vibedate 0.3.1 → 0.4.0

package/dist/{chunk-3VT4EOBX.js → chunk-43IYNWES.js}

@@ -1,10 +1,11 @@
 // src/index.ts
+import { readHarnessUsage } from "@pooriaarab/vibe-core";
 import { createConsentLedger as createConsentLedger2 } from "@pooriaarab/vibe-core";
 
 // src/p2p.ts
-import { createHash, randomBytes } from "crypto";
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync3 } from "fs";
-import path3 from "path";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import path4 from "path";
 import { makeEvent, notify as vibeCoreNotify } from "@pooriaarab/vibe-core";
 
 // src/frame.ts
@@ -39,7 +40,27 @@ function parseFrame(raw) {
     case "hello": {
       const { handle, league: league2, harness } = r;
       if (typeof handle !== "string" || typeof league2 !== "string") return null;
-      return { t: "hello", handle, league: league2, harness: typeof harness === "string" ? harness : "unknown" };
+      const verified = r["verified"];
+      if (verified !== void 0 && typeof verified !== "boolean") return null;
+      const pubkey = r["pubkey"];
+      if (pubkey !== void 0 && (typeof pubkey !== "string" || !/^[0-9a-fA-F]{64}$/.test(pubkey)))
+        return null;
+      const nonce = r["nonce"];
+      if (nonce !== void 0 && (typeof nonce !== "string" || !/^[0-9a-fA-F]{1,64}$/.test(nonce)))
+        return null;
+      const sig = r["sig"];
+      if (sig !== void 0 && (typeof sig !== "string" || !/^[0-9a-fA-F]{128}$/.test(sig)))
+        return null;
+      return {
+        t: "hello",
+        handle,
+        league: league2,
+        harness: typeof harness === "string" ? harness : "unknown",
+        ...typeof verified === "boolean" ? { verified } : {},
+        ...typeof pubkey === "string" ? { pubkey } : {},
+        ...typeof nonce === "string" ? { nonce } : {},
+        ...typeof sig === "string" ? { sig } : {}
+      };
     }
     case "msg": {
       const id = r["id"];
@@ -97,15 +118,286 @@ function parseFrame(raw) {
   }
 }
 
+// src/identity.ts
+import {
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  randomBytes,
+  sign,
+  verify
+} from "crypto";
+import { chmodSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import path2 from "path";
+
+// src/state.ts
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "fs";
+import os from "os";
+import path from "path";
+import { createConsentLedger } from "@pooriaarab/vibe-core";
+var CONSENT_SCOPE = "share:league";
+var LIVE_CONSENT_SCOPE = "share:live";
+function defaultStateDir() {
+  return path.join(os.homedir(), ".vibedating");
+}
+var FileConsentStore = class {
+  constructor(file) {
+    this.file = file;
+  }
+  file;
+  load() {
+    try {
+      const raw = readFileSync(this.file, "utf8");
+      const data = JSON.parse(raw);
+      return data.grants ?? [];
+    } catch {
+      return [];
+    }
+  }
+  save(grants) {
+    mkdirSync(path.dirname(this.file), { recursive: true });
+    writeFileSync(this.file, JSON.stringify({ grants }, null, 2) + "\n", "utf8");
+  }
+};
+function createLedger(dir = defaultStateDir()) {
+  return createConsentLedger(new FileConsentStore(path.join(dir, "consent.json")));
+}
+function profilePath(dir) {
+  return path.join(dir, "state.json");
+}
+function connectProfile(snapshot, handle, dir = defaultStateDir()) {
+  const lg = league(snapshot.totalTokens);
+  createLedger(dir).grant(CONSENT_SCOPE, "connect: league bucket only; raw usage stays local");
+  const state = {
+    handle,
+    harness: snapshot.harness,
+    league: lg.name,
+    leagueMin: lg.min,
+    totalTokens: snapshot.totalTokens,
+    verified: snapshot.verified,
+    connectedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(profilePath(dir), JSON.stringify(state, null, 2) + "\n", "utf8");
+  return state;
+}
+function loadProfile(dir = defaultStateDir()) {
+  try {
