@threadbase-sh/streamer 1.58.2 → 1.59.0

package/dist/cli.cjs

@@ -31270,7 +31270,7 @@ var require_websocket = __commonJS({
     var http = require("http");
     var net = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes5, createHash: createHash7 } = require("crypto");
+    var { randomBytes: randomBytes5, createHash: createHash8 } = require("crypto");
     var { Duplex, Readable: Readable2 } = require("stream");
     var { URL: URL2 } = require("url");
     var PerMessageDeflate2 = require_permessage_deflate();
@@ -31938,7 +31938,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash8("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -32229,7 +32229,7 @@ var require_stream = __commonJS({
           callback();
           if (duplex._readableState.endEmitted) duplex.destroy();
         } else {
-          ws2._socket.once("finish", function finish() {
+          ws2._socket.once("finish", function finish2() {
             callback();
           });
           ws2.close();
@@ -32307,7 +32307,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter5 = require("events");
     var http = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash7 } = require("crypto");
+    var { createHash: createHash8 } = require("crypto");
     var extension2 = require_extension();
     var PerMessageDeflate2 = require_permessage_deflate();
     var subprotocol2 = require_subprotocol();
@@ -32614,7 +32614,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash7("sha1").update(key + GUID).digest("base64");
+        const digest = createHash8("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -42935,7 +42935,7 @@ var require_writer = __commonJS({
       }
       return this;
     };
-    Writer.prototype.finish = function finish() {
+    Writer.prototype.finish = function finish2() {
       var head = this.head.next, buf = this.constructor.alloc(this.len), pos = 0;
       while (head) {
         head.fn(head.val, buf, pos);
@@ -44971,7 +44971,7 @@ var require_root = __commonJS({
         return util.asPromise(load, self2, filename, options);
       }
       var sync = callback === SYNC;
-      function finish(err, root) {
+      function finish2(err, root) {
         if (!callback) {
           return;
         }
@@ -45018,10 +45018,10 @@ var require_root = __commonJS({
             }
           }
         } catch (err) {
-          finish(err);
+          finish2(err);
         }
         if (!sync && !queued) {
-          finish(null, self2);
+          finish2(null, self2);
         }
       }
       function fetch2(filename2, weak, depth) {
@@ -45050,7 +45050,7 @@ var require_root = __commonJS({
             source = util.fs.readFileSync(filename2).toString("utf8");
           } catch (err) {
             if (!weak)
-              finish(err);
+              finish2(err);
             return;
           }
           process4(filename2, source, depth);
@@ -45063,9 +45063,9 @@ var require_root = __commonJS({
             }
             if (err) {
               if (!weak)
-                finish(err);
+                finish2(err);
               else if (!queued)
-                finish(null, self2);
+                finish2(null, self2);
               return;
             }
             process4(filename2, source2, depth);
@@ -45084,7 +45084,7 @@ var require_root = __commonJS({
         return self2;
       }
       if (!queued) {
-        finish(null, self2);
+        finish2(null, self2);
       }
       return self2;
     };
@@ -120687,11 +120687,11 @@ function toPublicSession(s3) {
     subStatus: s3.subStatus ?? null
   };
 }
-var import_crypto10, import_fs26, import_path26, OUTPUT_BUFFER_MAX, INPUT_HISTORY_MAX, QUIET_DETECT_MS, CODEX_READY_FALLBACK_MS, SUBMIT_BYTES, CODEX_SUBMIT_DELAY_MS, CODEX_SUBMIT_MAX_WAIT_MS, CODEX_SUBMIT_STALE_MS, CodexPtyRunner;
+var import_crypto11, import_fs26, import_path26, OUTPUT_BUFFER_MAX, INPUT_HISTORY_MAX, QUIET_DETECT_MS, CODEX_READY_FALLBACK_MS, SUBMIT_BYTES, CODEX_SUBMIT_DELAY_MS, CODEX_SUBMIT_MAX_WAIT_MS, CODEX_SUBMIT_STALE_MS, CodexPtyRunner;
 var init_codex_pty_runner = __esm({
   "src/codex-pty-runner.ts"() {
     "use strict";
-    import_crypto10 = require("crypto");
+    import_crypto11 = require("crypto");
     import_fs26 = require("fs");
     import_path26 = require("path");
     init_logger();
@@ -120856,7 +120856,7 @@ var init_codex_pty_runner = __esm({
       // binding logic). This runner generates a local placeholder id for the
       // ManagedSession handle only.
