prae-cli 0.9.1 → 0.10.0

package/lib/{src-D7g4lvaY.js → src-Cy-Acrgj.js}

@@ -1,5 +1,5 @@
 import { appendFileSync, closeSync, existsSync, fstatSync, mkdirSync, openSync, readFileSync, readSync, readdirSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { createCipheriv, createDecipheriv, createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, scryptSync, sign, verify } from "node:crypto";
 
 //#region ../ledger/src/entry.ts
@@ -116,6 +116,13 @@ const ANSWER_TTL_MS = 5 * 6e4;
 function signBytes(bytes, privateKey) {
 	return sign(null, Buffer.from(bytes), priv(privateKey)).toString("base64");
 }
+function verifyBytes(bytes, signature, publicKeyPem) {
+	try {
+		return verify(null, Buffer.from(bytes), createPublicKey(publicKeyPem), Buffer.from(signature.trim(), "base64"));
+	} catch {
+		return false;
+	}
+}
 /**
 * How a private key is sealed at rest: scrypt (N = 2^17, r = 8, p = 1) over
 * the passphrase, AES-256-GCM over the key. The sealed file can sit where an
@@ -171,13 +178,16 @@ function unsealPrivateKey(sealed, passphrase) {
 	if (match === null) throw new Error("not a PRAE sealed key (an older format?): make a new one with prae keygen --role");
 	const box = JSON.parse(Buffer.from((match[1] ?? "").replace(/\s/g, ""), "base64").toString("utf8"));
 	if (box.v !== 1 || box.kdf !== "scrypt") throw new Error("unknown sealing");
-	const decipher = createDecipheriv("aes-256-gcm", scryptSync(passphrase, Buffer.from(String(box.salt), "base64"), 32, {
+	const wrap = scryptSync(passphrase, Buffer.from(String(box.salt), "base64"), 32, {
 		N: Number(box.N),
 		r: Number(box.r),
 		p: Number(box.p),
 		maxmem: SCRYPT.maxmem
-	}), Buffer.from(String(box.iv), "base64"));
-	decipher.setAuthTag(Buffer.from(String(box.tag), "base64"));
+	});
+	const tag = Buffer.from(String(box.tag), "base64");
+	if (tag.length !== 16) throw new Error("sealed key: authentication tag is not 16 bytes");
+	const decipher = createDecipheriv("aes-256-gcm", wrap, Buffer.from(String(box.iv), "base64"), { authTagLength: 16 });
+	decipher.setAuthTag(tag);
 	return createPrivateKey({
 		key: Buffer.concat([decipher.update(Buffer.from(String(box.data), "base64")), decipher.final()]),
 		format: "der",
@@ -200,14 +210,15 @@ function readEntries(text) {
 	return text.split("\n").filter((line) => line.trim() !== "").map((line) => JSON.parse(line));
 }
 /** Re-derive every hash and confirm each entry names its predecessor. */
-function verifyEntries(text) {
+function verifyEntries(text, from) {
 	const problems = [];
-	let expectedPrev = GENESIS;
-	let expectedSeq = 0;
+	let expectedPrev = from?.prev ?? GENESIS;
+	let expectedSeq = from?.seq ?? 0;
 	let count = 0;
+	const offset = from?.line ?? 0;
 	const lines = text.split("\n").filter((line) => line.trim() !== "");
 	for (const [index, line] of lines.entries()) {
-		const at = index + 1;
+		const at = offset + index + 1;
 		count += 1;
 		let entry;
 		try {
@@ -294,6 +305,16 @@ const STALE_LOCK_MS = 1e4;
 /** Run `fn` holding an exclusive lock file; synchronous, like the append. */
 function withLock(lock, fn) {
 	const deadline = Date.now() + 3e4;
+	for (;;) {
+		const done = tryLock(lock, fn);
+		if (done !== BUSY) return done;
+		if (Date.now() > deadline) throw new Error(`prae ledger: ${lock} has been held for 30 s; refusing to append without it`);
+		Atomics.wait(SLEEP, 0, 0, 2);
+	}
+}
+const BUSY = Symbol("busy");
+/** Run `fn` holding the lock if it is free now (or stale); `BUSY` if not. */
+function tryLock(lock, fn) {
 	for (;;) {
 		let fd;
 		try {
@@ -306,9 +327,7 @@ function withLock(lock, fn) {
 					continue;
 				}
 			} catch {}
-			if (Date.now() > deadline) throw new Error(`prae ledger: ${lock} has been held for 30 s; refusing to append without it`);
-			Atomics.wait(SLEEP, 0, 0, 2);
-			continue;
+			return BUSY;
 		}
 		try {
 			return fn();
@@ -354,19 +373,30 @@ var Ledger = class Ledger {
 	}
 	/** Append one decision and return the entry as written. */
 	append(record) {
-		return withLock(`${this.path}.lock`, () => {
-			const { seq, last } = tailOf(this.path);
-			const sealed = chain(record, seq, last);
-			const entry = this.signer !== void 0 ? {
-				...sealed,
-				sig: this.signer(sealed)
-			} : this.signWith === void 0 ? sealed : {
-				...sealed,
-				sig: signEntry(sealed, this.signWith)
-			};
-			appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
-			return entry;
-		});
+		return withLock(`${this.path}.lock`, () => this.write(record));
+	}
+	/**
+	* Append only if no other writer holds the lock right now; `undefined`
+	* when one does. For a process that must not block while it waits —
+	* one that answers other writers' signers (PRA-143), whose writers hold
+	* the lock until it answers.
+	*/
+	tryAppend(record) {
+		const done = tryLock(`${this.path}.lock`, () => this.write(record));
+		return done === BUSY ? void 0 : done;
+	}
+	write(record) {
+		const { seq, last } = tailOf(this.path);
+		const sealed = chain(record, seq, last);
+		const entry = this.signer !== void 0 ? {
+			...sealed,
+			sig: this.signer(sealed)
+		} : this.signWith === void 0 ? sealed : {
+			...sealed,
+			sig: signEntry(sealed, this.signWith)
+		};
+		appendFileSync(this.path, `${JSON.stringify(entry)}\n`);
+		return entry;
 	}
 	/** Every entry, in order. */
 	read() {
@@ -389,4 +419,60 @@ var Ledger = class Ledger {
 const nap = new Int32Array(new SharedArrayBuffer(4));
 
