Ë
    ÛJêjV0  ã                  óþ   — d Z ddlmZ ddlZddlZddlZddlZddlmZm	Z	 ddl
mZ ddlmZ ddlmZ ddlmZ dd	lmZ dd
lmZ ddlmZmZ ddlmZ  G d„ dee«      Ze G d„ d«      «       Z G d„ dee«      Zg d¢Zy)z;SQLite-backed project memory and local provenance provider.é    )ÚannotationsN)Ú	dataclassÚfield)ÚEnum)ÚAny)Úuuid4)ÚSQLiteDatabase)ÚProvenanceProvider)ÚRetrievalProvider)ÚAuditEventTypeÚAuditLog)ÚPrivacyGatewayc                  ó    — e Zd ZdZdZdZdZdZy)ÚMemoryTrustLevelzHOrigin/review label, not a claim that memory content is safe to execute.Ú	untrustedÚexternalÚreviewedÚtrustedN)Ú__name__Ú
__module__Ú__qualname__Ú__doc__Ú	UNTRUSTEDÚEXTERNALÚREVIEWEDÚTRUSTED© ó    úK/home/oem/CyberBrain26-unified/src/cyberbrain26/data_plane/sqlite_memory.pyr   r      s   „ ÙRà€IØ€HØ€HØ�Gr   r   c                  ó|   — e Zd ZU ded<   ded<   ded<   ded<   dZded	<    ee¬
«      Zded<   dZded<   dZ	ded<   y)ÚProjectMemoryRecordÚstrÚ	memory_idÚ
project_idÚcontentr   Útrust_levelNú
str | NoneÚprovenance_id)Údefault_factoryúdict[str, Any]Úmetadatag        ÚfloatÚ
created_atúfloat | NoneÚ
expires_at)
r   r   r   Ú__annotations__r(   r   Údictr+   r-   r/   r   r   r   r!   r!      sD   … àƒNØƒOØƒLØ!Ó!Ø $€M�:Ó$Ù$°TÔ:€HˆnÓ:Ø€J�ÓØ#€J�Ô#r   r!   c                  óZ  — e Zd ZdZ ej
                  dej                  «      Zddddœ	 	 	 	 	 	 	 	 	 dd„Ze	dd„«       Z
e	dd„«       Zej                  ddddd	œ	 	 	 	 	 	 	 	 	 	 	 	 	 	 	 dd
„Zdd„Zdddœ	 	 	 	 	 	 	 dd„Zddœ	 	 	 	 	 	 	 dd„Zdd„Zddœ	 	 	 	 	 	 	 dd„Zdd„Zed d„«       Zy)!ÚSQLiteMemoryProvideraU  Local keyword retrieval, trust-labeled project memory, and provenance.

    Provenance hashes detect accidental content changes but are not signatures
    or protection against a database owner who can rewrite both content and
    hash. The provider records labels/watermark metadata; it does not embed
    watermarks into binary media.
    z[\w-]+NT)Ú	audit_logÚprivacy_gatewayÚredact_on_writec               óX   — || _         || _        |xs t        |¬«      | _        || _        y )N)r4   )Údatabaser4   r   r5   r6   )Úselfr8   r4   r5   r6   s        r   Ú__init__zSQLiteMemoryProvider.__init__5   s,   € ð !ˆŒØ"ˆŒØ.ÒU´.È9Ô2UˆÔØ.ˆÕr   c                 ó   — y)Nzsqlite-keywordr   ©r9   s    r   Ústrategy_namez"SQLiteMemoryProvider.strategy_nameB   s   € àr   c                 ó   — y)Nzsqlite-local-provenancer   r<   s    r   Úprovider_namez"SQLiteMemoryProvider.provider_nameF   s   € à(r   )r&   r(   r+   r/   r#   c               óP  — |j                  «       st        d«      ‚t        |t        «      r|j                  «       st        d«      ‚i }| j                  rW| j
                  j                  |d¬«      }	|	j                  }|	j                  D �
ci c]  }
|
j                  |
j                  “Œ }}
t        |xs dt        «       j                  › �||t        |«      |t        |xs i «      t!        j                   «       |¬«      }t#        j$                  |j&                  dd¬	«      }| j(                  j+                  «       5 }|j-                  d