+    const raw = readFileSync(profilePath(dir), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function grantLiveConsent(dir = defaultStateDir()) {
+  createLedger(dir).grant(
+    LIVE_CONSENT_SCOPE,
+    "discover --live: share handle+league+harness+verified flag+identity pubkey (never raw usage) with same-league peers on the public DHT"
+  );
+}
+function canShareLive(dir = defaultStateDir()) {
+  return createLedger(dir).allows(LIVE_CONSENT_SCOPE);
+}
+var HANDLE_FILE = "handle.json";
+var DEFAULT_HANDLE = "@you";
+var MAX_HANDLE_LEN = 32;
+function handleFilePath(dir) {
+  return path.join(dir, HANDLE_FILE);
+}
+function stripLeadingAt(handle) {
+  return handle.replace(/^@+/, "");
+}
+function sameHandle(a, b) {
+  return stripLeadingAt(a) === stripLeadingAt(b);
+}
+function normalizeHandle(input) {
+  if (typeof input !== "string") return null;
+  const trimmed = input.trim();
+  if (trimmed.length === 0) return null;
+  const body = stripLeadingAt(trimmed);
+  if (body.length === 0) return null;
+  if (/\s/.test(body) || /[\x00-\x1f\x7f]/.test(body)) return null;
+  const canonical = "@" + body;
+  if (canonical.length > MAX_HANDLE_LEN) return null;
+  return canonical;
+}
+function loadHandle(dir = defaultStateDir()) {
+  try {
+    const raw = readFileSync(handleFilePath(dir), "utf8");
+    const data = JSON.parse(raw);
+    if (typeof data["handle"] !== "string") return DEFAULT_HANDLE;
+    return normalizeHandle(data["handle"]) ?? DEFAULT_HANDLE;
+  } catch {
+    return DEFAULT_HANDLE;
+  }
+}
+function saveHandle(handle, dir = defaultStateDir()) {
+  const canonical = normalizeHandle(handle);
+  if (canonical === null) {
+    throw new Error(
+      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
+    );
+  }
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(handleFilePath(dir), JSON.stringify({ handle: canonical }, null, 2) + "\n", "utf8");
+  const existing = loadProfile(dir);
+  if (existing !== null) {
+    writeFileSync(
+      profilePath(dir),
+      JSON.stringify({ ...existing, handle: canonical }, null, 2) + "\n",
+      "utf8"
+    );
+  }
+  return canonical;
+}
+function resolveHandle(dir = defaultStateDir()) {
+  const env = process.env["VIBEDATING_HANDLE"];
+  if (env !== void 0 && env.trim() !== "") {
+    const canonical = normalizeHandle(env);
+    if (canonical !== null) return canonical;
+  }
+  return loadHandle(dir);
+}
+var BLOCKLIST_FILE = "blocklist.json";
+function blocklistPath(dir) {
+  return path.join(dir, BLOCKLIST_FILE);
+}
+function persistBlocklist(blocked, dir) {
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(blocklistPath(dir), JSON.stringify({ blocked }, null, 2) + "\n", "utf8");
+}
+function loadBlocklist(dir = defaultStateDir()) {
+  try {
+    const raw = readFileSync(blocklistPath(dir), "utf8");
+    const data = JSON.parse(raw);
+    if (!Array.isArray(data["blocked"])) return [];
+    return data["blocked"].filter((h) => typeof h === "string");
+  } catch {
+    return [];
+  }
+}
+function isBlocked(handle, dir = defaultStateDir()) {
+  const want = stripLeadingAt(handle);
+  if (want === "") return false;
+  return loadBlocklist(dir).some((entry) => stripLeadingAt(entry) === want);
+}
+function addBlock(handle, dir = defaultStateDir()) {
+  const canonical = normalizeHandle(handle);
+  if (canonical === null) {
+    throw new Error(
+      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
+    );
+  }
+  const list = loadBlocklist(dir);
+  if (list.some((e) => sameHandle(e, canonical))) return { blocked: list, changed: false };
+  const blocked = [...list, canonical];
+  persistBlocklist(blocked, dir);
+  return { blocked, changed: true };
+}
+function removeBlock(handle, dir = defaultStateDir()) {
+  const canonical = normalizeHandle(handle);
+  if (canonical === null) {
+    throw new Error(
+      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
+    );
+  }
+  const list = loadBlocklist(dir);
