fleetmesh-node 0.2.0__py3-none-any.whl

node/protocols/nostr/eventstore.py

@@ -0,0 +1,304 @@
+"""The node's event store: the reference SqliteStore, safe to share across threads.
+
+The relay face serves every connection on its own thread and the sync
+sessions run on others, all against one store. sqlite3 connections refuse
+use from a thread other than the one that opened them unless told otherwise,
+and even then two threads must not interleave statements. So: one
+connection opened for any thread, and one lock around every primitive the
+reference defines. The reference's own semantics - what supersedes what,
+tombstones, ranges, fingerprints - are inherited untouched.
+"""
+from __future__ import annotations
+
+from typing import Any, Callable, Iterable, Optional, TypedDict
+
+from node.compartment.schema import Column, Index, Table
+from node.interfaces import NostrEvent
+from node.storage import SqliteStore
+from fleetmesh_core.storage import store
+
+
+class BridgeCursorRecord(TypedDict):
+    relay: str
+    last_reconciled_at: int
+    last_event_at: int
+    events_reconciled: int
+
+
+class NodeStore(SqliteStore, store.SqliteStore):
+    LOCAL: str = 'local'
+    MESH: str = 'mesh'
+
+    # The reference's own tables first, verbatim, then this node's additions.
+    # The connection, PRAGMAs and lock come from BaseSqliteStore; the
+    # reference's query semantics - what supersedes what, tombstones, ranges,
+    # fingerprints - come from store.SqliteStore, whose __init__ is bypassed
+    # because the base already opened the connection and built the schema.
+    SCHEMA = (
+        Table('events', (
+            Column('id', 'TEXT', primary_key=True),
+            Column('pubkey', 'TEXT'),
+            Column('created_at', 'INTEGER'),
+            Column('kind', 'INTEGER'),
+            Column('json', 'TEXT'),
+        ), indices=(
+            Index('events_created_at', ('created_at', 'id')),
+            # Supersession and deletion ask for one author's events, and
+            # asked it of the whole table until this existed.
+            Index('events_author_kind', ('pubkey', 'kind')),
+            Index('events_kind_created_at', ('kind', 'created_at', 'id')),
+        )),
+        Table('tombstones', (
+            Column('key', 'TEXT', not_null=True),
+            Column('deleter', 'TEXT', not_null=True),
+        ), primary_key=('key', 'deleter')),
+        # Where each event came from. Not a protocol field and not in the
+        # reference: the specification only says what a node may *claim*,
+        # and forbids asserting completeness over a shard it holds only
+        # through mesh replication, which is how third-party replication
+        # would launder unverified peer data into an authoritative record.
+        # Knowing which is which is this implementation's own problem.
+        Table('origin', (
+            Column('id', 'TEXT', primary_key=True),
+            Column('origin', 'TEXT', not_null=True),
+        )),
+        # Single-letter tags, which is the set NIP-01 indexes. A client
+        # asking for its own gift wraps decoded every wrap in the store
+        # without this.
+        Table('tags', (
+            Column('id', 'TEXT', not_null=True),
+            Column('name', 'TEXT', not_null=True),
+            Column('value', 'TEXT', not_null=True),
+        ), primary_key=('id', 'name', 'value'), indices=(
+            Index('tags_name_value', ('name', 'value')),
+        ), without_rowid=True),
+        # Persistent checkpoints for external relay bridge reconciliation.
+        Table('bridge_cursor', (
+            Column('relay', 'TEXT', primary_key=True),
+            Column('last_reconciled_at', 'INTEGER'),
+            Column('last_event_at', 'INTEGER'),
+            Column('events_reconciled', 'INTEGER', default=0),
+        )),
+    )
+
+    def __init__(self, path: str = ':memory:', **kw: Any) -> None:
+        SqliteStore.__init__(self, path, **kw)
+        # After the lock exists and not before it. _index_tags goes through
+        # _locked like every other writer, so backfilling above this line
+        # raised AttributeError on the way up and took every node down at once
+        # - which is the same mistake, in the same shape, as the Reporter that
+        # read its account store four lines above the ledger it filled.