|j.                  |j0                  |j2                  |j4                  j6                  |j8                  ||j:                  |j<                  f«       ddd«       | j>                  �Z| j>                  jA                  tB        jD                  d||j.                  |j4                  j6                  |j8                  |dœ¬«       |S c c}
w # 1 sw Y   ŒvxY w)zBStore a project-scoped memory with an explicit source trust label.zproject_id must not be emptyz)memory content must be a non-empty stringÚproject_memory)ÚcontextÚmemory_©r#   r$   r%   r&   r(   r+   r-   r/   ©ú,ú:F©Ú
separatorsÚ	allow_nanzû
                INSERT INTO project_memories(
                    memory_id, project_id, content, trust_level, provenance_id,
                    metadata_json, created_at, expires_at
                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
                NÚproject_memory_write)r&   r(   Ú
redactions)ÚactionÚresourceÚmemory_writer+   )#ÚstripÚ
ValueErrorÚ
isinstancer"   r6   r5   ÚredactÚtextÚfindingsÚcategoryÚcountr!   r   Úhexr   r1   ÚtimeÚjsonÚdumpsr+   r8   ÚtransactionÚexecuter#   r$   r%   r&   Úvaluer(   r-   r/   r4   Úrecordr   ÚMEMORY_UPDATED)r9   r$   r%   r&   r(   r+   r/   r#   Úredaction_findingsÚprivacy_resultÚfindingr_   Úmetadata_jsonÚ
connections                 r   Ú
add_memoryzSQLiteMemoryProvider.add_memoryJ   sò  € ð ×ÑÔ!ÜÐ;Ó<Ð<Ü˜'¤3Ô'¨w¯}©}¬ÜÐHÓIÐIØ-/ÐØ×ÒØ!×1Ñ1×8Ñ8¸ÐJZÐ8Ó[ˆNØ$×)Ñ)ˆGà?M×?VÑ?Vö"Ø4;�× Ñ  '§-¡-Ñ/ð"Ðð "ô %ØÒ: W¬U«W¯[©[¨MÐ#:Ø!ØÜ(¨Ó5Ø'Ü˜(š. bÓ)Ü—y‘y“{Ø!ô	
ˆô Ÿ
™
 6§?¡?¸zÐUZÔ[ˆØ�]‰]×&Ñ&Ó(ð 	¨JØ×Ñðð ×$Ñ$Ø×%Ñ%Ø—N‘NØ×&Ñ&×,Ñ,Ø×(Ñ(Ø!Ø×%Ñ%Ø×%Ñ%ð	ô÷	ð& �>‰>Ð%Ø�N‰N×!Ñ!Ü×-Ñ-Ø-Ø#Ø#×-Ñ-à#)×#5Ñ#5×#;Ñ#;Ø%+×%9Ñ%9Ø"4ñð "ô 
ð ˆùò["÷	ð 	ús   ÂHÄ<A+HÈH%c                óÌ   — | j                   j                  «       5 }|j                  d|f«      j                  «       }d d d «       �| j	                  |«      S d S # 1 sw Y   ŒxY w)Nz2SELECT * FROM project_memories WHERE memory_id = ?)r8   re   r]   ÚfetchoneÚ_row_to_memory)r9   r#   re   Úrows       r   Ú
get_memoryzSQLiteMemoryProvider.get_memory�   sf   € Ø�]‰]×%Ñ%Ó'ð 	¨:Ø×$Ñ$ØDÀyÀlóç‰h‹jð ÷	ð ,/¨?ˆt×"Ñ" 3Ó'ÐDÀÐD÷		ð 	ús   ›"AÁA#é
   )ÚlimitÚfiltersc             ƒ  óB  K  — |dk  rg S |xs i }|j                  d«      }|j                  d«      }|€Nt        j                  j                  t        j                  j                  t        j
                  j                  h}nnt        |t        t        f«      r|g}|D �ch c])  }t        |t        «      r|j                  n
t        |«      ’Œ+ }}|t        D �ch c]  }|j                  ’Œ c}z  }dj                  d„ |D «       «      }	|	sg S d|	› d�}
t        |«      }|�|
d	z  }
|j                  t        |«      «       |
d
z  }
|j                  t        j                  «       «       |
dz  }
| j                  j                  «       5 }|j                  |
