@saadnvd1/agent-os 0.3.697 → 0.3.698

package/lib/peer/envelope.ts

@@ -0,0 +1,424 @@
+/**
+ * The signed, encrypted envelope linked machines call each other with
+ * (Node's crypto only).
+ *
+ * Request body: u32 header length ‖ header JSON ‖ hsig ‖ ciphertext ‖ sig.
+ *   header  {v:1, from, to, ts, nonce, epk}, epk a fresh X25519 key per call
+ *   hsig    Ed25519_A("agentos-peer-hdr-v1" ‖ header), so the receiver can
+ *           prove the sender before it holds any of the body
+ *   keys    HKDF-SHA256(X25519(epk, B_box), salt=nonce,
+ *                       info="agentos-peer-v1|from|to") → k_req ‖ k_res
+ *   ct      ChaCha20-Poly1305(k_req, AAD=header) over the inner request
+ *   sig     Ed25519_A("agentos-peer-req-v1" ‖ header ‖ SHA256(ct))
+ *
+ * Response body: iv ‖ ct ‖ sig, where iv is 12 fresh random bytes, ct =
+ * ChaCha20-Poly1305(k_res, iv) over the inner response and sig =
+ * Ed25519_B("agentos-peer-res-v1" ‖ request nonce ‖ iv ‖ SHA256(ct)), so it
+ * only opens for the request it answers.
+ *
+ * k_req seals exactly one message, so the request uses a fixed all-zero IV.
+ * The response doesn't rely on that: should a request ever be answered twice,
+ * a fresh IV keeps the two answers from sharing a keystream.
+ */
+
+import crypto, { type KeyObject } from "crypto";
+import { MACHINE_ID } from "../connect/control-api";
+import { rawPublic } from "./keys";
+import { type ReplayGuard } from "./replay";
+
+export const RPC_PATH = "/api/peer/rpc";
+export const MAX_REQUEST_BODY = 100 * 1024 * 1024;
+export const MAX_RESPONSE_BODY = 80 * 1024 * 1024;
+const OVERHEAD = 64 * 1024;
+export const MAX_REQUEST_ENVELOPE = MAX_REQUEST_BODY + OVERHEAD;
+export const MAX_RESPONSE_ENVELOPE = MAX_RESPONSE_BODY + OVERHEAD;
+export const SKEW_MS = 120_000;
+
+export const MAX_HEADER = 1024;
+const MAX_META = 16 * 1024;
+const SIG = 64;
+const TAG = 16;
+const ZERO_IV = Buffer.alloc(12);
+const IV_LEN = 12;
+export const HEADER_SIG = SIG;
+const HDR_DOMAIN = Buffer.from("agentos-peer-hdr-v1");
+const REQ_DOMAIN = Buffer.from("agentos-peer-req-v1");
+const RES_DOMAIN = Buffer.from("agentos-peer-res-v1");
+const B64_16 = /^[A-Za-z0-9_-]{22}$/;
+const B64_32 = /^[A-Za-z0-9_-]{43}$/;
+
+export interface PeerRequest {
+  method: string;
+  path: string;
+  /** URL query without the "?"; checked against the route's keys. */
+  query: string;
+  contentType: string;
+  body: Buffer;
+}
+
+export interface PeerResponse {
+  status: number;
+  contentType: string;
+  body: Buffer;
+}
+
+export interface RequestHeader {
+  v: 1;
+  from: string;
+  to: string;
+  ts: number;
+  nonce: string;
+  epk: string;
+}
+
+/** Why an envelope was refused before anything inside it was trusted. */
+export type Refusal =
+  | "bad_envelope"
+  | "wrong_machine"
+  | "unknown_peer"
+  | "suspended"
+  | "bad_sig"
+  | "stale"
+  | "replay"
+  | "busy";
+
+const sha256 = (b: Buffer) => crypto.createHash("sha256").update(b).digest();
+
+function frame(meta: object, body: Buffer): Buffer {
+  const m = Buffer.from(JSON.stringify(meta));
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(m.length);
+  return Buffer.concat([len, m, body]);
+}
+
+function unframe(buf: Buffer, max: number): { meta: unknown; rest: Buffer } {
+  if (buf.length < 4) throw new Error("short");
+  const len = buf.readUInt32BE(0);
+  if (len > max || 4 + len > buf.length) throw new Error("bad length");
+  return {
+    meta: JSON.parse(buf.subarray(4, 4 + len).toString("utf8")),
+    rest: buf.subarray(4 + len),
+  };
+}
+
+function keysFor(
