joinhive 2.0.0

package/bin/hive-claim-invite.mjs

@@ -0,0 +1,88 @@
+#!/usr/bin/env node
+// hive-claim-invite — redeem a Buzz community invite with THIS endpoint's key.
+//
+// The invite CODE is minted by a community owner/admin (in the Buzz desktop
+// app). Claiming is NIP-98-signed by the joining key and is exempt from the
+// membership gate by design — so this script only ever uses OUR own agent key.
+// It never touches anyone else's key.
+//
+// Usage:
+//   hive claim-invite <code|invite-url> [--age-confirmed]
+// The code looks like "v2.xxxxx"; a full https://<host>/invite/v2.xxxxx URL
+// is also accepted (the code is parsed out).
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { createHash } from 'node:crypto';
+import { finalizeEvent } from 'nostr-tools/pure';
+
+const sha256hex = (bytes) => createHash('sha256').update(bytes).digest('hex');
+
+const HIVE_HOME = process.env.HIVE_HOME || join(homedir(), '.hive');
+const identity = JSON.parse(readFileSync(join(HIVE_HOME, 'identity.json'), 'utf8'));
+const cfg = (() => { try { return JSON.parse(readFileSync(join(HIVE_HOME, 'config.json'), 'utf8')); } catch { return {}; } })();
+const RELAY = (process.env.BUZZ_RELAY_URL || cfg.relay || 'http://localhost:3000').replace(/\/$/, '');
+
+const args = process.argv.slice(2);
+const ageConfirmed = args.includes('--age-confirmed');
+let raw = args.find((a) => !a.startsWith('--'));
+if (!raw) { console.error(JSON.stringify({ error: 'usage: hive claim-invite <code|url> [--age-confirmed]' })); process.exit(1); }
+// Accept a full invite URL or a bare code.
+const code = raw.includes('/invite/') ? raw.split('/invite/')[1].trim() : raw.trim();
+
+const sk = Uint8Array.from(Buffer.from(identity.privkey, 'hex'));
+
+// Build a NIP-98 Authorization header for one request.
+const nip98 = (method, url, bodyBytes) => {
+  const tags = [
+    ['u', url],
+    ['method', method],
+    ['nonce', globalThis.crypto.randomUUID()],
+  ];
+  if (bodyBytes && bodyBytes.length) tags.push(['payload', sha256hex(bodyBytes)]);
+  const evt = finalizeEvent({ kind: 27235, created_at: Math.floor(Date.now() / 1000), tags, content: '' }, sk);
+  return 'Nostr ' + Buffer.from(JSON.stringify(evt)).toString('base64');
+};
+
+const post = async (path, obj) => {
+  const url = `${RELAY}${path}`;
+  const body = Buffer.from(JSON.stringify(obj));
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', authorization: nip98('POST', url, body) },
+    body,
+  });
+  const text = await res.text();
+  let json; try { json = JSON.parse(text); } catch { json = { raw: text }; }
+  return { status: res.status, json };
+};
+
+const main = async () => {
+  // 1) Join policy (terms/age). If present, we must post an acceptance receipt.
+  const polRes = await fetch(`${RELAY}/api/join-policy`);
+  const policy = (await polRes.json()).policy;
+
+  let policy_receipt;
+  if (policy) {
+    if (policy.age_attestation_required && !ageConfirmed) {
+      console.error(JSON.stringify({
+        error: 'age_attestation_required',
+        message: 'This community requires an age attestation. Re-run with --age-confirmed only if you truly meet the age requirement in the terms.',
+        version: policy.version,
+      }));
+      process.exit(2);
+    }
+    const acc = await post('/api/invites/accept-policy', {
+      code, policy_version: policy.version, age_confirmed: ageConfirmed,
+    });
+    if (acc.status !== 200) { console.error(JSON.stringify({ step: 'accept-policy', ...acc })); process.exit(1); }
+    policy_receipt = acc.json.receipt || acc.json.policy_receipt || acc.json.token;
+  }
+
+  // 2) Claim.
