@yefengr/pi-reach 0.0.0-stage → 0.0.2

package/dist/pairing/crypto.d.ts

@@ -0,0 +1,15 @@
+export interface Ed25519Keypair {
+    publicKey: Uint8Array;
+    secretKey: Uint8Array;
+}
+export declare class Ed25519PublicKeyError extends Error {
+    constructor(field: string, message: string);
+}
+export declare function generateEd25519Keypair(): Ed25519Keypair;
+export declare function ed25519Sign(sk: Uint8Array, msg: Uint8Array): Uint8Array;
+export declare function ed25519Verify(pk: Uint8Array, msg: Uint8Array, sig: Uint8Array): boolean;
+/** Decodes standard or URL-safe canonical 32-byte Ed25519 public-key base64. */
+export declare function decodeEd25519PublicKey(raw: string, field?: string): Uint8Array;
+export declare function encodeEd25519PublicKey(bytes: Uint8Array, field?: string): string;
+export declare function canonicalizeEd25519PublicKey(raw: string, field?: string): string;
+export declare function publicKeyFingerprint(bytes: Uint8Array): string;

package/dist/pairing/crypto.js

@@ -0,0 +1,72 @@
+import { createHash, randomBytes } from "node:crypto";
+import * as ed from "@noble/ed25519";
+ed.hashes["sha512"] = (...msgs) => {
+    const h = createHash("sha512");
+    for (const msg of msgs)
+        h.update(msg);
+    return Uint8Array.from(h.digest());
+};
+const ED25519_PUBLIC_KEY_BYTES = 32;
+export class Ed25519PublicKeyError extends Error {
+    constructor(field, message) {
+        super(`${field}: ${message}`);
+        this.name = "Ed25519PublicKeyError";
+    }
+}
+export function generateEd25519Keypair() {
+    const secretKey = randomBytes(32);
+    return { secretKey, publicKey: Buffer.from(ed.getPublicKey(secretKey)) };
+}
+export function ed25519Sign(sk, msg) {
+    return Buffer.from(ed.sign(msg, sk));
+}
+export function ed25519Verify(pk, msg, sig) {
+    return ed.verify(sig, msg, pk);
+}
+/** Decodes standard or URL-safe canonical 32-byte Ed25519 public-key base64. */
+export function decodeEd25519PublicKey(raw, field = "public key") {
+    if (typeof raw !== "string" || raw.length === 0) {
+        throw new Ed25519PublicKeyError(field, "invalid base64 encoding");
+    }
+    const standard = /[+/]/.test(raw);
+    const urlSafe = /[-_]/.test(raw);
+    if (standard && urlSafe)
+        throw new Ed25519PublicKeyError(field, "mixed base64 alphabets");
+    const firstPadding = raw.indexOf("=");
+    const body = firstPadding === -1 ? raw : raw.slice(0, firstPadding);
+    const padding = firstPadding === -1 ? "" : raw.slice(firstPadding);
+    const bodyPattern = urlSafe ? /^[A-Za-z0-9_-]+$/ : /^[A-Za-z0-9+/]+$/;
+    if (!bodyPattern.test(body) || (padding !== "" && !/^={1,2}$/.test(padding))) {
+        throw new Ed25519PublicKeyError(field, "invalid base64 encoding");
+    }
+    const requiredPadding = (4 - (body.length % 4)) % 4;
+    if (requiredPadding === 3 || (padding.length > 0 && padding.length !== requiredPadding)) {
+        throw new Ed25519PublicKeyError(field, "invalid base64 padding");
+    }
+    const normalized = body.replaceAll("-", "+").replaceAll("_", "/");
+    const bytes = new Uint8Array(Buffer.from(normalized + "=".repeat(requiredPadding), "base64"));
+    if (bytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+        throw new Ed25519PublicKeyError(field, `wrong length (${bytes.length}, expected ${ED25519_PUBLIC_KEY_BYTES})`);
+    }
+    const canonicalPadded = Buffer.from(bytes).toString("base64");
+    const canonicalUnpadded = canonicalPadded.replace(/=+$/, "");
+    const normalizedInput = normalized + padding;
+    if (normalizedInput !== canonicalPadded && normalizedInput !== canonicalUnpadded) {
+        throw new Ed25519PublicKeyError(field, "non-canonical base64 trailing bits");
+    }
+    return bytes;
+}
+export function encodeEd25519PublicKey(bytes, field = "public key") {
+    if (!(bytes instanceof Uint8Array) || bytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+        const length = bytes instanceof Uint8Array ? bytes.length : 0;
+        throw new Ed25519PublicKeyError(field, `wrong length (${length}, expected ${ED25519_PUBLIC_KEY_BYTES})`);
+    }
+    return Buffer.from(bytes).toString("base64");
+}
+export function canonicalizeEd25519PublicKey(raw, field = "public key") {
+    return encodeEd25519PublicKey(decodeEd25519PublicKey(raw, field), field);
+}
+export function publicKeyFingerprint(bytes) {
+    return createHash("sha256").update(bytes).digest("hex").slice(0, 8);
+}
+//# sourceMappingURL=crypto.js.map