+  shared: Buffer,
+  nonce: Buffer,
+  from: string,
+  to: string
+): { req: Buffer; res: Buffer } {
+  const okm = Buffer.from(
+    crypto.hkdfSync(
+      "sha256",
+      shared,
+      nonce,
+      `agentos-peer-v1|${from}|${to}`,
+      64
+    )
+  );
+  return { req: okm.subarray(0, 32), res: okm.subarray(32) };
+}
+
+function seal(
+  key: Buffer,
+  plain: Buffer,
+  o: { aad?: Buffer; iv?: Buffer } = {}
+): Buffer {
+  const { aad, iv = ZERO_IV } = o;
+  const c = crypto.createCipheriv("chacha20-poly1305", key, iv, {
+    authTagLength: TAG,
+  });
+  if (aad) c.setAAD(aad, { plaintextLength: plain.length });
+  return Buffer.concat([c.update(plain), c.final(), c.getAuthTag()]);
+}
+
+function unseal(
+  key: Buffer,
+  ct: Buffer,
+  o: { aad?: Buffer; iv?: Buffer } = {}
+): Buffer {
+  const { aad, iv = ZERO_IV } = o;
+  if (ct.length < TAG) throw new Error("short");
+  const d = crypto.createDecipheriv("chacha20-poly1305", key, iv, {
+    authTagLength: TAG,
+  });
+  d.setAuthTag(ct.subarray(ct.length - TAG));
+  if (aad) d.setAAD(aad, { plaintextLength: ct.length - TAG });
+  return Buffer.concat([d.update(ct.subarray(0, ct.length - TAG)), d.final()]);
+}
+
+export interface Sealed {
+  envelope: Buffer;
+  nonce: Buffer;
+  /** Opens the answer to this request, and nothing else. */
+  resKey: Buffer;
+}
+
+export function sealRequest(o: {
+  from: string;
+  to: string;
+  signKey: KeyObject;
+  peerBox: KeyObject;
+  request: PeerRequest;
+  now?: number;
+}): Sealed {
+  const nonce = crypto.randomBytes(16);
+  const eph = crypto.generateKeyPairSync("x25519");
+  const header: RequestHeader = {
+    v: 1,
+    from: o.from,
+    to: o.to,
+    ts: o.now ?? Date.now(),
+    nonce: nonce.toString("base64url"),
+    epk: rawPublic(eph.publicKey),
+  };
+  const headerBytes = Buffer.from(JSON.stringify(header));
+  const shared = crypto.diffieHellman({
+    privateKey: eph.privateKey,
+    publicKey: o.peerBox,
+  });
+  const keys = keysFor(shared, nonce, o.from, o.to);
+  const { body, ...meta } = o.request;
+  const ct = seal(keys.req, frame(meta, body), { aad: headerBytes });
+  const sig = crypto.sign(
+    null,
+    Buffer.concat([REQ_DOMAIN, headerBytes, sha256(ct)]),
+    o.signKey
+  );
+  const hsig = crypto.sign(
+    null,
+    Buffer.concat([HDR_DOMAIN, headerBytes]),
+    o.signKey
+  );
+  const len = Buffer.alloc(4);
+  len.writeUInt32BE(headerBytes.length);
+  return {
+    envelope: Buffer.concat([len, headerBytes, hsig, ct, sig]),
+    nonce,
+    resKey: keys.res,
+  };
+}
+
+function parseHeader(raw: unknown): RequestHeader | null {
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return null;
+  const h = raw as Record<string, unknown>;
+  const keys = Object.keys(h).sort().join(",");
+  if (keys !== "epk,from,nonce,to,ts,v") return null;
+  if (h.v !== 1) return null;
+  if (typeof h.from !== "string" || !MACHINE_ID.test(h.from)) return null;
+  if (typeof h.to !== "string" || !MACHINE_ID.test(h.to)) return null;
+  if (typeof h.ts !== "number" || !Number.isSafeInteger(h.ts)) return null;
+  if (typeof h.nonce !== "string" || !B64_16.test(h.nonce)) return null;
+  if (typeof h.epk !== "string" || !B64_32.test(h.epk)) return null;
+  return h as unknown as RequestHeader;
+}
+
+/** The header alone, as soon as it has arrived (to refuse early). */
+export function parseHeaderBytes(bytes: Buffer): RequestHeader | null {
+  try {
+    return parseHeader(JSON.parse(bytes.toString("utf8")));
+  } catch {
+    return null;
+  }
+}
+
+/** Whether the header alone is signed by `signKey`. */