       async startFresh(options) {
-        const sessionId = (0, import_crypto10.randomUUID)();
+        const sessionId = (0, import_crypto11.randomUUID)();
         const args = ["--cd", options.projectPath, "--no-alt-screen"];
         if (options.systemPrompt) {
           args.push(options.systemPrompt);
@@ -120875,7 +120875,7 @@ var init_codex_pty_runner = __esm({
        * until watchForCodexRollout binds the real id.
        */
       async startFork(options) {
-        const sessionId = (0, import_crypto10.randomUUID)();
+        const sessionId = (0, import_crypto11.randomUUID)();
         return this.launch(
           sessionId,
           ["fork", options.forkFromId, "--cd", options.projectPath, "--no-alt-screen"],
@@ -122102,11 +122102,11 @@ function toPublicSession2(s3) {
     subStatus: s3.subStatus ?? null
   };
 }
-var import_crypto11, import_fs27, import_path27, OUTPUT_BUFFER_MAX2, INPUT_HISTORY_MAX2, CLAUDE_PROMPT_MARKERS, QUIET_DETECT_MS2, OSC_TAIL_CHARS, SCRAPE_THROTTLE_MS, CLAUDE_READY_FALLBACK_MS, SUBMIT_BYTES2, SUBMIT_DELAY_MS, SUBMIT_MAX_WAIT_MS, PTYManager;
+var import_crypto12, import_fs27, import_path27, OUTPUT_BUFFER_MAX2, INPUT_HISTORY_MAX2, CLAUDE_PROMPT_MARKERS, QUIET_DETECT_MS2, OSC_TAIL_CHARS, SCRAPE_THROTTLE_MS, CLAUDE_READY_FALLBACK_MS, SUBMIT_BYTES2, SUBMIT_DELAY_MS, SUBMIT_MAX_WAIT_MS, PTYManager;
 var init_pty_manager = __esm({
   "src/pty-manager.ts"() {
     "use strict";
-    import_crypto11 = require("crypto");
+    import_crypto12 = require("crypto");
     import_fs27 = require("fs");
     import_path27 = require("path");
     init_claude_flags();
@@ -122296,7 +122296,7 @@ var init_pty_manager = __esm({
       // onReady fires once Claude reaches its first prompt (waiting_input).
       async startFresh(options) {
         const nodePty = await loadPty();
-        const sessionId = (0, import_crypto11.randomUUID)();
+        const sessionId = (0, import_crypto12.randomUUID)();
         const projectName = options.projectName ?? (0, import_path27.basename)(options.projectPath);
         const permissionMode = options.permissionMode ?? "acceptEdits";
         const args = [
@@ -123190,7 +123190,7 @@ async function probePtyHostStatus(socketPath, timeoutMs = 1e3) {
   return await new Promise((resolve4) => {
     const decoder = new LineDecoder();
     let settled = false;
-    const finish = (result) => {
+    const finish2 = (result) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
@@ -123198,31 +123198,31 @@ async function probePtyHostStatus(socketPath, timeoutMs = 1e3) {
       resolve4(result);
     };
     const timer = setTimeout(
-      () => finish({ reachable: false, error: `status timed out after ${timeoutMs}ms` }),
+      () => finish2({ reachable: false, error: `status timed out after ${timeoutMs}ms` }),
       timeoutMs
     );
     timer.unref?.();
-    transport.onClose(() => finish({ reachable: false, error: "pty-host connection closed" }));
+    transport.onClose(() => finish2({ reachable: false, error: "pty-host connection closed" }));
     transport.onLine((chunk) => {
       for (const line of decoder.push(chunk)) {
         let message;
         try {
           message = JSON.parse(line);
         } catch {
-          finish({ reachable: false, error: "pty-host returned an invalid status response" });
+          finish2({ reachable: false, error: "pty-host returned an invalid status response" });
           return;
         }
         if (isHostEvent(message) || message.id !== 1) continue;
         if (!message.ok) {
-          finish({ reachable: false, error: message.error });
+          finish2({ reachable: false, error: message.error });
           return;
