@geohar/un-bien 0.7.0

package/dist/pairing/storage.js

@@ -0,0 +1,614 @@
+import { writeFileSync } from "node:fs";
+import { mkdir, readFile, writeFile, chmod, unlink } from "node:fs/promises";
+import { dirname, join } from "node:path";
+import { generateEd25519Keypair } from "./crypto.js";
+import { canonicalizeEd25519PublicKey } from "../mesh/encoding.js";
+import { unbienStateHome } from "../paths.js";
+/**
+ * Pi-secret storage (plan/27 Wave E1).
+ *
+ * The Ed25519 long-term identity of this Pi lives in the platform keyring
+ * via `@napi-rs/keyring` (Keychain on macOS, libsecret on Linux desktop,
+ * Credential Manager on Windows — DPAPI-backed). When the keyring is
+ * unavailable (headless Linux without a D-Bus session, Docker containers,
+ * VPS without GNOME Keyring/KWallet running) we fall back to a
+ * file-backed store at `~/.pi/un-bien/identity.json` with `0o600`
+ * permissions and the parent dir at `0o700`.
+ *
+ * **Migration**: previous builds used `keytar` against service
+ * `dev.unbien.mac`. This module reads from the old service if the new
+ * service is empty, copies the entry to the new service `dev.unbien.pi`,
+ * and deletes the old one. Both keytar and `@napi-rs/keyring` address the
+ * same OS-level credential store on every supported platform, so the read
+ * succeeds without keeping the deprecated `keytar` dependency.
+ */
+const NEW_SERVICE = "dev.unbien.pi"; // platform-neutral
+const OLD_SERVICE = "dev.unbien.mac"; // legacy keytar service (pre-2026-05-25)
+const ACCOUNT = "longterm-ed25519";
+/**
+ * The keyring read can THROW transiently rather than permanently — most
+ * notably a macOS Keychain that's still locked right after login/wake (the
+ * machine sat idle for days). Treating that throw as "backend unavailable"
+ * and minting a fresh identity silently orphans the paired key (the
+ * "lost pairing after a week idle" failure). So we retry the read a few times
+ * before ever concluding the keyring is truly unavailable. Overridable for
+ * tests via `_setKeyringRetryForTest`. */
+let _keyringReadAttempts = 3;
+let _keyringRetryDelayMs = 300;
+/** Raised when the keyring is unreadable on a platform where it's a core OS
+ *  service (macOS Keychain, Windows Credential Manager) AND no prior file
+ *  identity exists. We refuse to generate a NEW identity here because that
+ *  would break existing pairing — the caller surfaces this so the user can
+ *  unlock the keychain and retry instead of silently re-pairing. */
+export class KeyringUnavailableError extends Error {
+    constructor(cause) {
+        super("Platform keyring is unreadable and no file-backed identity exists. " +
+            "Refusing to generate a NEW identity (that would break existing " +
+            "pairing). Unlock your keychain / start your secret service and retry. " +
+            "Set UNBIEN_ALLOW_FILE_IDENTITY=1 to force a file-backed identity. " +
+            `Cause: ${String(cause)}`);
+        this.name = "KeyringUnavailableError";
+    }
+}
+/** Raised when no identity can be resolved (keyring unreadable, no identity
+ *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
+ *  here would make SelfRevoke wipe those pairings — see issues #95 / #69. */
+export class PairedIdentityMissingError extends Error {
+    constructor(pairedCount, cause) {
+        super(`No identity could be read, but ${pairedCount} device(s) are already ` +
+            "paired. Refusing to generate a NEW identity — that would revoke every " +
+            "paired device. This usually means this process cannot reach the same " +
+            "keyring as the session that paired (e.g. a systemd --user daemon vs. " +
+            "your desktop session). Fix the service's keyring access, or pin the " +
+            "identity by copying the paired keypair to ~/.pi/un-bien/identity.json " +
+            "(0600), which both contexts read first. " +
+            `Cause: ${String(cause)}`);
+        this.name = "PairedIdentityMissingError";
+    }
+}
+const PI_DIR = unbienStateHome();
+const IDENTITY_FILE = join(PI_DIR, "identity.json");
+const PEERS_PATH = join(PI_DIR, "peers.json");
+/**
+ * Per-operation timeout for native keyring calls (gnome-keyring / libsecret
+ * via @napi-rs/keyring). A healthy secret service settles in milliseconds; 3s
+ * is generous. The point is NOT speed — it is converting a HANG into a thrown
+ * error. The native getPassword()/setPassword() can block indefinitely when
+ * gnome-keyring waits on a GUI authorization prompt that cannot be shown in
+ * a headless / tmux / non-interactive context. A hang never settles, so
+ * without this guard the promise never rejects and the retry + file-fallback
+ * logic in getOrCreateEd25519Keypair() is unreachable — freezing the entire
+ * /unbien pair bootstrap. Raising a real error here lets that fallback
+ * chain run as designed.