+export function verifyHeader(
+  headerBytes: Buffer,
+  hsig: Buffer,
+  signKey: KeyObject
+): boolean {
+  try {
+    return crypto.verify(
+      null,
+      Buffer.concat([HDR_DOMAIN, headerBytes]),
+      signKey,
+      hsig
+    );
+  } catch {
+    return false;
+  }
+}
+
+export interface ParsedRequest {
+  header: RequestHeader;
+  headerBytes: Buffer;
+  hsig: Buffer;
+  ct: Buffer;
+  sig: Buffer;
+}
+
+/** The envelope's parts, or null when it isn't shaped like one. */
+export function parseRequest(envelope: Buffer): ParsedRequest | null {
+  try {
+    if (envelope.length > MAX_REQUEST_ENVELOPE) return null;
+    const { meta, rest } = unframe(envelope, MAX_HEADER);
+    const header = parseHeader(meta);
+    if (!header || rest.length < SIG + TAG + SIG) return null;
+    const headerLen = envelope.readUInt32BE(0);
+    return {
+      header,
+      headerBytes: envelope.subarray(4, 4 + headerLen),
+      hsig: rest.subarray(0, SIG),
+      ct: rest.subarray(SIG, rest.length - SIG),
+      sig: rest.subarray(rest.length - SIG),
+    };
+  } catch {
+    return null;
+  }
+}
+
+export interface OpenDeps {
+  /** This machine's Connect id: an envelope for any other is refused. */
+  self: string;
+  boxKey: KeyObject;
+  /** The pinned signing key for a peer, or why there isn't one. */
+  signKeyFor: (machineId: string) => KeyObject | "unknown_peer" | "suspended";
+  replay: ReplayGuard;
+  now?: number;
+}
+
+export type Opened =
+  | {
+      ok: true;
+      header: RequestHeader;
+      request: PeerRequest;
+      nonce: Buffer;
+      resKey: Buffer;
+    }
+  | { ok: false; refusal: Refusal; header?: RequestHeader };
+
+/**
+ * Checks, in order: shape, addressed to this machine, a pinned peer, its
+ * signature, the clock, a fresh nonce; then decrypts. A nonce is remembered
+ * only once the signature holds, so nobody else can burn a peer's nonces.
+ */
+export function openRequest(envelope: Buffer, deps: OpenDeps): Opened {
+  const parsed = parseRequest(envelope);
+  if (!parsed) return { ok: false, refusal: "bad_envelope" };
+  const { header, headerBytes, hsig, ct, sig } = parsed;
+  const fail = (refusal: Refusal): Opened => ({ ok: false, refusal, header });
+  if (header.to !== deps.self) return fail("wrong_machine");
+  const signKey = deps.signKeyFor(header.from);
+  if (typeof signKey === "string") return fail(signKey);
+  let verified = verifyHeader(headerBytes, hsig, signKey);
+  try {
+    verified &&= crypto.verify(
+      null,
+      Buffer.concat([REQ_DOMAIN, headerBytes, sha256(ct)]),
+      signKey,
+      sig
+    );
+  } catch {
+    verified = false;
+  }
+  if (!verified) return fail("bad_sig");
+  const now = deps.now ?? Date.now();
+  const fresh = deps.replay.check(header.from, header.nonce, header.ts, now);
+  if (fresh !== "ok") return fail(fresh);
+  try {
+    const nonce = Buffer.from(header.nonce, "base64url");
+    const epk = crypto.createPublicKey({
+      key: { kty: "OKP", crv: "X25519", x: header.epk },
+      format: "jwk",
+    });
+    const shared = crypto.diffieHellman({
+      privateKey: deps.boxKey,
+      publicKey: epk,
+    });
+    const keys = keysFor(shared, nonce, header.from, header.to);
+    const { meta, rest } = unframe(
+      unseal(keys.req, ct, { aad: headerBytes }),
+      MAX_META
+    );
+    const request = parseInner(meta, rest);
+    if (!request) return fail("bad_envelope");
+    return { ok: true, header, request, nonce, resKey: keys.res };
+  } catch {
+    return fail("bad_envelope");
+  }
+}
+
