@log0u7/opencode-mesh 0.2.0 → 0.4.0

package/CHANGELOG.md

@@ -7,6 +7,156 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-14
+
+### Added
+
+- Signed pairing offers close the pending-token rebind window (Closes #30).
+  Each node keeps an Ed25519 keypair in `node.json` (generated on first run or
+  on migration; the `node_id` is preserved). Pairing offers carry the emitter's
+  public key (`pk`), completing a pairing pins it, mDNS TXT advertises it, and
+  every outgoing mail carries a pairing proof (`<pk>.<signature>` over
+  `opencode-mesh-pair:<node_id>:<token>`). A pending token now binds (or
+  rotates) a peer row only with a valid proof from the pinned key: a leaked
+  offer alone can no longer take over a paired peer's credential. Peers paired
+  without a pinned key (0.3.0-era rows, or completions without `pk`) refuse
+  remote rebinding: re-run `mesh_pair` to rotate them. `peers` gains a
+  `public_key` column (schema version 2, migrated in place).
+
+### Fixed
+
+- Peer addresses in the IPv4-mapped IPv6 form (`[::ffff:192.168.1.10]:4399`)
+  are accepted, so a dual-stack resolver's reported address no longer leaves
+  its peer unreachable ("no known address with a port"). Portless and
+  empty-zone forms stay rejected.
+
+## [0.3.0] - 2026-10-14
+
+### Added
+
+- Documentation: `docs/CONFIGURATION.md` (the full options reference), and new
+  architecture and wire protocol docs detailing the process model, worker
+  lifecycle, data-dir layout, and the HTTP/mDNS/pairing protocol. The README
+  links them and documents the plugin options inline.
+- Plugin options are validated at setup. A `port` outside `[0, 65535]` or not an
+  integer, a `bind` other than `loopback`/`lan`, a non-boolean `advertise`, or an
+  empty/non-string `dataDir` now fails fast with a clear message instead of
+  surfacing later as `EADDRINUSE`, a bind on the wrong interface, or a data dir
+  at the wrong path. `tsconfig.test.json` and a `pnpm typecheck:tests` step
+  typecheck the test suite, which `tsconfig.json` (src only) never did.
+
+### Changed
+
+- `engines.node` is now `>=22.5.0` (the first release with `node:sqlite`), and
+  `@types/node` is pinned to the max Node major tested in CI (24) instead of 26.
+  `scripts/smoke-dist.mjs` now asserts the v2 (`setup`) entrypoint, and
+  `biome.json` is migrated to the 2.5.x schema.
+- `mesh_lock` is documented and advertised as local to this machine: it is
+  enforced between sessions sharing this host's data directory and is not part
+  of the wire protocol. A guard test fails the build if a lock route reappears
+  on the server.
+- Removed the Ed25519 keypair ceremony in node identity: nothing signed or
+  verified with it, so the short fingerprint is derived from `node_id`.
+  Existing node ids are preserved on upgrade; the fingerprint value changes,
+  which may require re-pairing peers.
+- Workers spawned by `mesh_spawn` run with `OPENCODE_MESH_CHILD=1` and skip the
+  server, mDNS and all mesh tools, so a pool of N workers no longer costs N
+  mesh nodes.
+- `mesh_worker_logs` reads only the tail of a worker log instead of loading the
+  whole file on the host's event loop; `mesh_status` caches `tailscale status`
+  for 60s and bounds the subprocess with a 2s timeout.
+
+### Fixed
+
+- The docs no longer claim security behaviour the code does not implement:
+  `SECURITY.md` drops the "refuses entries that look like API-key formats"
+  promise (no such filtering exists) and the umask-077 claim (the data
+  *directory* is created `0700`; the SQLite file itself is not `chmod`ed), and
+  the README drops the non-existent `"allow_tailnet"` option while updating its
+  stale install pin.
+- `mesh_pair` now rejects an empty `node_id` or `token` instead of completing a
+  pairing with a credential nobody can present (or that clobbers a peer record).
+  A partially-supplied pair (`node_id` without `token`, or vice versa) is an
+  error rather than being silently ignored.
+- The mesh server reports a body read failure as `400` (malformed request) rather
+  than `413` (too large): a client that drops the connection mid-body no longer
+  looks like an oversized payload.
+- Peer addresses that carry an IPv6 zone id (`[fe80::1%eth0]:4399`) are accepted,
+  so a link-local peer is no longer silently unreachable.
+- `defaultDataDir()` no longer resolves to a filesystem-root path
+  (`/.local/share/opencode-mesh`) when `HOME` is unset or blank: it falls back to
+  `os.homedir()`, then `os.tmpdir()`.
+- The node identity migration now finishes on disk: a `node.json` written by
+  <= 0.2.0 is rewritten without its dead Ed25519 keypair, so the stale key