+  const blocked = list.filter((e) => !sameHandle(e, canonical));
+  if (blocked.length === list.length) return { blocked: list, changed: false };
+  persistBlocklist(blocked, dir);
+  return { blocked, changed: true };
+}
+
+// src/identity.ts
+var IDENTITY_FILE = "identity.json";
+function identityPath(dir) {
+  return path2.join(dir, IDENTITY_FILE);
+}
+function isStoredIdentity(data) {
+  if (typeof data !== "object" || data === null) return false;
+  const r = data;
+  return r["kty"] === "OKP" && r["crv"] === "Ed25519" && typeof r["x"] === "string" && typeof r["d"] === "string" && typeof r["createdAt"] === "string";
+}
+function fromJwk(x, d, createdAt) {
+  const privateKey = createPrivateKey({ key: { kty: "OKP", crv: "Ed25519", x, d }, format: "jwk" });
+  const publicKey = createPublicKey({ key: { kty: "OKP", crv: "Ed25519", x }, format: "jwk" });
+  const publicKeyHex = Buffer.from(x, "base64url").toString("hex");
+  if (publicKeyHex.length !== 64) throw new Error("corrupt identity: bad public key length");
+  return { publicKeyHex, publicKey, privateKey, createdAt };
+}
+function loadOrCreateIdentity(dir = defaultStateDir()) {
+  try {
+    const raw = readFileSync2(identityPath(dir), "utf8");
+    const data = JSON.parse(raw);
+    if (isStoredIdentity(data)) {
+      try {
+        chmodSync(identityPath(dir), 384);
+      } catch {
+      }
+      return fromJwk(data.x, data.d, data.createdAt);
+    }
+  } catch {
+  }
+  const { privateKey } = generateKeyPairSync("ed25519");
+  const jwk = privateKey.export({ format: "jwk" });
+  if (typeof jwk.x !== "string" || typeof jwk.d !== "string") {
+    throw new Error("could not export ed25519 keypair as JWK");
+  }
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const identity = fromJwk(jwk.x, jwk.d, createdAt);
+  mkdirSync2(dir, { recursive: true });
+  writeFileSync2(
+    identityPath(dir),
+    JSON.stringify({ kty: "OKP", crv: "Ed25519", x: jwk.x, d: jwk.d, createdAt }, null, 2) + "\n",
+    { encoding: "utf8", mode: 384 }
+  );
+  try {
+    chmodSync(identityPath(dir), 384);
+  } catch {
+  }
+  return identity;
+}
+function canonicalHelloClaims(claims) {
+  return [claims.handle, claims.league, claims.harness, String(claims.verified === true), claims.nonce].join(
+    "|"
+  );
+}
+function signHelloClaims(identity, claims) {
+  const nonce = randomBytes(16).toString("hex");
+  const payload = canonicalHelloClaims({ ...claims, nonce });
+  const sig = sign(null, Buffer.from(payload, "utf8"), identity.privateKey).toString("hex");
+  return { pubkey: identity.publicKeyHex, nonce, sig };
+}
+function verifyHelloClaims(claims, proof) {
+  try {
+    if (!/^[0-9a-f]{64}$/i.test(proof.pubkey)) return false;
+    if (!/^[0-9a-f]{1,64}$/i.test(proof.nonce)) return false;
+    if (!/^[0-9a-f]{128}$/i.test(proof.sig)) return false;
+    const publicKey = createPublicKey({
+      key: { kty: "OKP", crv: "Ed25519", x: Buffer.from(proof.pubkey, "hex").toString("base64url") },
+      format: "jwk"
+    });
+    const payload = canonicalHelloClaims({ ...claims, nonce: proof.nonce });
+    return verify(null, Buffer.from(payload, "utf8"), publicKey, Buffer.from(proof.sig, "hex"));
+  } catch {
+    return false;
+  }
+}
+function classifyHelloIdentity(hello) {
+  if (hello.pubkey === void 0) return "legacy";
+  if (hello.nonce === void 0 || hello.sig === void 0) return "drop";
+  return verifyHelloClaims(hello, { pubkey: hello.pubkey, nonce: hello.nonce, sig: hello.sig }) ? "verified" : "drop";
+}
+
 // src/link.ts
 import { randomUUID as randomUUID2 } from "crypto";
 
 // src/media.ts
 import { randomUUID } from "crypto";
 import { readFile } from "fs/promises";
-import { writeFileSync } from "fs";
-import os from "os";
-import path from "path";
+import { writeFileSync as writeFileSync3 } from "fs";
+import os2 from "os";
+import path3 from "path";
 var DEFAULT_CHUNK_BYTES = Math.floor(MAX_B64_CHUNK_LEN * 3 / 4);