+function parseInner(meta: unknown, body: Buffer): PeerRequest | null {
+  if (!meta || typeof meta !== "object" || Array.isArray(meta)) return null;
+  const m = meta as Record<string, unknown>;
+  if (
+    typeof m.method !== "string" ||
+    typeof m.path !== "string" ||
+    typeof m.query !== "string" ||
+    typeof m.contentType !== "string" ||
+    body.length > MAX_REQUEST_BODY
+  )
+    return null;
+  return {
+    method: m.method,
+    path: m.path,
+    query: m.query,
+    contentType: m.contentType,
+    body,
+  };
+}
+
+export function sealResponse(o: {
+  resKey: Buffer;
+  nonce: Buffer;
+  signKey: KeyObject;
+  response: PeerResponse;
+}): Buffer {
+  const { body, ...meta } = o.response;
+  const iv = crypto.randomBytes(IV_LEN);
+  const ct = seal(o.resKey, frame(meta, body), { iv });
+  const sig = crypto.sign(
+    null,
+    Buffer.concat([RES_DOMAIN, o.nonce, iv, sha256(ct)]),
+    o.signKey
+  );
+  return Buffer.concat([iv, ct, sig]);
+}
+
+/** The answer to the request sealed with this nonce and key, from that peer. */
+export function openResponse(o: {
+  envelope: Buffer;
+  nonce: Buffer;
+  resKey: Buffer;
+  peerSign: KeyObject;
+}): PeerResponse {
+  const { envelope } = o;
+  if (
+    envelope.length < IV_LEN + TAG + SIG ||
+    envelope.length > MAX_RESPONSE_ENVELOPE
+  )
+    throw new Error("its answer isn't an envelope");
+  const iv = envelope.subarray(0, IV_LEN);
+  const ct = envelope.subarray(IV_LEN, envelope.length - SIG);
+  const sig = envelope.subarray(envelope.length - SIG);
+  let ok = false;
+  try {
+    ok = crypto.verify(
+      null,
+      Buffer.concat([RES_DOMAIN, o.nonce, iv, sha256(ct)]),
+      o.peerSign,
+      sig
+    );
+  } catch {
+    ok = false;
+  }
+  if (!ok) throw new Error("its answer isn't signed by the linked machine");
+  let meta: unknown;
+  let body: Buffer;
+  try {
+    ({ meta, rest: body } = unframe(unseal(o.resKey, ct, { iv }), MAX_META));
+  } catch {
+    throw new Error("its answer doesn't decrypt");
+  }
+  const m = (meta ?? {}) as Record<string, unknown>;
+  if (
+    typeof m.status !== "number" ||
+    !Number.isInteger(m.status) ||
+    m.status < 100 ||
+    m.status > 599 ||
+    typeof m.contentType !== "string"
+  )
+    throw new Error("its answer is malformed");
+  return { status: m.status, contentType: m.contentType, body };
+}

package/lib/peer/internal.ts

@@ -0,0 +1,22 @@
+/**
+ * The per-boot secret the rpc server's loopback hop carries, so the gate
+ * knows a request is a verified peer call and not this machine itself.
+ * Held on globalThis: server.ts and the gate must share one value.
+ */
+
+import crypto from "crypto";
+
+const g = globalThis as unknown as { __agentosPeerSecret?: string };
+
+export function peerSecret(): string {
+  g.__agentosPeerSecret ??= crypto.randomBytes(32).toString("hex");
+  return g.__agentosPeerSecret;
+}
+
+/** Constant-time: how much of the secret matched never shows in timing. */
+export function secretMatches(given: unknown, secret: string): boolean {
+  if (typeof given !== "string" || !secret) return false;
+  const a = Buffer.from(given);
+  const b = Buffer.from(secret);
+  return a.length === b.length && crypto.timingSafeEqual(a, b);
+}

package/lib/peer/keys.ts

@@ -0,0 +1,122 @@
+/**
+ * The keys a machine uses with its linked peers. The signing key is
+ * Connect's machine.key (Ed25519); the box key (X25519) is peer.key next to
+ * it, made on first use, owner-only, and never sent to the Connect service.
+ * Public keys travel as base64url of their 32 raw bytes.