+  material no longer lingers after the id is loaded. A corrupt or `node_id`-less
+  `node.json` now fails loudly with a recovery path instead of silently minting a
+  new node id, which would break every peer that recognised the node. Closes #31.
+- `mesh_lock` no longer throws a raw `UNIQUE constraint failed` error when two
+  opencode sessions sharing the same data directory race for the same path. The
+  lock claim is a single atomic `INSERT ... ON CONFLICT DO NOTHING`, and the
+  worker status transition is a single guarded `UPDATE`, so a stale
+  read-then-write can neither raise nor overwrite a concurrently finalized row.
+- The mesh database now records a schema version (`PRAGMA user_version`) and
+  creates indexes for its hot lookups (unread messages, pending pairing tokens,
+  peer tokens, running workers, expired locks).
+- On OpenCode 2.x hosts, `mesh_spawn` and `mesh_worker_remove` no longer hand the
+  raw `ctx.worktree` domain to the REST-shaped worktree client. The in-process
+  domain (which resolves payloads directly, without the v1 `{ data, error }`
+  envelope) is wrapped back into that shape, and an injected
+  `options.worktreeClient` now takes precedence. Closes #29.
+- Worktree create/remove calls on the 1.x REST client are bounded by a 15s
+  timeout. A create response with no directory, or a remove response that is
+  not a boolean, now raises a clear error instead of persisting an `undefined`
+  directory. When the 2.x domain reports only a directory (no branch), the
+  worker's branch falls back to that directory's name.
+- A spawn that fails before the child runs no longer leaks its worktree:
+  `mesh_spawn` removes the worktree and the dead registry row when the child
+  never starts or `runWorker` throws. `mesh_worker_remove` keeps the registry
+  row when the worktree was not actually removed, instead of orphaning it.
+- Node runtime support: the published package no longer calls `require()` from
+  ESM modules. The Node fallback paths (`node:sqlite` engine, `node:crypto`)
+  now use static and dynamic imports and actually run. Vitest's module runner
+  injects a `require`, which hid the `ReferenceError` from the suite, so
+  `scripts/smoke-dist.mjs` loads the built package under plain Node and is part
+  of `pnpm verify`.
+- `mesh_send` no longer derives the peer's port from the local node. Discovered
+  addresses now carry the port from the mDNS SRV record (`[ipv6]:port` for IPv6
+  literals), and a portless address is refused instead of resolving to a wrong
+  socket. Peers that fall back to an ephemeral port are now reachable.
+- Workers killed through `mesh_worker_stop` no longer orphan their own child
+  processes: workers are detached process-group leaders and a stop takes the
+  group down. The late `exit` event after a deliberate stop no longer throws;
+  a host restart reconciles `running` rows whose pid is gone.
+- A worker that fails to start (binary missing, `error` event with no `exit`)
+  is now finalized as `failed` instead of staying `running` forever with a
+  leaked live entry; a `-1` pid is never persisted. `mesh_spawn` reports the
+  failure instead of a success envelope.
+- A worker's stderr is drained into its log; a child writing more than the pipe
+  buffer (~64 KB) to stderr no longer blocks. `mesh_worker_stop` escalates
+  `SIGTERM` to `SIGKILL` after 3s so a worker ignoring the signal cannot linger.
+- Worker logs are capped at 512 KB (rotated to `<id>.log.1`) and deleted by
+  `mesh_worker_remove`, so a chatty worker cannot fill the disk.
+- A JSON line split across two stdout chunks is now reassembled before parsing,
+  so a worker's `session_id` is captured instead of silently dropping to null.
+  A session id arriving after the row is terminal is ignored.
+
+### Security
+
+- The mesh HTTP server binds to `127.0.0.1` by default. `"bind": "lan"` opts
+  into listening on all interfaces, and `mesh_status` / the `mesh_pair` offer
+  report the address actually bound instead of a hardcoded loopback string.
+- Pairing offers expire after 5 minutes, are pruned on check, and a pending
+  token alone no longer installs a permanent peer: the claimed node must
+  already be known to this host (mDNS discovery or explicit `mesh_pair`).
+  Auto-pairing a previously unknown node id is gone.
+- Discovered peers keep their hostname and fingerprint through pairing instead
+  of collapsing to `"pending"`, so `mesh_status` still shows a real identity.
+
+### Removed
+
+- `/announce` endpoint, its parser and `touchAddress` (no client ever called
+  the route).
+
 ## [0.2.0] - 2026-10-12
 
