@richhardry/codor 0.10.0

package/node_modules/@codor/switchboard/dist/continuation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"continuation.js","sourceRoot":"","sources":["../src/continuation.ts"],"names":[],"mappings":"AAiBA,SAAS,QAAQ,CAAC,KAAgB;IAChC,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU;WAC3B,KAAK,CAAC,IAAI,KAAK,UAAU;WACzB,KAAK,CAAC,IAAI,KAAK,eAAe;QACjC,CAAC,CAAC,KAAK,CAAC,iBAAiB;QACzB,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,MAAM,CAAC,KAA+C;IAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa;QAAE,OAAO,SAAS,CAAC;IAC3F,MAAM,OAAO,GAAG,KAAK,CAAC,OAAgC,CAAC;IACvD,OAAO,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3E,CAAC;AAED,SAAS,MAAM,CAAC,KAA+C;IAC7D,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;QAAE,OAAO,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,OAA6B,CAAC;IACpD,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,kBAAkB,CAAC,SAA6B,EAAE,QAAgB;IACzE,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,IAAI,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5E,4EAA4E;IAC5E,+EAA+E;IAC/E,uEAAuE;IACvE,IAAI,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0GAA0G;AAC1G;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IAOlB;IANH,eAAe,CAAS;IACf,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,kBAAkB,GAAa,EAAE,CAAC;IAC3C,YAAY,GAAG,EAAE,CAAC;IAE1B,YACW,aAAqB,EAC9B,UAAgC,EAAE;QADzB,kBAAa,GAAb,aAAa,CAAQ;QAG9B,IAAI,CAAC,eAAe,GAAG,aAAa,CAAC;QACrC,KAAK,MAAM,KAAK,IAAI,OAAO;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CACJ,KAAgB,EAChB,eAAuB,EACvB,QAAsB;QAEtB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YAC7F,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QACD,IAAI,KAAK,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,CAAC;QACnB,CAAC;QAED,IAAI,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,uBAAuB,GAAG,GAAS,EAAE;YACzC,IAAI,eAAe,IAAI,IAAI,CAAC,eAAe;gBAAE,OAAO;YACpD,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAC;YAChC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC,CAAC;QAEF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,EAAE,CAAC;gBACtC,QAAQ,GAAG,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC;YAC1G,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;gBACnD,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,uBAAuB,EAAE,CAAC;gBAC1B,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBACtC,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,IAAI,CAAC,eAAe,CAAC;YACrE,CAAC;iBAAM,CAAC;gBACN,uBAAuB,EAAE,CAAC;gBAC1B,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;YAClC,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IACE,KAAK,CAAC,MAAM,KAAK,QAAQ;mBACtB,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,EACrE,CAAC;gBACD,uBAAuB,EAAE,CAAC;YAC5B,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC;QAClC,CAAC;QAED,MAAM,QAAQ,GAAG,EAAE,GAAG,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAqB,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO;YACL,KAAK,EAAE,QAAQ;YACf,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACpE,CAAC;IACJ,CAAC;IAEO,OAAO,CAAC,KAAgB;QAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC;QACrD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YACzB,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,EAAE,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC1F,IAAI,KAAK,CAAC,SAAS,KAAK,YAAY;gBAAE,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC;YACzE,IAAI,KAAK,CAAC,SAAS,KAAK,aAAa,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;gBACjF,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAChC,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACpC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACrC,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACtD,IAAI,KAAK,IAAI,CAAC;oBAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC;IACpE,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,0BAA0B,CACxC,aAAqB,EACrB,MAA4B;IAE5B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAiB,CAAC,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9D,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS,CAAC,aAAa,CAAC,CAAC,CAAC;IAC9D,MAAM,qBAAqB,GAAG,IAAI,GAAG,EAAU,CAAC;IAChD,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,eAAe,GAAG,aAAa,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,eAAe;YAAE,SAAS;QACvG,MAAM,MAAM,GAAG,KAAK,CAAC,iBAAiB,IAAI,aAAa,CAAC;QACxD,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,eAAe,GAAG,MAAM,CAAC;QAEzB,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBACtD,QAAQ,IAAI,IAAI,CAAC;gBACjB,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;iBAAM,IAAI,KAAK,CAAC,SAAS,KAAK,mBAAmB,EAAE,CAAC;gBACnD,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC1D,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,CAAC;AAClF,CAAC;AACD,kEAAkE"}