+ */
+const KEYRING_OP_TIMEOUT_MS = 3_000;
+function _withTimeout(p, op, ms = KEYRING_OP_TIMEOUT_MS) {
+    return Promise.race([
+        p,
+        new Promise((_, reject) => setTimeout(() => reject(new Error(`keyring ${op} timed out after ${ms}ms`)), ms)),
+    ]);
+}
+/**
+ * Lazily loaded `@napi-rs/keyring` binding — issue #113.
+ *
+ * A STATIC `import { AsyncEntry } from "@napi-rs/keyring"` is evaluated when
+ * the extension module is loaded, so a native binding that cannot be resolved
+ * takes the WHOLE extension down at load time ("Failed to load extension …:
+ * Cannot find native binding"). That happens on a Bun-compiled `pi`: the
+ * loader's first branch (`require("./keyring.<triple>.node")`) is fine, but its
+ * fallback (`require("@napi-rs/keyring-<triple>")`, a bare package whose `main`
+ * IS the .node file) resolves under Node and not under Bun — and the message it
+ * prints then blames npm's optional-dependency bug, sending users off to delete
+ * node_modules and losing their other pi packages.
+ *
+ * Loading on first use turns that fatal load error into an ordinary backend
+ * failure, which the existing retry + file-identity fallback already handles.
+ */
+let _asyncEntryCtor = null;
+let _nativeBindingError = null;
+async function _loadAsyncEntry() {
+    if (_asyncEntryCtor)
+        return _asyncEntryCtor;
+    if (_nativeBindingError)
+        throw _nativeBindingError;
+    try {
+        const mod = await import("@napi-rs/keyring");
+        _asyncEntryCtor = mod.AsyncEntry;
+        return _asyncEntryCtor;
+    }
+    catch (err) {
+        _nativeBindingError = err;
+        throw err;
+    }
+}
+/**
+ * Did the native binding fail to LOAD (as opposed to an operation failing)?
+ *
+ * A load failure is deterministic and platform-wide: no retry, no unlock, no
+ * amount of waiting brings the keyring back in this process. So it must NOT be
+ * treated like a transiently locked Keychain — on macOS/Windows that would
+ * throw `KeyringUnavailableError` and leave the user with no working path at
+ * all. The file-identity fallback (with its loud warning) is the only usable
+ * route here, exactly as on headless Linux.
+ */
+function _nativeBindingUnavailable() {
+    return _nativeBindingError !== null;
+}
+/** Test-only: force (or clear with `null`) a memoized binding-load failure, so
+ *  the Bun/no-native-binding branch is reachable without a Bun host. */
+export function _setNativeBindingErrorForTest(err) {
+    _asyncEntryCtor = null;
+    _nativeBindingError = err;
+}
+class NapiKeyringBackend {
+    async read(service, account) {
+        const AsyncEntry = await _loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        return _withTimeout(entry.getPassword(), `read(${service})`); // undefined on no-entry
+    }
+    async write(service, account, value) {
+        const AsyncEntry = await _loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        await _withTimeout(entry.setPassword(value), `write(${service})`);
+    }
+    async delete(service, account) {
+        let entry;
+        try {
+            const AsyncEntry = await _loadAsyncEntry();
+            entry = new AsyncEntry(service, account);
+        }
+        catch {
+            return false;
+        }
+        try {
+            return await _withTimeout(entry.deleteCredential(), `delete(${service})`);
+        }
+        catch {
+            return false;
+        }
+    }
+}
+let _backend = null;
+function _getBackend() {
+    if (!_backend)
+        _backend = new NapiKeyringBackend();
+    return _backend;
+}
+/** Test-only: swap (or clear with `null`) the keyring backend. */
+export function _setKeyStoreBackendForTest(backend) {
+    _backend = backend;
+}
+/**
+ * Is the platform keyring a CORE OS service we should expect to be present?
+ * macOS (Keychain) and Windows (Credential Manager) always have one, so a read
+ * that throws there is transient/locked, NOT "headless" — we must not mint a
+ * new identity. On Linux/other the secret service may be genuinely absent
+ * (headless, no D-Bus), so the documented file fallback applies. Overridable
+ * for tests via `_setKeyringExpectedForTest`. */
+let _keyringExpectedOverride = null;
+function _keyringExpectedAvailable() {
+    if (_keyringExpectedOverride !== null)
+        return _keyringExpectedOverride;
+    // Binding never loaded (Bun-built pi, issue #113) → there is no keyring on
+    // this platform *for this process*, whatever the OS normally offers.
