neotoma 0.3.0 → 0.3.2

package/src/config.ts

@@ -1,164 +0,0 @@
-import dotenv from "dotenv";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
-import { existsSync, readFileSync } from "fs";
-
-// Use NEOTOMA_ENV only to avoid conflicts when running as MCP in other workspaces
-// (host NODE_ENV would incorrectly override Neotoma's dev/prod choice)
-const env = process.env.NEOTOMA_ENV || "development";
-
-// Resolve .env file paths relative to this file's location (works when running as MCP)
-// When running as MCP, process.cwd() might be the workspace directory, not the Neotoma project
-// So we always resolve from the file location: dist/config.js -> project root
-const __filename = fileURLToPath(import.meta.url);
-const __dirname = dirname(__filename);
-// Always resolve project root from file location (dist/ -> project root, src/ -> project root)
-// This works regardless of process.cwd() when running as MCP
-const projectRoot = process.env.NEOTOMA_PROJECT_ROOT || 
-  (__dirname.endsWith("/dist") || __dirname.includes("/dist/") 
-    ? join(__dirname, "..") 
-    : __dirname.endsWith("/src") || __dirname.includes("/src/")
-    ? join(__dirname, "..")
-    : __dirname);
-
-// Load environment-specific .env files
-if (env === "production") {
-  // Try .env.production first, then fallback to .env
-  dotenv.config({ path: join(projectRoot, ".env.production"), override: false });
-  dotenv.config({ path: join(projectRoot, ".env"), override: false }); // Load .env as fallback
-} else {
-  // Development/test: load .env
-  dotenv.config({ path: join(projectRoot, ".env"), override: false });
-}
-
-function getOpenAIConfig() {
-  // Use OPENAI_API_KEY (set by 1Password sync based on ENVIRONMENT variable)
-  return process.env.OPENAI_API_KEY || "";
-}
-
-// Default ports: 8080 dev, 8180 prod, 8280 WS (spaced to avoid cascade when prod bumps)
-const defaultHttpPort = env === "production" ? "8180" : "8080";
-const httpPort = parseInt(
-  process.env.NEOTOMA_HTTP_PORT || process.env.HTTP_PORT || defaultHttpPort,
-  10
-);
-const storageBackend = "local";
-const dataDir = process.env.NEOTOMA_DATA_DIR || join(projectRoot, "data");
-const rawStorageSubdir = env === "production" ? "sources_prod" : "sources";
-const logsSubdir = env === "production" ? "logs_prod" : "logs";
-const logsDir = process.env.NEOTOMA_LOGS_DIR || join(dataDir, logsSubdir);
-// Event log: both envs in data/logs — events.log (dev), events.prod.log (prod)
-const eventLogFileName = env === "production" ? "events.prod.log" : "events.log";
-const eventLogPath =
-  process.env.NEOTOMA_EVENT_LOG_PATH ||
-  (process.env.NEOTOMA_EVENT_LOG_DIR ? join(process.env.NEOTOMA_EVENT_LOG_DIR, eventLogFileName) : null) ||
-  join(dataDir, "logs", eventLogFileName);
-
-/**
- * Auto-discover tunnel URL from file written by setup-https-tunnel.sh
- * This allows tunnels to "just work" without manually setting NEOTOMA_HOST_URL
- */
-function discoverTunnelUrl(httpPort: number): string {
-  const tunnelFiles = [
-    "/tmp/ngrok-mcp-url.txt",  // Combined scripts write here
-    "/tmp/cloudflared-tunnel.txt"  // Alternative for cloudflare-only
-  ];
-  
-  for (const file of tunnelFiles) {
-    try {
-      if (existsSync(file)) {
-        const url = readFileSync(file, "utf-8").trim();
-        if (url && url.startsWith("http")) {
