@verax-ai/body 0.1.0

package/dist/halt.js

@@ -0,0 +1,12 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+export function runHalt(stateDir, writeErr = (s) => process.stderr.write(s)) {
+    if (!stateDir) {
+        writeErr("verax halt <stateDir>\n");
+        return 78;
+    }
+    mkdirSync(stateDir, { recursive: true, mode: 0o700 });
+    writeFileSync(join(stateDir, "halted"), "", { encoding: "utf8", mode: 0o600 });
+    writeErr("halted\n");
+    return 0;
+}

package/dist/health-extras.d.ts

@@ -0,0 +1,11 @@
+export type HealthHeartbeat = {
+    atMs: number;
+    lastDecisionN: number;
+    lastEffectN: number;
+};
+export type HealthWitness = {
+    class: "self" | "same-org";
+    atMs: number;
+};
+export declare function readHeartbeat(stateDir: string): HealthHeartbeat | null;
+export declare function readWitnessPulse(stateDir: string): HealthWitness | null;

package/dist/health-extras.js

@@ -0,0 +1,47 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+export function readHeartbeat(stateDir) {
+    const path = join(stateDir, "heartbeat.json");
+    if (!existsSync(path))
+        return null;
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof raw.atMs !== "number" || !Number.isFinite(raw.atMs))
+            return null;
+        return {
+            atMs: raw.atMs,
+            lastDecisionN: typeof raw.lastDecisionN === "number" ? raw.lastDecisionN : 0,
+            lastEffectN: typeof raw.lastEffectN === "number" ? raw.lastEffectN : 0,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function readWitnessPulse(stateDir) {
+    const path = join(stateDir, "witness-status.jsonl");
+    if (!existsSync(path))
+        return null;
+    try {
+        const lines = readFileSync(path, "utf8")
+            .split("\n")
+            .map((l) => l.trim())
+            .filter((l) => l !== "");
+        const last = lines[lines.length - 1];
+        if (!last)
+            return null;
+        const row = JSON.parse(last);
+        if (typeof row.atMs !== "number" || !Number.isFinite(row.atMs))
+            return null;
+        if (row.result === "signed" || row.class === "same-org") {
+            return { class: "same-org", atMs: row.atMs };
+        }
+        if (row.result === "self-fallback" || row.class === "self") {
+            return { class: "self", atMs: row.atMs };
+        }
+        return null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { loadConfig, EX_CONFIG } from "./config.ts";
+export { listen } from "./server.ts";
+export { runDoctor, doctorExit } from "./doctor.ts";
+export { createBodyServices, TOOL_NAMES } from "./wiring.ts";

package/dist/index.js

@@ -0,0 +1,4 @@
+export { loadConfig, EX_CONFIG } from "./config.js";
+export { listen } from "./server.js";
+export { runDoctor, doctorExit } from "./doctor.js";
+export { createBodyServices, TOOL_NAMES } from "./wiring.js";

package/dist/inputs-read.d.ts

@@ -0,0 +1,12 @@
+export declare function matchingInputs(stateDir: string, decisions: {
+    claims: {
+        ref: string | null;
+        inputsHash: string | null;
+    };
+}[]): Promise<Record<string, unknown>>;
+export declare function inputsPrincipal(stateDir: string, ref: string): Promise<{
+    brain: string;
+    iss?: string;
+    tenant?: string;
+    org?: string;
+} | null>;