+    if (_nativeBindingUnavailable())
+        return false;
+    return process.platform === "darwin" || process.platform === "win32";
+}
+/** Test-only: force `_keyringExpectedAvailable()` (so a darwin test host can
+ *  exercise the Linux/headless branch and vice-versa). `null` restores the
+ *  real platform check. */
+export function _setKeyringExpectedForTest(value) {
+    _keyringExpectedOverride = value;
+}
+/** Test-only: shrink retry attempts/delay so the persistent-failure path is
+ *  fast. `null`/omitted restores defaults. */
+export function _setKeyringRetryForTest(attempts, delayMs) {
+    _keyringReadAttempts = attempts ?? 3;
+    _keyringRetryDelayMs = delayMs ?? 300;
+}
+function _sleep(ms) {
+    return ms > 0 ? new Promise((r) => setTimeout(r, ms)) : Promise.resolve();
+}
+function _serialize(kp) {
+    const payload = {
+        pk: Buffer.from(kp.publicKey).toString("base64"),
+        sk: Buffer.from(kp.secretKey).toString("base64"),
+    };
+    return JSON.stringify(payload);
+}
+function _deserialize(stored) {
+    const parsed = JSON.parse(stored);
+    return {
+        publicKey: Buffer.from(parsed.pk, "base64"),
+        secretKey: Buffer.from(parsed.sk, "base64"),
+    };
+}
+// ── File fallback (headless Linux) ──────────────────────────────────────────
+async function _readKeypairFromFile() {
+    try {
+        const raw = await readFile(IDENTITY_FILE, "utf8");
+        return _deserialize(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function _writeKeypairToFile(kp) {
+    await mkdir(PI_DIR, { recursive: true, mode: 0o700 });
+    // Best-effort tighten of the dir in case it pre-existed with looser
+    // permissions (mkdir's mode is only applied to NEW dirs).
+    try {
+        await chmod(PI_DIR, 0o700);
+    }
+    catch {
+        /* not fatal */
+    }
+    await writeFile(IDENTITY_FILE, _serialize(kp), { mode: 0o600 });
+    try {
+        await chmod(IDENTITY_FILE, 0o600);
+    }
+    catch {
+        /* not fatal */
+    }
+}
+// ── Public API ──────────────────────────────────────────────────────────────
+/**
+ * Returns the Pi-secret Ed25519 keypair, generating + persisting one on
+ * first call. Resolution order:
+ *   1. Existing file `~/.pi/un-bien/identity.json`, if present — it WINS over
+ *      the keyring. A file identity is only ever written by the headless/
+ *      degraded fallback (step 4) or an explicit `UNBIEN_ALLOW_FILE_IDENTITY`
+ *      opt-in, so its mere presence means this machine established its identity
+ *      as a file and the mobile device paired against THAT pubkey. If the
+ *      platform keyring later becomes readable (D-Bus/libsecret installed, a
+ *      desktop session, or a stale/other entry from another install), reading
+ *      it first would mask the file identity — returning a DIFFERENT key, or
+ *      (when the keyring is empty) minting a fresh one and persisting it —
+ *      silently breaking the existing pairing. So when both exist, file wins.
+ *   2. New keyring service `dev.unbien.pi` (read retried — a transiently
+ *      locked Keychain throws; we don't treat that as "no key")
+ *   3. Old keyring service `dev.unbien.mac` (migrate → step 2, delete old)
+ *   4. Generate a fresh keypair, BUT only when it's safe to: either both
+ *      keyring reads succeeded and returned nothing (genuine first run), or
+ *      the keyring is genuinely unavailable on a platform without a core one
+ *      (headless Linux → a file identity is minted here). On macOS/Windows a
+ *      persistent read failure with no file identity throws
+ *      `KeyringUnavailableError` instead of minting a new key — generating
+ *      there silently breaks existing pairing (the "lost pairing after idle"
+ *      bug). `UNBIEN_ALLOW_FILE_IDENTITY=1` opts back into a file identity
+ *      for headless macOS/Windows hosts.
+ *
+ * Idempotent: subsequent calls return the same identity. The migration
+ * runs at most once per machine (the old entry is deleted after copy).
