wikimemory 0.2.0

package/src/domain/secret-scanner.ts

@@ -0,0 +1,45 @@
+export interface SecretFinding {
+  field: string;
+  category: "private_key" | "aws_access_key" | "provider_token" | "credential_assignment";
+  fingerprint: string;
+}
+
+const PATTERNS: Array<{ category: SecretFinding["category"]; regex: RegExp }> = [
+  { category: "private_key", regex: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g },
+  { category: "aws_access_key", regex: /\bAKIA[0-9A-Z]{16}\b/g },
+  {
+    category: "provider_token",
+    regex: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,})\b/g
+  },
+  {
+    category: "credential_assignment",
+    regex: /\b(?:api[_-]?key|password|secret|token)\s*[:=]\s*["']?[^\s"']{12,}/gi
+  }
+];
+
+async function fingerprint(value: string): Promise<string> {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(value));
+  return Array.from(new Uint8Array(digest).slice(0, 8), (byte) =>
+    byte.toString(16).padStart(2, "0")
+  ).join("");
+}
+
+export async function scanSecrets(
+  fields: Readonly<Record<string, string>>
+): Promise<SecretFinding[]> {
+  const findings: SecretFinding[] = [];
+  for (const [field, value] of Object.entries(fields)) {
+    const seen = new Set<string>();
+    for (const { category, regex } of PATTERNS) {
+      regex.lastIndex = 0;
+      for (const match of value.matchAll(regex)) {
+        const candidate = match[0];
+        const key = `${category}:${candidate}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        findings.push({ field, category, fingerprint: await fingerprint(candidate) });
+      }
+    }
+  }
+  return findings;
+}

package/src/domain/text-chunk.ts

@@ -0,0 +1,24 @@
+export interface TextChunk {
+  body: string;
+  nextOffset: number | null;
+}
+
+export function chunkText(value: string, offset: number, maximumCharacters: number): TextChunk {
+  const characters = Array.from(value);
+  const hardEnd = Math.min(characters.length, offset + maximumCharacters);
+  let end = hardEnd;
+  if (hardEnd < characters.length && maximumCharacters >= 8) {
+    const earliestBreak = offset + Math.floor(maximumCharacters * 0.6);
+    for (let index = hardEnd - 1; index >= earliestBreak; index -= 1) {
+      const character = characters[index];
+      if (character !== undefined && /\s/u.test(character)) {
+        end = index + 1;
+        break;
+      }
+    }
+  }
+  return {
+    body: characters.slice(offset, end).join(""),
+    nextOffset: end < characters.length ? end : null
+  };
+}