package/dist/inputs-read.js

@@ -0,0 +1,64 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { canonical } from "@cedulon/core";
+function sha256Canonical(value) {
+    return createHash("sha256").update(canonical(value), "utf8").digest("hex");
+}
+export async function matchingInputs(stateDir, decisions) {
+    let text;
+    try {
+        text = await readFile(join(stateDir, "inputs.jsonl"), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return {};
+        throw err;
+    }
+    const byRef = new Map();
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        const row = JSON.parse(line);
+        if (typeof row.ref === "string")
+            byRef.set(row.ref, row.inputs);
+    }
+    const out = {};
+    for (const d of decisions) {
+        const ref = d.claims.ref;
+        if (!ref || typeof d.claims.inputsHash !== "string")
+            continue;
+        const doc = byRef.get(ref);
+        if (doc !== undefined && sha256Canonical(doc) === d.claims.inputsHash) {
+            out[ref] = doc;
+        }
+    }
+    return out;
+}
+export async function inputsPrincipal(stateDir, ref) {
+    let text;
+    try {
+        text = await readFile(join(stateDir, "inputs.jsonl"), "utf8");
+    }
+    catch (err) {
+        if (err.code === "ENOENT")
+            return null;
+        throw err;
+    }
+    let found = null;
+    for (const line of text.split("\n")) {
+        if (line === "")
+            continue;
+        const row = JSON.parse(line);
+        if (row.ref === ref)
+            found = row.inputs?.principal ?? null;
+    }
+    if (!found || typeof found.brain !== "string")
+        return null;
+    return {
+        brain: found.brain,
+        ...(typeof found.iss === "string" ? { iss: found.iss } : {}),
+        ...(typeof found.tenant === "string" ? { tenant: found.tenant } : {}),
+        ...(typeof found.org === "string" ? { org: found.org } : {}),
+    };
+}

package/dist/inventory-file.d.ts

@@ -0,0 +1,18 @@
+import { type Inventory } from "@verax-ai/inventory";
+export type InventoryDoor = {
+    inventory: Inventory;
+} | {
+    inventory: null;
+    reason?: string;
+};
+export type InventoryHealth = {
+    source: string;
+    takenAtMs: number;
+    agents: number;
+};
+/**
+ * Read the declared roster. A missing path or missing file is absence.
+ * A broken document is still absence, with a reason; no half-filled model.
+ */
+export declare function readInventoryFile(path: string | null | undefined): InventoryDoor;
+export declare function inventoryHealth(door: InventoryDoor): InventoryHealth | null;

package/dist/inventory-file.js

@@ -0,0 +1,41 @@
+import { existsSync, readFileSync } from "node:fs";
+import { parseInventory } from "@verax-ai/inventory";
+/**
+ * Read the declared roster. A missing path or missing file is absence.
+ * A broken document is still absence, with a reason; no half-filled model.
+ */
+export function readInventoryFile(path) {
+    if (path === undefined || path === null || path.trim() === "") {
+        return { inventory: null };
+    }
+    if (!existsSync(path)) {
+        return { inventory: null };
+    }
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        return { inventory: null, reason: "unreadable" };
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        return { inventory: null, reason: "invalid-json" };
+    }
+    const parsed = parseInventory(raw);
+    if (!parsed.ok)
+        return { inventory: null, reason: parsed.reason };
+    return { inventory: parsed.value };
+}
+export function inventoryHealth(door) {
+    if (!door.inventory)
+        return null;
+    return {
+        source: door.inventory.source,
+        takenAtMs: door.inventory.takenAtMs,
+        agents: door.inventory.agents.length,
+    };
+}

package/dist/keys.d.ts

@@ -0,0 +1,12 @@
+export type KeyPair = {
+    privateKeyPem: string;
+    publicKeyPem: string;
+};
+export declare class KeysPartialError extends Error {
+    readonly code = 78;
+    constructor();
+}
+export declare function loadOrCreateSigners(stateDir: string): {
+    recordSigner: KeyPair;
+    effectSigner: KeyPair;
+};