 ### Added

package/README.md

@@ -10,6 +10,8 @@ Coordination for [OpenCode](https://opencode.ai): multiple sessions working toge
 
 Each node advertises itself over mDNS, pairs with explicit operator approval (per-peer bearer tokens, deny by default), then sessions can exchange messages (`mesh_send` / `mesh_inbox`) and coordinate on shared work (`mesh_lock` / `mesh_unlock`). Tailscale IPs are picked up automatically when `tailscale status` works, for cross-subnet pools.
 
+`mesh_lock` is **local to your machine**: it is enforced between OpenCode sessions sharing this host's data directory (`~/.local/share/opencode-mesh/`). Locks are not part of the wire protocol, so a peer on another node does not see or respect them. Remote nodes coordinate through messages (`mesh_send`), not locks.
+
 ## Install
 
 Register the plugin in `opencode.json` (project or global `~/.config/opencode/opencode.json`):
@@ -24,12 +26,36 @@ Restart OpenCode. The package is installed automatically at startup into opencod
 
 ```json
 {
-  "plugin": ["@log0u7/opencode-mesh@0.1.1"]
+  "plugin": ["@log0u7/opencode-mesh@0.4.0"]
+}
+```
+
+### Configuration
+
+All options are optional; see [docs/CONFIGURATION.md](docs/CONFIGURATION.md) for the reference.
+
+On OpenCode 1.x hosts, options travel in a package-and-options tuple:
+
+```json
+{
+  "plugin": [["@log0u7/opencode-mesh", { "port": 4399, "bind": "loopback", "advertise": true }]]
+}
+```
+
+On 2.x hosts the key is `plugins` and each entry is an object:
+
+```json
+{
+  "plugins": [
+    { "package": "@log0u7/opencode-mesh", "options": { "port": 4399, "bind": "lan" } }
+  ]
 }
 ```
 
 Node identity and mailbox live under `~/.local/share/opencode-mesh/` (honors `XDG_DATA_HOME`), created with restrictive permissions.
 
+Workers spawned with `mesh_spawn` run with `OPENCODE_MESH_CHILD=1`: they skip the mesh server, mDNS and all mesh tools, so a pool of N workers costs N worktrees, not N mesh nodes.
+
 Note (npm 12): the package ships no lifecycle install scripts and needs no `allowScripts` / allowlist on install (its runtime dependency `bonjour-service` has none either).
 
 ## Usage
@@ -38,10 +64,10 @@ Same machine: start two OpenCode instances in the same repository.
 
 ```
 mesh_status()                      # local sessions + paired peers + active locks
-mesh_pair()                        # list discovered peers, approve pairing
+mesh_pair()                        # emit a pairing offer (5 min) / complete the peer's offer
 mesh_send(peer="laptop", subject="handoff", body="...")
 mesh_inbox()                       # pull new messages, ack
-mesh_lock(path="src/api.ts", ttl=300)   # claim a file before editing
+mesh_lock(path="src/api.ts", ttl=300)   # claim a file before editing (this machine only)
 mesh_unlock(path="src/api.ts")
 ```
 