package/src/domain/types.ts

@@ -0,0 +1,169 @@
+export const DOCUMENT_TYPES: readonly ["system", "project", "topic", "source", "note"] = [
+  "system",
+  "project",
+  "topic",
+  "source",
+  "note"
+];
+export type DocumentType = (typeof DOCUMENT_TYPES)[number];
+
+export const LINK_KINDS: readonly ["related", "part_of", "supersedes", "cites", "contradicts"] = [
+  "related",
+  "part_of",
+  "supersedes",
+  "cites",
+  "contradicts"
+];
+export type LinkKind = (typeof LINK_KINDS)[number];
+
+export type MemoryScope = "memory:read" | "memory:write" | "memory:admin";
+
+export interface ActorContext {
+  workspaceId: string;
+  principalId: string;
+  clientId: string;
+  agentLabel?: string;
+  scopes: ReadonlySet<MemoryScope>;
+  requestId: string;
+}
+
+export interface MetadataPatch {
+  set?: Record<string, string | null>;
+  multi?: Record<string, { replace?: string[]; add?: string[]; remove?: string[] }>;
+}
+
+export interface LinkValue {
+  kind: LinkKind;
+  targetSlug: string;
+}
+
+export interface LinkPatch {
+  add?: LinkValue[];
+  remove?: LinkValue[];
+}
+
+export interface IngestRequest {
+  operationId: string;
+  reason: string;
+  slug: string;
+  expectedRevisionId?: string;
+  type?: DocumentType;
+  title?: string;
+  body?: string;
+  summary?: string | null;
+  metadata?: MetadataPatch;
+  links?: LinkPatch;
+}
+
+export interface MetadataValue {
+  key: string;
+  value: string;
+  cardinality: "singleton" | "multi";
+}
+
+export interface StoredLink extends LinkValue {
+  origin: "explicit" | "body";
+  targetDocumentId: string | null;
+}
+
+export interface DocumentSnapshot {
+  documentId: string;
+  workspaceId: string;
+  slug: string;
+  type: DocumentType;
+  revisionId: string;
+  revisionNumber: number;
+  parentRevisionId: string | null;
+  title: string;
+  body: string;
+  summary: string | null;
+  createdAt: string;
+  principalId: string;
+  clientId: string;
+  agentLabel: string | null;
+  reason: string;
+  restoredFromRevisionId: string | null;
+  metadata: MetadataValue[];
+  links: StoredLink[];
+}
+
+export interface IngestResult {
+  documentId: string;
+  revisionId: string;
+  revisionNumber: number;
+  slug: string;
+  idempotentReplay: boolean;
+  unresolvedReferences: string[];
+}
+
+export interface RestoreRequest {
+  operationId: string;
+  reason: string;
+  slug: string;
+  targetRevisionId: string;
+  expectedRevisionId: string;
+}
+
+export interface LinkRequest {
+  operationId: string;
+  reason: string;
+  sourceSlug: string;
+  expectedRevisionId: string;
+  action: "add" | "remove";
+  link: LinkValue;
+}
+
+export interface OwnerContext extends ActorContext {
+  role: "owner";
+  reauthenticatedAt: string;
+  credentialId?: string;
+}
+
+export interface PurgeAuthorization {
+  id: string;
+  documentId: string;
+  slug: string;
+  expiresAt: string;
+}
+
+export interface RecallHit {
+  documentId: string;
+  revisionId: string;
+  slug: string;
+  type: DocumentType;
+  title: string;
+  summary: string | null;
+  snippet: string;
+  score: number;
+}
+
+export interface DocumentIndexEntry {
+  documentId: string;
+  revisionId: string;
+  revisionNumber: number;
+  slug: string;
+  type: DocumentType;
+  title: string;
+  summary: string | null;
+  updatedAt: string;
+  status: string | null;
+}
+
+export interface RevisionHeader {
+  revisionId: string;
+  revisionNumber: number;
+  parentRevisionId: string | null;
+  createdAt: string;
+  principalId: string;
+  clientId: string;
+  agentLabel: string | null;
+  reason: string;
+  restoredFromRevisionId: string | null;
+  requestHash: string;
+}
+
+export interface LintFinding {
+  kind: "unresolved_reference" | "orphan" | "missing_summary" | "stale_active_project";
+  slug: string;
+  detail: string;
+}

package/src/env.ts

@@ -0,0 +1,20 @@
+import type { OAuthHelpers } from "@cloudflare/workers-oauth-provider";
+
+export interface Env {
+  DB: D1Database;
+  OAUTH_KV: KVNamespace;
+  ASSETS: Fetcher;
+  OAUTH_PROVIDER: OAuthHelpers;
+  APP_ENV: "local" | "production";
+  APP_BASE_URL?: string;
+  SETUP_TOKEN_HASH?: string;
+}
+
+export function validateEnvironment(env: Env): void {
+  if (env.APP_ENV === "production") {
+    if (!env.APP_BASE_URL?.startsWith("https://"))
+      throw new Error("production APP_BASE_URL must use HTTPS");
+    if (!/^[a-f0-9]{64}$/u.test(env.SETUP_TOKEN_HASH ?? ""))
+      throw new Error("production SETUP_TOKEN_HASH must be a SHA-256 hex digest");
+  }
+}