package/dist/keys.js

@@ -0,0 +1,55 @@
+import { generateKeyPairSync } from "node:crypto";
+import { mkdirSync, readFileSync, renameSync, writeFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { EX_CONFIG } from "./config.js";
+export class KeysPartialError extends Error {
+    code = EX_CONFIG;
+    constructor() {
+        super("keys-partial");
+        this.name = "KeysPartialError";
+    }
+}
+function pair() {
+    const { publicKey, privateKey } = generateKeyPairSync("ed25519");
+    return {
+        publicKeyPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+        privateKeyPem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    };
+}
+function writePemAtomic(path, pem) {
+    const tmp = `${path}.tmp`;
+    writeFileSync(tmp, pem, { encoding: "utf8", mode: 0o600 });
+    renameSync(tmp, path);
+}
+export function loadOrCreateSigners(stateDir) {
+    const dir = join(stateDir, "keys");
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const recPriv = join(dir, "record.private.pem");
+    const recPub = join(dir, "record.public.pem");
+    const effPriv = join(dir, "effect.private.pem");
+    const effPub = join(dir, "effect.public.pem");
+    const paths = [recPriv, recPub, effPriv, effPub];
+    const present = paths.filter((p) => existsSync(p)).length;
+    if (present !== 0 && present !== 4) {
+        throw new KeysPartialError();
+    }
+    if (present === 0) {
+        const record = pair();
+        const effect = pair();
+        writePemAtomic(recPriv, record.privateKeyPem);
+        writePemAtomic(recPub, record.publicKeyPem);
+        writePemAtomic(effPriv, effect.privateKeyPem);
+        writePemAtomic(effPub, effect.publicKeyPem);
+        return { recordSigner: record, effectSigner: effect };
+    }
+    return {
+        recordSigner: {
+            privateKeyPem: readFileSync(recPriv, "utf8"),
+            publicKeyPem: readFileSync(recPub, "utf8"),
+        },
+        effectSigner: {
+            privateKeyPem: readFileSync(effPriv, "utf8"),
+            publicKeyPem: readFileSync(effPub, "utf8"),
+        },
+    };
+}

package/dist/main.d.ts

@@ -0,0 +1 @@
+export declare function main(env?: NodeJS.ProcessEnv, argv?: readonly string[]): Promise<void>;

package/dist/main.js

@@ -0,0 +1,34 @@
+import { EX_CONFIG, loadConfig, overlayInventoryArg } from "./config.js";
+import { KeysPartialError } from "./keys.js";
+import { listen } from "./server.js";
+export async function main(env = process.env, argv = process.argv) {
+    const overlaid = overlayInventoryArg(env, argv);
+    if ("error" in overlaid) {
+        process.stderr.write(`${overlaid.error}\n`);
+        process.exit(EX_CONFIG);
+    }
+    const loaded = loadConfig(overlaid);
+    if (!loaded.ok) {
+        process.stderr.write(`${loaded.reason}\n`);
+        process.exit(loaded.code);
+    }
+    try {
+        const server = await listen(loaded.value);
+        const shutdown = () => {
+            server.close(() => process.exit(0));
+        };
+        process.once("SIGINT", shutdown);
+        process.once("SIGTERM", shutdown);
+    }
+    catch (err) {
+        if (err instanceof KeysPartialError) {
+            process.stderr.write("keys-partial\n");
+            process.exit(err.code);
+        }
+        throw err;
+    }
+}
+const invoked = process.argv[1] && process.argv[1].replace(/\\/g, "/").endsWith("/main.ts");
+if (invoked) {
+    await main();
+}

package/dist/metrics.d.ts

@@ -0,0 +1,2 @@
+export declare function bumpMetric(stateDir: string, key: string): Promise<number>;
+export declare function bumpUnauthenticated(stateDir: string): Promise<number>;

package/dist/metrics.js

@@ -0,0 +1,23 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+export async function bumpMetric(stateDir, key) {
+    const path = join(stateDir, "metrics.json");
+    await mkdir(stateDir, { recursive: true, mode: 0o700 });
+    let raw = {};
+    try {
+        raw = JSON.parse(await readFile(path, "utf8"));
+    }
+    catch {
+        raw = {};
+    }
+    const count = Number(raw[key] ?? 0) + 1;
+    raw[key] = count;
+    await writeFile(path, `${JSON.stringify(raw)}\n`, {
+        encoding: "utf8",
+        mode: 0o600,
+    });
+    return count;
+}
+export async function bumpUnauthenticated(stateDir) {
+    return bumpMetric(stateDir, "unauthenticated_requests");
+}

package/dist/no-bypass-scan.d.ts

@@ -0,0 +1,10 @@
+export type BypassHit = {
+    file: string;
+    line: number;
+    why: string;
+    text: string;
+};
+export declare function scanNoBypass(base?: string, extra?: Array<{
+    file: string;
+    text: string;
+}>): BypassHit[];