@@ -50,10 +76,10 @@ mesh_unlock(path="src/api.ts")
 | Tool | Args | Description |
 |---|---|---|
 | `mesh_status` | : local session registry, own address, paired peers, active locks. |
-| `mesh_pair` | `query?` | List discovered peers; operator approves by hostname/fingerprint. |
+| `mesh_pair` | `node_id?`, `token?`, `address?` | No args: emit a pairing offer (5 min ttl). With args: complete the peer's offer. |
 | `mesh_send` | `peer`, `subject`, `body` | Deliver a message to a peer's mailbox. |
 | `mesh_inbox` | `ack?` | Fetch unread messages; ack marks them read. |
-| `mesh_lock` | `path`, `ttl?` | Exclusive claim on a file or worktree path (default ttl 600s). |
+| `mesh_lock` | `path`, `ttl?` | Exclusive claim on a file or path, enforced only between sessions on this machine (default ttl 600s). Not visible to remote peers. |
 | `mesh_unlock` | `path` | Release a claim. |
 
 ### Orchestrator
@@ -72,22 +98,29 @@ Workers run `opencode run --dir <worktree> --format json` headless with `--auto`
 
 ### Security model
 
-- Every HTTP endpoint requires a per-peer bearer token; nothing is open by default.
-- All peers, same machine or remote, pair through `mesh_pair`: one side emits a one-time token, the other completes the pairing with it.
-- mDNS TXT records carry node id + key fingerprint only, never secrets.
-- LAN-only by default; tailnet addresses are surfaced by `mesh_status` when `tailscale` runs, for cross-subnet pools (`"allow_tailnet": true` plugin option, planned).
+- The HTTP mesh server binds to `127.0.0.1` by default. Set `"bind": "lan"` in the plugin options to listen on all interfaces for a LAN pool.
+- Every endpoint requires a per-peer bearer token; nothing is open by default.
+- Pairing offers expire after 5 minutes. A pending token alone grants nothing: the claimed node must already be known to this host (discovered over mDNS, or paired out of band with `mesh_pair`). Both sides run `mesh_pair` to complete a pairing, so a leaked offer cannot install a permanent peer on its own.
+- Peer addresses always carry the advertised port; a portless address is refused instead of being completed with the local port.
+- mDNS TXT records carry node id + fingerprint only, never secrets.
+- Tailnet addresses are surfaced by `mesh_status` when `tailscale` runs, for cross-subnet pools.
+- Messages travel over plain HTTP: there is no TLS layer. Loopback and trusted networks only.
 
 ## Development
 
-Requires Node >= 22 (mise: `mise install`) and pnpm (corepack).
+Requires Node >= 22.5 (`mise install`) and pnpm (corepack).
 
 ```sh
 pnpm install
-pnpm verify      # biome + typecheck + vitest
-pnpm build:check # tsc build + pack dry-run
+pnpm verify            # biome + typecheck + vitest + Node smoke of dist/
+pnpm typecheck:tests   # typecheck the test suite (also enforced in CI)
+pnpm build:check       # tsc build + pack dry-run
+pnpm smoke:dist        # build, then load dist/ under plain Node (no vitest shims)
 ```
 
-See [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow.
+See [CONTRIBUTING.md](CONTRIBUTING.md) for the workflow, and the [docs/](docs/) folder for
+[configuration](docs/CONFIGURATION.md), [architecture](docs/ARCHITECTURE.md), and the
+wire [protocol](docs/PROTOCOL.md).
 
 ## License
 

package/dist/lib/client.d.ts

@@ -4,6 +4,8 @@ export type SendTarget = {
     from: string;
     subject: string;
     body: string;
+    /** `<base64 spki>.<base64 ed25519 signature>` over node_id:token. */
+    proof?: string;
 };
 export type SendResult = "ok" | "unreachable" | "unauthorized" | "error";
 export declare function sendMail(target: SendTarget): Promise<SendResult>;

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,CAAC;AAIzE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAqBtE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG,IAAI,GAAG,aAAa,GAAG,cAAc,GAAG,OAAO,CAAC;AAIzE,wBAAsB,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CA0BtE"}

package/dist/lib/client.js

@@ -8,7 +8,12 @@ export async function sendMail(target) {
                 "content-type": "application/json",
                 authorization: `Bearer ${target.token}`,
             },
-            body: JSON.stringify({ from: target.from, subject: target.subject, body: target.body }),
+            body: JSON.stringify({
+                from: target.from,
+                subject: target.subject,
+                body: target.body,
+                ...(target.proof !== undefined ? { proof: target.proof } : {}),
+            }),
             signal: AbortSignal.timeout(5000),
         });
         if (response.ok) {