package/node_modules/@codor/switchboard/dist/crypto/browser-sessions.d.ts

@@ -0,0 +1,22 @@
+import type { DeviceKeyStore } from './keys.js';
+export interface BrowserDeviceSession {
+    access_token: string;
+    device_id: string;
+    expires_at: string;
+}
+/** Short-lived bearer sessions exist only after an enrolled device signs a fresh challenge. */
+export declare class BrowserDeviceSessionAuthority {
+    private readonly keys;
+    private readonly now;
+    private readonly sessions;
+    private readonly stopWatchingRevocation;
+    constructor(keys: DeviceKeyStore, now?: () => number);
+    issue(deviceId: string): BrowserDeviceSession;
+    authenticate(token: string): string | undefined;
+    revoke(deviceId: string): void;
+    count(deviceId?: string): number;
+    close(): void;
+    private sweepExpired;
+    private trim;
+}
+//# sourceMappingURL=browser-sessions.d.ts.map

package/node_modules/@codor/switchboard/dist/crypto/browser-sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-sessions.d.ts","sourceRoot":"","sources":["../../src/crypto/browser-sessions.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAMhD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,+FAA+F;AAC/F,qBAAa,6BAA6B;IAKtC,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IALtB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAa;gBAGjC,IAAI,EAAE,cAAc,EACpB,GAAG,GAAE,MAAM,MAAiB;IAK/C,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,oBAAoB;IAgB7C,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAa/C,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAM9B,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM;IAOhC,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,IAAI;CASb"}

package/node_modules/@codor/switchboard/dist/crypto/browser-sessions.js

@@ -0,0 +1,92 @@
+import sodium from 'sodium-native';
+const SESSION_TTL_MS = 24 * 60 * 60 * 1_000;
+const MAX_SESSIONS_PER_DEVICE = 8;
+const MAX_SESSIONS_TOTAL = 1_024;
+function tokenDigest(token) {
+    const digest = Buffer.alloc(sodium.crypto_generichash_BYTES);
+    sodium.crypto_generichash(digest, Buffer.from(token, 'utf8'));
+    return digest.toString('base64url');
+}
+function randomToken() {
+    const token = Buffer.alloc(32);
+    sodium.randombytes_buf(token);
+    return token.toString('base64url');
+}
+// harn:assume paired-browser-challenge-session ref=device-session-token-authority
+/** Short-lived bearer sessions exist only after an enrolled device signs a fresh challenge. */
+export class BrowserDeviceSessionAuthority {
+    keys;
+    now;
+    sessions = new Map();
+    stopWatchingRevocation;
+    constructor(keys, now = Date.now) {
+        this.keys = keys;
+        this.now = now;
+        this.stopWatchingRevocation = keys.onPeerRevoked((deviceId) => this.revoke(deviceId));
+    }
+    issue(deviceId) {
+        const peer = this.keys.getPeer(deviceId);
+        if (peer?.kind !== 'device')
+            throw new Error('browser sessions require an enrolled device');
+        this.sweepExpired();
+        this.trim((session) => session.deviceId === deviceId, MAX_SESSIONS_PER_DEVICE);
+        this.trim(() => true, MAX_SESSIONS_TOTAL);
+        const accessToken = randomToken();
+        const expiresAt = this.now() + SESSION_TTL_MS;
+        this.sessions.set(tokenDigest(accessToken), { deviceId, expiresAt });
+        return {
+            access_token: accessToken,
+            device_id: deviceId,
+            expires_at: new Date(expiresAt).toISOString(),
+        };
+    }
+    authenticate(token) {
+        this.sweepExpired();
+        const digest = tokenDigest(token);
+        const session = this.sessions.get(digest);
+        if (!session)
+            return undefined;
+        const peer = this.keys.getPeer(session.deviceId);
+        if (peer?.kind !== 'device') {
+            this.sessions.delete(digest);
+            return undefined;
+        }
+        return session.deviceId;
+    }
+    revoke(deviceId) {
+        for (const [digest, session] of this.sessions) {
+            if (session.deviceId === deviceId)
+                this.sessions.delete(digest);
+        }
+    }
+    count(deviceId) {
+        this.sweepExpired();
+        return deviceId === undefined
+            ? this.sessions.size
+            : [...this.sessions.values()].filter((session) => session.deviceId === deviceId).length;
+    }
+    close() {
+        this.stopWatchingRevocation();
+        this.sessions.clear();
+    }
+    sweepExpired() {
+        const now = this.now();
+        for (const [digest, session] of this.sessions) {
+            if (session.expiresAt <= now)
+                this.sessions.delete(digest);
+        }
+    }
+    trim(matches, maximum) {
+        let count = [...this.sessions.values()].filter(matches).length;
+        for (const [digest, session] of this.sessions) {
+            if (count < maximum)
+                return;
+            if (!matches(session))
+                continue;
+            this.sessions.delete(digest);
+            count -= 1;
+        }
+    }
+}
+// harn:end paired-browser-challenge-session
+//# sourceMappingURL=browser-sessions.js.map