+        self._backfill_tags()
+        self.origin_swept: int = self._sweep_origin()
+
+    def _sweep_origin(self) -> int:
+        """Drop provenance rows for events this store no longer holds.
+
+        `_drop` used to leave them: every superseded replaceable event and
+        every NIP-09 deletion left its `origin` row behind - measured at two
+        events held against seven rows - and nothing ever read or removed
+        them (audit 2026-10-15, B3). `_drop` clears its own row now, which
+        stops that source. One remains by design: sync records a delivered
+        event's origin before deciding whether to keep it (`sync/initiator`),
+        so a delivery that is refused leaves a row too. Hence on every open,
+        not once: after the first it removes only those, in one indexed
+        anti-join, before anything else can write.
+        """
+        with self._lock:
+            cur = self.execute('DELETE FROM origin WHERE id NOT IN (SELECT id FROM events)')
+            self.db.commit()
+            return max(0, int(cur.rowcount or 0))
+
+    @staticmethod
+    def _locked(name: str) -> Callable[..., Any]:
+        def method(self: Any, *a: Any, **k: Any) -> Any:
+            with self._lock:
+                return getattr(store.SqliteStore, name)(self, *a, **k)
+        method.__name__ = name
+        return method
+
+    _put = _locked('_put')
+
+    def _drop(self, event_id: str) -> None:
+        """The reference's drop, plus this node's own provenance row.
+
+        Called by supersession and by a NIP-09 deletion, inside the one
+        transaction `insert_event` holds (`_atomic` joins it), so the event,
+        its tags and its origin go together or not at all. `forget` already
+        removed all three; this is the other way an event leaves (B3).
+        """
+        with self._lock, self._atomic():
+            store.SqliteStore._drop(self, event_id)
+            self.execute('DELETE FROM origin WHERE id = ?', (event_id,))
+
+    def _all(self, q: Optional[str] = None, args: Any = ()) -> list[Any]:
+        if q is not None:
+            return SqliteStore._all(self, q, args)
+        with self._lock:
+            return store.SqliteStore._all(self)
+    _get = _locked('_get')
+    # The narrowing reads go through the lock like every other primitive: the
+    # relay face serves each connection on its own thread and the sync sessions
+    # run on others, and two threads must not interleave statements on one
+    # connection whatever the statement is.
+    _narrow = _locked('_narrow')
+    # Held across the read rather than around a fetchall: the point of it is
+    # that it stops early, and a fetchall would put the whole match set back
+    # in memory as the rows it was written to avoid parsing.
+    newest_matching = _locked('newest_matching')
+    _index_tags = _locked('_index_tags')
+    _by_author_kind = _locked('_by_author_kind')
+    _by_author = _locked('_by_author')
+    _tombstone = _locked('_tombstone')
+    _tombstoned_by = _locked('_tombstoned_by')
+    # insert_event reads then writes; hold the lock across the whole decision.
+    insert_event = _locked('insert_event')
+
+    def by_kind_before(self, kind: int, cutoff: int, cap: Optional[int] = None,
+                       after: Optional[tuple[int, str]] = None) -> list[NostrEvent]:
+        """Events of one kind dated before a cutoff, oldest first, one page.
+
+        For retention, which is the only caller. The index is on
+        (created_at, id), so this reads a range rather than the table.
+
+        `cap` and `after` are what keep the sweep from being the thing that
+        kills the node: a policy set for the first time on a face holding days
+        of gift wraps has every one of them past the cutoff at once, and this
+        used to answer with all of them parsed. `after` is the (created_at, id)
+        of the last row of the previous page, and the cursor rather than an
+        offset because the sweep is deleting as it walks - and because an event
+        held back inside a claimed shard stays, so a page that re-read what it
+        had refused would never end.
+        """
+        import json as _json
+        where: list[str] = ['kind = ?', 'created_at < ?']
+        args: list[int | str] = [int(kind), int(cutoff)]
+        if after is not None:
+            where.append('(created_at, id) > (?, ?)')
+            args.extend([int(after[0]), str(after[1])])
+        sql = ('SELECT json FROM events WHERE ' + ' AND '.join(where)
+               + ' ORDER BY created_at, id')
+        if cap is not None:
+            sql += ' LIMIT ?'