+ */
+export async function getOrCreateEd25519Keypair() {
+    const backend = _getBackend();
+    // ── Path 0: an existing file-backed identity wins ──────────────────────
+    // `~/.pi/un-bien/identity.json` is only ever written by the headless/degraded
+    // fallback below (or an operator who set UNBIEN_ALLOW_FILE_IDENTITY=1) —
+    // never on a keyring-backed install. So its presence means THIS machine
+    // paired against the file key, and the keyring (readable or not, matching or
+    // not) must not be allowed to mask it. Short-circuit before touching the
+    // keyring so a keyring that later comes online can't return a different key,
+    // nor mint a fresh one over the file identity. No file → normal keyring
+    // resolution below; a headless first run still reaches Path B and mints one.
+    const existingFile = await _readKeypairFromFile();
+    if (existingFile)
+        return existingFile;
+    // ── Path A: keyring (retried) ──────────────────────────────────────────
+    // A throw here means the keyring op FAILED — but on macOS/Windows that is
+    // almost always a transiently locked Keychain (idle/just-woke machine), not
+    // a missing backend. `read` returns `undefined` for "no such entry" (the
+    // genuine first-run signal). So we retry on throw, and only a throw that
+    // SURVIVES every attempt drops us to Path B.
+    let keyringError;
+    for (let attempt = 0; attempt < _keyringReadAttempts; attempt++) {
+        try {
+            const existing = await backend.read(NEW_SERVICE, ACCOUNT);
+            if (existing)
+                return _deserialize(existing);
+            const legacy = await backend.read(OLD_SERVICE, ACCOUNT);
+            if (legacy) {
+                const kp = _deserialize(legacy);
+                await backend.write(NEW_SERVICE, ACCOUNT, legacy);
+                await backend.delete(OLD_SERVICE, ACCOUNT);
+                // Silent migration: writing the chat surface would be premature
+                // (Pi SDK isn't bound yet at this point in boot) and console
+                // output bleeds outside the TUI. The presence of an entry under
+                // NEW_SERVICE is itself the audit signal — re-running migration
+                // is idempotent and harmless.
+                return kp;
+            }
+            // Both reads SUCCEEDED and returned nothing → genuine first run on a
+            // working keyring. Generate and save to the new service.
+            const fresh = generateEd25519Keypair();
+            await backend.write(NEW_SERVICE, ACCOUNT, _serialize(fresh));
+            return fresh;
+        }
+        catch (err) {
+            keyringError = err;
+            if (attempt < _keyringReadAttempts - 1) {
+                // Linear backoff — a locked Keychain usually frees within seconds.
+                await _sleep(_keyringRetryDelayMs * (attempt + 1));
+            }
+        }
+    }
+    // ── Path B: keyring threw on every attempt ─────────────────────────────
+    // Path 0 already returned any pre-existing file identity; this defensive
+    // re-check catches a file written concurrently by another Pi process during
+    // the keyring-retry window (still: use it, never regenerate).
+    const fromFile = await _readKeypairFromFile();
+    if (fromFile)
+        return fromFile;
+    // No file identity AND the keyring is unreadable. CRITICAL FORK:
+    //
+    //  - On a platform without a guaranteed keyring (headless Linux, no D-Bus),
+    //    minting a file-backed identity is the documented, correct first-run
+    //    behavior.
+    //  - On macOS/Windows the keyring is a core OS service, so a persistent read
+    //    failure means it's LOCKED/denied — NOT that we're a fresh install.
+    //    Generating a new key here is exactly what silently broke pairing after
+    //    a week idle, and the new key then masks the real Keychain identity via
+    //    the file. So we FAIL LOUD instead, unless the operator explicitly
+    //    opts into a file identity.
+    const forceFile = process.env.UNBIEN_ALLOW_FILE_IDENTITY === "1";
+    if (_keyringExpectedAvailable() && !forceFile) {
+        throw new KeyringUnavailableError(keyringError);
+    }
+    // Issues #95 / #69 — minting a NEW identity when devices are already paired
+    // is destructive, on every platform.
+    //
+    // A daemon started by `systemd --user` resolves a different secret-service
+    // store than the desktop session that ran the pairing, so the keyring read
+    // fails, this path mints a fresh Ed25519 key, and the SelfRevoke poller then
+    // finds that key absent from the relay-side owner envelope, concludes it was
+    // revoked, and wipes `peers.json` — the phone silently goes offline a few
+    // seconds after every `daemon start`. `peers.json` being non-empty is proof
+    // that a working identity existed, so "no key found" here is a broken
+    // environment, not a first run. Fail loud and keep the pairing intact; the
+    // operator can pin the identity to a file (the confirmed workaround) or fix
+    // the service's keyring access.
