yakmesh 2.9.0 → 3.0.0

package/mesh/beacon-broadcast.js

@@ -32,7 +32,10 @@
  */
 
 import { randomBytes, createHash } from 'crypto';
-import { sha3_256 } from '@noble/hashes/sha3.js';
+import { sha3_256 as _nobleSha3 } from '@noble/hashes/sha3.js';
+
+// ACCEL: Hardware-accelerated SHA3-256 (OpenSSL/SHA-NI — 4.6x faster)
+import { sha3_256 } from '../utils/accel.js';
 import { bytesToHex, utf8ToBytes } from '@noble/hashes/utils.js';
 
 // YPC-27 quantum-hard checksums for packet integrity

package/mesh/darshan.js

@@ -37,9 +37,11 @@
  */
 
 import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';
-import { sha3_256 } from '@noble/hashes/sha3.js';
+import { sha3_256 as _nobleSha3 } from '@noble/hashes/sha3.js';
 import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';
 import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+// ACCEL: Hardware-accelerated crypto
+import { sha3_256, mlDsa65Sign, mlDsa65Verify } from '../utils/accel.js';
 import { createLogger } from '../utils/logger.js';
 import EventEmitter from 'events';
 
@@ -211,6 +213,16 @@ export class DarshanContent {
     if (this.path && this.path.length > DARSHAN_CONFIG.maxPathLength) {
       errors.push('path too long');
     }
+    // Defense-in-depth: reject path traversal at validation layer too.
+    // Note: absolute paths are allowed here because the HOST node legitimately
+    // uses them to register content from its own filesystem. The API boundary
+    // (darshan-api.js) rejects absolute paths from external requests.
+    if (this.path) {
+      const normalized = String(this.path).replace(/\\/g, '/');
+      if (normalized.includes('..')) {
+        errors.push('path traversal not allowed');
+      }
+    }
     if (this.size > DARSHAN_CONFIG.maxContentSize) {
       errors.push('content exceeds max size');
     }
@@ -537,7 +549,7 @@ export class DarshanAttestation {
    */
   signAsViewer(secretKey) {
     const payload = utf8ToBytes(this.getSignablePayload());
-    const signature = ml_dsa65.sign(payload, secretKey);
+    const signature = mlDsa65Sign(payload, secretKey);
     this.viewerSignature = bytesToHex(signature);
     return this;
   }
@@ -548,7 +560,7 @@ export class DarshanAttestation {
   signAsHost(secretKey) {
     // Include viewer signature in host signing
     const payload = utf8ToBytes(this.getSignablePayload() + (this.viewerSignature || ''));
-    const signature = ml_dsa65.sign(payload, secretKey);
+    const signature = mlDsa65Sign(payload, secretKey);
     this.hostSignature = bytesToHex(signature);
     return this;
   }
@@ -563,7 +575,7 @@ export class DarshanAttestation {
       const payload = utf8ToBytes(this.getSignablePayload());
       const signatureBytes = hexToBytes(this.viewerSignature);
       const publicKeyBytes = typeof publicKey === 'string' ? hexToBytes(publicKey) : publicKey;
-      return ml_dsa65.verify(signatureBytes, payload, publicKeyBytes);
+      return mlDsa65Verify(signatureBytes, payload, publicKeyBytes);
     } catch (err) {
       return false;
     }
@@ -579,7 +591,7 @@ export class DarshanAttestation {
       const payload = utf8ToBytes(this.getSignablePayload() + (this.viewerSignature || ''));
       const signatureBytes = hexToBytes(this.hostSignature);
       const publicKeyBytes = typeof publicKey === 'string' ? hexToBytes(publicKey) : publicKey;
-      return ml_dsa65.verify(signatureBytes, payload, publicKeyBytes);
+      return mlDsa65Verify(signatureBytes, payload, publicKeyBytes);
     } catch (err) {
       return false;
     }

package/mesh/gumba.js

@@ -39,13 +39,16 @@
  */
 
 import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';
-import { sha3_256 } from '@noble/hashes/sha3.js';
+import { sha3_256 as _nobleSha3 } from '@noble/hashes/sha3.js';
 import { bytesToHex, hexToBytes, utf8ToBytes } from '@noble/hashes/utils.js';
 import { ml_dsa65 } from '@noble/post-quantum/ml-dsa.js';
+// ACCEL: Hardware-accelerated crypto
+import { sha3_256, mlDsa65Sign, mlDsa65Verify } from '../utils/accel.js';
 import { createLogger } from '../utils/logger.js';
 import EventEmitter from 'events';
 
 const log = createLogger('mesh:gumba');
+const peerTag = (id) => id?.split('-pq-').pop() || id?.slice?.(-8) || String(id);
 