+  const claim = await post('/api/invites/claim', policy_receipt ? { code, policy_receipt } : { code });
+  if (claim.status !== 200) { console.error(JSON.stringify({ step: 'claim', ...claim })); process.exit(1); }
+  console.log(JSON.stringify({ joined: true, relay: RELAY, pubkey: identity.pubkey, ...claim.json }));
+};
+
+main().catch((e) => { console.error(JSON.stringify({ error: String(e && e.message || e) })); process.exit(1); });

package/bin/hive-join.mjs

@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+// hive-join — full member onboarding, from community link to live bee.
+//
+//   hive join --invite <code> --server https://api.<domain> [--export chat.zip] [--name sid]
+//
+// What happens where (the privacy contract):
+//   LAPTOP: identity keys, the shared wallet mnemonic (Apple Keychain), your
+//           LLM API key (login Keychain, for the sync watcher), and the
+//           profile distillation — RAW CHAT HISTORY NEVER LEAVES.
+//   UPLOADED: the distilled profile + a nacl.box-sealed {wallet_mnemonic,
+//           llm_api_key} that only the bee-host can open (your bee needs the
+//           key to think and the wallet to transact 24/7 — your decision #9).
+// Every step is idempotent: re-running resumes wherever it stopped.
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { homedir, platform, userInfo } from 'node:os';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline/promises';
+import nacl from 'tweetnacl';
+import { finalizeEvent } from 'nostr-tools/pure';
+import { signedFetch } from '../shared/nip98.mjs';
+import { computeAuthTag } from '../shared/nip-oa.mjs';
+import { createEngine } from '../daemon/engines/index.mjs';
+import { OPENAI_COMPAT_BASES, MODEL_TIERS } from '../shared/config-schema.mjs';
+
+const PACK_DIR = dirname(dirname(fileURLToPath(import.meta.url)));
+const HIVE_HOME = process.env.HIVE_HOME || join(homedir(), '.hive');
+const args = process.argv.slice(2);
+const flag = (n) => { const i = args.indexOf(`--${n}`); return i >= 0 ? args[i + 1] : null; };
+const say = (...a) => console.log('🐝', ...a);
+const die = (msg) => { console.error('❌', msg); process.exit(1); };
+const loadJson = (p, fb) => { try { return JSON.parse(readFileSync(p, 'utf8')); } catch { return fb; } };
+const node = (script, argv = [], opts = {}) => {
+  const r = spawnSync(process.execPath, [join(PACK_DIR, script), ...argv], { encoding: 'utf8', env: { ...process.env, HIVE_HOME }, ...opts });
+  return { code: r.status, out: (r.stdout || '') + (r.status !== 0 ? (r.stderr || '') : '') };
+};
+
+const INVITE = flag('invite');
+const SERVER = (flag('server') || '').replace(/\/+$/, '');
+if (!INVITE || !SERVER) die('usage: hive join --invite <code> --server https://api.<domain> [--export <claude-export.zip>] [--name <you>]');
+
+const rl = createInterface({ input: process.stdin, output: process.stdout });
+
+const main = async () => {
+  // 0. Server hello: provisioning box key + the community's relay URL.
+  say(`checking in with ${SERVER} …`);
+  let hello;
+  try { hello = await (await fetch(`${SERVER}/api/provision-key`, { signal: AbortSignal.timeout(8000) })).json(); }
+  catch { die(`can't reach ${SERVER} — check the URL from your invite link`); }
+  if (!hello.box_pub || !hello.relay) die('server did not return a provisioning key');
+  const RELAY = hello.relay;
+
+  // 1. Identity (idempotent).
+  const kg = node('bin/hive-keygen.mjs');
+  if (kg.code !== 0) die(`keygen failed: ${kg.out.slice(0, 200)}`);
+  const identity = loadJson(join(HIVE_HOME, 'identity.json'), null) || die('identity missing after keygen');
+  say(`your key: ${identity.pubkey.slice(0, 12)}…`);
+
+  // 2. Join the community relay (config + invite claim).