package/dist/pairing/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/pairing/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAEpC,EAAE,CAAC,MAAkC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAkB,EAAE,EAAE;IAC3E,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,IAAI;QAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AACrC,CAAC,CAAC;AAEF,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAOpC,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAa,EAAE,OAAe;QACxC,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,MAAM,UAAU,sBAAsB;IACpC,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAClC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAc,EAAE,GAAe;IACzD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,EAAc,EAAE,GAAe,EAAE,GAAe;IAC5E,OAAO,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;AACjC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAK,GAAG,YAAY;IACtE,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,IAAI,OAAO;QAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAE1F,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;IACpE,MAAM,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACtE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,eAAe,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,eAAe,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC9F,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,KAAK,CAAC,MAAM,cAAc,wBAAwB,GAAG,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,UAAU,GAAG,OAAO,CAAC;IAC7C,IAAI,eAAe,KAAK,eAAe,IAAI,eAAe,KAAK,iBAAiB,EAAE,CAAC;QACjF,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAiB,EAAE,KAAK,GAAG,YAAY;IAC5E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QAChF,MAAM,MAAM,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,qBAAqB,CAAC,KAAK,EAAE,iBAAiB,MAAM,cAAc,wBAAwB,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,GAAW,EAAE,KAAK,GAAG,YAAY;IAC5E,OAAO,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC"}

package/dist/pairing/identity-keyring.d.ts

@@ -0,0 +1,22 @@
+import { IDENTITY_LOCK_RELEASE_AFTER, type IdentityLockDeferredRelease } from "./identity-lock.js";
+export interface KeyStoreBackend {
+    read(service: string, account: string): Promise<string | undefined>;
+    write(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}
+export declare class KeyringReadTimeoutError extends Error {
+    constructor(op: string, timeoutMs: number);
+}
+export declare class KeyringMutationTimeoutError extends Error implements IdentityLockDeferredRelease {
+    readonly [IDENTITY_LOCK_RELEASE_AFTER]: Promise<void>;
+    constructor(op: string, timeoutMs: number, settled: Promise<void>);
+}
+export declare function _setKeyringOperationTimeoutForTest(timeoutMs: number | null): void;
+export declare function _runKeyringOperationWithTimeoutForTest<T>(operation: Promise<T>, op: string, mutating: boolean, timeoutMs: number): Promise<T>;
+export declare function nativeBindingUnavailable(): boolean;
+export declare function _setNativeBindingErrorForTest(error: unknown): void;
+export declare class NapiKeyringBackend implements KeyStoreBackend {
+    read(service: string, account: string): Promise<string | undefined>;
+    write(service: string, account: string, value: string): Promise<void>;
+    delete(service: string, account: string): Promise<boolean>;
+}