+    if (!forceFile) {
+        const paired = await listPeers();
+        if (paired.length > 0) {
+            throw new PairedIdentityMissingError(paired.length, keyringError);
+        }
+    }
+    console.warn(_nativeBindingUnavailable()
+        ? // Issue #113: the @napi-rs/keyring native binding could not be loaded at
+            // all (typically a Bun-compiled pi). Name it explicitly — the error the
+            // loader prints blames npm's optional-dependency bug and sends people off
+            // to delete node_modules, which takes their other pi packages with it.
+            "[un-bien] @napi-rs/keyring native binding could not be loaded in this " +
+                `runtime; using file-backed identity at ${IDENTITY_FILE} (0600) instead. ` +
+                "This is expected on a Bun-built pi. Paired devices keyed to a previous " +
+                `keyring identity must be re-paired. ${String(keyringError)}`
+        : "[un-bien] keyring unavailable; using file-backed identity at " +
+            `${IDENTITY_FILE}. ${String(keyringError)}`);
+    const fresh = generateEd25519Keypair();
+    await _writeKeypairToFile(fresh);
+    return fresh;
+}
+export async function listPeers() {
+    try {
+        const raw = await readFile(PEERS_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed.peers) ? parsed.peers : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Authoritative container read for SelfRevoke's token path. Public readers
+ * intentionally remain best-effort; only a missing file is proof of emptiness
+ * here. Valid array elements are returned verbatim for corruption isolation.
+ */
+async function _readPeerContainerStrict() {
+    let raw;
+    try {
+        raw = await readFile(PEERS_PATH, "utf8");
+    }
+    catch (error) {
+        if (typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.peers)) {
+        throw new Error("Invalid peers.json container");
+    }
+    return parsed.peers;
+}
+let _peerMutationQueue = Promise.resolve();
+const _ownerSlotTokens = new Map();
+const _ownerStorageTokenBrand = Symbol("owner-storage-token");
+function _ownerSlotKey(rawOwnerPubkey) {
+    if (typeof rawOwnerPubkey !== "string") {
+        // Invalid non-string records remain in snapshots, but SelfRevoke skips
+        // them before conditional removal; quarantine-key collisions cannot
+        // authorize a removal.
+        return `raw:quarantine:${typeof rawOwnerPubkey}`;
+    }
+    try {
+        return `owner:${canonicalizeEd25519PublicKey(rawOwnerPubkey, "Owner record")}`;
+    }
+    catch {
+        return `raw:string:${rawOwnerPubkey}`;
+    }
+}
+function _tokenForSlot(slot) {
+    const existing = _ownerSlotTokens.get(slot);
+    if (existing)
+        return existing;
+    const token = Object.freeze({
+        [_ownerStorageTokenBrand]: true,
+    });
+    _ownerSlotTokens.set(slot, token);
+    return token;
+}
+function _invalidateOwnerSlot(rawOwnerPubkey) {
+    const slot = _ownerSlotKey(rawOwnerPubkey);
+    const token = Object.freeze({
+        [_ownerStorageTokenBrand]: true,
+    });
+    _ownerSlotTokens.set(slot, token);
+    return token;
+}
+function _serializePeerMutation(mutation) {
+    const result = _peerMutationQueue.then(mutation, mutation);
+    _peerMutationQueue = result.then(() => undefined, () => undefined);
+    return result;
+}
+export function addPeer(record) {
+    return _serializePeerMutation(async () => {
+        const peers = (await listPeers());
+        const idx = peers.findIndex((peer) => !!peer &&
+            typeof peer === "object" &&
+            peer.remote_epk === record.remote_epk);
+        if (idx >= 0) {
+            peers[idx] = record; // idempotent re-pair
+        }
+        else {
+            peers.push(record);
+        }
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        await writeFile(PEERS_PATH, JSON.stringify({ peers }, null, 2));
+        // A successful re-pair is a new storage provenance event even when the
+        // record bytes happen to be identical.
+        _invalidateOwnerSlot(record.remote_epk);
+    });
+}
+/**
+ * Returns the set of distinct `remote_epk` values in peers.json.
+ *
+ * In the current pairing model (plan/23 + plan/24), each `remote_epk` is the
+ * Owner's Ed25519 pubkey — and we treat each as a distinct Owner the Pi has
+ * been paired with. Used by the mesh self-revoke poller (plan/24 Wave 3) to
+ * know which Owners' mesh blobs to fetch.
+ */
+export async function listOwnerPubkeys() {
+    const peers = (await listPeers());
+    const seen = new Set();
+    for (const peer of peers) {
+        if (!peer || typeof peer !== "object") {
+            seen.add(peer);
+            continue;
+        }
+        seen.add(peer.remote_epk);
+    }
+    return [...seen];
+}
+/**
+ * Atomically snapshots raw Owner handles and their canonical-slot provenance.