|«      j                  «       }ddd«       | j                   j#                  |«      D �ch c]  }|j%                  «       ’Œ }}g }D ]„  }| j'                  |«      }| j                   j#                  |j(                  «      D �ch c]  }|j%                  «       ’Œ }}t+        ||z  «      }|r|sŒg|j                  ||j,                  |f«       Œ† |j/                  d„ d¬«       |d| D ���cg c]a  \  }}}|j0                  |j2                  |j(                  |j4                  j                  |j6                  |j8                  |j,                  |dœ‘Œc c}}}S c c}w c c}w # 1 sw Y   �Œ]xY wc c}w c c}w c c}}}w ­w)zBRetrieve keyword matches, excluding untrusted memories by default.r   r$   Útrust_levelsNrF   c              3  ó    K  — | ]  }d –— Œ y­w)Ú?Nr   )Ú.0Ú_s     r   ú	<genexpr>z0SQLiteMemoryProvider.retrieve.<locals>.<genexpr>¯   s   è ø€ Ò5¨¤Ñ5ùs   ‚z5SELECT * FROM project_memories WHERE trust_level IN (ú)z AND project_id = ?z+ AND (expires_at IS NULL OR expires_at > ?)z ORDER BY created_at DESCc                ó   — | d   | d   fS )Nr   é   r   )Úitems    r   ú<lambda>z/SQLiteMemoryProvider.retrieve.<locals>.<lambda>Å   s   €  d¨1¡g¨t°A©wÐ%7€ r   T)ÚkeyÚreverse)r#   r$   r%   r&   r(   r+   r-   Úscore)Úgetr   r   r^   r   r   rR   r"   ÚjoinÚsortedÚappendrY   r8   re   r]   ÚfetchallÚ	_TOKEN_REÚfindallÚcasefoldri   r%   Úlenr-   Úsortr#   r$   r&   r(   r+   )r9   Úqueryrm   rn   r$   Ú
raw_levelsÚallowedr^   ÚlevelÚplaceholdersÚsqlÚ
parametersre   ÚrowsÚtokenÚquery_tokensÚrankedrj   r_   Úcontent_tokensr}   rt   s                         r   ÚretrievezSQLiteMemoryProvider.retrieve”   s÷  è ø€ ð �AŠ:ØˆIØ’-˜RˆØ—[‘[ Ó.ˆ
Ø—[‘[ Ó0ˆ
ØÐä ×)Ñ)×/Ñ/Ü ×)Ñ)×/Ñ/Ü ×(Ñ(×.Ñ.ð‰Gô ˜*¤sÔ,<Ð&=Ô>Ø(˜\�
ð (öàô  *¨%Ô1AÔB�—’ÌÈEË
ÑRðˆGð ð Ô1AÖB¨˜Ÿ›ÒBÑBˆGØ—x‘xÑ5¨WÔ5Ó5ˆÙØˆIØEÀlÀ^ÐSTÐUˆÜ & w£ˆ
ØÐ!ØÐ(Ñ(ˆCØ×Ñœc *›oÔ.ØÐ<Ñ<ˆØ×Ñœ$Ÿ)™)›+Ô&ØÐ*Ñ*ˆØ�]‰]×%Ñ%Ó'ð 	B¨:Ø×%Ñ% c¨:Ó6×?Ñ?ÓAˆD÷	Bð 7;·n±n×6LÑ6LÈUÓ6SÖT¨U˜Ÿ™Õ(ÐTˆÐTØ?AˆØò 	BˆCØ×(Ñ(¨Ó-ˆFØ<@¿N¹N×<RÑ<RÐSY×SaÑSaÓ<bÖc°5˜eŸn™nÕ.ÐcˆNÐcÜ˜ ~Ñ5Ó6ˆEÙ¢5Ø—‘˜u f×&7Ñ&7¸Ð@ÕAð	Bð 	�‰Ñ7ÀˆÔFð %+¨6¨E N÷
ð 
ñ !��q˜&ð $×-Ñ-Ø$×/Ñ/Ø!Ÿ>™>Ø%×1Ñ1×7Ñ7Ø!'×!5Ñ!5Ø"ŸO™OØ$×/Ñ/Øó	ô
ð 	
ùò9ùò C÷	Bñ 	Büò Uùò dùô

ùsc   ‚BLÂ.K7ÃLÃK<Ã+BLÆ!LÆ&%LÇLÇ"ALÈ#LÈ:LÉ=LÊA&LË2LÌLÌL)r+   c          	   ƒ  óê  K  — |j                  «       st        d«      ‚t        j                  |dddd¬«      }t	        j
                  |j                  d«      «      j                  «       }t        j                  |xs i dd¬«      }t        j                  «       }| j                  j                  «       5 }|j                  d|||||f«       d	d	d	«       ||| j                  |ddd
œS # 1 sw Y   ŒxY w­w)z<Store canonical JSON and a SHA-256 integrity digest locally.zcontent_id must not be emptyTrE   F)Ú	sort_keysrI   Úensure_asciirJ   úutf-8rH   z÷
                INSERT INTO provenance_records(
                    content_id, content_json, sha256, metadata_json, labels_json,
                    watermark_json, created_at
                ) VALUES (?, ?, ?, ?, '[]', NULL, ?)