         }
         const status = message.result;
         if (typeof status?.protocolVersion !== "number" || !Array.isArray(status.sessions)) {
-          finish({ reachable: false, error: "pty-host returned an invalid status response" });
+          finish2({ reachable: false, error: "pty-host returned an invalid status response" });
           return;
         }
-        finish({
+        finish2({
           reachable: true,
           protocolVersion: status.protocolVersion,
           sessionCount: status.sessions.length
@@ -123232,7 +123232,7 @@ async function probePtyHostStatus(socketPath, timeoutMs = 1e3) {
     try {
       transport.send(encodeMessage({ id: 1, type: "status" }));
     } catch (err) {
-      finish({ reachable: false, error: err instanceof Error ? err.message : String(err) });
+      finish2({ reachable: false, error: err instanceof Error ? err.message : String(err) });
     }
   });
 }
@@ -132212,7 +132212,7 @@ Content-Length: 0\r
 
 // src/server.ts
 var import_client = __toESM(require_lib3(), 1);
-var import_crypto14 = require("crypto");
+var import_crypto15 = require("crypto");
 var import_events2 = require("events");
 var import_fs39 = require("fs");
 var import_promises16 = require("fs/promises");
@@ -148910,6 +148910,250 @@ var SessionsRepository = class {
 // src/server.ts
 init_runtime_store();
 
+// src/e2ee/noise.ts
+var import_crypto10 = require("crypto");
+var NOISE_PROTOCOL_NAME = "Noise_IKpsk1_25519_ChaChaPoly_SHA256";
+var PAIR_PROLOGUE = Buffer.from("threadbase-e2ee/1 pair", "utf-8");
+var DHLEN = 32;
+var HASHLEN = 32;
+var TAGLEN = 16;
+var NOISE_MESSAGE_1_OVERHEAD = DHLEN + DHLEN + TAGLEN + TAGLEN;
+var NOISE_MESSAGE_2_OVERHEAD = DHLEN + TAGLEN;
+var NOISE_MAX_MESSAGE_BYTES = 4096;
+var NoiseError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "NoiseError";
+  }
+};
+function generateKeyPair() {
+  const { publicKey, privateKey } = (0, import_crypto10.generateKeyPairSync)("x25519");
+  return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
+}
+function keyPairFrom(privateKey) {
+  const publicKey = (0, import_crypto10.createPublicKey)(privateKey);
+  return { publicKey, privateKey, publicKeyRaw: rawPublicKey(publicKey) };
+}
+function rawPublicKey(key) {
+  const pub = key.type === "public" ? key : (0, import_crypto10.createPublicKey)(key);
+  const jwk = pub.export({ format: "jwk" });
+  if (jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new NoiseError("Not an X25519 public key");
+  }
+  return Buffer.from(jwk.x, "base64url");
+}
+function publicKeyFromRaw(raw2) {
+  if (raw2.length !== DHLEN) {
+    throw new NoiseError(`X25519 public key must be ${DHLEN} bytes, got ${raw2.length}`);
+  }
+  try {
+    return (0, import_crypto10.createPublicKey)({
+      key: { kty: "OKP", crv: "X25519", x: raw2.toString("base64url") },
+      format: "jwk"
+    });
+  } catch {
+    throw new NoiseError("Invalid X25519 public key");
+  }
+}
+function pskFromPairToken(token) {
+  return (0, import_crypto10.createHash)("sha256").update("threadbase-e2ee/1 psk", "utf-8").update(token, "utf-8").digest();
+}
+function chachaNonce(n) {
+  const nonce = Buffer.alloc(12);
+  nonce.writeBigUInt64LE(n, 4);
+  return nonce;
+}
+var CipherState = class {
+  k = null;
+  n = 0n;
+  initializeKey(key) {
+    this.k = key;
+    this.n = 0n;
+  }
+  hasKey() {
+    return this.k !== null;
+  }
+  encryptWithAd(ad, plaintext) {
+    if (!this.k) return plaintext;
+    const cipher = (0, import_crypto10.createCipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+      authTagLength: TAGLEN
+    });
+    cipher.setAAD(ad, { plaintextLength: plaintext.length });
