@richhardry/codor 0.10.0

package/node_modules/@codor/switchboard/dist/crypto/pairing.js

@@ -0,0 +1,182 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import sodium from 'sodium-native';
+import { BrowserDeviceSessionAuthority } from './browser-sessions.js';
+import { ChallengeAuthority, constantTimeEqual } from './challenge.js';
+import { DeviceKeyStore, privateJsonWrite, } from './keys.js';
+import { RoomKeyStore } from './roomkeys.js';
+const PAIRING_TTL_MS = 10 * 60 * 1_000;
+export const PAIRING_CODE_ALPHABET = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';
+const PAIRING_CODE_LENGTH = 8;
+function randomToken() {
+    const token = Buffer.alloc(32);
+    sodium.randombytes_buf(token);
+    return token.toString('base64url');
+}
+function randomPairingCode() {
+    const bytes = Buffer.alloc(PAIRING_CODE_LENGTH);
+    sodium.randombytes_buf(bytes);
+    return Array.from(bytes, (byte) => PAIRING_CODE_ALPHABET[byte & 31]).join('');
+}
+export function normalizePairingCode(value) {
+    const candidate = value.toUpperCase();
+    const characterClass = `[${PAIRING_CODE_ALPHABET}]`;
+    if (!new RegExp(`^(?:${characterClass}{8}|${characterClass}{4}-${characterClass}{4})$`).test(candidate)) {
+        return undefined;
+    }
+    return candidate.replace('-', '');
+}
+export function formatPairingCode(value) {
+    const normalized = normalizePairingCode(value);
+    if (!normalized)
+        throw new Error('invalid pairing code');
+    return `${normalized.slice(0, 4)}-${normalized.slice(4)}`;
+}
+function hashToken(token) {
+    const digest = Buffer.alloc(sodium.crypto_generichash_BYTES);
+    sodium.crypto_generichash(digest, Buffer.from(token, 'utf8'));
+    return digest.toString('base64url');
+}
+export function pairingUrl(offer) {
+    const url = new URL('/pair', offer.endpoint);
+    url.searchParams.set('endpoint', offer.endpoint);
+    url.searchParams.set('pairing_token', offer.pairing_token);
+    url.searchParams.set('switchboard_sign_pub', offer.switchboard_sign_pub);
+    return url.toString();
+}
+export class PairingService {
+    keys;
+    roomKeys;
+    now;
+    path;
+    constructor(dataDir, keys, roomKeys, now = Date.now) {
+        this.keys = keys;
+        this.roomKeys = roomKeys;
+        this.now = now;
+        this.path = join(dataDir, 'crypto', 'pairing-tokens.json');
+        if (!existsSync(this.path))
+            privateJsonWrite(this.path, { version: 1, tokens: [] });
+    }
+    // harn:assume short-pairing-code-grant-exchange ref=pairing-code-grant-source
+    issue(endpoint) {
+        const normalized = new URL(endpoint).toString().replace(/\/$/, '');
+        const token = randomToken();
+        const code = randomPairingCode();
+        const expiresAt = new Date(this.now() + PAIRING_TTL_MS).toISOString();
+        const state = this.read();
+        state.tokens = state.tokens
+            .filter((entry) => Date.parse(entry.expires_at) >= this.now())
+            .concat({
+            token_hash: hashToken(token),
+            code_hash: hashToken(code),
+            endpoint: normalized,
+            expires_at: expiresAt,
+        });
+        this.write(state);
+        return {
+            endpoint: normalized,
+            pairing_token: token,
+            pairing_code: formatPairingCode(code),
+            expires_at: expiresAt,
+            switchboard_sign_pub: this.keys.identity.sign_public_key,
+        };
+    }
+    exchange(code) {
+        const normalized = normalizePairingCode(code);
+        const digest = hashToken(normalized ?? 'INVALID2');
+        const state = this.read();