package/dist/no-bypass-scan.js

@@ -0,0 +1,95 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+const pkgRoot = join(dirname(fileURLToPath(import.meta.url)), "..");
+function walk(dir, out = []) {
+    for (const name of readdirSync(dir)) {
+        const full = join(dir, name);
+        if (statSync(full).isDirectory()) {
+            walk(full, out);
+            continue;
+        }
+        if (name.endsWith(".ts") || name.endsWith(".js") || name.endsWith(".mjs")) {
+            out.push(full);
+        }
+    }
+    return out;
+}
+const IMPORT_TOOLS = /(?:from|import)\s+["'][^"']*tools\/[^"']+["']/;
+const DYNAMIC_IMPORT = /\bimport\s*(?:\/\*[\s\S]*?\*\/\s*|\/\/[^\n]*\n\s*)*\(/g;
+const NEW_FUNCTION = /new Function\s*\(/;
+const EVAL_CALL = /\beval\s*\(/;
+const VM = /\bvm\b/;
+const PROCESS_BINDING = /process\.binding/;
+const REQUIRE = /\brequire\s*\(/;
+const CREATE_REQUIRE = /\bcreateRequire\b/;
+const CONCAT_TOOLS = /["']\.\/to["']\s*\+\s*["']ols/;
+const CHILD = /\bchild_process\b/;
+const WORKER = /\bworker_threads\b/;
+function lineAt(text, index) {
+    return text.slice(0, index).split(/\n/).length;
+}
+export function scanNoBypass(base = pkgRoot, extra = []) {
+    const hits = [];
+    const files = [
+        ...walk(join(base, "src")).map((full) => ({
+            file: relative(base, full).replace(/\\/g, "/"),
+            text: readFileSync(full, "utf8"),
+        })),
+        ...(existsSync(join(base, "tests"))
+            ? walk(join(base, "tests")).map((full) => ({
+                file: relative(base, full).replace(/\\/g, "/"),
+                text: readFileSync(full, "utf8"),
+            }))
+            : []),
+        ...extra,
+    ];
+    for (const { file, text } of files) {
+        const rel = file.replace(/\\/g, "/");
+        if (rel === "src/no-bypass-scan.ts")
+            continue;
+        const wiring = rel === "src/wiring.ts";
+        // Desktop supervises issuer/body/panel. It is not a tool-call path.
+        const desktop = rel === "src/desktop.ts";
+        const originalLines = text.split(/\r?\n/);
+        for (const match of text.matchAll(DYNAMIC_IMPORT)) {
+            const index = match.index ?? 0;
+            const line = lineAt(text, index);
+            hits.push({
+                file,
+                line,
+                why: "dynamic-import",
+                text: (originalLines[line - 1] ?? "").trim(),
+            });
+        }
+        const lines = text.split(/\r?\n/);
+        for (let i = 0; i < lines.length; i += 1) {
+            const line = lines[i] ?? "";
+            const push = (why) => {
+                hits.push({ file, line: i + 1, why, text: (originalLines[i] ?? "").trim() });
+            };
+            if (IMPORT_TOOLS.test(line) && !wiring) {
+                push("static import of tools/");
+            }
+            if (NEW_FUNCTION.test(line))
+                push("new-function");
+            if (EVAL_CALL.test(line))
+                push("eval");
+            if (VM.test(line))
+                push("vm");
+            if (PROCESS_BINDING.test(line))
+                push("process.binding");
+            if (REQUIRE.test(line))
+                push("require(");
+            if (CREATE_REQUIRE.test(line))
+                push("createRequire");
+            if (CONCAT_TOOLS.test(line))
+                push("concatenated tools path");
+            if (CHILD.test(line) && !desktop)
+                push("child_process");
+            if (WORKER.test(line))
+                push("worker_threads");
+        }
+    }
+    return hits;
+}

package/dist/operator-cli.d.ts

@@ -0,0 +1 @@
+export declare function runOperator(argv: string[]): Promise<number>;

