Implement experimental file-based encrypted private chat

Add fixed-suite Rust/WASI identity files, signed challenge authentication, ciphertext-only SQLite storage, a minimal LibreJS-compatible interface, and consistent backup snapshots. Keep production unchanged and document the local workflow, limits, source distribution, and browser recovery tests.

3 files changed, 64 insertions, 5 deletions

diff --git a/infra/chat/build-browser.sh b/infra/chat/build-browser.sh
new file mode 100644
index 0000000..dd0c777
--- /dev/null
+++ b/infra/chat/build-browser.sh
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -eu
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+SOURCE="$ROOT/.tools/wasi-source"
+SDK="$SOURCE/wasi-sdk-34.0-x86_64-linux"
+PREFIX="$ROOT/.tools/openssl-wasi"
+cd "$ROOT"
+test -x "$SDK/bin/clang"
+test -f "$PREFIX/lib/libcrypto.a"
+printf '%s  %s\n' b761e3a0721dbae9c09a0059e5fdb2bf917d1b4a8a7b430fb3b5aafb0984b2c4 "$SOURCE/sdk.tar.gz" | sha256sum --check
+printf '%s  %s\n' a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 "$SOURCE/openssl.tar.gz" | sha256sum --check
+rustup target add wasm32-wasip1
+RUST_LIB="$(rustc --print target-libdir --target wasm32-wasip1)/self-contained"
+env LIBCLANG_PATH="$SDK/lib" OPENSSL_DIR="$PREFIX" OPENSSL_STATIC=1 \
+    CC_wasm32_wasip1="$SDK/bin/clang" AR_wasm32_wasip1="$SDK/bin/llvm-ar" \
+    BINDGEN_EXTRA_CLANG_ARGS_wasm32_wasip1="--sysroot=$SDK/share/wasi-sysroot --target=wasm32-wasip1 -fvisibility=default" \
+    RUSTFLAGS="-Lnative=$RUST_LIB -Lnative=$SDK/share/wasi-sysroot/lib/wasm32-wasip1 -Clink-arg=-lwasi-emulated-getpid -Clink-arg=--max-memory=268435456" \
+    cargo build --locked --release -p stack-chat-crypto --bin stack-chat-crypto --target wasm32-wasip1
+sha256sum target/wasm32-wasip1/release/stack-chat-crypto.wasm
diff --git a/infra/chat/build-openssl-wasi.sh b/infra/chat/build-openssl-wasi.sh
index 7cdd9b6..91c0583 100755
--- a/infra/chat/build-openssl-wasi.sh
+++ b/infra/chat/build-openssl-wasi.sh
@@ -42,8 +42,4 @@ cd "$SOURCE/openssl-3.6.5"
 env CC="$SDK/bin/clang" AR="$SDK/bin/llvm-ar" RANLIB="$SDK/bin/llvm-ranlib"     CFLAGS='-O2 -D_WASI_EMULATED_GETPID -Dgetuid=getpagesize -Dgeteuid=getpagesize -Dgetgid=getpagesize -Dgetegid=getpagesize'     LDFLAGS='-lwasi-emulated-getpid'     ./Configure stack-wasi --prefix="$PREFIX" --libdir=lib --with-rand-seed=getrandom     no-asm no-async no-autoload-config no-dso no-module no-posix-io no-secure-memory     no-shared no-sock no-stdio no-thread-pool no-threads no-ui-console
 make -j"${CHAT_BUILD_JOBS:-8}" build_libs
 make install_dev
-cd "$ROOT"
-rustup target add wasm32-wasip1
-RUST_LIB="$(rustc --print target-libdir --target wasm32-wasip1)/self-contained"
-env LIBCLANG_PATH="$SDK/lib" OPENSSL_DIR="$PREFIX" OPENSSL_STATIC=1     CC_wasm32_wasip1="$SDK/bin/clang" AR_wasm32_wasip1="$SDK/bin/llvm-ar"     BINDGEN_EXTRA_CLANG_ARGS_wasm32_wasip1="--sysroot=$SDK/share/wasi-sysroot --target=wasm32-wasip1 -fvisibility=default"     RUSTFLAGS="-Lnative=$RUST_LIB -Lnative=$SDK/share/wasi-sysroot/lib/wasm32-wasip1 -Clink-arg=-lwasi-emulated-getpid"     cargo build --locked --release -p stack-chat-crypto --bin stack-chat-crypto --target wasm32-wasip1
-sha256sum target/wasm32-wasip1/release/stack-chat-crypto.wasm
+sh "$ROOT/infra/chat/build-browser.sh"
diff --git a/infra/chat/build-source.sh b/infra/chat/build-source.sh
new file mode 100644
index 0000000..6f24dcd
--- /dev/null
+++ b/infra/chat/build-source.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+# Copyright (C) 2026 Doan Luu Duc Tai <doan@luuduct.ai>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+set -eu
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/../.." && pwd)"
+cd "$ROOT"
+BUILD="$ROOT/var/build"
+mkdir -p "$BUILD"
+cargo vendor --locked var/build/chat-vendor | sed 's|directory = "var/build/chat-vendor"|directory = "chat-vendor"|' > "$BUILD/chat-vendor-config.txt"
+cp "$ROOT/.tools/wasi-source/openssl.tar.gz" "$BUILD/chat-openssl-3.6.5.tar.gz"
+printf '%s  %s\n' a2157c2830efdec3788939b00c9b0638306d3f0bbb76dc4832ee503bb397df98 "$BUILD/chat-openssl-3.6.5.tar.gz" | sha256sum --check
+source_list="$BUILD/chat-source-files.txt"
+find Cargo.toml Cargo.lock rust-toolchain.toml .cargo .gitignore .gitattributes src crates infra web docs README.txt LICENSE deny.toml about.toml about.hbs .env.example -type f -print > "$source_list"
+tar -czf "$BUILD/chat-source.tar.gz.pending" --verbatim-files-from -T "$source_list" -C "$BUILD" chat-vendor chat-vendor-config.txt chat-openssl-3.6.5.tar.gz
+mv "$BUILD/chat-source.tar.gz.pending" "$BUILD/chat-source.tar.gz"
+sha256sum "$BUILD/chat-source.tar.gz"