-          // Store for logging after config is created
-          (discoverTunnelUrl as any)._discovered = { url, file };
-          return url;
-        }
-      }
-    } catch {
-      // File doesn't exist or unreadable, continue to next
-    }
-  }
-  
-  // Store that we're using localhost default
-  (discoverTunnelUrl as any)._discovered = { url: `http://localhost:${httpPort}`, file: null };
-  return `http://localhost:${httpPort}`;
-}
-
-export const config = {
-  projectRoot,
-  storageBackend,
-  dataDir,
-  sqlitePath: join(dataDir, env === "production" ? "neotoma.prod.db" : "neotoma.db"),
-  rawStorageDir: process.env.NEOTOMA_RAW_STORAGE_DIR || join(dataDir, rawStorageSubdir),
-  eventLogPath,
-  logsDir,
-  eventLogMirrorEnabled: process.env.NEOTOMA_EVENT_LOG_MIRROR === "true",
-  // Kept as inert placeholders for backward-compatible call sites while remote storage is removed.
-  authServerUrl: "",
-  authServiceKey: "",
-  openaiApiKey: getOpenAIConfig(),
-  port: parseInt(
-    process.env.NEOTOMA_PORT || process.env.PORT || "3000",
-    10
-  ),
-  httpPort,
-  environment: env,
-  apiBase:
-    process.env.NEOTOMA_HOST_URL ||
-    discoverTunnelUrl(httpPort),
-  mcpTokenEncryptionKey:
-    process.env.NEOTOMA_MCP_TOKEN_ENCRYPTION_KEY ||
-    process.env.MCP_TOKEN_ENCRYPTION_KEY ||
-    "",
-  oauthClientId: process.env.NEOTOMA_OAUTH_CLIENT_ID || "",
-  requireKeyForOauth:
-    (process.env.NEOTOMA_REQUIRE_KEY_FOR_OAUTH || "true").toLowerCase() !== "false",
-  // Encryption settings (local backend)
-  encryption: {
-    enabled: process.env.NEOTOMA_ENCRYPTION_ENABLED === "true",
-    keyFilePath: process.env.NEOTOMA_KEY_FILE_PATH || "",
-    mnemonic: process.env.NEOTOMA_MNEMONIC || "",
-    mnemonicPassphrase: process.env.NEOTOMA_MNEMONIC_PASSPHRASE || "",
-    logEncryptionEnabled: process.env.NEOTOMA_LOG_ENCRYPTION_ENABLED === "true",
-  },
-
-  // Icon generation settings
-  iconGeneration: {
-    enabled:
-      (process.env.NEOTOMA_ICON_GENERATION_ENABLED ?? process.env.ICON_GENERATION_ENABLED) !==
-      "false",
-    confidenceThreshold: parseFloat(
-      process.env.NEOTOMA_ICON_MATCH_CONFIDENCE_THRESHOLD ||
-        process.env.ICON_MATCH_CONFIDENCE_THRESHOLD ||
-        "0.8"
-    ),
-    model:
-      process.env.NEOTOMA_ICON_GENERATION_MODEL ||
-      process.env.ICON_GENERATION_MODEL ||
-      "gpt-4o",
-    cacheTTL: parseInt(
-      process.env.NEOTOMA_ICON_CACHE_TTL || process.env.ICON_CACHE_TTL || "86400",
-      10
-    ),
-  },
-};
-
-/**
- * Log configuration after it's loaded
- * Call this after importing config to see what was configured
- */
-export function logConfigInfo(): void {
-  const discovered = (discoverTunnelUrl as any)._discovered;
-
-  if (process.env.NEOTOMA_HOST_URL) {
-    console.log(`[Config] Using NEOTOMA_HOST_URL from environment: ${config.apiBase}`);
-  } else if (discovered?.file) {
-    console.log(`[Config] NEOTOMA_HOST_URL not set; auto-discovered tunnel URL from ${discovered.file}: ${discovered.url}`);
-  } else {
-    console.log(`[Config] NEOTOMA_HOST_URL not set and no tunnel URL file found; using localhost:${config.httpPort}`);
-  }
-  
-  console.log(`[Config] API base (apiBase): ${config.apiBase}`);
-  console.log(`[Config] Storage backend: ${config.storageBackend}`);
-  console.log(`[Config] Environment: ${config.environment}`);
-}