package/dist/operator-cli.js

@@ -0,0 +1,25 @@
+import { beginPairing } from "./operator-pairing.js";
+export async function runOperator(argv) {
+    if (argv[1] !== "enroll") {
+        process.stderr.write("verax operator enroll --state <dir>\n");
+        return 78;
+    }
+    let stateDir = "";
+    for (let i = 2; i < argv.length; i += 1) {
+        if (argv[i] === "--state") {
+            stateDir = argv[++i] ?? "";
+            continue;
+        }
+        if (argv[i]?.startsWith("-")) {
+            process.stderr.write(`flag-unknown:${argv[i]}\n`);
+            return 78;
+        }
+    }
+    if (!stateDir) {
+        process.stderr.write("verax operator enroll --state <dir>\n");
+        return 78;
+    }
+    const { code } = beginPairing(stateDir);
+    process.stdout.write(`${code}\n`);
+    return 0;
+}

package/dist/operator-credentials.d.ts

@@ -0,0 +1,23 @@
+export declare const CREDENTIALS_FILE = "operator-credentials.json";
+export declare const DEFAULT_OPERATOR_SUB = "operator-1";
+export type StoredCredential = {
+    id: string;
+    publicKey: string;
+    counter: number;
+    sub: string;
+};
+export type CredentialStore = {
+    credentials: StoredCredential[];
+};
+export declare function credentialsPath(stateDir: string): string;
+export declare function readCredentials(stateDir: string): StoredCredential[];
+/**
+ * The file is written only when an operator enrolls, so its presence is the
+ * answer. Asking whether it parses would read a truncated or mistyped file as
+ * "no operator" and reopen the passkey-less flow; the issuer stays closed
+ * instead, and a fresh enrollment replaces the file.
+ */
+export declare function hasRegisteredOperator(stateDir: string): boolean;
+export declare function findCredential(stateDir: string, id: string): StoredCredential | null;
+export declare function saveCredential(stateDir: string, credential: StoredCredential): void;
+export declare function updateCounter(stateDir: string, id: string, counter: number): boolean;

package/dist/operator-credentials.js

@@ -0,0 +1,56 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeFileAtomic } from "./atomic-write.js";
+export const CREDENTIALS_FILE = "operator-credentials.json";
+export const DEFAULT_OPERATOR_SUB = "operator-1";
+export function credentialsPath(stateDir) {
+    return join(stateDir, CREDENTIALS_FILE);
+}
+export function readCredentials(stateDir) {
+    const path = credentialsPath(stateDir);
+    if (!existsSync(path))
+        return [];
+    try {
+        const row = JSON.parse(readFileSync(path, "utf8"));
+        if (!Array.isArray(row.credentials))
+            return [];
+        return row.credentials.filter((c) => typeof c?.id === "string" &&
+            typeof c.publicKey === "string" &&
+            typeof c.counter === "number" &&
+            typeof c.sub === "string");
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The file is written only when an operator enrolls, so its presence is the
+ * answer. Asking whether it parses would read a truncated or mistyped file as
+ * "no operator" and reopen the passkey-less flow; the issuer stays closed
+ * instead, and a fresh enrollment replaces the file.
+ */
+export function hasRegisteredOperator(stateDir) {
+    return existsSync(credentialsPath(stateDir));
+}
+export function findCredential(stateDir, id) {
+    return readCredentials(stateDir).find((c) => c.id === id) ?? null;
+}
+export function saveCredential(stateDir, credential) {
+    const credentials = readCredentials(stateDir);
+    const next = credentials.filter((c) => c.id !== credential.id);
+    next.push(credential);
+    writeFileAtomic(credentialsPath(stateDir), `${JSON.stringify({ credentials: next })}\n`);
+}
+export function updateCounter(stateDir, id, counter) {
+    const credentials = readCredentials(stateDir);
+    const row = credentials.find((c) => c.id === id);
+    if (!row)
+        return false;
+    if (counter < row.counter)
+        return false;
+    if (counter === row.counter && counter > 0)
+        return false;
+    row.counter = counter;
+    writeFileAtomic(credentialsPath(stateDir), `${JSON.stringify({ credentials })}\n`);
+    return true;
+}

