2. Write a dataview server

// receive · project · answer
import {
  ecdh, deriveKey, decrypt, hexToBytes, bytesToHex, derivePublicKey,
} from '@enc-protocol/core'
 
const CORS = {
  'Access-Control-Allow-Origin': '*',
  'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
  'Access-Control-Allow-Headers': 'Content-Type',
}
const json = (body, status = 200) =>
  new Response(JSON.stringify(body), { status, headers: { 'Content-Type': 'application/json', ...CORS } })
 
class DataView {
  constructor(privateKeyHex) {
    // Our identity. The node ECDH-encrypts each push TO this public key, so we
    // need the private key to decrypt.
    this.priv = hexToBytes(privateKeyHex)
    this.pubHex = bytesToHex(derivePublicKey(this.priv))
 
    // The read-model: latest public post per (enclave, author).
    // You'd typically persist this to a database; for this example we use in-memory.
    this.profiles = new Map()
  }
 
  async fetch(request) {
    const { pathname } = new URL(request.url)
    if (request.method === 'OPTIONS') return new Response(null, { status: 204, headers: CORS })
 
    // The node fetches this once to learn the key it must encrypt pushes to.
    if (request.method === 'GET' && pathname === '/identity') {
      return json({ pubHex: this.pubHex })
    }
 
    // ── RECEIVE ── encrypted wire message { content, from, to, type, url }.
    if (request.method === 'POST' && pathname === '/push') {
      const wire = await request.json()
      const payload = this.#decrypt(wire)          // { push_seq, push: { enclaves: [{ enclave, events }] } }
      // `push.enclaves` groups events by enclave — flatten to each event (it also
      // carries its own `.enclave`).
      let ingested = 0
      for (const group of payload.push?.enclaves || []) {
        for (const event of group.events || []) { this.#project({ enclave: group.enclave, ...event }); ingested++ }
      }
      return json({ ok: true, ingested })
    }
 
    // ── ANSWER ── the public feed: latest public post per author, newest first.
    if (request.method === 'GET' && pathname === '/profiles') {
      const profiles = Array.from(this.profiles.values())
        .sort((a, b) => (b.timestamp - a.timestamp) || (b.seq - a.seq))
        .slice(0, 100)
      return json({ profiles })
    }
 
    return json({ error: 'not_found' }, 404)
  }
 
  // Mirror the node's encrypt side: ECDH(ourPriv, nodeSeqPub) → HKDF "enc:push" → XChaCha20.
  #decrypt(wire) {
    const shared = ecdh(this.priv, hexToBytes(wire.from)) // wire.from = node's seq pubkey
    const key = deriveKey(shared, 'enc:push')
    return JSON.parse(decrypt(key, wire.content))
  }
 
  // ── PROJECT ── fold one event in. We only index `public` posts.
  #project(event) {
    if (event.type !== 'public') return
    let draft = ''
    try { draft = JSON.parse(event.content).draft ?? '' } catch { return }
    const key = `${event.enclave}:${event.from}`
    this.profiles.set(key, {
      enclave: event.enclave,
      author: event.from,
      draft,
      seq: event.seq,
      timestamp: event.timestamp,
    })
  }
}
 
const dataview = new DataView(process.env.DATAVIEW_PRIVATE_KEY)
const server = Bun.serve({
  port: process.env.PORT || 8789,
  async fetch(request) {
    return dataview.fetch(request)
  },
})
console.log(`Dataview listening on http://localhost:${server.port}`)

{
  "name": "my-dataview",
  "type": "module",
  "dependencies": { "@enc-protocol/core": "^0.9.0" }
}

curl http://127.0.0.1:8789/identity
# → {"pubHex":"02ab…"}

// run once, as the enclave owner
import { NetworkAdapter } from '@enc-protocol/client'
import { ownerFromMnemonic } from './owner.mjs'
import { readFileSync } from 'node:fs'
 
const DATAVIEW_URL = process.env.DATAVIEW_URL || 'http://localhost:8789'
const PUSH_URL = DATAVIEW_URL.replace(/\/$/, '') + '/push'           // the node POSTs the batch here
const cfg = JSON.parse(readFileSync('enc.config.json', 'utf8'))     // node URL + enclave ids (step 3)
const owner = ownerFromMnemonic(readFileSync('owner.seed', 'utf8')) // your owner identity (step 1)
 
// 1. ask the dataview for the key the node must encrypt pushes to
const { pubHex } = await (await fetch(DATAVIEW_URL + '/identity')).json()
 
// 2. owner-signed Grant(dataview) into the Personal enclave, carrying the push URL.
//    The node POSTs each batch to `endpoint` verbatim, so register the FULL /push
//    route — not the base URL — or the pushes 404.
const personal = new NetworkAdapter(cfg.nodeUrl, cfg.enclaves.Personal, owner)
await personal.submit('Grant(dataview)', { identity: pubHex, endpoint: PUSH_URL })
console.log('registered dataview', pubHex, '→', PUSH_URL)

curl http://127.0.0.1:8789/profiles
# → {"profiles":[
# {"enclave":"3c1f…","author":"02ab…","draft":"gm from my enclave","seq":7,"timestamp":1750000000000}
# ]}