+    const out = Buffer.concat([cipher.update(plaintext), cipher.final(), cipher.getAuthTag()]);
+    this.n += 1n;
+    return out;
+  }
+  decryptWithAd(ad, ciphertext) {
+    if (!this.k) return ciphertext;
+    if (ciphertext.length < TAGLEN) throw new NoiseError("Ciphertext shorter than its tag");
+    const body = ciphertext.subarray(0, ciphertext.length - TAGLEN);
+    const tag = ciphertext.subarray(ciphertext.length - TAGLEN);
+    const decipher = (0, import_crypto10.createDecipheriv)("chacha20-poly1305", this.k, chachaNonce(this.n), {
+      authTagLength: TAGLEN
+    });
+    decipher.setAAD(ad, { plaintextLength: body.length });
+    decipher.setAuthTag(tag);
+    let out;
+    try {
+      out = Buffer.concat([decipher.update(body), decipher.final()]);
+    } catch {
+      throw new NoiseError("Decryption failed");
+    }
+    this.n += 1n;
+    return out;
+  }
+};
+var SymmetricState = class {
+  ck;
+  h;
+  cipher = new CipherState();
+  constructor(protocolName) {
+    const name = Buffer.from(protocolName, "utf-8");
+    this.h = name.length <= HASHLEN ? Buffer.concat([name, Buffer.alloc(HASHLEN - name.length)]) : (0, import_crypto10.createHash)("sha256").update(name).digest();
+    this.ck = Buffer.from(this.h);
+    this.cipher.initializeKey(null);
+  }
+  /**
+   * Noise's HKDF (spec §4.3) is RFC 5869 with `salt = chaining_key`,
+   * `ikm = input_key_material` and an EMPTY info, so Node's `hkdfSync` is
+   * exactly it rather than approximately it. Using the platform's HKDF removes
+   * the HMAC chain that would otherwise be the easiest thing here to get
+   * subtly wrong.
+   */
+  hkdf(ikm, outputs) {
+    const raw2 = Buffer.from((0, import_crypto10.hkdfSync)("sha256", ikm, this.ck, Buffer.alloc(0), HASHLEN * outputs));
+    const out = [];
+    for (let i = 0; i < outputs; i++) out.push(raw2.subarray(i * HASHLEN, (i + 1) * HASHLEN));
+    return out;
+  }
+  mixKey(ikm) {
+    const [ck, tempK] = this.hkdf(ikm, 2);
+    this.ck = ck;
+    this.cipher.initializeKey(tempK);
+  }
+  mixHash(data) {
+    this.h = (0, import_crypto10.createHash)("sha256").update(this.h).update(data).digest();
+  }
+  /** Spec §5.2. Used only by the `psk` token. */
+  mixKeyAndHash(ikm) {
+    const [ck, tempH, tempK] = this.hkdf(ikm, 3);
+    this.ck = ck;
+    this.mixHash(tempH);
+    this.cipher.initializeKey(tempK);
+  }
+  encryptAndHash(plaintext) {
+    const ciphertext = this.cipher.encryptWithAd(this.h, plaintext);
+    this.mixHash(ciphertext);
+    return ciphertext;
+  }
+  decryptAndHash(ciphertext) {
+    const plaintext = this.cipher.decryptWithAd(this.h, ciphertext);
+    this.mixHash(ciphertext);
+    return plaintext;
+  }
+  /** The transcript hash. Both sides must arrive at the same value. */
+  handshakeHash() {
+    return Buffer.from(this.h);
+  }
+  /** Spec §5.2 `Split()`: the two directional transport keys. */
+  split() {
+    const [k1, k2] = this.hkdf(Buffer.alloc(0), 2);
+    return { k1: Buffer.from(k1), k2: Buffer.from(k2) };
+  }
+};
+function dh(privateKey, publicKey) {
+  return (0, import_crypto10.diffieHellman)({ privateKey, publicKey });
+}
+function readMessage1(args) {
+  assertMessageSize(args.message1, NOISE_MESSAGE_1_OVERHEAD);
+  const state = new SymmetricState(NOISE_PROTOCOL_NAME);
+  state.mixHash(args.prologue ?? PAIR_PROLOGUE);
+  state.mixHash(args.staticKeyPair.publicKeyRaw);
+  const reRaw = args.message1.subarray(0, DHLEN);
+  const re2 = publicKeyFromRaw(reRaw);
+  state.mixHash(reRaw);
+  state.mixKey(reRaw);
+  state.mixKey(dh(args.staticKeyPair.privateKey, re2));
+  const encryptedStatic = args.message1.subarray(DHLEN, DHLEN + DHLEN + TAGLEN);
+  const initiatorStaticPub = state.decryptAndHash(encryptedStatic);