package/node_modules/@codor/switchboard/dist/crypto/browser-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-sessions.js","sourceRoot":"","sources":["../../src/crypto/browser-sessions.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AAInC,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AAC5C,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAajC,SAAS,WAAW,CAAC,KAAa;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC7D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,kFAAkF;AAClF,+FAA+F;AAC/F,MAAM,OAAO,6BAA6B;IAKrB;IACA;IALF,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,sBAAsB,CAAa;IAEpD,YACmB,IAAoB,EACpB,MAAoB,IAAI,CAAC,GAAG;QAD5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxF,CAAC;IAED,KAAK,CAAC,QAAgB;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QAC5F,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAC1C,MAAM,WAAW,GAAG,WAAW,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC9C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QACrE,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE;SAC9C,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,OAAO,CAAC,QAAQ,CAAC;IAC1B,CAAC;IAED,MAAM,CAAC,QAAgB;QACrB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAiB;QACrB,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,QAAQ,KAAK,SAAS;YAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI;YACpB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;IAC5F,CAAC;IAED,KAAK;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,OAAO,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAEO,IAAI,CAAC,OAA4C,EAAE,OAAe;QACxE,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC/D,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC9C,IAAI,KAAK,GAAG,OAAO;gBAAE,OAAO;YAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,SAAS;YAChC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAC7B,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;CACF;AACD,4CAA4C"}

package/node_modules/@codor/switchboard/dist/crypto/challenge.d.ts

@@ -0,0 +1,37 @@
+import { type DeviceIdentity, type DeviceKeyStore, type PeerRecord } from './keys.js';
+export interface AuthChallenge {
+    challenge_id: string;
+    server_nonce: string;
+    transcript_hash: string;
+    expires_at: string;
+}
+export interface AuthenticatedConnection {
+    id: string;
+    peer: PeerRecord;
+    close(reason: string): void;
+}
+export declare function challengeBytes(challenge: Pick<AuthChallenge, 'server_nonce' | 'transcript_hash'>): Buffer;
+export declare function hashTranscript(transcript: Uint8Array): string;
+export declare function signChallenge(challenge: AuthChallenge, identity: DeviceIdentity): string;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+export declare class ChallengeAuthority {
+    private readonly keys;
+    private readonly now;
+    private readonly pending;
+    constructor(keys: DeviceKeyStore, now?: () => number);
+    issue(peerId: string, transcriptHash: string): AuthChallenge;
+    pendingCount(peerId?: string): number;
+    verify(challengeId: string, signature: string): PeerRecord;
+    private sweepExpired;
+    private trimPending;
+}
+export declare class AuthenticatedConnectionRegistry {
+    private readonly connections;
+    private readonly stopWatching;
+    constructor(keys: DeviceKeyStore);
+    add(connection: AuthenticatedConnection): () => void;
+    has(id: string): boolean;
+    close(): void;
+    private dropPeer;
+}
+//# sourceMappingURL=challenge.d.ts.map

package/node_modules/@codor/switchboard/dist/crypto/challenge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.d.ts","sourceRoot":"","sources":["../../src/crypto/challenge.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EAChB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,aAAa;IAC5B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,UAAU,CAAC;IACjB,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAaD,wBAAgB,cAAc,CAAC,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,cAAc,GAAG,iBAAiB,CAAC,GAAG,MAAM,CAMzG;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAI7D;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,CAQxF;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAMtE;AAGD,qBAAa,kBAAkB;IAI3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,GAAG;IAJtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAsC;gBAG3C,IAAI,EAAE,cAAc,EACpB,GAAG,GAAE,MAAM,MAAiB;IAG/C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,aAAa;IAkB5D,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAOrC,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,UAAU;IAgB1D,OAAO,CAAC,YAAY;IAOpB,OAAO,CAAC,WAAW;CAYpB;AAED,qBAAa,+BAA+B;IAC1C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8C;IAC1E,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAa;gBAE9B,IAAI,EAAE,cAAc;IAIhC,GAAG,CAAC,UAAU,EAAE,uBAAuB,GAAG,MAAM,IAAI;IAKpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAIxB,KAAK,IAAI,IAAI;IAMb,OAAO,CAAC,QAAQ;CAOjB"}