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAUA,8EAA8E;AAC9E,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,OAAO,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;YACvF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAYA,8EAA8E;AAC9E,gCAAgC;AAChC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,MAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,OAAO,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE;aACxC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;YACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC5B,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/lib/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AA4CF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,MAAM,MAAM,GAAG;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAuEF,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAW/C"}

package/dist/lib/db.js

@@ -1,6 +1,9 @@
 import { mkdirSync } from "node:fs";
 import { dirname } from "node:path";
 import { openSqlite } from "./sqlite.js";
+// Bump when a schema change needs a migration step; the version anchors future
+// migrations that cannot be expressed as idempotent `CREATE ... IF NOT EXISTS`.
+const SCHEMA_VERSION = 2;
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS peers (
   node_id TEXT PRIMARY KEY,
@@ -9,6 +12,7 @@ CREATE TABLE IF NOT EXISTS peers (
   addresses TEXT NOT NULL DEFAULT '[]',
   paired INTEGER NOT NULL DEFAULT 0,
   token TEXT,
+  public_key TEXT,
   last_seen INTEGER NOT NULL
 );
 CREATE TABLE IF NOT EXISTS messages (
@@ -41,7 +45,28 @@ CREATE TABLE IF NOT EXISTS workers (
   started_at INTEGER NOT NULL,
   finished_at INTEGER
 );
+CREATE INDEX IF NOT EXISTS idx_messages_status_created ON messages(status, created_at);
+CREATE INDEX IF NOT EXISTS idx_pending_tokens_created ON pending_tokens(created_at);
+CREATE INDEX IF NOT EXISTS idx_peers_token ON peers(token);
+CREATE INDEX IF NOT EXISTS idx_workers_status ON workers(status);
+CREATE INDEX IF NOT EXISTS idx_locks_expires ON locks(expires_at);
 `;
+function migrate(conn) {
+    const current = conn.get("PRAGMA user_version")?.user_version ?? 0;
+    if (current >= SCHEMA_VERSION) {
+        return;
+    }
+    // Every statement in SCHEMA is idempotent, so a version-0 database (fresh or
+    // pre-versioning) is brought up to date by re-running it.
+    conn.exec(SCHEMA);
+    // v2: pairing proofs are verified against a pinned public key, so peers gain
+    // the column. ALTER TABLE is not idempotent: guard it on the live schema.
+    const peerColumns = conn.all("PRAGMA table_info(peers)").map((row) => row.name);
+    if (!peerColumns.includes("public_key")) {
+        conn.exec("ALTER TABLE peers ADD COLUMN public_key TEXT");
+    }
+    conn.run(`PRAGMA user_version = ${SCHEMA_VERSION}`);
+}
 export function openMeshDb(path) {
     if (path !== ":memory:") {
         mkdirSync(dirname(path), { recursive: true });
@@ -49,7 +74,7 @@ export function openMeshDb(path) {
     const conn = openSqlite(path);
     conn.run("PRAGMA journal_mode = WAL");
     conn.run("PRAGMA busy_timeout = 5000");
-    conn.exec(SCHEMA);
+    migrate(conn);
     return { conn, close: () => conn.close() };
 }
 //# sourceMappingURL=db.js.map

package/dist/lib/db.js.map

@@ -1 +1 @@
-{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAO1D,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAwCd,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAElB,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC"}
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/lib/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,UAAU,EAAmB,MAAM,aAAa,CAAC;AAO1D,+EAA+E;AAC/E,gFAAgF;AAChF,MAAM,cAAc,GAAG,CAAC,CAAC;AAEzB,MAAM,MAAM,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8Cd,CAAC;AAEF,SAAS,OAAO,CAAC,IAAgB;IAC/B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAA2B,qBAAqB,CAAC,EAAE,YAAY,IAAI,CAAC,CAAC;IAC7F,IAAI,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,OAAO;IACT,CAAC;IACD,6EAA6E;IAC7E,0DAA0D;IAC1D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClB,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAmB,0BAA0B,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClG,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,yBAAyB,cAAc,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACtC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;AAC7C,CAAC"}