+        let match;
+        for (const entry of state.tokens) {
+            if (entry.code_hash && constantTimeEqual(entry.code_hash, digest))
+                match = entry;
+        }
+        if (!normalized || !match || this.now() > Date.parse(match.expires_at)) {
+            throw new Error('pairing code not found');
+        }
+        const token = randomToken();
+        state.tokens = state.tokens.map((entry) => entry === match
+            ? { ...entry, token_hash: hashToken(token), code_hash: undefined }
+            : entry);
+        this.write(state);
+        return {
+            endpoint: match.endpoint,
+            pairing_token: token,
+            expires_at: match.expires_at,
+            switchboard_sign_pub: this.keys.identity.sign_public_key,
+        };
+    }
+    complete(token, request) {
+        const state = this.read();
+        const digest = hashToken(token);
+        let match;
+        for (const entry of state.tokens) {
+            if (constantTimeEqual(entry.token_hash, digest))
+                match = entry;
+        }
+        state.tokens = state.tokens.filter((entry) => !constantTimeEqual(entry.token_hash, digest));
+        this.write(state);
+        if (!match)
+            throw new Error('invalid or already-used pairing token');
+        if (this.now() > Date.parse(match.expires_at))
+            throw new Error('pairing token expired');
+        return this.enroll(request);
+    }
+    // harn:end short-pairing-code-grant-exchange
+    // harn:assume tailnet-auto-pairing-explicit-trust ref=trusted-device-enrollment
+    completeTrusted(request, label) {
+        if (request.kind !== 'device')
+            throw new Error('trusted enrollment is only for browser devices');
+        return this.enroll({ ...request, label });
+    }
+    // harn:end tailnet-auto-pairing-explicit-trust
+    enroll(request) {
+        const peer = this.keys.enrollPeer(request);
+        this.roomKeys.enrollPeer(peer);
+        return {
+            switchboard: this.keys.publicIdentity(),
+            room_keys: this.roomKeys.sealedFor(peer.device_id),
+        };
+    }
+    accept(result, label = 'home') {
+        return this.keys.enrollPeer({ ...result.switchboard, kind: 'switchboard', label });
+    }
+    read() {
+        const parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+        if (parsed.version !== 1 || !Array.isArray(parsed.tokens))
+            throw new Error('invalid pairing file');
+        return parsed;
+    }
+    write(state) {
+        privateJsonWrite(this.path, state);
+    }
+}
+// harn:assume revocation-rotates-room-keys ref=revoke-rekey-disconnect
+export class CryptoVault {
+    dataDir;
+    keys;
+    roomKeys;
+    pairing;
+    challenges;
+    browserChallenges;
+    browserSessions;
+    constructor(dataDir) {
+        this.dataDir = dataDir;
+        this.keys = new DeviceKeyStore(dataDir);
+        this.roomKeys = new RoomKeyStore(dataDir, this.keys);
+        this.pairing = new PairingService(dataDir, this.keys, this.roomKeys);
+        this.challenges = new ChallengeAuthority(this.keys);
+        this.browserChallenges = new ChallengeAuthority(this.keys);
+        this.browserSessions = new BrowserDeviceSessionAuthority(this.keys);
+    }
+    revokePeer(reference) {
+        const revoked = this.keys.revokePeer(reference);
+        this.roomKeys.rotateAll();
+        return revoked;
+    }
+    close() {
+        this.browserSessions.close();
+        this.keys.close();
+    }
+}
+// harn:end revocation-rotates-room-keys
+//# sourceMappingURL=pairing.js.map