package/dist/pairing/identity-keyring.js

@@ -0,0 +1,94 @@
+import { IDENTITY_LOCK_RELEASE_AFTER, } from "./identity-lock.js";
+export class KeyringReadTimeoutError extends Error {
+    constructor(op, timeoutMs) {
+        super(`keyring ${op} timed out after ${timeoutMs}ms`);
+        this.name = "KeyringReadTimeoutError";
+    }
+}
+export class KeyringMutationTimeoutError extends Error {
+    [IDENTITY_LOCK_RELEASE_AFTER];
+    constructor(op, timeoutMs, settled) {
+        super(`keyring ${op} timed out after ${timeoutMs}ms; the underlying operation is still pending`);
+        this.name = "KeyringMutationTimeoutError";
+        this[IDENTITY_LOCK_RELEASE_AFTER] = settled.then(() => undefined, () => undefined);
+    }
+}
+let keyringOperationTimeoutMs = 3_000;
+export function _setKeyringOperationTimeoutForTest(timeoutMs) {
+    keyringOperationTimeoutMs = timeoutMs ?? 3_000;
+}
+export function _runKeyringOperationWithTimeoutForTest(operation, op, mutating, timeoutMs) {
+    return withKeyringTimeout(operation, op, mutating, timeoutMs);
+}
+function withKeyringTimeout(operation, op, mutating, timeoutMs = keyringOperationTimeoutMs) {
+    const settled = operation.then(() => undefined, () => undefined);
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(mutating
+                ? new KeyringMutationTimeoutError(op, timeoutMs, settled)
+                : new KeyringReadTimeoutError(op, timeoutMs));
+        }, timeoutMs);
+        operation.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (error) => {
+            clearTimeout(timer);
+            reject(error);
+        });
+    });
+}
+let asyncEntryCtor = null;
+let nativeBindingError = null;
+async function loadAsyncEntry() {
+    if (asyncEntryCtor)
+        return asyncEntryCtor;
+    if (nativeBindingError)
+        throw nativeBindingError;
+    try {
+        const mod = await import("@napi-rs/keyring");
+        asyncEntryCtor = mod.AsyncEntry;
+        return asyncEntryCtor;
+    }
+    catch (error) {
+        nativeBindingError = error;
+        throw error;
+    }
+}
+export function nativeBindingUnavailable() {
+    return nativeBindingError !== null;
+}
+export function _setNativeBindingErrorForTest(error) {
+    asyncEntryCtor = null;
+    nativeBindingError = error;
+}
+export class NapiKeyringBackend {
+    async read(service, account) {
+        const AsyncEntry = await loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        return withKeyringTimeout(entry.getPassword(), `read(${service})`, false);
+    }
+    async write(service, account, value) {
+        const AsyncEntry = await loadAsyncEntry();
+        const entry = new AsyncEntry(service, account);
+        await withKeyringTimeout(entry.setPassword(value), `write(${service})`, true);
+    }
+    async delete(service, account) {
+        let entry;
+        try {
+            const AsyncEntry = await loadAsyncEntry();
+            entry = new AsyncEntry(service, account);
+        }
+        catch {
+            return false;
+        }
+        try {
+            return await withKeyringTimeout(entry.deleteCredential(), `delete(${service})`, true);
+        }
+        catch (error) {
+            if (error instanceof KeyringMutationTimeoutError)
+                throw error;
+            return false;
+        }
+    }
+}
+//# sourceMappingURL=identity-keyring.js.map