+  const rs2 = publicKeyFromRaw(initiatorStaticPub);
+  state.mixKey(dh(args.staticKeyPair.privateKey, rs2));
+  state.mixKeyAndHash(args.psk);
+  const payload = state.decryptAndHash(args.message1.subarray(DHLEN + DHLEN + TAGLEN));
+  return {
+    symmetric: state,
+    initiatorStaticPub,
+    payload,
+    initiatorEphemeral: re2,
+    initiatorStatic: rs2,
+    staticKeyPair: args.staticKeyPair
+  };
+}
+function writeMessage2(state, responsePayload, ephemeral) {
+  const e = ephemeral ?? generateKeyPair();
+  state.symmetric.mixHash(e.publicKeyRaw);
+  state.symmetric.mixKey(e.publicKeyRaw);
+  state.symmetric.mixKey(dh(e.privateKey, state.initiatorEphemeral));
+  state.symmetric.mixKey(dh(e.privateKey, state.initiatorStatic));
+  const encryptedPayload = state.symmetric.encryptAndHash(responsePayload);
+  return {
+    message2: Buffer.concat([e.publicKeyRaw, encryptedPayload]),
+    keys: finish(state.symmetric)
+  };
+}
+function finish(state) {
+  const { k1, k2 } = state.split();
+  return { handshakeHash: state.handshakeHash(), clientToServer: k1, serverToClient: k2 };
+}
+function assertMessageSize(message, minimum) {
+  if (message.length < minimum) {
+    throw new NoiseError(`Handshake message too short: ${message.length} < ${minimum}`);
+  }
+  if (message.length > NOISE_MAX_MESSAGE_BYTES) {
+    throw new NoiseError(`Handshake message too large: ${message.length}`);
+  }
+}
+
+// src/e2ee/pair-request.ts
+var E2EE_EXCHANGE_VERSION = 1;
+var MAX_BASE64_CHARS = Math.ceil(NOISE_MAX_MESSAGE_BYTES * 4 / 3) + 4;
+var E2eeRequestError = class extends Error {
+  /** Stable code for the client, so a version mismatch is not a parse failure. */
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "E2eeRequestError";
+    this.code = code;
+  }
+};
+function parseE2eeRequest(raw2) {
+  if (raw2 === void 0 || raw2 === null) return null;
+  if (typeof raw2 !== "object" || Array.isArray(raw2)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee must be an object");
+  }
+  const { v: v2, noise } = raw2;
+  if (typeof v2 !== "number" || !Number.isInteger(v2)) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.v must be an integer");
+  }
+  if (v2 !== E2EE_EXCHANGE_VERSION) {
+    throw new E2eeRequestError(
+      "E2EE_VERSION_UNSUPPORTED",
+      `e2ee.v ${v2} is not supported; this server speaks ${E2EE_EXCHANGE_VERSION}`
+    );
+  }
+  if (typeof noise !== "string") {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise must be a base64 string");
+  }
+  if (noise.length > MAX_BASE64_CHARS) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise is too large");
+  }
+  const message1 = Buffer.from(noise, "base64");
+  if (message1.length === 0) {
+    throw new E2eeRequestError("E2EE_MALFORMED", "e2ee.noise is not valid base64");
+  }
+  return { version: v2, message1 };
+}
+
 // src/external-tails.ts
 var import_fs24 = require("fs");
 init_logger();
@@ -149087,7 +149331,7 @@ init_live_session_manager();
 init_logger();
 
 // src/pair-store.ts
-var import_crypto12 = require("crypto");
+var import_crypto13 = require("crypto");
 var DEFAULT_TTL_SECONDS = 180;
 var SWEEP_INTERVAL_MS = 6e4;
 var PairTokenStore = class {
@@ -149102,7 +149346,7 @@ var PairTokenStore = class {
     }
   }
   mint() {
-    const token = `pt_${(0, import_crypto12.randomBytes)(16).toString("hex")}`;
+    const token = `pt_${(0, import_crypto13.randomBytes)(16).toString("hex")}`;
     const expiresAt = Date.now() + this.ttlMs;
     this.current = { token, expiresAt, used: false };
     return {
@@ -149112,7 +149356,7 @@ var PairTokenStore = class {
     };
   }
   /**
-   * Whether `consume` would succeed right now, WITHOUT spending the token.