+  const cfgPath = join(HIVE_HOME, 'config.json');
+  const cfg = loadJson(cfgPath, {});
+  cfg.relay = RELAY;
+  writeFileSync(cfgPath, JSON.stringify(cfg, null, 2) + '\n');
+  const claim = node('bin/hive-claim-invite.mjs', [INVITE], { env: { ...process.env, HIVE_HOME, BUZZ_RELAY_URL: RELAY } });
+  const claimJson = (() => { try { return JSON.parse(claim.out.trim().split('\n').pop()); } catch { return {}; } })();
+  if (claim.code !== 0 && !/already/.test(JSON.stringify(claimJson))) {
+    if (claimJson.error === 'age_attestation_required') die('this community requires an age attestation — re-run with the CLI flag --age-confirmed via: hive claim-invite');
+    // Open relay (dev/local) has no membership gate: if reads work without a
+    // claim, continue. On a closed relay the probe 403s and this is fatal.
+    const { signedFetch: probeFetch } = await import('../shared/nip98.mjs');
+    const probe = await probeFetch(identity.privkey, 'POST', `${RELAY.replace(/^ws/, 'http')}/query`, [{ kinds: [39000], limit: 1 }]);
+    if (probe.status !== 200) die(`relay invite claim failed: ${claim.out.slice(0, 300)}`);
+    say('relay has no membership gate (open/dev) — continuing without a claim');
+  }
+  say(`joined relay ${RELAY}`);
+
+  // 3. Shared wallet — mnemonic into the Apple Keychain, shown ONCE.
+  const w = node('bin/hive-wallet.mjs');
+  if (w.code !== 0) die(`wallet failed: ${w.out.slice(0, 200)}`);
+  const wallet = JSON.parse(w.out.trim().split('\n').pop());
+  say(`shared wallet: ${wallet.evm_address}`);
+  if (wallet.status === 'created') {
+    const exp = node('bin/hive-wallet.mjs', ['export']);
+    try {
+      const mn = JSON.parse(exp.out).mnemonic;
+      say('———— WRITE THIS DOWN (recovery phrase — shown once, stored in your Apple Keychain) ————');
+      console.log(`    ${mn}`);
+      say('————————————————————————————————————————————————————————————————————————');
+    } catch {}
+  }
+
+  // 4. Your LLM provider + API key (your bee thinks with YOUR key).
+  const name = (flag('name') || cfg.owner_name || userInfo().username || 'member').toLowerCase().replace(/[^a-z0-9-]/g, '').slice(0, 24);
+  let provider = flag('provider') || (['anthropic', 'openai', 'openrouter', 'hermes'].includes(cfg.provider) ? cfg.provider : null);
+  if (!provider) {
+    provider = (await rl.question('LLM provider for your bee [anthropic/openai/openrouter/hermes] (default anthropic): ')).trim().toLowerCase() || 'anthropic';
+  }
+  if (!['anthropic', 'openai', 'openrouter', 'hermes', 'echo'].includes(provider)) die(`unknown provider "${provider}"`);
+  let llmKey = process.env.HIVE_LLM_KEY || null;
+  let models = { extract: flag('model-extract'), compute: flag('model-compute') };
+  if (provider === 'echo') {
+    llmKey = 'echo'; // test seam: no key, no thinking, no spend — rehearsals/CI
+  } else {
+    if (!llmKey && platform() === 'darwin') {
+      try { llmKey = execFileSync('security', ['find-generic-password', '-a', provider, '-s', 'hive-llm-key', '-w'], { stdio: ['ignore', 'pipe', 'ignore'] }).toString().trim(); say(`using the ${provider} key already in your Keychain`); } catch {}
+    }
+    if (!llmKey) llmKey = (await rl.question(`${provider} API key (stored in your login Keychain, uploaded sealed for your bee): `)).trim();
+    if (!llmKey) die('an API key is required — your bee cannot think without one');
+    if ((provider === 'openrouter' || provider === 'hermes') && (!models.extract || !models.compute)) {
+      models.extract = models.extract || (await rl.question(`${provider} model id for cheap extraction: `)).trim();