package/src/index.ts

@@ -0,0 +1,138 @@
+import { OAuthProvider } from "@cloudflare/workers-oauth-provider";
+import { z } from "zod";
+import {
+  approveLocalAuthorization,
+  handleLocalAuthorization,
+  localAuthorizationOptions
+} from "./auth/local";
+import {
+  beginPasskeyAuthorization,
+  passkeyAuthorizationOptions,
+  productionWebOwner,
+  registrationOptions,
+  registrationVerify,
+  setupOptions,
+  setupVerify,
+  verifyPasskeyAuthorization
+} from "./auth/passkey";
+import { handlePasskeyApi } from "./auth/passkey-api";
+import { downscopeAccessToken } from "./auth/props";
+import { DomainError } from "./domain/errors";
+import type { Env } from "./env";
+import { validateEnvironment } from "./env";
+import { mcpHandler } from "./mcp/server";
+import { LATEST_SCHEMA_VERSION, WIKIMEMORY_VERSION } from "./version";
+import { handleWebApi } from "./web/app";
+
+const webHandler = {
+  async fetch(request: Request, env: Env): Promise<Response> {
+    validateEnvironment(env);
+    const url = new URL(request.url);
+    if (url.pathname === "/authorize")
+      return env.APP_ENV === "local"
+        ? handleLocalAuthorization(request, env)
+        : beginPasskeyAuthorization(request, env, "mcp");
+    if (url.pathname === "/api/local-authorize/options" && request.method === "GET")
+      return safeJson(() => localAuthorizationOptions(request, env));
+    if (url.pathname === "/api/local-authorize/approve" && request.method === "POST")
+      return safeJson(() => approveLocalAuthorization(request, env));
+    if (url.pathname === "/api/auth/options" && request.method === "GET")
+      return safeJson(() => passkeyAuthorizationOptions(request, env));
+    if (url.pathname === "/auth/passkey/verify" && request.method === "POST")
+      return safeJson(() => verifyPasskeyAuthorization(request, env));
+    if (url.pathname === "/setup/options" && request.method === "POST")
+      return safeJson(() => setupOptions(request, env));
+    if (url.pathname === "/setup/verify" && request.method === "POST")
+      return safeJson(() => setupVerify(request, env));
+    if (url.pathname === "/passkeys/add/options" && request.method === "POST")
+      return safeJson(() => registrationOptions(request, env));
+    if (url.pathname === "/passkeys/add/verify" && request.method === "POST")
+      return safeJson(() => registrationVerify(request, env));
+    if (url.pathname === "/api/passkeys") return safeJson(() => handlePasskeyApi(request, env));
+    if (env.APP_ENV === "production" && url.pathname === "/app/login")
+      return beginPasskeyAuthorization(request, env, "web");
+    if (env.APP_ENV === "local" && url.pathname === "/test/passkey/login")
+      return beginPasskeyAuthorization(request, env, "web");
+    if (env.APP_ENV === "local" && url.pathname === "/app/test-passkey-whoami") {
+      return Response.json({ authenticated: (await productionWebOwner(request, env)) !== null });
+    }
+    if (url.pathname === "/api/app" || url.pathname.startsWith("/api/app/"))
+      return handleWebApi(request, env);
+    if (url.pathname === "/health") {
+      return Response.json({ status: "ok", service: "wikimemory", version: WIKIMEMORY_VERSION });
+    }
+    if (url.pathname === "/ready") {
+      await env.DB.batch([
+        env.DB.prepare("SELECT 1 FROM passkey_credentials LIMIT 1"),
+        env.DB.prepare("SELECT 1 FROM passkey_bootstrap LIMIT 1"),
+        env.DB.prepare("SELECT 1 FROM passkey_challenges LIMIT 1"),
+        env.DB.prepare("SELECT 1 FROM passkey_registration_tokens LIMIT 1")
+      ]);
+      const schema = await env.DB.prepare(
+        "SELECT name FROM d1_migrations ORDER BY id DESC LIMIT 1"
+      ).first<{ name: string }>();
+      if (schema?.name !== LATEST_SCHEMA_VERSION)
+        throw new Error("Wikimemory database schema does not match this Worker version");
+      return Response.json({
+        status: "ready",
+        service: "wikimemory",
+        version: WIKIMEMORY_VERSION,
+        schemaVersion: schema.name
+      });
+    }
+    const asset = await env.ASSETS.fetch(request);
+    const headers = new Headers(asset.headers);
+    if (headers.get("content-type")?.startsWith("text/html")) {
+      headers.set(
+        "content-security-policy",
+        "default-src 'self'; connect-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'self'"
+      );
+      headers.set("referrer-policy", "no-referrer");
+      headers.set("x-frame-options", "DENY");
+      headers.set("x-content-type-options", "nosniff");
+      headers.set("cache-control", "no-store");
+    }
+    return new Response(asset.body, {
+      status: asset.status,
+      statusText: asset.statusText,
+      headers
+    });
+  }
+} satisfies ExportedHandler<Env>;
+
+async function safeJson(operation: () => Promise<Response>): Promise<Response> {
+  try {
+    return await operation();
+  } catch (error) {
+    if (
+      error instanceof z.ZodError ||
+      error instanceof SyntaxError ||
+      error instanceof DomainError
+    ) {
+      return Response.json({ error: "Invalid request." }, { status: 400 });
+    }
+    return Response.json({ error: "The authentication operation failed." }, { status: 500 });
+  }
+}
+
+export default new OAuthProvider<Env>({
+  apiRoute: "/mcp",
+  apiHandler: mcpHandler,
+  defaultHandler: webHandler,
+  authorizeEndpoint: "/authorize",
+  tokenEndpoint: "/oauth/token",
+  clientRegistrationEndpoint: "/oauth/register",
+  scopesSupported: ["memory:read", "memory:write", "memory:admin"],
+  allowPlainPKCE: false,
+  allowImplicitFlow: false,
+  disallowPublicClientRegistration: false,
+  accessTokenTTL: 3600,
+  refreshTokenTTL: 2_592_000,
+  clientRegistrationTTL: 7_776_000,
+  tokenExchangeCallback: downscopeAccessToken,
+  resourceMetadata: {
+    scopes_supported: ["memory:read", "memory:write", "memory:admin"],
+    bearer_methods_supported: ["header"],
+    resource_name: "Wikimemory"
+  }
+});

