nervur 0.2.0 → 0.5.0

package/tools.mjs

@@ -0,0 +1,139 @@
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHash,
+  createPublicKey,
+  randomBytes,
+  verify,
+} from 'node:crypto';
+
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+
+const B32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+
+const VERSION_G = 6 << 3;
+
+const ordered = (value) =>
+  value === null || typeof value !== 'object'
+    ? value
+    : Array.isArray(value)
+      ? value.map(ordered)
+      : Object.fromEntries(
+          Object.keys(value)
+            .sort()
+            .map((key) => [key, ordered(value[key])]),
+        );
+
+const crc16 = (bytes) => {
+  let crc = 0;
+  for (const b of bytes) {
+    crc ^= b << 8;
+    for (let i = 0; i < 8; i += 1) {
+      crc = (crc & 0x8000 ? (crc << 1) ^ 0x1021 : crc << 1) & 0xffff;
+    }
+  }
+  return crc;
+};
+
+const base32 = (bytes) => {
+  let bits = 0;
+  let value = 0;
+  let out = '';
+  for (const b of bytes) {
+    value = (value << 8) | b;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32[(value >>> (bits - 5)) & 31];
+      bits -= 5;
+    }
+  }
+  return out;
+};
+
+const unbase32 = (text) => {
+  let bits = 0;
+  let value = 0;
+  const out = [];
+  for (const c of text) {
+    const index = B32.indexOf(c);
+    if (index < 0) {
+      return null;
+    }
+    value = (value << 5) | index;
+    bits += 5;
+    if (bits >= 8) {
+      out.push((value >>> (bits - 8)) & 0xff);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+};
+
+const Tools = Object.freeze({
+  address: (pk) => {
+    const payload = Buffer.concat([Buffer.from([VERSION_G]), pk]);
+    const crc = crc16(payload);
+    return base32(Buffer.concat([payload, Buffer.from([crc & 0xff, crc >> 8])]));
+  },
+  canon: (claim) => Buffer.from(JSON.stringify(ordered(claim))),
+  derive: (root, label) => createHash('sha256').update(root).update(label).digest(),
+  digest: (bytes) => createHash('sha256').update(bytes).digest('hex'),
+  envelope: (voice, to, op, seq) => {
+    const from = Tools.address(voice.pk);
+    return { from, op, seq, sig: voice.sign(Tools.canon({ from, op, seq, to })), to };
+  },
+  pkOf: (address) => {
+    const bytes = typeof address === 'string' && address.length === 56 ? unbase32(address) : null;
+    if (bytes === null || bytes[0] !== VERSION_G) {
+      return null;
+    }
+    const payload = bytes.subarray(0, 33);
+    const checksum = bytes[33] | (bytes[34] << 8);
+    return crc16(payload) === checksum ? Buffer.from(payload.subarray(1)) : null;
+  },
+  seal: (secret, value) => {
+    const iv = randomBytes(12);
+    const cipher = createCipheriv('aes-256-gcm', secret, iv);
+    const sealed = Buffer.concat([cipher.update(JSON.stringify(value), 'utf8'), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), sealed]).toString('base64');
+  },
+  secret: () => randomBytes(32),
+  unseal: (secret, sealed) => {
+    try {
+      const bytes = Buffer.from(sealed, 'base64');
+      const decipher = createDecipheriv('aes-256-gcm', secret, bytes.subarray(0, 12));
+      decipher.setAuthTag(bytes.subarray(12, 28));
+      return JSON.parse(
+        Buffer.concat([decipher.update(bytes.subarray(28)), decipher.final()]).toString('utf8'),
+      );
+    } catch {
+      return undefined;
+    }
+  },
+  verifies: (pk, bytes, sig) => {
+    try {
+      return verify(
+        null,
+        bytes,
+        createPublicKey({
+          key: Buffer.concat([ED25519_SPKI_PREFIX, pk]),
+          format: 'der',
+          type: 'spki',
+        }),
+        Buffer.from(sig, 'base64'),
+      );
+    } catch {
+      return false;
+    }
+  },
+});
+
+const Stamp = () => {
+  let last = 0;
+  return () => {
+    last = Math.max(last + 1, Date.now());
+    return last;
+  };
+};
+
+export { Stamp, Tools };