+      models.compute = models.compute || (await rl.question(`${provider} model id for strong compute: `)).trim();
+    }
+    say('validating the key with a 1-token self-test …');
+    const tiers = MODEL_TIERS[provider] || {};
+    const engine = createEngine({ provider, base_url: OPENAI_COMPAT_BASES[provider], model_extract: models.extract || tiers.extract, model_compute: models.compute || tiers.compute }, { llm_api_key: llmKey }, {});
+    const probe = await engine.selftest();
+    if (String(probe).startsWith('engine-error')) die(`key check failed: ${probe.slice(0, 200)}`);
+    say('key works ✓');
+    if (platform() === 'darwin') {
+      try { execFileSync('security', ['add-generic-password', '-U', '-a', provider, '-s', 'hive-llm-key', '-l', `Hive LLM key (${provider})`, '-w', llmKey], { stdio: 'ignore' }); } catch {}
+    }
+  }
+
+  // 5. Distill the private profile LOCALLY (the only data that gets uploaded).
+  //    An existing profile is PRESERVED (migrations, re-joins) — pass
+  //    --redistill to rebuild it from scratch.
+  mkdirSync(join(HIVE_HOME, 'data-store'), { recursive: true });
+  const profilePath = join(HIVE_HOME, 'data-store', 'profile.md');
+  if (existsSync(profilePath) && readFileSync(profilePath, 'utf8').trim().length > 50 && !args.includes('--redistill')) {
+    say('using your existing profile (pass --redistill to rebuild it)');
+  } else {
+    say('distilling your profile from local chat history (raw chats never leave this machine) …');
+    const distillArgs = ['--provider', provider, '--key', llmKey, '--out', profilePath];
+    if (flag('export')) distillArgs.push('--export', flag('export'));
+    if (models.extract) distillArgs.push('--model', models.extract);
+    const d = node('watcher/distill.mjs', distillArgs);
+    if (d.code !== 0 || !existsSync(profilePath)) die(`distillation failed: ${d.out.slice(0, 300)}`);
+  }
+  const profile = readFileSync(profilePath, 'utf8');
+  say(`profile ready (${profile.length} chars) — review anytime: ~/.hive/data-store/profile.md`);
+
+  // 6. Seal {mnemonic, llm key} to the server's box key and provision the bee.
+  const mnemonic = (() => {
+    try { return JSON.parse(node('bin/hive-wallet.mjs', ['export']).out).mnemonic; } catch { return null; }
+  })();
+  if (!mnemonic) die('could not read the wallet mnemonic back from the Keychain');
+  const client = nacl.box.keyPair();
+  const nonce = nacl.randomBytes(24);
+  const box = nacl.box(
+    Buffer.from(JSON.stringify({ wallet_mnemonic: mnemonic, llm_api_key: llmKey })),
+    nonce, Buffer.from(hello.box_pub, 'base64'), client.secretKey,
+  );
+  say(`provisioning ${name}.bee on the community server …`);
+  const body = {
+    invite: INVITE, name, owner_pubkey: identity.pubkey, owner_name: name,
+    evm_address: wallet.evm_address, provider,
+    ...(OPENAI_COMPAT_BASES[provider] ? { base_url: OPENAI_COMPAT_BASES[provider] } : {}),
+    ...(models.extract ? { model_extract: models.extract } : {}),
+    ...(models.compute ? { model_compute: models.compute } : {}),
+    sealed: { nonce: Buffer.from(nonce).toString('base64'), box: Buffer.from(box).toString('base64'), client_pub: Buffer.from(client.publicKey).toString('base64') },
+    profile_md: profile,
+  };
+  const resp = await signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees`, body);
+  if (resp.status !== 200) die(`provisioning failed (http ${resp.status}): ${JSON.stringify(resp.json).slice(0, 300)}`);
+  const beePubkey = resp.json.bee_pubkey;
+  say(`${name}.bee exists: ${String(beePubkey).slice(0, 12)}…`);
+
+  // 6b. Buzz Agents directory (NIP-OA): the OWNER key signs both halves of
+  //     the pairing right here — it never leaves this laptop.