+            args.append(int(cap))
+        with self._lock:
+            rows = self.execute(sql, args).fetchall()
+        return [_json.loads(r[0]) for r in rows]
+
+    def count(self) -> int:
+        """How many events this node holds, as one number from the index.
+
+        Written into status.json on every tick, and until this existed it was
+        `len(self._all())`: the whole store parsed into dicts to be thrown
+        away, so the node's peak heap was the size of its store and the
+        allocator kept it. On the public face that was 600 MB of a 1 GB box
+        for a number that a COUNT answers without reading a row.
+        """
+        with self._lock:
+            return int(self.execute('SELECT COUNT(*) FROM events').fetchone()[0])
+
+    def forget(self, event_id: str) -> bool:
+        """Drop one event because this node stopped keeping it. NOT a deletion.
+
+        A NIP-09 kind 5 tombstones an id so a later re-offer cannot resurrect
+        it, because there the author said the thing should not exist. Retention
+        says only that THIS node stopped holding it, which is a fact about a
+        disk and not about the event: a peer may hand it back tomorrow and be
+        right to. So the row goes and no tombstone is written.
+        """
+        with self._lock:
+            cur = self.execute('DELETE FROM events WHERE id = ?', (event_id,))
+            self.execute('DELETE FROM origin WHERE id = ?', (event_id,))
+            self.execute('DELETE FROM tags WHERE id = ?', (event_id,))
+            self.db.commit()
+            return cur.rowcount > 0
+
+    def note_origin(self, event_id: str, origin: str) -> None:
+        """Record how one event reached this node. First writer wins: an event
+        this node already held locally is not reclassified because a peer later
+        sent it too."""
+        if origin not in (self.LOCAL, self.MESH):
+            raise ValueError('origin is local or mesh')
+        with self._lock:
+            self.execute('INSERT OR IGNORE INTO origin VALUES (?,?)', (event_id, origin))
+            self.db.commit()
+
+    def origin_of(self, event_id: str) -> Optional[str]:
+        with self._lock:
+            row = self.execute('SELECT origin FROM origin WHERE id = ?', (event_id,)).fetchone()
+        return row[0] if row else None
+
+    def any_replicated(self, event_ids: Iterable[str]) -> bool:
+        """True if any of these arrived through the mesh, or is of unknown origin.
+
+        Unknown counts as replicated. A claim of completeness is a falsifiable
+        assertion about data this node stands behind, and an event it cannot
+        account for the arrival of is not data it can stand behind.
+        """
+        ids = list(event_ids)
+        if not ids:
+            return False
+        with self._lock:
+            known: dict[str, str] = {}
+            # Chunked: a have/need may carry validate.MAX_IDS ids, past what
+            # SQLite binds in one statement.
+            for chunk in store.chunked(ids):
+                sql, vals = store.in_clause('id', chunk)
+                known.update((r[0], r[1]) for r in self.execute(
+                    'SELECT id, origin FROM origin WHERE ' + sql, vals))
+        return any(known.get(i) != self.LOCAL for i in ids)
+
+    def get_bridge_cursor(self, relay_url: str) -> Optional[BridgeCursorRecord]:
+        with self._lock:
+            cur = self.db.cursor()
+            cur.execute('SELECT last_reconciled_at, last_event_at, events_reconciled FROM bridge_cursor WHERE relay = ?', (relay_url,))
+            row = cur.fetchone()
+            if row is None:
+                return None
+            return {
+                'relay': relay_url,
+                'last_reconciled_at': row[0],
+                'last_event_at': row[1],
+                'events_reconciled': row[2],
+            }
+
+    def set_bridge_cursor(
+        self,
+        relay_url: str,
+        last_reconciled_at: Optional[int] = None,