+   * What `consume` would answer right now, WITHOUT spending the token.
    *
    * Exists so a caller can reject a bad token before doing any work, and still
    * spend the token only once the work has succeeded. A pair token is
@@ -149121,10 +149365,14 @@ var PairTokenStore = class {
    * indistinguishable from an attacker replaying a photographed code, which is
    * the one signal `design.md` §2.6 designates as replay detection.
    *
-   * Advisory, not a reservation: it takes no lock and holds nothing. The
-   * authoritative answer is still `consume`'s.
+   * **Named for its relationship to `consume`, deliberately.** It reserves
+   * nothing and takes no lock, so two callers can both be told `{ ok: true }`
+   * for the same token. A name like `verify` would read as a gate that had
+   * decided something, and inviting a caller to act on this alone is precisely
+   * the misuse the ordering it enables exists to prevent. A reader who sees
+   * `wouldConsume` asks where the `consume` is, which is the right question.
    */
-  verify(token) {
+  wouldConsume(token) {
     const result = this.check(token);
     return result.ok ? { ok: true } : result;
   }
@@ -150469,7 +150717,7 @@ function createApiDeps(deps) {
 }
 
 // src/services/cache-integrity/cacheIntegrityMonitor.ts
-var import_crypto13 = require("crypto");
+var import_crypto14 = require("crypto");
 var import_fs34 = require("fs");
 
 // src/services/cache-integrity/alertStore.ts
@@ -150534,7 +150782,7 @@ function envInt(name, fallback) {
 }
 function fingerprintOf(ids) {
   const sorted = [...ids].sort();
-  return `sha256:${(0, import_crypto13.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
+  return `sha256:${(0, import_crypto14.createHash)("sha256").update(sorted.join("\n")).digest("hex")}`;
 }
 var CacheIntegrityMonitor = class {
   constructor(cache, wsHub, log15, cacheDir, rescan, runDuringReset) {
@@ -153084,7 +153332,7 @@ var StreamerServer = class {
   runtimeStore = null;
   // Identifies this streamer run. A registry row carrying a different id is a
   // session that outlived the process that started it.
-  streamerInstanceId = (0, import_crypto14.randomUUID)();
+  streamerInstanceId = (0, import_crypto15.randomUUID)();
   cacheMetadataRepo = null;
   // Push registration + delivery state (C7). Null when the cache DB failed to
   // open — registration then degrades to a no-op rather than 500ing.