package/node_modules/@codor/switchboard/dist/crypto/pairing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.js","sourceRoot":"","sources":["../../src/crypto/pairing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC,OAAO,EAAE,6BAA6B,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EACL,cAAc,EAId,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,YAAY,EAAsB,MAAM,eAAe,CAAC;AAEjE,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,kCAAkC,CAAC;AACxE,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAmC9B,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAChD,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,qBAAqB,GAAG,CAAC;IACpD,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,cAAc,OAAO,cAAc,OAAO,cAAc,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxG,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC7C,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IACzD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAC7D,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAqB;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,OAAO,cAAc;IAKN;IACA;IACA;IANF,IAAI,CAAS;IAE9B,YACE,OAAe,EACE,IAAoB,EACpB,QAAsB,EACtB,MAAoB,IAAI,CAAC,GAAG;QAF5B,SAAI,GAAJ,IAAI,CAAgB;QACpB,aAAQ,GAAR,QAAQ,CAAc;QACtB,QAAG,GAAH,GAAG,CAAyB;QAE7C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC3D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,QAAgB;QACpB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,iBAAiB,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;aACxB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;aAC7D,MAAM,CAAC;YACN,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC;YAC5B,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC;YAC1B,QAAQ,EAAE,UAAU;YACpB,UAAU,EAAE,SAAS;SACtB,CAAC,CAAC;QACL,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,UAAU;YACpB,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACrC,UAAU,EAAE,SAAS;YACrB,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe;SACzD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,IAAI,UAAU,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,IAAI,KAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,SAAS,IAAI,iBAAiB,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,UAAU,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,KAAK;YACxD,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE;YAClE,CAAC,CAAC,KAAK,CAAC,CAAC;QACX,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,aAAa,EAAE,KAAK;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe;SACzD,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,KAAa,EAAE,OAAuB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAqC,CAAC;QAC1C,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,KAAK,GAAG,KAAK,CAAC;QACjE,CAAC;QACD,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACrE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IACD,6CAA6C;IAE7C,gFAAgF;IAChF,eAAe,CAAC,OAAuB,EAAE,KAAa;QACpD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACjG,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,+CAA+C;IAEvC,MAAM,CAAC,OAAuB;QACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;YACvC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;SACnD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,MAAqB,EAAE,KAAK,GAAG,MAAM;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;IACrF,CAAC;IAEO,IAAI;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACnG,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAkB;QAC9B,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AAED,uEAAuE;AACvE,MAAM,OAAO,WAAW;IAQD;IAPZ,IAAI,CAAiB;IACrB,QAAQ,CAAe;IACvB,OAAO,CAAiB;IACxB,UAAU,CAAqB;IAC/B,iBAAiB,CAAqB;IACtC,eAAe,CAAgC;IAExD,YAAqB,OAAe;QAAf,YAAO,GAAP,OAAO,CAAQ;QAClC,IAAI,CAAC,IAAI,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,QAAQ,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,IAAI,CAAC,UAAU,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,CAAC,iBAAiB,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,CAAC,eAAe,GAAG,IAAI,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtE,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC;CACF;AACD,wCAAwC"}