                N)Ú
content_idÚsha256Úproviderr-   Úintegrity_onlyÚsignature_verified)rP   rQ   rZ   r[   Úhashlibrš   ÚencodeÚ	hexdigestrY   r8   r\   r]   r?   )	r9   r™   r%   r+   Úcontent_jsonÚcontent_hashrd   r-   re   s	            r   ÚattestzSQLiteMemoryProvider.attestÔ   sí   è ø€ ð ×ÑÔ!ÜÐ;Ó<Ð<Ü—z‘zØ˜t°
ÈÐZ_ô
ˆô —~‘~ l×&9Ñ&9¸'Ó&BÓC×MÑMÓOˆÜŸ
™
 8¢>¨r¸jÐTYÔZˆÜ—Y‘Y“[ˆ
Ø�]‰]×&Ñ&Ó(ð 		¨JØ×Ñðð ˜\¨<¸È
ÐSô÷		ð %Ø"Ø×*Ñ*Ø$Ø"Ø"'ñ
ð 	
÷		ð 		üs   ‚B2C3Â4C'ÃC3Ã'C0Ã,C3c           
   ƒ  óÜ  K  — | j                   j                  «       5 }|j                  d|f«      j                  «       }d d d «       €y t	        j
                  |d   j                  d«      «      j                  «       }||d   ||d   k(  t        j                  |d   «      t        j                  |d   «      |d   rt        j                  |d   «      nd |d   d	d
dœ	S # 1 sw Y   Œ¢xY w­w)Nz5SELECT * FROM provenance_records WHERE content_id = ?r¡   r˜   rš   rd   Úlabels_jsonÚwatermark_jsonr-   TF)	r™   rš   Úintegrity_validr+   ÚlabelsÚ	watermarkr-   rœ   r�   )
r8   re   r]   rh   rž   rš   rŸ   r    rZ   Úloads)r9   r™   re   rj   Úcomputed_hashs        r   ÚverifyzSQLiteMemoryProvider.verify÷   së   è ø€ Ø�]‰]×%Ñ%Ó'ð 	¨:Ø×$Ñ$ØGÈ*Èóç‰h‹jð ÷	ð ˆ;ØÜŸ™ s¨>Ñ':×'AÑ'AÀ'Ó'JÓK×UÑUÓWˆà$Ø˜(‘mØ,°°H±Ñ=ÜŸ
™
 3 Ñ#7Ó8Ü—j‘j  ]Ñ!3Ó4Ø>AÐBRÒ>SœŸ™ CÐ(8Ñ$9Ô:ÐY]Ø˜lÑ+Ø"Ø"'ñ

ð 
	
÷	ð 	üs   ‚C,�"C ¿B!C,Ã C)Ã%C,F)Úvisiblec             ƒ  ó  K  — ||t        j                   «       ddœ}| j                  j                  «       5 }|j                  dt	        j
                  |d¬«      |f«      j                  }d d d «       r|S |||dddœS # 1 sw Y   ŒxY w­w)NF)Úlabelr­   Úrecorded_atÚapplied_to_contentzEUPDATE provenance_records SET watermark_json = ? WHERE content_id = ?rE   ©rI   zcontent not found)r™   r¯   r­   r±   Úerror)rY   r8   r\   r]   rZ   r[   Úrowcount)r9   r™   r¯   r­   r©   re   Úupdateds          r   r©   zSQLiteMemoryProvider.watermark  s�   è ø€ ð ØÜŸ9™9›;Ø"'ñ	
ˆ	ð �]‰]×&Ñ&Ó(ð 	¨JØ ×(Ñ(ØWÜ—‘˜I°*Ô=¸zÐJó÷ ‰hð ÷	ñ
 ØÐà$ØØØ"'Ø(ñ
ð 	
÷	ð 	üs   ‚4B
¶4A>Á*B
Á>BÂB
c           	   ƒ  ó‚  K  — | j                   j                  «       5 }|j                  d|f«      j                  «       }|€