package/node_modules/@codor/switchboard/dist/crypto/challenge.js

@@ -0,0 +1,132 @@
+import sodium from 'sodium-native';
+import { decodeKey, } from './keys.js';
+const CHALLENGE_TTL_MS = 30_000;
+const MAX_PENDING_PER_PEER = 8;
+const MAX_PENDING_TOTAL = 1_024;
+const CHALLENGE_DOMAIN = Buffer.from('codor-auth-v1\0', 'utf8');
+function random(bytes) {
+    const value = Buffer.alloc(bytes);
+    sodium.randombytes_buf(value);
+    return value;
+}
+export function challengeBytes(challenge) {
+    return Buffer.concat([
+        CHALLENGE_DOMAIN,
+        decodeKey(challenge.server_nonce, 32, 'server nonce'),
+        decodeKey(challenge.transcript_hash, sodium.crypto_generichash_BYTES, 'transcript hash'),
+    ]);
+}
+export function hashTranscript(transcript) {
+    const digest = Buffer.alloc(sodium.crypto_generichash_BYTES);
+    sodium.crypto_generichash(digest, Buffer.from(transcript));
+    return digest.toString('base64url');
+}
+export function signChallenge(challenge, identity) {
+    const signature = Buffer.alloc(sodium.crypto_sign_BYTES);
+    sodium.crypto_sign_detached(signature, challengeBytes(challenge), decodeKey(identity.sign_secret_key, sodium.crypto_sign_SECRETKEYBYTES, 'Ed25519 secret key'));
+    return signature.toString('base64url');
+}
+export function constantTimeEqual(left, right) {
+    const leftHash = Buffer.alloc(sodium.crypto_generichash_BYTES);
+    const rightHash = Buffer.alloc(sodium.crypto_generichash_BYTES);
+    sodium.crypto_generichash(leftHash, Buffer.from(left, 'utf8'));
+    sodium.crypto_generichash(rightHash, Buffer.from(right, 'utf8'));
+    return sodium.sodium_memcmp(leftHash, rightHash);
+}
+// harn:assume nonce-challenge-auth-no-key-possession-identity ref=replay-bound-peer-auth
+export class ChallengeAuthority {
+    keys;
+    now;
+    pending = new Map();
+    constructor(keys, now = Date.now) {
+        this.keys = keys;
+        this.now = now;
+    }
+    issue(peerId, transcriptHash) {
+        if (!this.keys.getPeer(peerId))
+            throw new Error('peer is not enrolled');
+        decodeKey(transcriptHash, sodium.crypto_generichash_BYTES, 'transcript hash');
+        this.sweepExpired();
+        this.trimPending((challenge) => challenge.peer_id === peerId, MAX_PENDING_PER_PEER);
+        this.trimPending(() => true, MAX_PENDING_TOTAL);
+        const issued = this.now();
+        const challenge = {
+            challenge_id: random(16).toString('base64url'),
+            server_nonce: random(32).toString('base64url'),
+            transcript_hash: transcriptHash,
+            expires_at: new Date(issued + CHALLENGE_TTL_MS).toISOString(),
+            peer_id: peerId,
+        };
+        this.pending.set(challenge.challenge_id, challenge);
+        return challenge;
+    }
+    pendingCount(peerId) {
+        this.sweepExpired();
+        return peerId === undefined
+            ? this.pending.size
+            : [...this.pending.values()].filter((challenge) => challenge.peer_id === peerId).length;
+    }
+    verify(challengeId, signature) {
+        const challenge = this.pending.get(challengeId);
+        this.pending.delete(challengeId);
+        if (!challenge)
+            throw new Error('unknown or already-consumed challenge');
+        if (this.now() > Date.parse(challenge.expires_at))
+            throw new Error('challenge expired');
+        const peer = this.keys.getPeer(challenge.peer_id);
+        if (!peer)
+            throw new Error('peer is no longer enrolled');
+        const valid = sodium.crypto_sign_verify_detached(decodeKey(signature, sodium.crypto_sign_BYTES, 'Ed25519 signature'), challengeBytes(challenge), decodeKey(peer.sign_public_key, sodium.crypto_sign_PUBLICKEYBYTES, 'Ed25519 public key'));
+        if (!valid)
+            throw new Error('invalid challenge signature');
+        return peer;
+    }
+    sweepExpired() {
+        const now = this.now();
+        for (const [id, challenge] of this.pending) {
+            if (now > Date.parse(challenge.expires_at))
+                this.pending.delete(id);
+        }
+    }
+    trimPending(matches, maximum) {
+        let count = [...this.pending.values()].filter(matches).length;
+        for (const [id, challenge] of this.pending) {
+            if (count < maximum)
+                return;
+            if (!matches(challenge))
+                continue;
+            this.pending.delete(id);
+            count -= 1;
+        }
+    }
+}
+export class AuthenticatedConnectionRegistry {
+    connections = new Map();
+    stopWatching;
+    constructor(keys) {
+        this.stopWatching = keys.onPeerRevoked((deviceId) => this.dropPeer(deviceId));
+    }
+    add(connection) {
+        this.connections.set(connection.id, connection);
+        return () => this.connections.delete(connection.id);
+    }
+    has(id) {
+        return this.connections.has(id);
+    }
+    close() {
+        this.stopWatching();
+        for (const connection of this.connections.values())
+            connection.close('registry closed');
+        this.connections.clear();
+    }
+    dropPeer(deviceId) {
+        for (const [id, connection] of this.connections) {
+            if (connection.peer.device_id !== deviceId)
+                continue;
+            this.connections.delete(id);
+            connection.close('peer revoked');
+        }
+    }
+}
+// harn:end nonce-challenge-auth-no-key-possession-identity
+//# sourceMappingURL=challenge.js.map