package/src/mcp/schemas.ts

@@ -0,0 +1,117 @@
+import { z } from "zod";
+
+const documentType = z.enum(["system", "project", "topic", "source", "note"]);
+const metadata = z.object({
+  key: z.string(),
+  value: z.string(),
+  cardinality: z.enum(["singleton", "multi"])
+});
+const link = z.object({
+  kind: z.enum(["related", "part_of", "supersedes", "cites", "contradicts"]),
+  targetSlug: z.string(),
+  origin: z.enum(["explicit", "body"]),
+  targetDocumentId: z.string().nullable()
+});
+const document = z.object({
+  documentId: z.string(),
+  workspaceId: z.string(),
+  slug: z.string(),
+  type: documentType,
+  revisionId: z.string(),
+  revisionNumber: z.number().int(),
+  parentRevisionId: z.string().nullable(),
+  title: z.string(),
+  body: z.string(),
+  summary: z.string().nullable(),
+  createdAt: z.string(),
+  principalId: z.string(),
+  clientId: z.string(),
+  agentLabel: z.string().nullable(),
+  reason: z.string(),
+  restoredFromRevisionId: z.string().nullable(),
+  metadata: z.array(metadata),
+  links: z.array(link)
+});
+const indexEntry = z.object({
+  documentId: z.string(),
+  revisionId: z.string(),
+  revisionNumber: z.number().int(),
+  slug: z.string(),
+  type: documentType,
+  title: z.string(),
+  summary: z.string().nullable(),
+  updatedAt: z.string(),
+  status: z.string().nullable()
+});
+const revision = z.object({
+  revisionId: z.string(),
+  revisionNumber: z.number().int(),
+  parentRevisionId: z.string().nullable(),
+  createdAt: z.string(),
+  principalId: z.string(),
+  clientId: z.string(),
+  agentLabel: z.string().nullable(),
+  reason: z.string(),
+  restoredFromRevisionId: z.string().nullable(),
+  requestHash: z.string()
+});
+const finding = z.object({
+  kind: z.enum(["unresolved_reference", "orphan", "missing_summary", "stale_active_project"]),
+  slug: z.string(),
+  detail: z.string()
+});
+const ingestResult = {
+  documentId: z.string(),
+  revisionId: z.string(),
+  revisionNumber: z.number().int(),
+  slug: z.string(),
+  idempotentReplay: z.boolean(),
+  unresolvedReferences: z.array(z.string())
+};
+
+export const MCP_OUTPUT_SCHEMAS = {
+  orient: {
+    now: document,
+    activeProjects: z.array(indexEntry),
+    recentRevisions: z.array(
+      z.object({
+        slug: z.string(),
+        revision_number: z.number().int(),
+        created_at: z.string(),
+        reason: z.string()
+      })
+    ),
+    lintCounts: z.record(z.string(), z.number().int().nonnegative())
+  },
+  recall: {
+    hits: z.array(
+      z.object({
+        documentId: z.string(),
+        revisionId: z.string(),
+        slug: z.string(),
+        type: documentType,
+        title: z.string(),
+        summary: z.string().nullable(),
+        snippet: z.string(),
+        score: z.number().min(0).max(1)
+      })
+    )
+  },
+  get: { ...document.shape, nextCursor: z.string().nullable() },
+  index: { items: z.array(indexEntry), nextCursor: z.string().nullable() },
+  history: { revisions: z.array(revision) },
+  lint: { findings: z.array(finding) },
+  ingest: ingestResult,
+  link: ingestResult,
+  restore_preview: {
+    slug: z.string(),
+    targetRevisionId: z.string(),
+    expectedCurrentRevisionId: z.string(),
+    titleChanged: z.boolean(),
+    bodyChanged: z.boolean(),
+    summaryChanged: z.boolean(),
+    metadataChanged: z.boolean(),
+    linksChanged: z.boolean()
+  },
+  restore_apply: ingestResult
+} satisfies Record<string, z.ZodRawShape>;