package/dist/lib/discovery.d.ts

@@ -8,12 +8,14 @@ export declare function advertiseMesh(options: {
     port: number;
     node_id: string;
     fingerprint: string;
+    public_key: string;
 }): AdvertiseHandle;
 export type DiscoveredPeer = {
     node_id: string;
     hostname: string;
     fingerprint: string;
     addresses: string[];
+    public_key?: string;
 };
 export declare function browseMesh(options: {
     bonjour: Bonjour;
@@ -21,5 +23,6 @@ export declare function browseMesh(options: {
 }): {
     close(): void;
 };
+export declare function resetTailnetCache(): void;
 export declare function tailnetAddresses(): Promise<string[]>;
 //# sourceMappingURL=discovery.d.ts.map

package/dist/lib/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAIF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,GAAG,eAAe,CAalB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;CAC9C,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CAoBpB;AAID,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAkB1D"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAE/C,eAAO,MAAM,iBAAiB,kBAAkB,CAAC;AAEjD,MAAM,MAAM,eAAe,GAAG;IAC5B,KAAK,IAAI,IAAI,CAAC;CACf,CAAC;AAIF,wBAAgB,aAAa,CAAC,OAAO,EAAE;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,eAAe,CAalB;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wBAAgB,UAAU,CAAC,OAAO,EAAE;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,CAAC,IAAI,EAAE,cAAc,KAAK,IAAI,CAAC;CAC9C,GAAG;IAAE,KAAK,IAAI,IAAI,CAAA;CAAE,CAuBpB;AAsBD,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAgC1D"}

package/dist/lib/discovery.js

@@ -1,12 +1,12 @@
 export const MESH_SERVICE_TYPE = "opencode-mesh";
-// Advertise this node on the LAN. TXT carries only the node id and key
-// fingerprint: never secrets.
+// Advertise this node on the LAN. TXT carries the node id, key fingerprint and
+// the pairing public key (pk): never secrets.
 export function advertiseMesh(options) {
     const service = options.bonjour.publish({
         name: options.node_id,
         type: MESH_SERVICE_TYPE,
         port: options.port,
-        txt: { id: options.node_id, fp: options.fingerprint },
+        txt: { id: options.node_id, fp: options.fingerprint, pk: options.public_key },
     });
     return {
         close() {
@@ -25,7 +25,10 @@ export function browseMesh(options) {
             node_id: id,
             hostname: service.host ?? service.name,
             fingerprint: fp,
-            addresses: service.addresses ?? [],
+            addresses: socketAddresses(service.addresses, service.port),
+            ...(typeof service.txt?.pk === "string" && service.txt.pk.length > 0
+                ? { public_key: service.txt.pk }
+                : {}),
         });
     });
     return {
@@ -34,12 +37,33 @@ export function browseMesh(options) {
         },
     };
 }
+// An mDNS A/AAAA record is a bare IP: the peer's listening port comes from the
+// SRV record in the same service. Guessing the port from the local node is
+// wrong whenever the peer fell back to an ephemeral port, so a record without
+// a port yields no address at all rather than a wrong one.
+function socketAddresses(ips, port) {
+    if (port === undefined) {
+        return [];
+    }
+    return (ips ?? []).map((ip) => (ip.includes(":") ? `[${ip}]:${port}` : `${ip}:${port}`));
+}
 // Tailnet addresses let peers connect across subnets when tailscale runs.
-// Absent CLI = empty list, never an error.
+// Absent CLI = empty list, never an error. The result is cached: mesh_status is
+// a hot tool call and `tailscale status --json` is a subprocess we must not pay
+// on every invocation.
+const TAILNET_TTL_MS = 60_000;
+const TAILNET_TIMEOUT_MS = 2000;
+let tailnetCache = null;
+export function resetTailnetCache() {
+    tailnetCache = null;
+}
 export async function tailnetAddresses() {
+    if (tailnetCache !== null && tailnetCache.expiresAt > Date.now()) {
+        return tailnetCache.addresses;
+    }
     const { execFile } = await import("node:child_process");
-    return new Promise((resolve) => {
-        execFile("tailscale", ["status", "--json"], (error, stdout) => {
+    const addresses = await new Promise((resolve) => {
+        execFile("tailscale", ["status", "--json"], { timeout: TAILNET_TIMEOUT_MS }, (error, stdout) => {
             if (error) {
                 resolve([]);
                 return;
@@ -54,5 +78,7 @@ export async function tailnetAddresses() {
             }
         });
     });
+    tailnetCache = { addresses, expiresAt: Date.now() + TAILNET_TTL_MS };
+    return addresses;
 }
 //# sourceMappingURL=discovery.js.map