package/dist/pairing/identity-keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-keyring.js","sourceRoot":"","sources":["../../src/pairing/identity-keyring.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,2BAA2B,GAE5B,MAAM,oBAAoB,CAAC;AAQ5B,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IAChD,YAAY,EAAU,EAAE,SAAiB;QACvC,KAAK,CAAC,WAAW,EAAE,oBAAoB,SAAS,IAAI,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IAC3C,CAAC,2BAA2B,CAAC,CAAgB;IAEtD,YAAY,EAAU,EAAE,SAAiB,EAAE,OAAsB;QAC/D,KAAK,CAAC,WAAW,EAAE,oBAAoB,SAAS,+CAA+C,CAAC,CAAC;QACjG,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;QAC1C,IAAI,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,IAAI,CAC9C,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IACJ,CAAC;CACF;AAED,IAAI,yBAAyB,GAAG,KAAK,CAAC;AAEtC,MAAM,UAAU,kCAAkC,CAAC,SAAwB;IACzE,yBAAyB,GAAG,SAAS,IAAI,KAAK,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,SAAqB,EACrB,EAAU,EACV,QAAiB,EACjB,SAAiB;IAEjB,OAAO,kBAAkB,CAAC,SAAS,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,SAAqB,EACrB,EAAU,EACV,QAAiB,EACjB,YAAoB,yBAAyB;IAE7C,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAC5B,GAAG,EAAE,CAAC,SAAS,EACf,GAAG,EAAE,CAAC,SAAS,CAChB,CAAC;IAEF,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,IAAI,2BAA2B,CAAC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC;gBACzD,CAAC,CAAC,IAAI,uBAAuB,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC;QAClD,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,SAAS,CAAC,IAAI,CACZ,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,IAAI,cAAc,GAAwD,IAAI,CAAC;AAC/E,IAAI,kBAAkB,GAAY,IAAI,CAAC;AAEvC,KAAK,UAAU,cAAc;IAC3B,IAAI,cAAc;QAAE,OAAO,cAAc,CAAC;IAC1C,IAAI,kBAAkB;QAAE,MAAM,kBAAkB,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,cAAc,GAAG,GAAG,CAAC,UAAU,CAAC;QAChC,OAAO,cAAc,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,kBAAkB,GAAG,KAAK,CAAC;QAC3B,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,kBAAkB,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAc;IAC1D,cAAc,GAAG,IAAI,CAAC;IACtB,kBAAkB,GAAG,KAAK,CAAC;AAC7B,CAAC;AAED,MAAM,OAAO,kBAAkB;IAC7B,KAAK,CAAC,IAAI,CAAC,OAAe,EAAE,OAAe;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,QAAQ,OAAO,GAAG,EAAE,KAAK,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAe,EAAE,OAAe,EAAE,KAAa;QACzD,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC/C,MAAM,kBAAkB,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,SAAS,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAe,EAAE,OAAe;QAC3C,IAAI,KAAiE,CAAC;QACtE,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;YAC1C,KAAK,GAAG,IAAI,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,KAAK,CAAC,gBAAgB,EAAE,EAAE,UAAU,OAAO,GAAG,EAAE,IAAI,CAAC,CAAC;QACxF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,2BAA2B;gBAAE,MAAM,KAAK,CAAC;YAC9D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF"}

package/dist/pairing/identity-lock.d.ts

@@ -0,0 +1,14 @@
+export declare const IDENTITY_LOCK_RELEASE_AFTER: unique symbol;
+export interface IdentityLockDeferredRelease {
+    readonly [IDENTITY_LOCK_RELEASE_AFTER]: Promise<void>;
+}
+export interface IdentityLockOptions {
+    readonly waitTimeoutMs?: number;
+    readonly pollIntervalMs?: number;
+}
+export declare class IdentityLockTimeoutError extends Error {
+    readonly lockPath: string;
+    constructor(lockPath: string, waitTimeoutMs: number);
+}
+export declare function ensurePrivateIdentityDirectory(directory: string): Promise<void>;
+export declare function withIdentityLock<T>(directory: string, operation: () => Promise<T>, options?: IdentityLockOptions): Promise<T>;