 // ═══════════════════════════════════════════════════════════════════════════════
 // CONFIGURATION
@@ -521,7 +524,7 @@ export class GumbaProof {
     
     const payloadBytes = utf8ToBytes(payload);
     // API: sign(message, secretKey)
-    const signature = ml_dsa65.sign(payloadBytes, secretKey);
+    const signature = mlDsa65Sign(payloadBytes, secretKey);
     
     return {
       ...challenge,
@@ -556,7 +559,7 @@ export class GumbaProof {
         : publicKey;
       
       // API: verify(signature, message, publicKey)
-      const valid = ml_dsa65.verify(signatureBytes, payloadBytes, publicKeyBytes);
+      const valid = mlDsa65Verify(signatureBytes, payloadBytes, publicKeyBytes);
       
       return { valid, reason: valid ? 'OK' : 'INVALID_SIGNATURE' };
     } catch (err) {
@@ -591,7 +594,7 @@ export class GumbaProof {
     const payload = JSON.stringify(attestation);
     const payloadBytes = utf8ToBytes(payload);
     // API: sign(message, secretKey)
-    const signature = ml_dsa65.sign(payloadBytes, grantorSecretKey);
+    const signature = mlDsa65Sign(payloadBytes, grantorSecretKey);
     
     return {
       ...attestation,
@@ -632,7 +635,7 @@ export class GumbaProof {
         : grantorPublicKey;
       
       // API: verify(signature, message, publicKey)
-      const valid = ml_dsa65.verify(signatureBytes, payloadBytes, publicKeyBytes);
+      const valid = mlDsa65Verify(signatureBytes, payloadBytes, publicKeyBytes);
       
       return { valid, reason: valid ? 'OK' : 'INVALID_SIGNATURE' };
     } catch (err) {
@@ -1236,9 +1239,12 @@ export class GumbaHub extends EventEmitter {
     // Access sessions
     this.sessions = new Map(); // sessionId -> { dokoId, bundleIds, expiresAt }
     
-    // Public key registry (for testing/local lookups before KHATA integration)
+    // Public key registry (for testing/local lookups before KeyResolver integration)
     this.publicKeys = new Map(); // dokoId -> publicKey
     
+    // KeyResolver: unified key resolution (attached lazily)
+    this.keyResolver = options.keyResolver || null;
+    
     // Stats
     this.stats = {
       bundlesCreated: 0,
@@ -1379,8 +1385,27 @@ export class GumbaHub extends EventEmitter {
     
     this.stats.messagesProcessed += result.count;
     
-    // TODO: Deliver via ANNEX for E2E encryption to visitor
-    // For now, return directly
+    // Deliver via ANNEX for E2E encryption to remote visitor
+    if (this.annex && session.visitorNodeId) {
+      try {
+        await this.annex.send(session.visitorNodeId, {
+          type: 'gumba:messages',
+          sessionId,
+          bundleId: session.bundleId,
+          ...result,
+        });
+        return { delivered: true, via: 'annex', count: result.count };
+      } catch (err) {
+        // HARD FAIL: No plaintext fallback. GUMBA content is encrypted for a reason.
+        // Returning decrypted content in plaintext defeats the entire security model.
+        log.error('ANNEX delivery failed — refusing plaintext return', {
+          visitor: peerTag(session.visitorNodeId),
+          error: err.message,
+        });
+        return { error: 'ENCRYPTION_REQUIRED', message: 'ANNEX session required for content delivery' };
+      }
+    }
+    
     return result;
   }
   
@@ -1475,11 +1500,15 @@ export class GumbaHub extends EventEmitter {
   }
   
   /**
-   * Get DOKO public key from mesh
-   * TODO: Integrate with KHATA protocol
+   * Get DOKO public key — unified resolution cascade
+   * 
+   * Resolution order:
+   *   1. Local publicKeys map (test/pre-cached)
+   *   2. Own identity
+   *   3. KeyResolver (DOKO cache, peers, SHERPA, etc.)
    */
   async _getDokoPublicKey(dokoId) {
-    // Check local registry first
+    // Check local registry first (backwards compat)
     if (this.publicKeys.has(dokoId)) {
       return this.publicKeys.get(dokoId);
     }
@@ -1489,8 +1518,13 @@ export class GumbaHub extends EventEmitter {
       return this.identity.identity.publicKey;
     }
     
-    // TODO: Query KHATA network
-    log.warn('DOKO public key lookup not implemented', { dokoId: dokoId.slice(0, 16) });
+    // KeyResolver: unified key resolution
+    if (this.keyResolver) {
+      const key = this.keyResolver.resolve(dokoId);
+      if (key) return key;
+    }
+    
+    log.warn('DOKO public key not found', { dokoId: dokoId.slice(0, 16) });
     return null;
   }