+ * The token is deliberately process-local and opaque to callers.
+ */
+export function snapshotOwnerPubkeys() {
+    return _serializePeerMutation(async () => {
+        const peers = await _readPeerContainerStrict();
+        const rawOwners = new Set();
+        for (const peer of peers) {
+            if (!peer || typeof peer !== "object") {
+                rawOwners.add(peer);
+            }
+            else {
+                rawOwners.add(peer.remote_epk);
+            }
+        }
+        return [...rawOwners].map((rawOwnerPubkey) => ({
+            rawOwnerPubkey,
+            token: _tokenForSlot(_ownerSlotKey(rawOwnerPubkey)),
+        }));
+    });
+}
+/**
+ * Removes one exact raw handle only when its snapshot provenance still owns
+ * the target canonical Owner slot. The final authority/token checks and sync
+ * write share the existing serialized mutation lane.
+ */
+export function conditionalRemovePeer(remoteEpk, expectedToken, canCommit) {
+    return _serializePeerMutation(async () => {
+        const slot = _ownerSlotKey(remoteEpk);
+        // Provenance belongs to the canonical Owner slot, not the exact raw
+        // spelling. A stale slot must therefore win over an absent old spelling.
+        if (_tokenForSlot(slot) !== expectedToken)
+            return { outcome: "stale" };
+        const peers = await _readPeerContainerStrict();
+        const filtered = peers.filter((peer) => !peer ||
+            typeof peer !== "object" ||
+            peer.remote_epk !== remoteEpk);
+        if (filtered.length === peers.length)
+            return { outcome: "not_found" };
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        // No await may intervene between the final token/authority checks and
+        // synchronous write, preserving the lane's fail-closed commit boundary.
+        if (_tokenForSlot(slot) !== expectedToken)
+            return { outcome: "stale" };
+        if (canCommit) {
+            let authorized = false;
+            try {
+                authorized = canCommit();
+            }
+            catch {
+                return { outcome: "no_authority" };
+            }
+            if (!authorized)
+                return { outcome: "no_authority" };
+        }
+        writeFileSync(PEERS_PATH, JSON.stringify({ peers: filtered }, null, 2));
+        return { outcome: "removed", nextToken: _invalidateOwnerSlot(remoteEpk) };
+    });
+}
+export function removePeer(remoteEpk, canCommit) {
+    return _serializePeerMutation(async () => {
+        const peers = (await listPeers());
+        const filtered = peers.filter((peer) => !peer ||
+            typeof peer !== "object" ||
+            peer.remote_epk !== remoteEpk);
+        if (filtered.length === peers.length)
+            return false;
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        const serialized = JSON.stringify({ peers: filtered }, null, 2);
+        if (canCommit) {
+            // Guarded SelfRevoke commits must be atomic with their final authority
+            // check at the JavaScript level: fail closed on false/throw, then perform
+            // the tiny JSON rewrite synchronously with no interruptible await between.
+            let authorized = false;
+            try {
+                authorized = canCommit();
+            }
+            catch {
+                return false;
+            }
+            if (!authorized)
+                return false;
+            writeFileSync(PEERS_PATH, serialized);
+        }
+        else {
+            // Manual removals keep the established asynchronous storage behavior.
+            await writeFile(PEERS_PATH, serialized);
+        }
+        const removed = true;
+        if (removed)
+            _invalidateOwnerSlot(remoteEpk);
+        return removed;
+    });
+}
+// ── Test-only helpers ────────────────────────────────────────────────────────
+/** Test-only: expose the identity-file path so tests can clean it. */
+export const _IDENTITY_FILE_FOR_TEST = IDENTITY_FILE;
+/** Test-only: expose unlink for cleanup. */
+export const _unlinkIdentityFileForTest = async () => {
+    try {
+        await unlink(IDENTITY_FILE);
+    }
+    catch {
+        /* fine if missing */
+    }
+};
+//# sourceMappingURL=storage.js.map