@@ -154212,11 +154460,44 @@ var StreamerServer = class {
       json2(res, 400, { error: "Missing token or clientPublicKey" });
       return;
     }
-    const precheck = this.pairTokens.verify(token);
+    let e2eeRequest;
+    try {
+      e2eeRequest = parseE2eeRequest(body?.e2ee);
+    } catch (err) {
+      const e = err;
+      json2(res, 400, { error: e.message, code: e.code });
+      return;
+    }
+    const precheck = this.pairTokens.wouldConsume(token);
     if (!precheck.ok) {
+      if (precheck.reason === "used") {
+        this.log.warn(
+          "[pair] a pair token was replayed. If you did not just pair a device, check the paired-devices list and revoke anything you do not recognise.",
+          { event: "pair.token_replayed", ip }
+        );
+      }
       json2(res, 401, { error: `Pair token ${precheck.reason}` });
       return;
     }
+    let handshake = null;
+    if (e2eeRequest) {
+      try {
+        handshake = readMessage1({
+          staticKeyPair: keyPairFrom(loadOrCreateServerIdentity().privateKey),
+          // The pair token binds this handshake to the scanned QR. Derivation
+          // is specified in design.md §2.4 and pinned by a committed vector
+          // that tb-mobile checks against independently.
+          psk: pskFromPairToken(token),
+          message1: e2eeRequest.message1
+        });
+      } catch {
+        json2(res, 400, {
+          error: "E2EE handshake failed. Scan a fresh pairing code and try again.",
+          code: "E2EE_HANDSHAKE_FAILED"
+        });
+        return;
+      }
+    }
     let sealed;
     try {
       sealed = seal(this.apiKey, clientPublicKey);
@@ -154240,14 +154521,59 @@ var StreamerServer = class {
     try {
       const name = typeof body?.deviceName === "string" ? body.deviceName.slice(0, 100) : null;
       const preset = body?.readOnly === true ? "read-only" : "full";
-      device = this.devicesRepo?.register({ publicKey: clientPublicKey, name, preset }) ?? null;
+      device = this.devicesRepo?.register({
+        publicKey: clientPublicKey,
+        name,
+        preset,
+        // Recorded only when the handshake authenticated it. The static key
+        // comes out of the transcript, never off the wire as a claim — that
+        // is the difference between a device identified by a key it proved
+        // it holds and one identified by a string it sent.
+        //
+        // Setting it also sets `e2ee_required`, so a device that has once
+        // paired encrypted is pinned and never served plaintext again.
+        ...handshake && {
+          e2eeStaticPub: handshake.initiatorStaticPub.toString("base64"),
+          e2eeVersion: E2EE_EXCHANGE_VERSION
+        }
+      }) ?? null;
     } catch (err) {
       this.log.warn("[pair] device registration failed; pairing continues", {
         event: "pair.device_register_failed",
         err
       });
     }
+    let e2eeResponse = null;
+    if (handshake) {
+      try {
+        const { message2 } = writeMessage2(
+          handshake,
+          Buffer.from(
+            JSON.stringify({
+              v: E2EE_EXCHANGE_VERSION,
+              deviceId: device?.deviceId ?? null,
+              serverVersion: getVersion(),
+              // Always true on this path: completing a handshake is what pins
+              // the device, and design.md §6.3 says nothing a client sends
+              // ever clears it.
+              e2eeRequired: true
+            }),
+            "utf-8"
+          )
+        );
+        e2eeResponse = { v: E2EE_EXCHANGE_VERSION, noise: message2.toString("base64") };
+      } catch (err) {
+        this.log.warn("[pair] E2EE response could not be written; pairing continues", {
+          event: "pair.e2ee_response_failed",
+          err
+        });
+      }
+    }
     json2(res, 200, {
+      // Unchanged and still sent on the E2EE path, deliberately. An older app
+      // is the only thing that can read these and it cannot be force-updated
+      // (docs/compatibility/tb-mobile.md); a new app ignores them and uses the
+      // Noise result. The response grows a field, it never loses one.
       ciphertext: sealed.ciphertext,
       nonce: sealed.nonce,
       ephemeralPublicKey: sealed.ephemeralPublicKey,
@@ -154270,7 +154596,11 @@ var StreamerServer = class {
         deviceId: device.deviceId,
         deviceToken: device.deviceToken,
         capabilities: device.capabilities
-      }
+      },
+      // Additive. Absent means this pairing is plaintext — either the client
+      // never asked, or writing the reply failed — and a client that asked for
+      // encryption must treat its absence as a refusal, not as consent.
+      ...e2eeResponse && { e2ee: e2eeResponse }
     });
   }
   rotateApiKey() {