package/dist/lib/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAMjD,uEAAuE;AACvE,8BAA8B;AAC9B,MAAM,UAAU,aAAa,CAAC,OAK7B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE;KACtD,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,UAAU,CAAC,OAG1B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,YAAY,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;YACtC,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,EAAE;SACnC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAExD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,CAAC,KAAmB,EAAE,MAAc,EAAE,EAAE;YAClF,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2C,CAAC;gBAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;gBACtC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/lib/discovery.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAMjD,+EAA+E;AAC/E,8CAA8C;AAC9C,MAAM,UAAU,aAAa,CAAC,OAM7B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC;QACtC,IAAI,EAAE,OAAO,CAAC,OAAO;QACrB,IAAI,EAAE,iBAAiB;QACvB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,GAAG,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,OAAO,CAAC,UAAU,EAAE;KAC9E,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,UAAU,CAAC,OAG1B;IACC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC,OAAO,EAAE,EAAE;QAC5E,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;QAC3B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxE,OAAO;QACT,CAAC;QACD,OAAO,CAAC,YAAY,CAAC;YACnB,OAAO,EAAE,EAAE;YACX,QAAQ,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;YACtC,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,eAAe,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC;YAC3D,GAAG,CAAC,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC;gBAClE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE;gBAChC,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,2EAA2E;AAC3E,8EAA8E;AAC9E,2DAA2D;AAC3D,SAAS,eAAe,CAAC,GAAyB,EAAE,IAAwB;IAC1E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,0EAA0E;AAC1E,gFAAgF;AAChF,gFAAgF;AAChF,uBAAuB;AACvB,MAAM,cAAc,GAAG,MAAM,CAAC;AAC9B,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,IAAI,YAAY,GAAsD,IAAI,CAAC;AAE3E,MAAM,UAAU,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,IAAI,YAAY,KAAK,IAAI,IAAI,YAAY,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACjE,OAAO,YAAY,CAAC,SAAS,CAAC;IAChC,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAExD,MAAM,SAAS,GAAG,MAAM,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,EAAE;QACxD,QAAQ,CACN,WAAW,EACX,CAAC,QAAQ,EAAE,QAAQ,CAAC,EACpB,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAC/B,CAAC,KAAmB,EAAE,MAAc,EAAE,EAAE;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,OAAO,CAAC,EAAE,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA2C,CAAC;gBAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC;gBACtC,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CACnF,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,YAAY,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,EAAE,CAAC;IACrE,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/identity.d.ts

@@ -1,15 +1,17 @@
-type Jwk = {
-    kty?: string;
-    x?: string;
-    [key: string]: unknown;
-};
 export type NodeIdentity = {
     node_id: string;
     hostname: string;
+    public_key: string;
+    private_key: string;
     fingerprint: string;
-    public_key: Jwk;
-    private_key: Jwk;
 };
 export declare function loadOrCreateIdentity(dataDir: string): NodeIdentity;
-export {};
+export declare function pairingProofPayload(nodeId: string, token: string): string;
+export declare function signPairingProof(privateKey: string, payload: string): string;
+export declare function pairingProof(identity: {
+    node_id: string;
+    public_key: string;
+    private_key: string;
+}, token: string): string;
+export declare function verifyPairingProof(publicKey: string, payload: string, proof: string): boolean;
 //# sourceMappingURL=identity.d.ts.map

package/dist/lib/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAKA,KAAK,GAAG,GAAG;IACT,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,GAAG,CAAC;IAChB,WAAW,EAAE,GAAG,CAAC;CAClB,CAAC;AASF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CASlE"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAaA,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAoBlE;AA+FD,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAED,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAO5E;AAGD,wBAAgB,YAAY,CAC1B,QAAQ,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EACtE,KAAK,EAAE,MAAM,GACZ,MAAM,CAKR;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAW7F"}