	 d d d «       yt	        t        t        j                  |d   «      «      t        |«      z  «      }|j                  dt        j                  |d¬«      |f«       d d d «       y# 1 sw Y   yxY w­w)Nz?SELECT labels_json FROM provenance_records WHERE content_id = ?Fr¥   zBUPDATE provenance_records SET labels_json = ? WHERE content_id = ?rE   r²   T)	r8   r\   r]   rh   r€   ÚsetrZ   rª   r[   )r9   r™   r¨   re   rj   Úmergeds         r   r¯   zSQLiteMemoryProvider.label'  sµ   è ø€ Ø�]‰]×&Ñ&Ó(ð 	¨JØ×$Ñ$ØQØ�ó÷ ‰h‹jð ð ˆ{Ø÷	ð 	ô œC¤§
¡
¨3¨}Ñ+=Ó >Ó?Ä#ÀfÃ+ÑMÓNˆFØ×ÑØTÜ—‘˜F¨zÔ:¸JÐGô÷	ð ÷	ð üs)   ‚B?�%B3Á	B?ÁAB3Â*	B?Â3B<Â8B?c                ó�   — t        | d   | d   | d   t        | d   «      | d   t        j                  | d   «      | d   | d   ¬	«      S )
Nr#   r$   r%   r&   r(   rd   r-   r/   rD   )r!   r   rZ   rª   )rj   s    r   ri   z#SQLiteMemoryProvider._row_to_memory6  s\   € ä"Ø˜+Ñ&Ø˜<Ñ(Ø˜	‘NÜ(¨¨]Ñ);Ó<Ø˜oÑ.Ü—Z‘Z  OÑ 4Ó5Ø˜<Ñ(Ø˜<Ñ(ô	
ð 		
r   )
r8   r	   r4   zAuditLog | Noner5   zPrivacyGateway | Noner6   ÚboolÚreturnÚNone)r»   r"   )r$   r"   r%   r"   r&   r   r(   r'   r+   údict[str, Any] | Noner/   r.   r#   r'   r»   r!   )r#   r"   r»   zProjectMemoryRecord | None)rˆ   r"   rm   Úintrn   r½   r»   zlist[dict[str, Any]])r™   r"   r%   r*   r+   r½   r»   r*   )r™   r"   r»   r½   )r™   r"   r¯   r"   r­   rº   r»   r*   )r™   r"   r¨   z	list[str]r»   rº   )rj   r   r»   r!   )r   r   r   r   ÚreÚcompileÚUNICODErƒ   r:   Úpropertyr=   r?   r   r   rf   rk   r”   r£   r¬   r©   r¯   Ústaticmethodri   r   r   r   r3   r3   *   s´  „ ñð �—
‘
˜9 b§j¡jÓ1€Ið &*Ø15Ø $ñ/à ð/ð #ð	/ð
 /ð/ð ð/ð 
ó/ð ò ó ð ð ò)ó ð)ð )9×(AÑ(AØ$(Ø*.Ø#'Ø $ñAàðAð ðAð
 &ðAð "ðAð (ðAð !ðAð ðAð 
óAóFEð Ø)-ñ>
àð>
ð ð	>
ð
 'ð>
ð 
ó>
ðJ +/ñ!
àð!
ð  ð!
ð
 (ð!
ð 
ó!
óF
ð2 ñ
àð
ð ð
ð
 ð
ð 
ó
ó8ð ò

ó ñ

r   r3   )r   r!   r3   ) r   Ú
__future__r   rž   rZ   r¿   rY   Údataclassesr   r   Úenumr   Útypingr   Úuuidr   Ú$cyberbrain26.data_plane.sqlite_storer	   Ú0cyberbrain26.extension_layer.provenance_providerr
   Ú/cyberbrain26.extension_layer.retrieval_providerr   Ú!cyberbrain26.security_plane.auditr   r   Ú+cyberbrain26.security_plane.privacy_gatewayr   r"   r   r!   r3   Ú__all__r   r   r   ú<module>rÏ      st   ðÙ Aå "ã Û Û 	Û ß (Ý Ý Ý å ?Ý OÝ Mß FÝ Fô�s˜Dô ð ÷$ð $ó ð$ôW
Ð,Ð.@ô W
òt N�r   