package/dist/pairing/identity-lock.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { chmod, mkdir, open, readFile, unlink } from "node:fs/promises";
+import { join } from "node:path";
+export const IDENTITY_LOCK_RELEASE_AFTER = Symbol("identity-lock-release-after");
+export class IdentityLockTimeoutError extends Error {
+    lockPath;
+    constructor(lockPath, waitTimeoutMs) {
+        super(`Identity initialization lock remained held for ${waitTimeoutMs}ms at ${lockPath}. ` +
+            "Another process may still be initializing the identity, or a previous process may " +
+            "have exited unexpectedly. The lock is never removed automatically. Confirm that no " +
+            "identity initialization or keyring operation is still running before removing it manually.");
+        this.name = "IdentityLockTimeoutError";
+        this.lockPath = lockPath;
+    }
+}
+function isNodeErrorWithCode(error, code) {
+    return typeof error === "object" && error !== null && "code" in error &&
+        error.code === code;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+export async function ensurePrivateIdentityDirectory(directory) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    await chmod(directory, 0o700);
+}
+async function tryAcquire(lockPath) {
+    let handle;
+    try {
+        handle = await open(lockPath, "wx", 0o600);
+    }
+    catch (error) {
+        if (isNodeErrorWithCode(error, "EEXIST"))
+            return null;
+        throw error;
+    }
+    const token = randomUUID();
+    try {
+        await handle.writeFile(JSON.stringify({ pid: process.pid, token, createdAt: new Date().toISOString() }));
+        await handle.sync();
+        return { handle, path: lockPath, token };
+    }
+    catch (error) {
+        await handle.close().catch(() => undefined);
+        await unlink(lockPath).catch(() => undefined);
+        throw error;
+    }
+}
+async function acquireIdentityLock(directory, options) {
+    await ensurePrivateIdentityDirectory(directory);
+    const lockPath = join(directory, "identity.lock");
+    const waitTimeoutMs = options.waitTimeoutMs ?? 15_000;
+    const pollIntervalMs = Math.max(1, options.pollIntervalMs ?? 50);
+    const deadline = Date.now() + Math.max(0, waitTimeoutMs);
+    while (true) {
+        const held = await tryAcquire(lockPath);
+        if (held)
+            return held;
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0)
+            throw new IdentityLockTimeoutError(lockPath, waitTimeoutMs);
+        await sleep(Math.min(pollIntervalMs, remainingMs));
+    }
+}
+async function releaseIdentityLock(lock) {
+    try {
+        let raw;
+        try {
+            raw = await readFile(lock.path, "utf8");
+        }
+        catch (error) {
+            if (isNodeErrorWithCode(error, "ENOENT"))
+                return;
+            throw error;
+        }
+        let token;
+        try {
+            token = JSON.parse(raw).token;
+        }
+        catch {
+            return;
+        }
+        if (token !== lock.token)
+            return;
+        await unlink(lock.path);
+    }
+    finally {
+        await lock.handle.close();
+    }
+}
+function deferredRelease(error) {
+    if (typeof error !== "object" || error === null)
+        return null;
+    const settled = error[IDENTITY_LOCK_RELEASE_AFTER];
+    return settled instanceof Promise ? settled : null;
+}
+export async function withIdentityLock(directory, operation, options = {}) {
+    const lock = await acquireIdentityLock(directory, options);
+    let releaseWasDeferred = false;
+    try {
+        return await operation();
+    }
+    catch (error) {
+        const settled = deferredRelease(error);
+        if (settled) {
+            releaseWasDeferred = true;
+            void settled.then(() => releaseIdentityLock(lock), () => releaseIdentityLock(lock)).catch(() => undefined);
+        }
+        throw error;
+    }
+    finally {
+        if (!releaseWasDeferred)
+            await releaseIdentityLock(lock);
+    }
+}
+//# sourceMappingURL=identity-lock.js.map