package/node_modules/@codor/switchboard/dist/crypto/challenge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"challenge.js","sourceRoot":"","sources":["../../src/crypto/challenge.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC,OAAO,EACL,SAAS,GAIV,MAAM,WAAW,CAAC;AAmBnB,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,iBAAiB,GAAG,KAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAEhE,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,SAAkE;IAC/F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,gBAAgB;QAChB,SAAS,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,cAAc,CAAC;QACrD,SAAS,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,wBAAwB,EAAE,iBAAiB,CAAC;KACzF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,UAAsB;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC7D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAC3D,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,SAAwB,EAAE,QAAwB;IAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACzD,MAAM,CAAC,oBAAoB,CACzB,SAAS,EACT,cAAc,CAAC,SAAS,CAAC,EACzB,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CAC7F,CAAC;IACF,OAAO,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAChE,MAAM,CAAC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,MAAM,CAAC,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACjE,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AACnD,CAAC;AAED,yFAAyF;AACzF,MAAM,OAAO,kBAAkB;IAIV;IACA;IAJF,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;IAE9D,YACmB,IAAoB,EACpB,MAAoB,IAAI,CAAC,GAAG;QAD5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ,KAAK,CAAC,MAAc,EAAE,cAAsB;QAC1C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACxE,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,wBAAwB,EAAE,iBAAiB,CAAC,CAAC;QAC9E,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM,EAAE,oBAAoB,CAAC,CAAC;QACpF,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAoB;YACjC,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9C,YAAY,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;YAC9C,eAAe,EAAE,cAAc;YAC/B,UAAU,EAAE,IAAI,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,CAAC,WAAW,EAAE;YAC7D,OAAO,EAAE,MAAM;SAChB,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACpD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,YAAY,CAAC,MAAe;QAC1B,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,OAAO,MAAM,KAAK,SAAS;YACzB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI;YACnB,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC5F,CAAC;IAED,MAAM,CAAC,WAAmB,EAAE,SAAiB;QAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACzE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,CAAC,2BAA2B,CAC9C,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EACnE,cAAc,CAAC,SAAS,CAAC,EACzB,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CACzF,CAAC;QACF,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAEO,WAAW,CACjB,OAAgD,EAChD,OAAe;QAEf,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC9D,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC3C,IAAI,KAAK,GAAG,OAAO;gBAAE,OAAO;YAC5B,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxB,KAAK,IAAI,CAAC,CAAC;QACb,CAAC;IACH,CAAC;CACF;AAED,MAAM,OAAO,+BAA+B;IACzB,WAAW,GAAG,IAAI,GAAG,EAAmC,CAAC;IACzD,YAAY,CAAa;IAE1C,YAAY,IAAoB;QAC9B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,GAAG,CAAC,UAAmC;QACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAChD,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,GAAG,CAAC,EAAU;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,YAAY,EAAE,CAAC;QACpB,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxF,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAEO,QAAQ,CAAC,QAAgB;QAC/B,KAAK,MAAM,CAAC,EAAE,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAChD,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAAE,SAAS;YACrD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACnC,CAAC;IACH,CAAC;CACF;AACD,2DAA2D"}

package/node_modules/@codor/switchboard/dist/crypto/keys.d.ts

@@ -0,0 +1,41 @@
+export type PeerKind = 'device' | 'switchboard';
+export interface PublicIdentity {
+    device_id: string;
+    sign_public_key: string;
+    encryption_public_key: string;
+}
+export interface DeviceIdentity extends PublicIdentity {
+    sign_secret_key: string;
+    encryption_secret_key: string;
+}
+export interface PeerRecord extends PublicIdentity {
+    kind: PeerKind;
+    label?: string;
+    paired_at: string;
+}
+export declare function decodeKey(value: string, bytes: number, label: string): Buffer;
+export declare function privateJsonWrite(path: string, value: unknown): void;
+export declare function generateIdentity(): DeviceIdentity;
+export declare class DeviceKeyStore {
+    readonly dataDir: string;
+    readonly identity: DeviceIdentity;
+    private readonly identityPath;
+    private readonly peersPath;
+    private readonly revokeListeners;
+    private knownPeerIds;
+    constructor(dataDir: string);
+    publicIdentity(): PublicIdentity;
+    listPeers(): PeerRecord[];
+    getPeer(deviceId: string): PeerRecord | undefined;
+    resolvePeer(reference: string): PeerRecord | undefined;
+    enrollPeer(input: Omit<PeerRecord, 'paired_at'> & {
+        paired_at?: string;
+    }): PeerRecord;
+    revokePeer(reference: string): PeerRecord;
+    onPeerRevoked(listener: (deviceId: string) => void): () => void;
+    close(): void;
+    private readPeers;
+    private writePeers;
+    private detectExternalRevokes;
+}
+//# sourceMappingURL=keys.d.ts.map

