HOME || "";
+var KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || join(HOME, ".openclaw", "secrets", "crystal-relay-key");
+function loadRelayKey() {
+  if (!existsSync(KEY_PATH)) {
+    throw new Error(
+      `Relay key not found at ${KEY_PATH}
+Generate one: openssl rand -base64 32 > ${KEY_PATH} && chmod 600 ${KEY_PATH}
+Copy the same key to all trusted machines.`
+    );
+  }
+  const raw = readFileSync(KEY_PATH, "utf-8").trim();
+  const key = Buffer.from(raw, "base64");
+  if (key.length !== 32) {
+    throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
+  }
+  return key;
+}
+function deriveSigningKey(masterKey) {
+  return Buffer.from(hkdfSync("sha256", masterKey, "", "crystal-relay-sign", 32));
+}
+function encrypt(plaintext, masterKey) {
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", masterKey, nonce);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const signingKey = deriveSigningKey(masterKey);
+  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
+  const hmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
+  return {
+    v: 1,
+    nonce: nonce.toString("base64"),
+    ciphertext: ciphertext.toString("base64"),
+    tag: tag.toString("base64"),
+    hmac
+  };
+}
+function decrypt(payload, masterKey) {
+  if (payload.v !== 1) {
+    throw new Error(`Unknown payload version: ${payload.v}`);
+  }
+  const nonce = Buffer.from(payload.nonce, "base64");
+  const ciphertext = Buffer.from(payload.ciphertext, "base64");
+  const tag = Buffer.from(payload.tag, "base64");
+  const signingKey = deriveSigningKey(masterKey);
+  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
+  const expectedHmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
+  if (payload.hmac !== expectedHmac) {
+    throw new Error("HMAC verification failed \u2014 blob rejected (tampered or wrong key)");
+  }
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, nonce);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+function encryptJSON(data, masterKey) {
+  const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
+  return encrypt(plaintext, masterKey);
+}
+function decryptJSON(payload, masterKey) {
+  const plaintext = decrypt(payload, masterKey);
+  return JSON.parse(plaintext.toString("utf-8"));
+}
+function encryptFile(filePath, masterKey) {
+  const plaintext = readFileSync(filePath);
+  return encrypt(plaintext, masterKey);
+}
+function hashBuffer(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
+
+export {
+  loadRelayKey,
+  encrypt,
+  decrypt,
+  encryptJSON,
+  decryptJSON,
+  encryptFile,
+  hashBuffer
+};