+  //     (a) kind-30177 managed-agent record (owner-authored, bee pubkey in
+  //         the d tag), published straight to the relay: the relay requires
+  //         event author == HTTP signer, so only this laptop can publish it.
+  //     (b) the NIP-OA auth tag co-signature over the bee's pubkey, shipped
+  //         to the server (it holds the bee key) so the bee's kind-0 profile
+  //         carries it. Together these make the bee show up under Agents in
+  //         the Buzz desktop app, cryptographically verified as YOURS.
+  //     Best-effort: the bee works without it; a re-join retries both halves.
+  if (/^[0-9a-f]{64}$/.test(String(beePubkey))) {
+    try {
+      const httpRelay = RELAY.replace(/^wss:\/\//, 'https://').replace(/^ws:\/\//, 'http://').replace(/\/+$/, '');
+      const ownerSk = Uint8Array.from(Buffer.from(identity.privkey, 'hex'));
+      const record = finalizeEvent({
+        kind: 30177, created_at: Math.floor(Date.now() / 1000),
+        tags: [['d', beePubkey]],
+        content: JSON.stringify({ name: `${name}.bee`, parallelism: 1, respond_to: 'anyone' }),
+      }, ownerSk);
+      const pub = await signedFetch(identity.privkey, 'POST', `${httpRelay}/events`, record);
+      if (pub.status !== 200 || pub.json?.accepted !== true) throw new Error(`kind-30177 publish: http=${pub.status} ${JSON.stringify(pub.json).slice(0, 160)}`);
+      const authTag = computeAuthTag(identity.privkey, beePubkey, '');
+      const resp2 = await signedFetch(identity.privkey, 'POST', `${SERVER}/api/bees`, { ...body, nip_oa_auth: authTag });
+      if (resp2.status !== 200) throw new Error(`auth-tag delivery: http=${resp2.status} ${JSON.stringify(resp2.json).slice(0, 160)}`);
+      say(`registered in the Buzz Agents directory (owner-verified: ${name}.bee)`);
+    } catch (e) {
+      say(`⚠️ Buzz Agents registration incomplete (${String(e.message).slice(0, 160)}) — re-run this join to retry; the bee itself is unaffected`);
+    }
+  }
+
+  // 7. Remember the pairing locally + enable sync, and publish YOUR kind-0
+  //    profile so apps (Buzz desktop included) show your name, not a pubkey.
+  const cfg2 = loadJson(cfgPath, {});
+  Object.assign(cfg2, { owner_name: name, bee_name: `${name}.bee`, bee_pubkey: beePubkey, server_url: SERVER, sync: { enabled: true, provider } });
+  writeFileSync(cfgPath, JSON.stringify(cfg2, null, 2) + '\n');
+  const prof = node('bin/hive-net.mjs', ['set-name', name]);
+  if (prof.code === 0) say(`your profile name is set: ${name}`);
+
+  // 8. Auto-sync watcher (launchd, macOS). --no-watcher skips it — used for
+  //    secondary endpoints on the same machine (one watcher per Mac).