+ */
+
+import crypto, { type KeyObject } from "crypto";
+import fs from "fs";
+import path from "path";
+import { connectDir, readConnect } from "../connect/config";
+
+const RAW = /^[A-Za-z0-9_-]{43}$/;
+
+export const rawPublic = (key: KeyObject): string => {
+  const jwk = key.export({ format: "jwk" });
+  if (typeof jwk.x !== "string") throw new Error("not an OKP key");
+  return jwk.x;
+};
+
+function publicFromRaw(raw: string, crv: "Ed25519" | "X25519"): KeyObject {
+  if (!RAW.test(raw)) throw new Error(`bad ${crv} public key`);
+  const key = crypto.createPublicKey({
+    key: { kty: "OKP", crv, x: raw },
+    format: "jwk",
+  });
+  if (key.asymmetricKeyType !== crv.toLowerCase())
+    throw new Error(`bad ${crv} public key`);
+  return key;
+}
+
+export const signPublic = (raw: string) => publicFromRaw(raw, "Ed25519");
+export const boxPublic = (raw: string) => publicFromRaw(raw, "X25519");
+
+export interface BoxKey {
+  privateKey: KeyObject;
+  publicRaw: string;
+}
+
+/**
+ * Makes sure `p` is this user's and nobody else's: repairs group or other
+ * access, refuses one owned by someone else.
+ */
+function ownerOnly(p: string, mode: number) {
+  if (process.platform === "win32") return;
+  const st = fs.lstatSync(p);
+  if (st.isSymbolicLink()) throw new Error(`${p} is a symlink`);
+  if (typeof process.getuid === "function" && st.uid !== process.getuid())
+    throw new Error(`${p} belongs to another user`);
+  if (st.mode & 0o077) fs.chmodSync(p, mode);
+}
+
+/** peer.key, created owner-only if it isn't there yet. */
+export function loadBoxKey(dir = connectDir()): BoxKey {
+  const file = path.join(dir, "peer.key");
+  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  ownerOnly(dir, 0o700);
+  if (!fs.existsSync(file)) {
+    const { privateKey } = crypto.generateKeyPairSync("x25519");
+    const pem = privateKey.export({ format: "pem", type: "pkcs8" });
+    // Written whole under a temp name, then linked in: a crash never leaves
+    // a half-written key, and two starts racing keep whichever came first.
+    const tmp = `${file}.${process.pid}.${crypto.randomBytes(4).toString("hex")}`;
+    fs.writeFileSync(tmp, pem, { mode: 0o600, flag: "wx" });
+    try {
+      fs.linkSync(tmp, file);
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+    } finally {
+      fs.rmSync(tmp, { force: true });
+    }
+  }
+  ownerOnly(file, 0o600);
+  const privateKey = crypto.createPrivateKey(fs.readFileSync(file, "utf8"));
+  if (privateKey.asymmetricKeyType !== "x25519")
+    throw new Error(`${file} is not an X25519 key`);
+  return {
+    privateKey,
+    publicRaw: rawPublic(crypto.createPublicKey(privateKey)),
+  };
+}
+
+export interface Identity {
+  machineId: string;
+  signKey: KeyObject;
+  signPub: string;
+}
+
+/** This machine as Connect knows it, or null when it isn't enrolled. */
+export function loadIdentity(dir = connectDir()): Identity | null {
+  const read = readConnect(dir);
+  if (!read.ok) return null;
+  const signKey = crypto.createPrivateKey(read.files.machineKey);
+  if (signKey.asymmetricKeyType !== "ed25519") return null;
+  return {
+    machineId: read.files.config.machineId,
+    signKey,
+    signPub: rawPublic(crypto.createPublicKey(signKey)),
+  };
+}
+
+const g = globalThis as unknown as {
+  __agentosPeerIdentity?: {
+    at: number;
+    dir: string;
+    identity: Identity | null;
+  };
+};
+
+/** loadIdentity, re-read at most every 30 s (it's on every peer call). */
+export function currentIdentity(dir = connectDir()): Identity | null {
+  const c = g.__agentosPeerIdentity;
+  if (c && c.dir === dir && Date.now() - c.at < 30_000) return c.identity;
+  let identity: Identity | null = null;
+  try {
+    identity = loadIdentity(dir);
+  } catch {
+    identity = null;
+  }
+  g.__agentosPeerIdentity = { at: Date.now(), dir, identity };
+  return identity;
+}

package/lib/peer/links.ts

@@ -0,0 +1,96 @@
+/**
+ * Pinned peers: a machine linked through Connect, by its Connect id, with
+ * the keys it paired with. Nothing here talks to the network.