+        last_event_at: Optional[int] = None,
+        count_increment: int = 0,
+    ) -> None:
+        with self._lock:
+            cur = self.db.cursor()
+            cur.execute('SELECT last_reconciled_at, last_event_at, events_reconciled FROM bridge_cursor WHERE relay = ?', (relay_url,))
+            row = cur.fetchone()
+            if row is None:
+                cur.execute(
+                    'INSERT INTO bridge_cursor (relay, last_reconciled_at, last_event_at, events_reconciled) VALUES (?, ?, ?, ?)',
+                    (relay_url, last_reconciled_at or 0, last_event_at or 0, count_increment)
+                )
+            else:
+                new_reconciled = last_reconciled_at if last_reconciled_at is not None else row[0]
+                new_event_at = max(row[1] or 0, last_event_at or 0)
+                new_count = (row[2] or 0) + count_increment
+                cur.execute(
+                    'UPDATE bridge_cursor SET last_reconciled_at = ?, last_event_at = ?, events_reconciled = ? WHERE relay = ?',
+                    (new_reconciled, new_event_at, new_count, relay_url)
+                )
+            self.db.commit()
+
+    def all_bridge_cursors(self) -> list[BridgeCursorRecord]:
+        with self._lock:
+            cur = self.db.cursor()
+            cur.execute('SELECT relay, last_reconciled_at, last_event_at, events_reconciled FROM bridge_cursor ORDER BY relay')
+            rows = cur.fetchall()
+            return [
+                {
+                    'relay': r[0],
+                    'last_reconciled_at': r[1],
+                    'last_event_at': r[2],
+                    'events_reconciled': r[3],
+                }
+                for r in rows
+            ]

node/protocols/nostr/package.py

@@ -0,0 +1,182 @@
+"""fleetmesh-protocol-nostr: Decoupled Nostr & Blossom protocol package.
+
+Conforms to ProtocolPackage (fleetmesh_core.wire.interfaces.ProtocolPackage).
+Wraps RelayServer and BlossomServer, allowing them to be mounted onto
+ProtocolHostRouter or operated with zero listening overhead when disabled.
+"""
+from __future__ import annotations
+
+from fleetmesh_core.wire import spelling  # noqa: E402
+
+from typing import Any, Callable, Mapping, Optional
+
+from fleetmesh_core.wire.interfaces import (
+    ProtocolHealth,
+    ProtocolHostRouter,
+    ProtocolIdentityAdapter,
+)
+from . import relayserver
+
+
+class NostrIdentityAdapter:
+    """Identity and assertion adapter for Nostr (secp256k1 / BIP-340)."""
+
+    def __init__(self, keystore: Any) -> None:
+        self.ks = keystore
+
+    def resolve_id(self, uri: str) -> Optional[str]:
+        # Handle npub1... or hex
+        if uri.startswith('npub1'):
+            try:
+                from fleetmesh_core.crypto import bech32
+                raw = bech32.bech32_decode('npub', uri)
+                if raw is not None:
+                    return raw.hex()
+            except Exception:
+                pass
+        elif spelling.is_hex(uri, 64, upper=True):
+            return uri.lower()
+        return None
+
+    def sign_assertion(self, payload: bytes) -> bytes:
+        import hashlib
+        from fleetmesh_core.crypto import crypto
+        msg32 = hashlib.sha256(payload).digest() if len(payload) != 32 else payload
+        sk = getattr(self.ks, 'node_sk', None)
+        sk_hex = sk.hex() if isinstance(sk, (bytes, bytearray)) else str(sk or '')
+        sig = crypto.schnorr_sign(msg32, sk_hex)
+        return bytes.fromhex(sig)
+
+    def verify_assertion(self, payload: bytes, signature: bytes, pubkey: str) -> bool:
+        import hashlib
+        from fleetmesh_core.crypto import crypto
+        msg32 = hashlib.sha256(payload).digest() if len(payload) != 32 else payload
+        try:
+            return crypto.schnorr_verify(msg32, pubkey, signature.hex())
+        except Exception:
+            return False
+
+
+class NostrProtocolPackage:
+    """The Nostr & Blossom protocol suite for Fleetmesh."""