+  if (platform() === 'darwin' && !args.includes('--no-watcher')) {
+    try {
+      const tmpl = readFileSync(join(PACK_DIR, 'watcher', 'global.nfh.hive.sync.plist.tmpl'), 'utf8')
+        .replaceAll('__NODE__', process.execPath).replaceAll('__PACK__', PACK_DIR).replaceAll('__HOME__', homedir());
+      const plist = join(homedir(), 'Library', 'LaunchAgents', 'global.nfh.hive.sync.plist');
+      mkdirSync(dirname(plist), { recursive: true });
+      writeFileSync(plist, tmpl);
+      execFileSync('launchctl', ['unload', plist], { stdio: 'ignore' });
+      try { execFileSync('launchctl', ['load', plist], { stdio: 'ignore' }); } catch {}
+      say('auto-sync watcher installed (every 15 min; hive sync off to stop)');
+    } catch (e) { say(`watcher install skipped (${String(e.message).slice(0, 80)}) — run: hive sync now`); }
+  }
+
+  // 9. Wait for the bee to come alive + grants to land.
+  say('waiting for your bee to wake up (engine self-test + genesis grants) …');
+  for (let i = 0; i < 30; i++) {
+    await new Promise((r) => setTimeout(r, 5000));
+    try {
+      const st = await (await fetch(`${SERVER}/api/bees/${name}/status`, { signal: AbortSignal.timeout(5000) })).json();
+      if (st.status === 'ready') {
+        say('———— YOU ARE IN ————');
+        say(`bee:     ${name}.bee (${String(beePubkey).slice(0, 12)}…)`);
+        say(`wallet:  ${wallet.evm_address} (shared: you + your bee)`);
+        if (st.grants?.jelly_tx) say(`grant:   500 JELLY — https://sepolia.etherscan.io/tx/${st.grants.jelly_tx}`);
+        say(`try:     hive ask "what should we watch this weekend"   ·   hive feed   ·   hive leaderboard`);
+        rl.close();
+        return;
+      }
+    } catch {}
+  }
+  say('provisioned, but the bee has not heartbeated yet — check later: hive agent status');
+  rl.close();
+};
+
+main().catch((e) => { rl.close(); die(String(e.message || e)); });

package/bin/hive-keygen.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+// Generate (or print) the Hive endpoint identity at ~/.hive/identity.json.
+// Idempotent: an existing identity is never overwritten (join once — the same
+// endpoint is reused by every client: Claude Code, Codex, Hermes, ...).
+import { generateSecretKey, getPublicKey, nip19 } from 'nostr-tools';
+import { mkdirSync, existsSync, readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const dir = process.env.HIVE_HOME || join(homedir(), '.hive'); // respect HIVE_HOME like wallet/CLI
+const file = join(dir, 'identity.json');
+
+if (existsSync(file)) {
+  const id = JSON.parse(readFileSync(file, 'utf8'));
+  // Migration: v1 identities predate the owner keypair (used for private
+  // relay memory — NIP-AE engrams need a distinct owner key). Add one once.
+  if (!id.owner_pubkey) {
+    const osk = generateSecretKey();
+    id.owner_privkey = Buffer.from(osk).toString('hex');
+    id.owner_pubkey = getPublicKey(osk);
+    id.version = 2;
+    writeFileSync(file, JSON.stringify(id, null, 2) + '\n', { mode: 0o600 });
+  }
+  console.log(JSON.stringify({ status: 'existing', pubkey: id.pubkey, npub: id.npub, owner_pubkey: id.owner_pubkey, created_at: id.created_at }));
+  process.exit(0);
+}
+
+const sk = generateSecretKey();
+const skHex = Buffer.from(sk).toString('hex');
+const pk = getPublicKey(sk);
+const osk = generateSecretKey(); // owner key: recovery + private-memory owner
+const identity = {
+  version: 2,
+  privkey: skHex,
+  nsec: nip19.nsecEncode(sk),
+  pubkey: pk,
+  npub: nip19.npubEncode(pk),
+  owner_privkey: Buffer.from(osk).toString('hex'),
+  owner_pubkey: getPublicKey(osk),
+  created_at: Math.floor(Date.now() / 1000),
+};
+mkdirSync(dir, { recursive: true, mode: 0o700 });
+for (const sub of ['data-store', 'capability-store', 'object-store']) {
+  mkdirSync(join(dir, sub), { recursive: true });
+}
+writeFileSync(file, JSON.stringify(identity, null, 2) + '\n', { mode: 0o600 });
+chmodSync(file, 0o600);
+console.log(JSON.stringify({ status: 'created', pubkey: pk, npub: identity.npub, created_at: identity.created_at }));

package/bin/hive-mint.mjs

@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+// Mint a playful Hive object through computational proof-of-work.