package/src/crypto/agent_identity.ts

@@ -1,46 +0,0 @@
-/**
- * Agent Identity Abstraction for Cryptographic Schema Fields (FU-053)
- *
- * Represents agent as public key for future cryptographic signature verification.
- */
-
-export interface AgentIdentity {
-  publicKey: string;
-  algorithm?: string; // e.g., 'ed25519'
-}
-
-/**
- * Get agent public key from request context (stub)
- *
- * In future, this will extract public key from authenticated request.
- */
-export function getAgentPublicKey(): string | null {
-  // Stub: Future implementation will extract from request context
-  // For now, return null (no agent identity)
-  return null;
-}
-
-/**
- * Create agent identity from public key
- */
-export function createAgentIdentity(
-  publicKey: string,
-  algorithm: string = "ed25519",
-): AgentIdentity {
-  return {
-    publicKey,
-    algorithm,
-  };
-}
-
-/**
- * Validate agent identity format (stub)
- */
-export function validateAgentIdentity(identity: AgentIdentity): boolean {
-  // Stub: Future implementation will validate public key format
-  if (!identity.publicKey || typeof identity.publicKey !== "string") {
-    return false;
-  }
-  // Basic validation: non-empty string
-  return identity.publicKey.length > 0;
-}

package/src/crypto/auth.ts

@@ -1,110 +0,0 @@
-/**
- * Request authentication utilities
- * Signs HTTP requests and MCP messages with Ed25519
- */
-
-import { signMessage, verifySignature } from "./signature.js";
-import { deriveBearerToken, parseBearerToken } from "./keys.js";
-import type { Ed25519KeyPair } from "./types.js";
-
-/**
- * Sign HTTP request body for authentication
- * Returns signature that can be included in Authorization header or request body
- */
-export function signRequest(
-  body: Uint8Array | string,
-  keyPair: Ed25519KeyPair,
-): { signature: string; bearerToken: string } {
-  const message =
-    typeof body === "string" ? new TextEncoder().encode(body) : body;
-  const signature = signMessage(message, keyPair.privateKey);
-
-  // Base64url encode signature
-  const signatureStr = base64UrlEncode(signature);
-  const bearerToken = deriveBearerToken(keyPair.publicKey);
-
-  return { signature: signatureStr, bearerToken };
-}
-
-/**
- * Verify request signature
- */
-export function verifyRequest(
-  body: Uint8Array | string,
-  signature: string,
-  bearerToken: string,
-): boolean {
-  try {
-    const message =
-      typeof body === "string" ? new TextEncoder().encode(body) : body;
-    const signatureBytes = base64UrlDecode(signature);
-    if (signatureBytes.length === 0) {
-      return false; // Invalid signature encoding
-    }
-    const publicKey = parseBearerToken(bearerToken);
-    if (publicKey.length === 0) {
-      return false; // Invalid bearer token
-    }
-    return verifySignature(message, signatureBytes, publicKey);
-  } catch {
-    return false;
-  }
-}
-
-/**
- * Create Authorization header value with signature
- * Format: Bearer <token> Signature <signature>
- */
-export function createAuthHeader(
-  body: Uint8Array | string,
-  keyPair: Ed25519KeyPair,
-): string {
-  const { signature, bearerToken } = signRequest(body, keyPair);
-  return `Bearer ${bearerToken} Signature ${signature}`;
-}
-
-/**
- * Parse Authorization header
- */
-export function parseAuthHeader(header: string): {
-  bearerToken: string;
-  signature?: string;
-} {
-  const parts = header.split(" ");
-  const bearerIndex = parts.indexOf("Bearer");
-  const signatureIndex = parts.indexOf("Signature");
-
-  const bearerToken =
-    bearerIndex >= 0 && parts[bearerIndex + 1] ? parts[bearerIndex + 1] : "";
-  const signature =
-    signatureIndex >= 0 && parts[signatureIndex + 1]
-      ? parts[signatureIndex + 1]
-      : undefined;
-
-  return { bearerToken, signature };
-}
-
-/**
- * Base64url encode
- */
-function base64UrlEncode(data: Uint8Array): string {
-  return btoa(String.fromCharCode(...data))
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=/g, "");
-}
-
-/**
- * Base64url decode
- */
-function base64UrlDecode(str: string): Uint8Array {
-  try {
-    const base64 = str.replace(/-/g, "+").replace(/_/g, "/");
-    const padded = base64 + "=".repeat((4 - (base64.length % 4)) % 4);
-    const binary = atob(padded);
-    return new Uint8Array([...binary].map((c) => c.charCodeAt(0)));
-  } catch (error) {
-    // Return empty array for invalid base64 strings
-    return new Uint8Array(0);
-  }
-}