package/voice.mjs

@@ -0,0 +1,90 @@
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  sign,
+} from 'node:crypto';
+import { Tools } from './tools.mjs';
+
+const X25519_SPKI_PREFIX = Buffer.from('302a300506032b656e032100', 'hex');
+
+const packed = (privateKey) =>
+  privateKey.export({ format: 'der', type: 'pkcs8' }).toString('base64');
+
+const unpacked = (text) =>
+  createPrivateKey({ key: Buffer.from(text, 'base64'), format: 'der', type: 'pkcs8' });
+
+const rawPk = (privateKey) =>
+  createPublicKey(privateKey).export({ format: 'der', type: 'spki' }).subarray(-32);
+
+const agreed = (privateKey, rawPub) =>
+  createHash('sha256')
+    .update(
+      diffieHellman({
+        privateKey,
+        publicKey: createPublicKey({
+          key: Buffer.concat([X25519_SPKI_PREFIX, rawPub]),
+          format: 'der',
+          type: 'spki',
+        }),
+      }),
+    )
+    .digest();
+
+const voiced = ({ present, next, box }) =>
+  Object.freeze({
+    boxPk: rawPk(box),
+    nextPkHash: Tools.digest(rawPk(next)),
+    open: (wrapped) => {
+      try {
+        const [ephemeral, sealed] = wrapped.split('.');
+        return Tools.unseal(agreed(box, Buffer.from(ephemeral, 'base64')), sealed);
+      } catch {
+        return undefined;
+      }
+    },
+    pack: () => ({ box: packed(box), next: packed(next), present: packed(present) }),
+    pk: rawPk(present),
+    sign: (bytes) => sign(null, bytes, present).toString('base64'),
+    succeed: () =>
+      voiced({
+        box: generateKeyPairSync('x25519').privateKey,
+        next: generateKeyPairSync('ed25519').privateKey,
+        present: next,
+      }),
+  });
+
+const Voice = Object.freeze(
+  Object.assign(
+    () =>
+      voiced({
+        box: generateKeyPairSync('x25519').privateKey,
+        next: generateKeyPairSync('ed25519').privateKey,
+        present: generateKeyPairSync('ed25519').privateKey,
+      }),
+    {
+      revive: (bundle) => {
+        try {
+          return voiced({
+            box: unpacked(bundle.box),
+            next: unpacked(bundle.next),
+            present: unpacked(bundle.present),
+          });
+        } catch {
+          return undefined;
+        }
+      },
+      sealTo: (boxPk, value) => {
+        const ephemeral = generateKeyPairSync('x25519');
+        return `${rawPk(ephemeral.privateKey).toString('base64')}.${Tools.seal(
+          agreed(ephemeral.privateKey, boxPk),
+          value,
+        )}`;
+      },
+    },
+  ),
+);
+
+export { Voice };