 var MIME_BY_EXT = {
   ".png": "image/png",
@@ -117,7 +409,7 @@ var MIME_BY_EXT = {
   ".webm": "video/webm"
 };
 function inferMime(name) {
-  return MIME_BY_EXT[path.extname(name).toLowerCase()] ?? "application/octet-stream";
+  return MIME_BY_EXT[path3.extname(name).toLowerCase()] ?? "application/octet-stream";
 }
 function writeFrame(socket, line) {
   return new Promise((resolve) => {
@@ -148,7 +440,7 @@ async function sendMedia(opts) {
 }
 async function sendMediaFile(opts) {
   const data = await readFile(opts.path);
-  const name = opts.name ?? path.basename(opts.path);
+  const name = opts.name ?? path3.basename(opts.path);
   const mime = opts.mime ?? inferMime(name);
   return sendMedia({
     socket: opts.socket,
@@ -160,7 +452,7 @@ async function sendMediaFile(opts) {
   });
 }
 function safeName(id, name) {
-  const ext = path.extname(name);
+  const ext = path3.extname(name);
   return ext && /^\.[A-Za-z0-9]{1,16}$/.test(ext) ? `${id}${ext}` : id;
 }
 var MediaReceiver = class {
@@ -219,9 +511,9 @@ var MediaReceiver = class {
         this.transfers.delete(frame.id);
         if (tx.received !== tx.size) return;
         const buf = Buffer.concat(tx.chunks, tx.received);
-        const filePath = path.join(this.opts.tmpDir ?? os.tmpdir(), safeName(frame.id, tx.name));
+        const filePath = path3.join(this.opts.tmpDir ?? os2.tmpdir(), safeName(frame.id, tx.name));
         try {
-          writeFileSync(filePath, buf);
+          writeFileSync3(filePath, buf);
         } catch {
           return;
         }
@@ -364,190 +656,12 @@ function createPeerLink(socket, hello, initialBuffer = "", linkOpts = {}) {
   };
 }
 
-// src/state.ts
-import { mkdirSync, readFileSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
-import os2 from "os";
-import path2 from "path";
-import { createConsentLedger } from "@pooriaarab/vibe-core";
-var CONSENT_SCOPE = "share:league";
-var LIVE_CONSENT_SCOPE = "share:live";
-function defaultStateDir() {
-  return path2.join(os2.homedir(), ".vibedating");
-}
-var FileConsentStore = class {
-  constructor(file) {
-    this.file = file;
-  }
-  file;
-  load() {
-    try {
-      const raw = readFileSync(this.file, "utf8");
-      const data = JSON.parse(raw);
-      return data.grants ?? [];
-    } catch {
-      return [];
-    }
-  }
-  save(grants) {
-    mkdirSync(path2.dirname(this.file), { recursive: true });
-    writeFileSync2(this.file, JSON.stringify({ grants }, null, 2) + "\n", "utf8");
-  }
-};
-function createLedger(dir = defaultStateDir()) {
-  return createConsentLedger(new FileConsentStore(path2.join(dir, "consent.json")));
-}
-function profilePath(dir) {
-  return path2.join(dir, "state.json");
-}
-function connectProfile(snapshot, handle, dir = defaultStateDir()) {
-  const lg = league(snapshot.totalTokens);
-  createLedger(dir).grant(CONSENT_SCOPE, "connect: league bucket only; raw usage stays local");
-  const state = {
-    handle,
-    harness: snapshot.harness,
-    league: lg.name,
-    leagueMin: lg.min,
-    totalTokens: snapshot.totalTokens,
-    verified: snapshot.verified,
-    connectedAt: (/* @__PURE__ */ new Date()).toISOString()
-  };
-  mkdirSync(dir, { recursive: true });
-  writeFileSync2(profilePath(dir), JSON.stringify(state, null, 2) + "\n", "utf8");
-  return state;
-}
-function loadProfile(dir = defaultStateDir()) {
-  try {
-    const raw = readFileSync(profilePath(dir), "utf8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function grantLiveConsent(dir = defaultStateDir()) {
-  createLedger(dir).grant(
-    LIVE_CONSENT_SCOPE,
-    "discover --live: share handle+league+harness (never raw usage) with same-league peers on the public DHT"
-  );
-}
-function canShareLive(dir = defaultStateDir()) {
-  return createLedger(dir).allows(LIVE_CONSENT_SCOPE);
-}
-var HANDLE_FILE = "handle.json";
-var DEFAULT_HANDLE = "@you";