+// The object id is sha256 over the canonical JSON (sorted keys, no id field);
+// a mint is valid when the id has >= `difficulty` leading zero bits. Anyone
+// can verify a mint by recomputing one hash — scarcity comes from the work.
+//
+// Usage: hive-mint.mjs --difficulty 16 [--name "..."] [--emoji "🐝"]
+import { createHash } from 'node:crypto';
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+const args = Object.fromEntries(
+  process.argv.slice(2).map((a, i, arr) => (a.startsWith('--') ? [a.slice(2), arr[i + 1]] : null)).filter(Boolean),
+);
+const difficulty = Number(args.difficulty ?? 16);
+if (!Number.isInteger(difficulty) || difficulty < 8 || difficulty > 28) {
+  console.error(JSON.stringify({ error: 'difficulty must be an integer in 8..28' }));
+  process.exit(1);
+}
+
+const identity = JSON.parse(readFileSync(join(process.env.HIVE_HOME || join(homedir(), '.hive'), 'identity.json'), 'utf8'));
+
+const ADJ = ['Amber', 'Waggle', 'Golden', 'Drowsy', 'Zippy', 'Velvet', 'Honeyed', 'Fuzzy', 'Gilded', 'Nectar', 'Dappled', 'Humming'];
+const NOUN = ['Hexagon', 'Drone', 'Comb', 'Pollen Puff', 'Stinger', 'Queen Cell', 'Waggle Dance', 'Propolis Chip', 'Royal Jelly', 'Swarm Stone', 'Bee Bread', 'Wax Sigil'];
+const EMOJI = ['🐝', '🍯', '🌻', '🧡', '🔶', '👑', '💛', '🌼'];
+const pick = (list, seed) => list[((seed % list.length) + list.length) % list.length];
+const seed = parseInt(identity.pubkey.slice(0, 8), 16) + Date.now();
+
+const RARITY = difficulty >= 24 ? 'legendary' : difficulty >= 20 ? 'rare' : difficulty >= 16 ? 'uncommon' : 'common';
+const base = {
+  v: 1,
+  kind: 'hive-object',
+  name: args.name ?? `${pick(ADJ, seed)} ${pick(NOUN, Math.floor(seed / 16))}`,
+  emoji: args.emoji ?? pick(EMOJI, Math.floor(seed / 4)),
+  rarity: RARITY,
+  difficulty,
+  owner: identity.pubkey,
+  minted_at: Math.floor(Date.now() / 1000),
+};
+
+const canonical = (obj) => JSON.stringify(Object.fromEntries(Object.entries(obj).sort(([a], [b]) => (a < b ? -1 : 1))));
+const leadingZeroBits = (buf) => {
+  let bits = 0;
+  for (const byte of buf) {
+    if (byte === 0) { bits += 8; continue; }
+    bits += Math.clz32(byte) - 24;
+    break;
+  }
+  return bits;
+};
+
+const t0 = Date.now();
+let nonce = 0, id;
+for (;;) {
+  const digest = createHash('sha256').update(canonical({ ...base, nonce })).digest();
+  if (leadingZeroBits(digest) >= difficulty) { id = digest.toString('hex'); break; }
+  nonce++;
+}
+const object = { ...base, nonce, id };
+const outDir = join(process.env.HIVE_HOME || join(homedir(), '.hive'), 'object-store');
+mkdirSync(outDir, { recursive: true });
+const outFile = join(outDir, `${id.slice(0, 16)}.json`);
+writeFileSync(outFile, JSON.stringify(object, null, 2) + '\n');
+console.log(JSON.stringify({ ...object, hashes: nonce + 1, ms: Date.now() - t0, file: outFile }));