package/node_modules/@codor/switchboard/dist/crypto/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,CAAC;AAEhD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,eAAe,EAAE,MAAM,CAAC;IACxB,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,UAAW,SAAQ,cAAc;IAChD,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AASD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7E;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAMnE;AAwBD,wBAAgB,gBAAgB,IAAI,cAAc,CAejD;AAED,qBAAa,cAAc;IAOb,QAAQ,CAAC,OAAO,EAAE,MAAM;IANpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyC;IACzE,OAAO,CAAC,YAAY,CAAqB;gBAEpB,OAAO,EAAE,MAAM;IAmBpC,cAAc,IAAI,cAAc;IAIhC,SAAS,IAAI,UAAU,EAAE;IAIzB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAIjD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAKtD,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,UAAU;IAcrF,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU;IAUzC,aAAa,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,GAAG,MAAM,IAAI;IAK/D,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,SAAS;IAOjB,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,qBAAqB;CAS9B"}

package/node_modules/@codor/switchboard/dist/crypto/keys.js

@@ -0,0 +1,145 @@
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unwatchFile, watchFile, writeFileSync, } from 'node:fs';
+import { dirname, join } from 'node:path';
+import sodium from 'sodium-native';
+const encode = (value) => Buffer.from(value).toString('base64url');
+export function decodeKey(value, bytes, label) {
+    const decoded = Buffer.from(value, 'base64url');
+    if (decoded.length !== bytes)
+        throw new Error(`${label} must be ${String(bytes)} bytes`);
+    return decoded;
+}
+export function privateJsonWrite(path, value) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    const temporary = `${path}.${String(process.pid)}.tmp`;
+    writeFileSync(temporary, `${JSON.stringify(value, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(temporary, 0o600);
+    renameSync(temporary, path);
+}
+function publicIdentity(identity) {
+    return {
+        device_id: identity.device_id,
+        sign_public_key: identity.sign_public_key,
+        encryption_public_key: identity.encryption_public_key,
+    };
+}
+function validatePublicIdentity(identity) {
+    decodeKey(identity.sign_public_key, sodium.crypto_sign_PUBLICKEYBYTES, 'Ed25519 public key');
+    decodeKey(identity.encryption_public_key, sodium.crypto_box_PUBLICKEYBYTES, 'X25519 public key');
+    if (identity.device_id !== identity.sign_public_key) {
+        throw new Error('device id must equal the Ed25519 public key');
+    }
+}
+// harn:assume ed25519-identity-x25519-encryption ref=dual-device-identity
+// harn:assume single-crypto-suite-libsodium ref=node-libsodium-suite
+export function generateIdentity() {
+    const signPublic = Buffer.alloc(sodium.crypto_sign_PUBLICKEYBYTES);
+    const signSecret = Buffer.alloc(sodium.crypto_sign_SECRETKEYBYTES);
+    sodium.crypto_sign_keypair(signPublic, signSecret);
+    const encryptionPublic = Buffer.alloc(sodium.crypto_box_PUBLICKEYBYTES);
+    const encryptionSecret = Buffer.alloc(sodium.crypto_box_SECRETKEYBYTES);
+    sodium.crypto_box_keypair(encryptionPublic, encryptionSecret);
+    const signPublicKey = encode(signPublic);
+    return {
+        device_id: signPublicKey,
+        sign_public_key: signPublicKey,
+        sign_secret_key: encode(signSecret),
+        encryption_public_key: encode(encryptionPublic),
+        encryption_secret_key: encode(encryptionSecret),
+    };
+}
+export class DeviceKeyStore {
+    dataDir;
+    identity;
+    identityPath;
+    peersPath;
+    revokeListeners = new Set();
+    knownPeerIds = new Set();
+    constructor(dataDir) {
+        this.dataDir = dataDir;
+        const cryptoDir = join(dataDir, 'crypto');
+        this.identityPath = join(cryptoDir, 'identity.json');
+        this.peersPath = join(cryptoDir, 'peers.json');
+        mkdirSync(cryptoDir, { recursive: true, mode: 0o700 });
+        if (!existsSync(this.identityPath))
+            privateJsonWrite(this.identityPath, generateIdentity());
+        this.identity = JSON.parse(readFileSync(this.identityPath, 'utf8'));
+        validatePublicIdentity(this.identity);
+        decodeKey(this.identity.sign_secret_key, sodium.crypto_sign_SECRETKEYBYTES, 'Ed25519 secret key');
+        decodeKey(this.identity.encryption_secret_key, sodium.crypto_box_SECRETKEYBYTES, 'X25519 secret key');
+        if (!existsSync(this.peersPath))
+            privateJsonWrite(this.peersPath, { version: 1, peers: [] });
+        this.knownPeerIds = new Set(this.readPeers().map((peer) => peer.device_id));
+        watchFile(this.peersPath, { persistent: false, interval: 100 }, () => this.detectExternalRevokes());
+    }
+    publicIdentity() {
+        return publicIdentity(this.identity);
+    }
+    listPeers() {
+        return this.readPeers();
+    }
+    getPeer(deviceId) {
+        return this.readPeers().find((peer) => peer.device_id === deviceId);
+    }
+    resolvePeer(reference) {
+        const peers = this.readPeers();
+        return peers.find((peer) => peer.device_id === reference || peer.label === reference);
+    }
+    enrollPeer(input) {
+        validatePublicIdentity(input);
+        if (input.kind !== 'device' && input.kind !== 'switchboard') {
+            throw new Error(`invalid peer kind '${String(input.kind)}'`);
+        }
+        const peers = this.readPeers();
+        const record = { ...input, paired_at: input.paired_at ?? new Date().toISOString() };
+        const existing = peers.findIndex((peer) => peer.device_id === record.device_id);
+        if (existing >= 0)
+            peers[existing] = record;
+        else
+            peers.push(record);
+        this.writePeers(peers);
+        return record;
+    }
+    revokePeer(reference) {
+        const peers = this.readPeers();
+        const peer = peers.find((candidate) => candidate.device_id === reference || candidate.label === reference);
+        if (!peer)
+            throw new Error(`no such peer '${reference}'`);
+        this.writePeers(peers.filter((candidate) => candidate.device_id !== peer.device_id));
+        for (const listener of this.revokeListeners)
+            listener(peer.device_id);
+        return peer;
+    }
+    onPeerRevoked(listener) {
+        this.revokeListeners.add(listener);
+        return () => this.revokeListeners.delete(listener);
+    }
+    close() {
+        unwatchFile(this.peersPath);
+        this.revokeListeners.clear();
+    }
+    readPeers() {
+        const parsed = JSON.parse(readFileSync(this.peersPath, 'utf8'));
+        if (parsed.version !== 1 || !Array.isArray(parsed.peers))
+            throw new Error('invalid peers file');
+        for (const peer of parsed.peers)
+            validatePublicIdentity(peer);
+        return parsed.peers;
+    }
+    writePeers(peers) {
+        privateJsonWrite(this.peersPath, { version: 1, peers });
+        this.knownPeerIds = new Set(peers.map((peer) => peer.device_id));
+    }
+    detectExternalRevokes() {
+        const current = new Set(this.readPeers().map((peer) => peer.device_id));
+        for (const deviceId of this.knownPeerIds) {
+            if (!current.has(deviceId)) {
+                for (const listener of this.revokeListeners)
+                    listener(deviceId);
+            }
+        }
+        this.knownPeerIds = current;
+    }
+}
+// harn:end single-crypto-suite-libsodium
+// harn:end ed25519-identity-x25519-encryption
+//# sourceMappingURL=keys.js.map