package/src/crypto/column_encryption.ts

@@ -1,109 +0,0 @@
-/**
- * Column-level encryption for SQLite DB fields
- *
- * Uses AES-256-GCM with per-value random IV.
- * Storage format: iv:authTag:ciphertext (all hex-encoded)
- *
- * Design decisions (see plan Section 7 - blockchain compatibility):
- * - Only content/payload columns are encrypted (never IDs, timestamps, hashes, signatures)
- * - Hash-chain integrity uses ciphertext: event_hash = hash(ciphertext || metadata)
- * - Encryption/decryption happens in the repository layer only
- */
-
-import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
-
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 16; // 128-bit IV for GCM
-const AUTH_TAG_LENGTH = 16; // 128-bit auth tag
-
-/**
- * Encrypt a string value for storage in a DB column.
- *
- * @param plaintext - The value to encrypt (typically JSON-stringified)
- * @param key - 32-byte AES-256 key (Data Key from key_derivation)
- * @returns Encrypted string in format iv:authTag:ciphertext (hex)
- */
-export function encryptColumn(plaintext: string, key: Uint8Array): string {
-  if (key.length !== 32) {
-    throw new Error("Encryption key must be exactly 32 bytes");
-  }
-
-  const iv = randomBytes(IV_LENGTH);
-  const cipher = createCipheriv(ALGORITHM, Buffer.from(key), iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-
-  let encrypted = cipher.update(plaintext, "utf8", "hex");
-  encrypted += cipher.final("hex");
-
-  const authTag = cipher.getAuthTag();
-
-  return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted}`;
-}
-
-/**
- * Decrypt a column value from the iv:authTag:ciphertext format.
- *
- * @param encrypted - Encrypted string in format iv:authTag:ciphertext (hex)
- * @param key - 32-byte AES-256 key (same Data Key used for encryption)
- * @returns Decrypted plaintext string
- * @throws Error if decryption fails (wrong key, tampered data, bad format)
- */
-export function decryptColumn(encrypted: string, key: Uint8Array): string {
-  if (key.length !== 32) {
-    throw new Error("Decryption key must be exactly 32 bytes");
-  }
-
-  const parts = encrypted.split(":");
-  if (parts.length !== 3) {
-    throw new Error("Invalid encrypted column format (expected iv:authTag:ciphertext)");
-  }
-
-  const iv = Buffer.from(parts[0], "hex");
-  const authTag = Buffer.from(parts[1], "hex");
-  const ciphertext = parts[2];
-
-  if (iv.length !== IV_LENGTH) {
-    throw new Error(`Invalid IV length: expected ${IV_LENGTH}, got ${iv.length}`);
-  }
-  if (authTag.length !== AUTH_TAG_LENGTH) {
-    throw new Error(`Invalid auth tag length: expected ${AUTH_TAG_LENGTH}, got ${authTag.length}`);
-  }
-
-  const decipher = createDecipheriv(ALGORITHM, Buffer.from(key), iv, {
-    authTagLength: AUTH_TAG_LENGTH,
-  });
-  decipher.setAuthTag(authTag);
-
-  let decrypted = decipher.update(ciphertext, "hex", "utf8");
-  decrypted += decipher.final("utf8");
-
-  return decrypted;
-}
-
-/**
- * Check whether a string value looks like an encrypted column (iv:authTag:ciphertext hex format).
- *
- * Useful for backward compatibility: detect whether a value is plaintext or already encrypted.
- *
- * @param value - The string to check
- * @returns true if the value matches the encrypted column format
- */
-export function isEncryptedColumn(value: string): boolean {
-  if (!value || typeof value !== "string") {
-    return false;
-  }
-  const parts = value.split(":");
-  if (parts.length !== 3) {
-    return false;
-  }
-  // IV = 32 hex chars (16 bytes), authTag = 32 hex chars (16 bytes), ciphertext = any length
-  return (
-    parts[0].length === 32 &&
-    parts[1].length === 32 &&
-    parts[2].length > 0 &&
-    /^[0-9a-f]+$/.test(parts[0]) &&
-    /^[0-9a-f]+$/.test(parts[1]) &&
-    /^[0-9a-f]+$/.test(parts[2])
-  );
-}