package/dist/pairing/identity-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-lock.js","sourceRoot":"","sources":["../../src/pairing/identity-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAmB,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC,6BAA6B,CAAC,CAAC;AAWjF,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,QAAQ,CAAS;IAE1B,YAAY,QAAgB,EAAE,aAAqB;QACjD,KAAK,CACH,kDAAkD,aAAa,SAAS,QAAQ,IAAI;YACpF,oFAAoF;YACpF,qFAAqF;YACrF,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;CACF;AAQD,SAAS,mBAAmB,CAAC,KAAc,EAAE,IAAY;IACvD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK;QAClE,KAA4B,CAAC,IAAI,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,SAAiB;IACpE,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACzD,MAAM,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAgB;IACxC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC;QACzG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,OAA4B;IAE5B,MAAM,8BAA8B,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAEzD,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,WAAW,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,IAAI,WAAW,IAAI,CAAC;YAAE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QAClF,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IACvD,IAAI,CAAC;QACH,IAAI,GAAW,CAAC;QAChB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,mBAAmB,CAAC,KAAK,EAAE,QAAQ,CAAC;gBAAE,OAAO;YACjD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,IAAI,KAAc,CAAC;QACnB,IAAI,CAAC;YACH,KAAK,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC,KAAK,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK;YAAE,OAAO;QACjC,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,OAAO,GAAI,KAA8C,CAAC,2BAA2B,CAAC,CAAC;IAC7F,OAAO,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAiB,EACjB,SAA2B,EAC3B,UAA+B,EAAE;IAEjC,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,kBAAkB,GAAG,KAAK,CAAC;IAC/B,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,OAAO,EAAE,CAAC;YACZ,kBAAkB,GAAG,IAAI,CAAC;YAC1B,KAAK,OAAO,CAAC,IAAI,CACf,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,EAC/B,GAAG,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAChC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,IAAI,CAAC,kBAAkB;YAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}

package/dist/pairing/owner_storage.d.ts

@@ -0,0 +1,61 @@
+export interface PeerRecord {
+    name: string;
+    remote_epk: string;
+    paired_at: string;
+}
+export declare function listPeers(): Promise<PeerRecord[]>;
+declare const _ownerStorageTokenBrand: unique symbol;
+/** Opaque, process-local provenance for one canonical Owner storage slot. */
+export type OwnerStorageToken = {
+    readonly [_ownerStorageTokenBrand]: true;
+};
+export interface OwnerStorageSnapshotRecord {
+    readonly rawOwnerPubkey: unknown;
+    readonly token: OwnerStorageToken;
+}
+export type ConditionalPeerRemoval = {
+    readonly outcome: "removed";
+    readonly nextToken: OwnerStorageToken;
+} | {
+    readonly outcome: "stale" | "not_found" | "no_authority";
+};
+/** Provenance and pre-write state for one successful addPeer mutation. */
+export interface PeerWriteReceipt {
+    readonly record: PeerRecord;
+    readonly token: OwnerStorageToken;
+    /** The raw record replaced by this write, when addPeer overwrote one. */
+    readonly previousRecord?: unknown;
+}
+export type ConditionalPeerRollback = {
+    readonly outcome: "removed" | "restored";
+    readonly nextToken: OwnerStorageToken;
+} | {
+    readonly outcome: "stale" | "not_found" | "no_authority";
+};
+export declare function addPeer(record: PeerRecord): Promise<PeerWriteReceipt>;
+/**
+ * Returns the set of distinct `remote_epk` values in peers.json.
+ *
+ * Each `remote_epk` is the paired Owner's Ed25519 public key and represents a
+ * machine-scoped authorization entry.
+ */
+export declare function listOwnerPubkeys(): Promise<unknown[]>;
+/**
+ * Atomically snapshots raw Owner handles and their canonical-slot provenance.
+ * The token is process-local and opaque to callers.
+ */
+export declare function snapshotOwnerPubkeys(): Promise<readonly OwnerStorageSnapshotRecord[]>;
+/**
+ * Removes one exact raw handle only when its snapshot provenance still owns
+ * the target canonical Owner slot. The final authority/token checks and sync
+ * write share the existing serialized mutation lane.
+ */
+export declare function conditionalRemovePeer(remoteEpk: string, expectedToken: OwnerStorageToken, canCommit?: () => boolean): Promise<ConditionalPeerRemoval>;
+/**
+ * Compensates a specific addPeer write only while that write still owns its
+ * canonical Owner slot. The receipt's raw written record must still be
+ * present, so an out-of-band replacement cannot be removed or overwritten.
+ */
+export declare function conditionalRollbackPeer(receipt: PeerWriteReceipt, canCommit?: () => boolean): Promise<ConditionalPeerRollback>;
+export declare function removePeer(remoteEpk: string, canCommit?: () => boolean): Promise<boolean>;
+export {};