package/node_modules/@codor/switchboard/dist/crypto/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/crypto/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,MAAM,MAAM,eAAe,CAAC;AA0BnC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEvF,MAAM,UAAU,SAAS,CAAC,KAAa,EAAE,KAAa,EAAE,KAAa;IACnE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,YAAY,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAc;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;IACvD,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjF,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5B,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,cAAc,CAAC,QAAwB;IAC9C,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,qBAAqB,EAAE,QAAQ,CAAC,qBAAqB;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAwB;IACtD,SAAS,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;IAC7F,SAAS,CACP,QAAQ,CAAC,qBAAqB,EAC9B,MAAM,CAAC,yBAAyB,EAChC,mBAAmB,CACpB,CAAC;IACF,IAAI,QAAQ,CAAC,SAAS,KAAK,QAAQ,CAAC,eAAe,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,qEAAqE;AACrE,MAAM,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;IACnE,MAAM,CAAC,mBAAmB,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACxE,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACxE,MAAM,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;IACzC,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,eAAe,EAAE,aAAa;QAC9B,eAAe,EAAE,MAAM,CAAC,UAAU,CAAC;QACnC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC;QAC/C,qBAAqB,EAAE,MAAM,CAAC,gBAAgB,CAAC;KAChD,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,cAAc;IAOJ;IANZ,QAAQ,CAAiB;IACjB,YAAY,CAAS;IACrB,SAAS,CAAS;IAClB,eAAe,GAAG,IAAI,GAAG,EAA8B,CAAC;IACjE,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;IAEzC,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC;YAAE,gBAAgB,CAAC,IAAI,CAAC,YAAY,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC5F,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAmB,CAAC;QACtF,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,0BAA0B,EAAE,oBAAoB,CAAC,CAAC;QAClG,SAAS,CACP,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EACnC,MAAM,CAAC,yBAAyB,EAChC,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QAC5E,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED,cAAc;QACZ,OAAO,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,QAAgB;QACtB,OAAO,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC;IACtE,CAAC;IAED,WAAW,CAAC,SAAiB;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,UAAU,CAAC,KAA6D;QACtE,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CAAC,sBAAsB,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAe,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS,CAAC,CAAC;QAChF,IAAI,QAAQ,IAAI,CAAC;YAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;;YACvC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACpC,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,SAAS,GAAG,CAAC,CAAC;QAC1D,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACrF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,eAAe;YAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,QAAoC;QAChD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,KAAK;QACH,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5B,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;IAEO,SAAS;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAa,CAAC;QAC5E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAChG,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK;YAAE,sBAAsB,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC;IAEO,UAAU,CAAC,KAAmB;QACpC,gBAAgB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAqB,CAAC,CAAC;QAC3E,IAAI,CAAC,YAAY,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,qBAAqB;QAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC;QACxE,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,eAAe;oBAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;IAC9B,CAAC;CACF;AACD,yCAAyC;AACzC,8CAA8C"}