+ */
+
+import { getDb } from "../db";
+
+export type PinState = "active" | "suspended";
+
+export interface PeerPin {
+  hostId: string;
+  machineId: string;
+  hostname: string;
+  signPub: string;
+  boxPub: string;
+  state: PinState;
+  suspendedReason: string | null;
+}
+
+interface Row {
+  host_id: string;
+  machine_id: string;
+  hostname: string;
+  sign_pub: string;
+  box_pub: string;
+  state: string;
+  suspended_reason: string | null;
+}
+
+const toPin = (r: Row | undefined): PeerPin | null =>
+  r
+    ? {
+        hostId: r.host_id,
+        machineId: r.machine_id,
+        hostname: r.hostname,
+        signPub: r.sign_pub,
+        boxPub: r.box_pub,
+        state: r.state === "active" ? "active" : "suspended",
+        suspendedReason: r.suspended_reason,
+      }
+    : null;
+
+// Only a host created as a Connect machine counts: a pin on any other row
+// would be a second way in that nothing shows.
+const SELECT = `SELECT p.* FROM peer_links p JOIN hosts h ON h.id = p.host_id
+  WHERE h.kind = 'connect'`;
+
+export const pinForMachine = (machineId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.machine_id = ?`).get(machineId) as
+      Row | undefined
+  );
+
+/** Whether any linked machine may call in at all. */
+export const hasActivePin = (): boolean =>
+  getDb().prepare(`${SELECT} AND p.state = 'active' LIMIT 1`).get() !==
+  undefined;
+
+export const pinForHost = (hostId: string): PeerPin | null =>
+  toPin(
+    getDb().prepare(`${SELECT} AND p.host_id = ?`).get(hostId) as
+      Row | undefined
+  );
+
+/** Pins a peer's keys to a Connect host. Pairing (S2) is the only caller. */
+export function savePin(pin: Omit<PeerPin, "state" | "suspendedReason">) {
+  getDb()
+    .prepare(
+      `INSERT INTO peer_links (host_id, machine_id, hostname, sign_pub, box_pub)
+       VALUES (?, ?, ?, ?, ?)
+       ON CONFLICT(host_id) DO UPDATE SET machine_id = excluded.machine_id,
+         hostname = excluded.hostname, sign_pub = excluded.sign_pub,
+         box_pub = excluded.box_pub, state = 'active', suspended_reason = NULL,
+         paired_at = datetime('now'), last_error = NULL`
+    )
+    .run(pin.hostId, pin.machineId, pin.hostname, pin.signPub, pin.boxPub);
+}
+
+export function suspendPin(hostId: string, reason: string) {
+  getDb()
+    .prepare(
+      `UPDATE peer_links SET state = 'suspended', suspended_reason = ? WHERE host_id = ?`
+    )
+    .run(reason, hostId);
+}
+
+/** Last outcome of a call to that peer, for Machines. */
+export function notePinResult(hostId: string, error: string | null) {
+  getDb()
+    .prepare(
+      error
+        ? `UPDATE peer_links SET last_error = ? WHERE host_id = ?`
+        : `UPDATE peer_links SET last_ok_at = datetime('now'), last_error = NULL WHERE host_id = ?`
+    )
+    .run(...(error ? [error.slice(0, 300), hostId] : [hostId]));
+}

package/lib/peer/nonce-store.ts

@@ -0,0 +1,23 @@
+/**
+ * The replay guard's nonces in SQLite, so they outlive a restart. One
+ * statement both checks and records, so two requests carrying the same nonce
+ * can't both pass.
+ */
+
+import { getDb } from "../db";
+import type { NonceStore } from "./replay";
+
+export function sqliteNonceStore(db = getDb): NonceStore {
+  return {
+    claim: (peer, nonce, until, now) =>
+      db()
+        .prepare(
+          `INSERT INTO peer_nonces (machine_id, nonce, until) VALUES (?, ?, ?)
+           ON CONFLICT (machine_id, nonce) DO UPDATE SET until = excluded.until
+             WHERE peer_nonces.until < ?`
+        )
+        .run(peer.slice(0, 64), nonce, until, now).changes === 1,
+    prune: (now) =>
+      void db().prepare(`DELETE FROM peer_nonces WHERE until < ?`).run(now),
+  };
+}