package/node_modules/@codor/switchboard/dist/crypto/roomkeys.d.ts

@@ -0,0 +1,30 @@
+import { type DeviceIdentity, type DeviceKeyStore, type PeerRecord } from './keys.js';
+export interface SealedRoomKey {
+    room: string;
+    generation: number;
+    sealed_key: string;
+}
+interface StoredRoomKey {
+    generation: number;
+    key: string;
+    sealed: Record<string, string>;
+}
+export declare function sealBox(message: Uint8Array, publicKey: string): string;
+export declare function openSealedBox(ciphertext: string, identity: DeviceIdentity): Buffer;
+export declare class RoomKeyStore {
+    private readonly keys;
+    private readonly path;
+    constructor(dataDir: string, keys: DeviceKeyStore);
+    ensureRoom(room: string): StoredRoomKey;
+    roomGeneration(room: string): number;
+    roomKey(room: string): Buffer;
+    enrollPeer(peer: PeerRecord): void;
+    rotateRoom(room: string): StoredRoomKey;
+    rotateAll(): void;
+    sealedFor(deviceId: string): SealedRoomKey[];
+    private createRoomKey;
+    private read;
+    private write;
+}
+export {};
+//# sourceMappingURL=roomkeys.d.ts.map

package/node_modules/@codor/switchboard/dist/crypto/roomkeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roomkeys.d.ts","sourceRoot":"","sources":["../../src/crypto/roomkeys.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EAEhB,MAAM,WAAW,CAAC;AAEnB,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,UAAU,aAAa;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AASD,wBAAgB,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAKtE;AAED,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,GAAG,MAAM,CAYlF;AAGD,qBAAa,YAAY;IAKrB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJvB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAG5B,OAAO,EAAE,MAAM,EACE,IAAI,EAAE,cAAc;IAMvC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAUvC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAIpC,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAQ7B,UAAU,CAAC,IAAI,EAAE,UAAU,GAAG,IAAI;IAWlC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IASvC,SAAS,IAAI,IAAI;IASjB,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,EAAE;IAQ5C,OAAO,CAAC,aAAa;IAarB,OAAO,CAAC,IAAI;IAMZ,OAAO,CAAC,KAAK;CAGd"}

package/node_modules/@codor/switchboard/dist/crypto/roomkeys.js

@@ -0,0 +1,101 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import sodium from 'sodium-native';
+import { decodeKey, privateJsonWrite, } from './keys.js';
+const encode = (value) => Buffer.from(value).toString('base64url');
+export function sealBox(message, publicKey) {
+    const recipient = decodeKey(publicKey, sodium.crypto_box_PUBLICKEYBYTES, 'X25519 public key');
+    const ciphertext = Buffer.alloc(message.length + sodium.crypto_box_SEALBYTES);
+    sodium.crypto_box_seal(ciphertext, Buffer.from(message), recipient);
+    return encode(ciphertext);
+}
+export function openSealedBox(ciphertext, identity) {
+    const sealed = Buffer.from(ciphertext, 'base64url');
+    if (sealed.length < sodium.crypto_box_SEALBYTES)
+        throw new Error('invalid sealed box');
+    const plaintext = Buffer.alloc(sealed.length - sodium.crypto_box_SEALBYTES);
+    const opened = sodium.crypto_box_seal_open(plaintext, sealed, decodeKey(identity.encryption_public_key, sodium.crypto_box_PUBLICKEYBYTES, 'X25519 public key'), decodeKey(identity.encryption_secret_key, sodium.crypto_box_SECRETKEYBYTES, 'X25519 secret key'));
+    if (!opened)
+        throw new Error('sealed box was not addressed to this identity');
+    return plaintext;
+}
+// harn:assume sealed-room-keys-per-enrollee ref=sealed-room-key-fanout
+export class RoomKeyStore {
+    keys;
+    path;
+    constructor(dataDir, keys) {
+        this.keys = keys;
+        this.path = join(dataDir, 'crypto', 'room-keys.json');
+        if (!existsSync(this.path))
+            privateJsonWrite(this.path, { version: 1, rooms: {} });
+    }
+    ensureRoom(room) {
+        const state = this.read();
+        const existing = state.rooms[room];
+        if (existing)
+            return existing;
+        const created = this.createRoomKey(1, this.keys.listPeers());
+        state.rooms[room] = created;
+        this.write(state);
+        return created;
+    }
+    roomGeneration(room) {
+        return this.ensureRoom(room).generation;
+    }
+    roomKey(room) {
+        return decodeKey(this.ensureRoom(room).key, sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, 'room key');
+    }
+    enrollPeer(peer) {
+        const state = this.read();
+        for (const stored of Object.values(state.rooms)) {
+            stored.sealed[peer.device_id] = sealBox(decodeKey(stored.key, sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES, 'room key'), peer.encryption_public_key);
+        }
+        this.write(state);
+    }
+    rotateRoom(room) {
+        const state = this.read();
+        const generation = (state.rooms[room]?.generation ?? 0) + 1;
+        const rotated = this.createRoomKey(generation, this.keys.listPeers());
+        state.rooms[room] = rotated;
+        this.write(state);
+        return rotated;
+    }
+    rotateAll() {
+        const state = this.read();
+        const peers = this.keys.listPeers();
+        for (const [room, stored] of Object.entries(state.rooms)) {
+            state.rooms[room] = this.createRoomKey(stored.generation + 1, peers);
+        }
+        this.write(state);
+    }
+    sealedFor(deviceId) {
+        const state = this.read();
+        return Object.entries(state.rooms).flatMap(([room, stored]) => {
+            const sealed = stored.sealed[deviceId];
+            return sealed ? [{ room, generation: stored.generation, sealed_key: sealed }] : [];
+        });
+    }
+    createRoomKey(generation, peers) {
+        const key = Buffer.alloc(sodium.crypto_aead_xchacha20poly1305_ietf_KEYBYTES);
+        sodium.crypto_aead_xchacha20poly1305_ietf_keygen(key);
+        return {
+            generation,
+            key: encode(key),
+            sealed: Object.fromEntries(peers.map((peer) => [
+                peer.device_id,
+                sealBox(key, peer.encryption_public_key),
+            ])),
+        };
+    }
+    read() {
+        const parsed = JSON.parse(readFileSync(this.path, 'utf8'));
+        if (parsed.version !== 1 || typeof parsed.rooms !== 'object')
+            throw new Error('invalid room key file');
+        return parsed;
+    }
+    write(state) {
+        privateJsonWrite(this.path, state);
+    }
+}
+// harn:end sealed-room-keys-per-enrollee
+//# sourceMappingURL=roomkeys.js.map