package/dist/operator-pairing.d.ts

@@ -0,0 +1,25 @@
+export declare const PAIRING_TTL_MS: number;
+export declare const PAIRING_MAX_ATTEMPTS = 5;
+export declare const PAIRING_FILE = "operator-pairing.json";
+export type PairingRecord = {
+    hash: string;
+    expiresAtMs: number;
+    attempts: number;
+};
+export type PairingCheck = {
+    ok: true;
+} | {
+    ok: false;
+    reason: "missing" | "expired" | "mismatch" | "burned";
+};
+export declare function pairingPath(stateDir: string): string;
+export declare function hashPairingCode(code: string): string;
+export declare function mintPairingCode(): string;
+export declare function writePairing(stateDir: string, record: PairingRecord): void;
+export declare function readPairing(stateDir: string): PairingRecord | null;
+export declare function beginPairing(stateDir: string, nowMs?: number): {
+    code: string;
+};
+export declare function checkPairing(stateDir: string, code: string, nowMs?: number): PairingCheck;
+/** A used pairing is spent so the same code cannot enroll twice. */
+export declare function consumePairing(stateDir: string): void;

package/dist/operator-pairing.js

@@ -0,0 +1,67 @@
+import { createHash, randomInt } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { writeFileAtomic } from "./atomic-write.js";
+export const PAIRING_TTL_MS = 5 * 60_000;
+export const PAIRING_MAX_ATTEMPTS = 5;
+export const PAIRING_FILE = "operator-pairing.json";
+export function pairingPath(stateDir) {
+    return join(stateDir, PAIRING_FILE);
+}
+export function hashPairingCode(code) {
+    return createHash("sha256").update(code, "utf8").digest("hex");
+}
+export function mintPairingCode() {
+    return String(randomInt(0, 100_000_000)).padStart(8, "0");
+}
+export function writePairing(stateDir, record) {
+    writeFileAtomic(pairingPath(stateDir), `${JSON.stringify(record)}\n`);
+}
+export function readPairing(stateDir) {
+    const path = pairingPath(stateDir);
+    if (!existsSync(path))
+        return null;
+    try {
+        const row = JSON.parse(readFileSync(path, "utf8"));
+        if (typeof row.hash !== "string" || typeof row.expiresAtMs !== "number" || typeof row.attempts !== "number") {
+            return null;
+        }
+        return { hash: row.hash, expiresAtMs: row.expiresAtMs, attempts: row.attempts };
+    }
+    catch {
+        return null;
+    }
+}
+export function beginPairing(stateDir, nowMs = Date.now()) {
+    const code = mintPairingCode();
+    writePairing(stateDir, {
+        hash: hashPairingCode(code),
+        expiresAtMs: nowMs + PAIRING_TTL_MS,
+        attempts: 0,
+    });
+    return { code };
+}
+export function checkPairing(stateDir, code, nowMs = Date.now()) {
+    const row = readPairing(stateDir);
+    if (!row)
+        return { ok: false, reason: "missing" };
+    if (row.attempts >= PAIRING_MAX_ATTEMPTS)
+        return { ok: false, reason: "burned" };
+    if (nowMs > row.expiresAtMs)
+        return { ok: false, reason: "expired" };
+    if (hashPairingCode(code) !== row.hash) {
+        writePairing(stateDir, { ...row, attempts: row.attempts + 1 });
+        const again = readPairing(stateDir);
+        if (again && again.attempts >= PAIRING_MAX_ATTEMPTS)
+            return { ok: false, reason: "burned" };
+        return { ok: false, reason: "mismatch" };
+    }
+    return { ok: true };
+}
+/** A used pairing is spent so the same code cannot enroll twice. */
+export function consumePairing(stateDir) {
+    const path = pairingPath(stateDir);
+    if (!existsSync(path))
+        return;
+    writeFileAtomic(path, `${JSON.stringify({ hash: "", expiresAtMs: 0, attempts: PAIRING_MAX_ATTEMPTS })}\n`);
+}