+
+    name: str = 'nostr'
+    version: str = '1.0.0'
+    standards: tuple[str, ...] = (
+        'NIP-01', 'NIP-11', 'NIP-40', 'NIP-42', 'NIP-44', 'NIP-59', 'NIP-77',
+        'BUD-01', 'BUD-02', 'BUD-04',
+    )
+
+    def __init__(
+        self,
+        backend: Optional[Any] = None,
+        blob_store: Optional[Any] = None,
+        grants: Optional[Any] = None,
+        node: Optional[Any] = None,
+        clock: Optional[Callable[[], int]] = None,
+        name: str = 'meshnode',
+        pubkey: Optional[str] = None,
+    ) -> None:
+        self.backend = backend
+        self.blob_store = blob_store
+        self.grants = grants
+        self.node = node
+        self.clock = clock
+        self.node_name = name
+        self.pubkey = pubkey
+        self.config: Mapping[str, Any] = {}
+        self.relay_server: Optional[relayserver.RelayServer] = None
+        self._host: Optional[ProtocolHostRouter] = None
+        self._enabled: bool = True
+
+    def configure(self, config: Mapping[str, Any]) -> None:
+        self.config = dict(config)
+        self._enabled = self.config.get('enabled', True)
+
+    def identity_adapter(self, keystore: Any) -> Optional[ProtocolIdentityAdapter]:
+        if keystore is None:
+            return None
+        return NostrIdentityAdapter(keystore)
+
+    def mount_ingress(self, host: ProtocolHostRouter) -> None:
+        if not self._enabled:
+            return
+        self._host = host
+        if self.relay_server is None:
+            self.relay_server = relayserver.RelayServer(
+                backend=self.backend,
+                blob_store=self.blob_store,
+                grants=self.grants,
+                node=self.node,
+                clock=self.clock,
+                name=self.node_name,
+                pubkey=self.pubkey,
+                future_seconds=self.config.get('future_seconds', 900),
+                require_auth=self.config.get('require_auth', False),
+                host_router=host,
+            )
+        self.relay_server.mount_ingress(host, owner='nostr')
+
+    def transport_rung(self, context: Any) -> Optional[Any]:
+        # Outbound RelayRung for TransportRouter
+        if not self._enabled:
+            return None
+        from node.transport.relay_rung import RelayRung
+        from node.transport.rung import RelayRungAdapter
+        if context is not None and hasattr(context, 'nostr'):
+            return RelayRungAdapter(context)
+        if context is not None and hasattr(context, 'ks') and hasattr(context, 'peers'):
+            return RelayRung(
+                keystore=context.ks,
+                peers=context.peers,
+                relay_urls=self.config.get('relays', ()),
+                clock=context.clock,
+            )
+        return None
+
+    def compartments(self) -> tuple[type[Any], ...]:
+        # Background compartments associated with Nostr
+        return ()
+
+    def start(self) -> None:
+        if not self._enabled:
+            return
+        if self.relay_server is not None:
+            self.relay_server.start()
+
+    def stop(self) -> None:
+        if self.relay_server is not None:
+            self.relay_server.stop()
+
+    def health(self) -> ProtocolHealth:
+        if not self._enabled:
+            return ProtocolHealth(
+                healthy=True,
+                status="disabled",
+                connections_active=0,
+                messages_in=0,
+                messages_out=0,
+                errors=(),
+            )
+        if self.relay_server is not None:
+            return ProtocolHealth(
+                healthy=True,
+                status="serving",
+                connections_active=len(getattr(self.relay_server, '_conns', {})),
+                messages_in=self.relay_server.accepted,
+                messages_out=0,
+                errors=(),
+            )
+        return ProtocolHealth(
+            healthy=True,
+            status="configured",
+            connections_active=0,
+            messages_in=0,
+            messages_out=0,
+            errors=(),
+        )
+
+    def descriptor_capabilities(self) -> tuple[tuple[str, str], ...]:
+        if not self._enabled:
+            return ()
+        return (('c', 'relay'), ('c', 'negentropy'))

node/protocols/nostr/peers.py

@@ -0,0 +1,109 @@
+"""What this node knows about other nodes: their live descriptors.
+
+A peer is addressed by its node pubkey. From its descriptor come the
+agreement key an envelope is encrypted to, the class, the protocols it
+implements and the endpoints. Descriptors are cached and refreshed from
+relays when missing or expired, and every one goes through
+fleetmesh_core.identity.validate_descriptor before it is believed.