 //#endregion
-export { seal as _, signBytes as a, generateKeypair as c, verifyReceipt as d, verifySignature as f, hashEntry as g, chain as h, sealedKeypair as i, makeReceipt as l, canonical as m, readEntries as n, unsealPrivateKey as o, GENESIS as p, verifyEntries as r, fingerprint as s, Ledger as t, signEntry as u };
+//#region ../ledger/src/verify-cache.ts
+const prefixes = /* @__PURE__ */ new Map();
+const sha = (s) => createHash("sha256").update(s).digest("hex");
+function verifyGrowing(path, publicKey) {
+	const raw = readFileSync(path, "utf8");
+	const text = raw.slice(0, raw.lastIndexOf("\n") + 1);
+	const slot = `${path}\u0000${publicKey ?? ""}`;
+	const known = prefixes.get(slot);
+	const from = known !== void 0 && known.key === publicKey && text.length >= known.length && sha(text.slice(0, known.length)) === known.sha ? known : void 0;
+	const fresh = from === void 0 ? text : text.slice(from.length);
+	const verified = verifyEntries(fresh, from === void 0 ? void 0 : {
+		prev: from.head,
+		seq: from.seq,
+		line: from.entries
+	});
+	let checked = from?.checked ?? 0;
+	const failed = [...from?.failed ?? []];
+	let rows = [];
+	try {
+		rows = readEntries(fresh);
+	} catch {
+		rows = [];
+	}
+	if (publicKey !== void 0) for (const e of rows) {
+		if (e.sig === void 0) continue;
+		checked += 1;
+		if (!verifySignature(e, e.sig, publicKey)) failed.push(e.seq);
+	}
+	const entries = (from?.entries ?? 0) + verified.entries;
+	const problems = [...from?.problems ?? [], ...verified.problems];
+	const last = rows.at(-1);
+	if (rows.length === verified.entries) prefixes.set(slot, {
+		length: text.length,
+		sha: sha(text),
+		key: publicKey,
+		head: last?.hash ?? from?.head ?? GENESIS,
+		seq: last === void 0 ? from?.seq ?? 0 : last.seq + 1,
+		entries,
+		checked,
+		failed,
+		problems
+	});
+	else prefixes.delete(slot);
+	return {
+		ok: problems.length === 0,
+		entries,
+		problems,
+		signatures: publicKey === void 0 ? null : {
+			checked,
+			failed
+		},
+		text
+	};
+}
+
+//#endregion
+export { canonical as _, verifyEntries as a, seal as b, unsealPrivateKey as c, generateKeypair as d, makeReceipt as f, GENESIS as g, verifySignature as h, tailOf as i, verifyBytes as l, verifyReceipt as m, Ledger as n, sealedKeypair as o, signEntry as p, readEntries as r, signBytes as s, verifyGrowing as t, fingerprint as u, chain as v, hashEntry as y };

package/lib/{src-CwBEFhww.js → src-DMoYsdfo.js}

@@ -1,3 +1,3 @@
-import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-B25SHWcz.js";
+import { a as scan, i as looksBinary, n as MAX_SCAN_BYTES, r as entropy, t as DETECTORS } from "./src-BuaOiL2v.js";
 
 export { DETECTORS, MAX_SCAN_BYTES, entropy, looksBinary, scan };

package/lib/src-wG36kT6K.js

@@ -0,0 +1,3 @@
+import { _ as canonical, a as verifyEntries, b as seal, c as unsealPrivateKey, d as generateKeypair, f as makeReceipt, g as GENESIS, h as verifySignature, i as tailOf, l as verifyBytes, m as verifyReceipt, n as Ledger, o as sealedKeypair, p as signEntry, r as readEntries, s as signBytes, t as verifyGrowing, u as fingerprint, v as chain, y as hashEntry } from "./src-Cy-Acrgj.js";
+
+export { GENESIS, Ledger, canonical, chain, fingerprint, generateKeypair, hashEntry, makeReceipt, readEntries, seal, sealedKeypair, signBytes, signEntry, tailOf, unsealPrivateKey, verifyBytes, verifyEntries, verifyGrowing, verifyReceipt, verifySignature };

package/lib/{test-run-XNIRHKOu.js → test-run-C8dHjIE2.js}

@@ -1,4 +1,4 @@
-import { t as evaluate } from "./evaluate-wMPkjcIC.js";
+import { t as evaluate } from "./evaluate-DhoGQw0Z.js";
 
 //#region src/test-run.ts
 /** The path argument a scenario's call carries, if any. */