package/dist/pairing/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../../src/pairing/storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAuB,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;;;;;;;;;;;;;;;;GAiBG;AAEH,MAAM,WAAW,GAAG,eAAe,CAAC,CAAC,mBAAmB;AACxD,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,yCAAyC;AAC/E,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAEnC;;;;;;;0CAO0C;AAC1C,IAAI,oBAAoB,GAAG,CAAC,CAAC;AAC7B,IAAI,oBAAoB,GAAG,GAAG,CAAC;AAE/B;;;;oEAIoE;AACpE,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,KAAc;QACxB,KAAK,CACH,qEAAqE;YACnE,iEAAiE;YACjE,wEAAwE;YACxE,oEAAoE;YACpE,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED;;6EAE6E;AAC7E,MAAM,OAAO,0BAA2B,SAAQ,KAAK;IACnD,YAAY,WAAmB,EAAE,KAAc;QAC7C,KAAK,CACH,kCAAkC,WAAW,yBAAyB;YACpE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,0CAA0C;YAC1C,UAAU,MAAM,CAAC,KAAK,CAAC,EAAE,CAC5B,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AAED,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;AACjC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAoB9C;;;;;;;;;;;GAWG;AACH,MAAM,qBAAqB,GAAG,KAAK,CAAC;AAEpC,SAAS,YAAY,CACnB,CAAa,EACb,EAAU,EACV,KAAa,qBAAqB;IAElC,OAAO,OAAO,CAAC,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,OAAO,CAAI,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CAC3B,UAAU,CACR,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,WAAW,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC,EAChE,EAAE,CACH,CACF;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,IAAI,eAAe,GAAwD,IAAI,CAAC;AAChF,IAAI,mBAAmB,GAAY,IAAI,CAAC;AAExC,KAAK,UAAU,eAAe;IAG5B,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAC5C,IAAI,mBAAmB;QAAE,MAAM,mBAAmB,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,eAAe,GAAG,GAAG,CAAC,UAAU,CAAC;QACjC,OAAO,eAAe,CAAC;IACzB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,GAAG,GAAG,CAAC;QAC1B,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,yBAAyB;IAChC,OAAO,mBAAmB,KAAK,IAAI,CAAC;AACtC,CAAC;AAED;wEACwE;AACxE,MAAM,UAAU,6BAA6B,CAAC,GAAY;IACxD,eAAe,GAAG,IAAI,CAAC;IACvB,mBAAmB,GAAG,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,kBAAkB;IACtB,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAe;QACzC,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC,CAAC,wBAAwB;IACxF,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;QACzD,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,KAAiE,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC3C,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,OAAO,GAAG,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF;AAED,IAAI,QAAQ,GAA2B,IAAI,CAAC;AAE5C,SAAS,WAAW;IAClB,IAAI,CAAC,QAAQ;QAAE,QAAQ,GAAG,IAAI,kBAAkB,EAAE,CAAC;IACnD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,0BAA0B,CACxC,OAA+B;IAE/B,QAAQ,GAAG,OAAO,CAAC;AACrB,CAAC;AAED;;;;;;iDAMiD;AACjD,IAAI,wBAAwB,GAAmB,IAAI,CAAC;AACpD,SAAS,yBAAyB;IAChC,IAAI,wBAAwB,KAAK,IAAI;QAAE,OAAO,wBAAwB,CAAC;IACvE,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,yBAAyB,EAAE;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AACvE,CAAC;AAED;;2BAE2B;AAC3B,MAAM,UAAU,0BAA0B,CAAC,KAAqB;IAC9D,wBAAwB,GAAG,KAAK,CAAC;AACnC,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,uBAAuB,CACrC,QAAuB,EACvB,OAAgB;IAEhB,oBAAoB,GAAG,QAAQ,IAAI,CAAC,CAAC;IACrC,oBAAoB,GAAG,OAAO,IAAI,GAAG,CAAC;AACxC,CAAC;AAED,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AAC5E,CAAC;AASD,SAAS,UAAU,CAAC,EAAkB;IACpC,MAAM,OAAO,GAAsB;QACjC,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAChD,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;KACjD,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAsB,CAAC;IACvD,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;QAC3C,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC;KAC5C,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,EAAkB;IACnD,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,oEAAoE;IACpE,0DAA0D;IAC1D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,MAAM,SAAS,CAAC,aAAa,EAAE,UAAU,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB;IAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,0EAA0E;IAC1E,8EAA8E;IAC9E,yEAAyE;IACzE,wEAAwE;IACxE,6EAA6E;IAC7E,yEAAyE;IACzE,6EAA6E;IAC7E,wEAAwE;IACxE,6EAA6E;IAC7E,MAAM,YAAY,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAClD,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IAEtC,0EAA0E;IAC1E,0EAA0E;IAC1E,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,IAAI,YAAqB,CAAC;IAC1B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,oBAAoB,EAAE,OAAO,EAAE,EAAE,CAAC;QAChE,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAC1D,IAAI,QAAQ;gBAAE,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;YAE5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,EAAE,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;gBAChC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;gBAClD,MAAM,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;gBAC3C,gEAAgE;gBAChE,6DAA6D;gBAC7D,gEAAgE;gBAChE,gEAAgE;gBAChE,8BAA8B;gBAC9B,OAAO,EAAE,CAAC;YACZ,CAAC;YAED,qEAAqE;YACrE,yDAAyD;YACzD,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;YACvC,MAAM,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,GAAG,GAAG,CAAC;YACnB,IAAI,OAAO,GAAG,oBAAoB,GAAG,CAAC,EAAE,CAAC;gBACvC,mEAAmE;gBACnE,MAAM,MAAM,CAAC,oBAAoB,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,8DAA8D;IAC9D,MAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,iEAAiE;IACjE,EAAE;IACF,4EAA4E;IAC5E,yEAAyE;IACzE,eAAe;IACf,6EAA6E;IAC7E,wEAAwE;IACxE,4EAA4E;IAC5E,4EAA4E;IAC5E,uEAAuE;IACvE,gCAAgC;IAChC,