package/completion.js

@@ -1,122 +0,0 @@
-// nervur — shell completion (`nervur completion [bash|zsh]`). Client-local like
-// scaffold: touches no carcass. One verb table is the single truth; both scripts
-// are generated from it so a new verb lands in completion by editing one list.
-// No prompt anywhere: the shell is a positional with a sane default ($SHELL).
-
-import { appendFileSync, existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'
-import { homedir } from 'node:os'
-import { join } from 'node:path'
-
-// verb → one-line description; subs/kinds drive second-position completion.
-export const VERBS = [
-  ['install', 'stand a published carcass at NERVUR_HOME'],
-  ['up', '(dev bench) preflight, then stand the ground'],
-  ['down', 'stop the ground'],
-  ['reset', 'stop the ground and wipe its data'],
-  ['preflight', 'run the bench preflight and report'],
-  ['whoami', 'ask the carcass who it is'],
-  ['status', 'ask the carcass for its status'],
-  ['identity', 'manage identities (add · key · list · remove)'],
-  ['use', 'select the identity the verbs act as'],
-  ['add', 'add a being under the selected identity'],
-  ['list', 'list the beings on the ground'],
-  ['remove', 'remove a being'],
-  ['scaffold', 'mint a species repo from a template'],
-  ['deploy', 'grant + pin + run a species'],
-  ['species', 'list deployed species and their pins'],
-  ['completion', 'print the shell completion script (bash · zsh)'],
-  ['help', 'show help']
-]
-
-const names = VERBS.map(([v]) => v).join(' ')
-
-const bash = () => `# nervur completion (bash)
-# load now:   eval "$(nervur completion bash)"
-# persist:    nervur completion bash >> ~/.bashrc   (or into bash_completion.d)
-_nervur() {
-  local cur prev
-  cur="\${COMP_WORDS[COMP_CWORD]}"
-  prev="\${COMP_WORDS[COMP_CWORD-1]}"
-  case "$prev" in
-    identity)   COMPREPLY=($(compgen -W "add key list remove" -- "$cur")); return ;;
-    completion) COMPREPLY=($(compgen -W "bash zsh" -- "$cur")); return ;;
-    add|--kind) COMPREPLY=($(compgen -W "empty" -- "$cur")); return ;;
-    --dir)      COMPREPLY=($(compgen -d -- "$cur")); return ;;
-  esac
-  case "$cur" in
-    --*) COMPREPLY=($(compgen -W "--as --no-door --kind --dir --key" -- "$cur")); return ;;
-  esac
-  if [ "$COMP_CWORD" -eq 1 ]; then
-    COMPREPLY=($(compgen -W "${names}" -- "$cur"))
-  fi
-}
-complete -F _nervur nervur
-`
-
-const zsh = () => `#compdef nervur
-# nervur completion (zsh)
-# load now:   eval "$(nervur completion zsh)"
-# persist:    nervur completion zsh > "\${fpath[1]}/_nervur" && rm -f ~/.zcompdump; compinit
-_nervur() {
-  local -a verbs
-  verbs=(
-${VERBS.map(([v, d]) => `    '${v}:${d.replace(/'/g, "'\\''")}'`).join('\n')}
-  )
-  if (( CURRENT == 2 )); then
-    _describe 'verb' verbs
-    return
-  fi
-  case "\${words[2]}" in
-    identity)     (( CURRENT == 3 )) && _values 'sub' add key list remove ;;
-    completion)   (( CURRENT == 3 )) && _values 'shell' bash zsh ;;
-    add)          (( CURRENT == 3 )) && _values 'kind' empty ;;
-    scaffold)     _arguments '--kind[template kind]:kind:(empty)' '--dir[target directory]:dir:_directories' ;;
-    up|preflight) _arguments '--no-door[stand on localhost only (headless/CI)]' ;;
-  esac
-}
-if (( ! $+functions[compdef] )); then
-  autoload -Uz compinit
-  compinit
-fi
-compdef _nervur nervur
-`
-
-export function completionScript(shell) {
-  const which = shell ?? (process.env.SHELL?.endsWith('zsh') ? 'zsh' : 'bash')
-  if (which === 'zsh') return zsh()
-  if (which === 'bash') return bash()
-  throw new Error(`usage: nervur completion [bash|zsh] — '${which}' is not a shell I know`)
-}
-
-const MARK_OPEN = '# >>> nervur completion >>>'
-const MARK_CLOSE = '# <<< nervur completion <<<'
-
-// Wire completion for the operator's shell: the script lands as a file in the
-// nervur home and the rc file gains one marked source-block — sourcing a file
-// costs nothing per shell start, where `eval "$(nervur completion)"` would
-// spawn node every time. Idempotent by the marker block (the dev/hosts.sh
-// idiom): re-wiring rewrites the block in place, never stacks a second one.
-export function wireCompletion(home) {
-  const shell = process.env.SHELL?.endsWith('zsh')
-    ? 'zsh'
-    : process.env.SHELL?.endsWith('bash')
-      ? 'bash'
-      : null
-  if (!shell) return { wired: false }
-  mkdirSync(home, { recursive: true })
-  const scriptPath = join(home, `completion.${shell}`)
-  writeFileSync(scriptPath, completionScript(shell))
-  const rc = join(homedir(), shell === 'zsh' ? '.zshrc' : '.bashrc')
-  const block = `${MARK_OPEN}\n[ -f "${scriptPath}" ] && source "${scriptPath}"\n${MARK_CLOSE}\n`
-  const current = existsSync(rc) ? readFileSync(rc, 'utf8') : ''
-  if (current.includes(MARK_OPEN)) {
-    const next = current.replace(
-      current.slice(current.indexOf(MARK_OPEN), current.indexOf(MARK_CLOSE) + MARK_CLOSE.length + 1),
-      block
-    )
-    if (next !== current) writeFileSync(rc, next)
-  } else {
-    appendFileSync(rc, `${current && !current.endsWith('\n') ? '\n' : ''}\n${block}`)
-  }
-  return { wired: true, shell, rc, scriptPath }
-}