package/node_modules/@codor/switchboard/dist/crypto/pairing.d.ts

@@ -0,0 +1,53 @@
+import { BrowserDeviceSessionAuthority } from './browser-sessions.js';
+import { ChallengeAuthority } from './challenge.js';
+import { DeviceKeyStore, type PeerKind, type PeerRecord, type PublicIdentity } from './keys.js';
+import { RoomKeyStore, type SealedRoomKey } from './roomkeys.js';
+export declare const PAIRING_CODE_ALPHABET = "23456789ABCDEFGHJKLMNPQRSTUVWXYZ";
+export interface PairingPayload {
+    endpoint: string;
+    pairing_token: string;
+    expires_at: string;
+    switchboard_sign_pub: string;
+}
+export interface PairingOffer extends PairingPayload {
+    pairing_code: string;
+}
+export interface PairingRequest extends PublicIdentity {
+    kind: PeerKind;
+    label?: string;
+}
+export interface PairingResult {
+    switchboard: PublicIdentity;
+    room_keys: SealedRoomKey[];
+}
+export declare function normalizePairingCode(value: string): string | undefined;
+export declare function formatPairingCode(value: string): string;
+export declare function pairingUrl(offer: PairingPayload): string;
+export declare class PairingService {
+    private readonly keys;
+    private readonly roomKeys;
+    private readonly now;
+    private readonly path;
+    constructor(dataDir: string, keys: DeviceKeyStore, roomKeys: RoomKeyStore, now?: () => number);
+    issue(endpoint: string): PairingOffer;
+    exchange(code: string): PairingPayload;
+    complete(token: string, request: PairingRequest): PairingResult;
+    completeTrusted(request: PairingRequest, label: string): PairingResult;
+    private enroll;
+    accept(result: PairingResult, label?: string): PeerRecord;
+    private read;
+    private write;
+}
+export declare class CryptoVault {
+    readonly dataDir: string;
+    readonly keys: DeviceKeyStore;
+    readonly roomKeys: RoomKeyStore;
+    readonly pairing: PairingService;
+    readonly challenges: ChallengeAuthority;
+    readonly browserChallenges: ChallengeAuthority;
+    readonly browserSessions: BrowserDeviceSessionAuthority;
+    constructor(dataDir: string);
+    revokePeer(reference: string): PeerRecord;
+    close(): void;
+}
+//# sourceMappingURL=pairing.d.ts.map

package/node_modules/@codor/switchboard/dist/crypto/pairing.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.d.ts","sourceRoot":"","sources":["../../src/crypto/pairing.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAqB,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,cAAc,EACd,KAAK,QAAQ,EACb,KAAK,UAAU,EACf,KAAK,cAAc,EAEpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAGjE,eAAO,MAAM,qBAAqB,qCAAqC,CAAC;AAexE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAE,QAAQ,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,cAAc,CAAC;IAC5B,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B;AAcD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAOtE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAIvD;AAQD,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAMxD;AAED,qBAAa,cAAc;IAKvB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,GAAG;IANtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAG5B,OAAO,EAAE,MAAM,EACE,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,YAAY,EACtB,GAAG,GAAE,MAAM,MAAiB;IAO/C,KAAK,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY;IAwBrC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc;IAyBtC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,aAAa;IAgB/D,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa;IAMtE,OAAO,CAAC,MAAM;IASd,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,SAAS,GAAG,UAAU;IAIzD,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,KAAK;CAGd;AAGD,qBAAa,WAAW;IAQV,QAAQ,CAAC,OAAO,EAAE,MAAM;IAPpC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,kBAAkB,CAAC;IACxC,QAAQ,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;IAC/C,QAAQ,CAAC,eAAe,EAAE,6BAA6B,CAAC;gBAEnC,OAAO,EAAE,MAAM;IASpC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,UAAU;IAMzC,KAAK,IAAI,IAAI;CAId"}