package/node_modules/@codor/switchboard/dist/crypto/roomkeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roomkeys.js","sourceRoot":"","sources":["../../src/crypto/roomkeys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,MAAM,MAAM,eAAe,CAAC;AAEnC,OAAO,EACL,SAAS,EAIT,gBAAgB,GACjB,MAAM,WAAW,CAAC;AAmBnB,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAEvF,MAAM,UAAU,OAAO,CAAC,OAAmB,EAAE,SAAiB;IAC5D,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CAAC;IAC9F,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC9E,MAAM,CAAC,eAAe,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,UAAkB,EAAE,QAAwB;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;IACpD,IAAI,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,CAAC,oBAAoB,CACxC,SAAS,EACT,MAAM,EACN,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,EAChG,SAAS,CAAC,QAAQ,CAAC,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,EAAE,mBAAmB,CAAC,CACjG,CAAC;IACF,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC9E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,uEAAuE;AACvE,MAAM,OAAO,YAAY;IAKJ;IAJF,IAAI,CAAS;IAE9B,YACE,OAAe,EACE,IAAoB;QAApB,SAAI,GAAJ,IAAI,CAAgB;QAErC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC;QACtD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7D,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,cAAc,CAAC,IAAY;QACzB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC;IAC1C,CAAC;IAED,OAAO,CAAC,IAAY;QAClB,OAAO,SAAS,CACd,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EACzB,MAAM,CAAC,2CAA2C,EAClD,UAAU,CACX,CAAC;IACJ,CAAC;IAED,UAAU,CAAC,IAAgB;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,OAAO,CACrC,SAAS,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,2CAA2C,EAAE,UAAU,CAAC,EACrF,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,UAAU,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACtE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAClB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,UAAU,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,SAAS,CAAC,QAAgB;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC1B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE;YAC5D,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,aAAa,CAAC,UAAkB,EAAE,KAAmB;QAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAC7E,MAAM,CAAC,yCAAyC,CAAC,GAAG,CAAC,CAAC;QACtD,OAAO;YACL,UAAU;YACV,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC;YAChB,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBAC7C,IAAI,CAAC,SAAS;gBACd,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,qBAAqB,CAAC;aACzC,CAAC,CAAC;SACJ,CAAC;IACJ,CAAC;IAEO,IAAI;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;QAC1E,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACvG,OAAO,MAAM,CAAC;IAChB,CAAC;IAEO,KAAK,CAAC,KAAkB;QAC9B,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC;CACF;AACD,yCAAyC"}