+"""
+from __future__ import annotations
+
+import threading
+import time
+from typing import Callable, Optional, Sequence
+
+from cryptography.hazmat.primitives.asymmetric import x25519
+from fleetmesh_core.crypto import keys  # noqa: E402
+from fleetmesh_core.identity import identity  # noqa: E402
+from node.interfaces import NostrEvent  # noqa: E402
+from . import descriptor  # noqa: E402
+
+
+def agreement_key(desc: NostrEvent) -> Optional[x25519.X25519PublicKey]:
+    """The X25519 public key a descriptor's agreement Multikey names, or None."""
+    for t in desc.get('tags', []):
+        if t and t[0] == 'key' and len(t) > 2 and t[1] == 'agreement':
+            kind, raw = keys.parse_multikey(t[2])
+            if kind == 'agreement':
+                return keys.agreement_public(raw)
+    return None
+
+
+from fleetmesh_core.identity.did import node_of_did
+
+__all__ = ['Peers', 'agreement_key']
+
+
+class Peers:
+    # A descriptor that is not on the relays is asked for again on every
+    # message its key sends, and the asking happens on the transport's
+    # listener thread with the relay timeout in front of it. A stranger with
+    # no descriptor could hold that thread for fifteen seconds per wrap. A
+    # miss is remembered for this long before the relays are asked again.
+    MISS_TTL: int = 60
+
+    def __init__(
+        self,
+        relay_urls: Sequence[str] = (),
+        clock: Optional[Callable[[], int]] = None,
+        timeout: float = 15.0,
+        resolver: Optional[Callable[[str, Sequence[str], Optional[int], float], Optional[NostrEvent]]] = None,
+    ) -> None:
+        self.relays: list[str] = list(relay_urls)
+        self.clock: Callable[[], int] = clock or (lambda: int(time.time()))
+        self.timeout: float = timeout
+        # How a descriptor not held is looked up; given so a test can count
+        # the lookups without touching the descriptor module.
+        self.resolver = resolver or (lambda pk, urls, now, timeout: descriptor.resolve(pk, urls, now=now, timeout=timeout))
+        self._cache: dict[str, NostrEvent] = {}
+        self._missing: dict[str, int] = {}          # pubkey -> when a failed resolve may be retried
+        self._lock: threading.Lock = threading.Lock()
+
+    def learn(self, desc: NostrEvent) -> bool:
+        """Accept a descriptor if it is genuine, validates and is newer than what we hold."""
+        if not descriptor.genuine(desc) or identity.validate_descriptor(desc, now=self.clock(), digest=descriptor.DIGEST):
+            return False
+        with self._lock:
+            have = self._cache.get(desc['pubkey'])
+            if have is None or desc['created_at'] > have['created_at']:
+                self._cache[desc['pubkey']] = desc
+                self._missing.pop(desc['pubkey'], None)
+                return True
+        return False
+
+    def descriptor(self, pubkey: str, refresh: bool = False) -> Optional[NostrEvent]:
+        now = self.clock()
+        with self._lock:
+            d = self._cache.get(pubkey)
+        if d is not None and not refresh and not identity.validate_descriptor(d, now=now, digest=descriptor.DIGEST):
+            return d
+        with self._lock:
+            until = self._missing.get(pubkey)
+        if until is not None and now < until and not refresh:
+            return None
+        if self.relays:
+            fresh = self.resolver(pubkey, self.relays, now, self.timeout)
+            if fresh is not None:
+                self.learn(fresh)
+                return fresh
+            with self._lock:
+                self._missing[pubkey] = now + self.MISS_TTL
+        return None
+
+    def agreement(self, pubkey: str) -> Optional[x25519.X25519PublicKey]:
+        d = self.descriptor(pubkey)
+        return agreement_key(d) if d is not None else None
+
+    def resolve_sender(self, skid: str) -> Optional[x25519.X25519PublicKey]:
+        """For didcomm.decrypt: the static agreement key a skid names, if the
+        descriptor behind it is live. The kid must be the #agree fragment."""
+        if not skid.endswith('#agree'):
+            return None
+        try:
+            return self.agreement(node_of_did(skid))
+        except ValueError:
+            return None
+
+    def known(self) -> list[str]:
+        with self._lock:
+            return sorted(self._cache)