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,GAAG,CAAC;IACjE,IAAI,yBAAyB,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,uBAAuB,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;IAED,4EAA4E;IAC5E,qCAAqC;IACrC,EAAE;IACF,2EAA2E;IAC3E,2EAA2E;IAC3E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,4EAA4E;IAC5E,gCAAgC;IAChC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,0BAA0B,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,IAAI,CACV,yBAAyB,EAAE;QACzB,CAAC,CAAC,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,wEAAwE;gBACtE,0CAA0C,aAAa,mBAAmB;gBAC1E,yEAAyE;gBACzE,uCAAuC,MAAM,CAAC,YAAY,CAAC,EAAE;QACjE,CAAC,CAAC,+DAA+D;YAC7D,GAAG,aAAa,KAAK,MAAM,CAAC,YAAY,CAAC,EAAE,CAClD,CAAC;IACF,MAAM,KAAK,GAAG,sBAAsB,EAAE,CAAC;IACvC,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,KAAK,CAAC;AACf,CAAC;AAUD,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,MAAM,CAAC,KAAsB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,wBAAwB;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACd,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAC/C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,IAAI,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAC9D,MAAM,uBAAuB,GAAkB,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAgB7E,SAAS,aAAa,CAAC,cAAuB;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,uEAAuE;QACvE,oEAAoE;QACpE,uBAAuB;QACvB,OAAO,kBAAkB,OAAO,cAAc,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,4BAA4B,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,cAAc,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,CAAC,uBAAuB,CAAC,EAAE,IAAI;KAChC,CAAsB,CAAC;IACxB,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAuB;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;QAC1B,CAAC,uBAAuB,CAAC,EAAE,IAAI;KAChC,CAAsB,CAAC;IACxB,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAI,QAA0B;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAC9B,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,EAAE,CAAc,CAAC;QAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CACzB,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,CAAC,IAAI;YACN,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CACtE,CAAC;QACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,qBAAqB;QAC5C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,uEAAuE;QACvE,uCAAuC;QACvC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,EAAE,CAAc,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAE,IAAiC,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAGlC,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAW,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAE,IAAiC,CAAC,UAAU,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC7C,cAAc;YACd,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;SACpD,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,aAAgC,EAChC,SAAyB;IAEzB,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACtC,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI;YACL,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,SAAS,CAC9D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACvE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YACrC,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACtD,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,SAAyB;IAEzB,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,CAAC,MAAM,SAAS,EAAE,CAAc,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAC3B,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,IAAI;YACL,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,SAAS,CAC9D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,uEAAuE;YACvE,0EAA0E;YAC1E,2EAA2E;YAC3E,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,SAAS,EAAE,CAAC;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9B,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,MAAM,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO;YAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gFAAgF;AAEhF,sEAAsE;AACtE,MAAM,CAAC,MAAM,uBAAuB,GAAG,aAAa,CAAC;AACrD,4CAA4C;AAC5C,MAAM,CAAC,MAAM,0BAA0B,GAAG,KAAK,IAAmB,EAAE;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC,CAAC"}

package/dist/panel_bridge.d.ts

@@ -0,0 +1,15 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ServerMessage } from "./protocol/types.js";
+export interface PanelBridge {
+    /** Current panels as `panel_update` frames, for `session_sync` to replay to a
+     *  late-joining peer (mirrors the ui bridge's `pendingRequests`). */
+    pendingPanels(): ServerMessage[];
+    /** Drop subscriptions, timers, and state. */
+    dispose(): void;
+}
+/**
+ * Subscribe the plan + subagents buses and broadcast `panel_update` frames.
+ * Returns `null` when the SDK exposes no usable events bus (defensive — modern
+ * Pi always has one); callers stay null-safe.
+ */
+export declare function createPanelBridge(pi: ExtensionAPI, broadcast: (msg: ServerMessage) => void): PanelBridge | null;