-var MAX_HANDLE_LEN = 32;
-function handleFilePath(dir) {
-  return path2.join(dir, HANDLE_FILE);
-}
-function stripLeadingAt(handle) {
-  return handle.replace(/^@+/, "");
-}
-function sameHandle(a, b) {
-  return stripLeadingAt(a) === stripLeadingAt(b);
-}
-function normalizeHandle(input) {
-  if (typeof input !== "string") return null;
-  const trimmed = input.trim();
-  if (trimmed.length === 0) return null;
-  const body = stripLeadingAt(trimmed);
-  if (body.length === 0) return null;
-  if (/\s/.test(body) || /[\x00-\x1f\x7f]/.test(body)) return null;
-  const canonical = "@" + body;
-  if (canonical.length > MAX_HANDLE_LEN) return null;
-  return canonical;
-}
-function loadHandle(dir = defaultStateDir()) {
-  try {
-    const raw = readFileSync(handleFilePath(dir), "utf8");
-    const data = JSON.parse(raw);
-    if (typeof data["handle"] !== "string") return DEFAULT_HANDLE;
-    return normalizeHandle(data["handle"]) ?? DEFAULT_HANDLE;
-  } catch {
-    return DEFAULT_HANDLE;
-  }
-}
-function saveHandle(handle, dir = defaultStateDir()) {
-  const canonical = normalizeHandle(handle);
-  if (canonical === null) {
-    throw new Error(
-      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
-    );
-  }
-  mkdirSync(dir, { recursive: true });
-  writeFileSync2(handleFilePath(dir), JSON.stringify({ handle: canonical }, null, 2) + "\n", "utf8");
-  const existing = loadProfile(dir);
-  if (existing !== null) {
-    writeFileSync2(
-      profilePath(dir),
-      JSON.stringify({ ...existing, handle: canonical }, null, 2) + "\n",
-      "utf8"
-    );
-  }
-  return canonical;
-}
-function resolveHandle(dir = defaultStateDir()) {
-  const env = process.env["VIBEDATING_HANDLE"];
-  if (env !== void 0 && env.trim() !== "") {
-    const canonical = normalizeHandle(env);
-    if (canonical !== null) return canonical;
-  }
-  return loadHandle(dir);
-}
-var BLOCKLIST_FILE = "blocklist.json";
-function blocklistPath(dir) {
-  return path2.join(dir, BLOCKLIST_FILE);
-}
-function persistBlocklist(blocked, dir) {
-  mkdirSync(dir, { recursive: true });
-  writeFileSync2(blocklistPath(dir), JSON.stringify({ blocked }, null, 2) + "\n", "utf8");
-}
-function loadBlocklist(dir = defaultStateDir()) {
-  try {
-    const raw = readFileSync(blocklistPath(dir), "utf8");
-    const data = JSON.parse(raw);
-    if (!Array.isArray(data["blocked"])) return [];
-    return data["blocked"].filter((h) => typeof h === "string");
-  } catch {
-    return [];
-  }
-}
-function isBlocked(handle, dir = defaultStateDir()) {
-  const want = stripLeadingAt(handle);
-  if (want === "") return false;
-  return loadBlocklist(dir).some((entry) => stripLeadingAt(entry) === want);
-}
-function addBlock(handle, dir = defaultStateDir()) {
-  const canonical = normalizeHandle(handle);
-  if (canonical === null) {
-    throw new Error(
-      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
-    );
-  }
-  const list = loadBlocklist(dir);
-  if (list.some((e) => sameHandle(e, canonical))) return { blocked: list, changed: false };
-  const blocked = [...list, canonical];
-  persistBlocklist(blocked, dir);
-  return { blocked, changed: true };
-}
-function removeBlock(handle, dir = defaultStateDir()) {
-  const canonical = normalizeHandle(handle);
-  if (canonical === null) {
-    throw new Error(
-      `invalid handle: use 1-${MAX_HANDLE_LEN} chars (optional leading '@'), no whitespace`
-    );
-  }
-  const list = loadBlocklist(dir);
-  const blocked = list.filter((e) => !sameHandle(e, canonical));
-  if (blocked.length === list.length) return { blocked: list, changed: false };
-  persistBlocklist(blocked, dir);
-  return { blocked, changed: true };
-}
-
 // src/p2p.ts
 var TOPIC_PREFIX = "vibedate:";
 function leagueTopic(leagueName) {
   return createHash("sha256").update(`${TOPIC_PREFIX}${leagueName}`, "utf8").digest();
 }
-var LIVE_NOTICE = "live discovery: sharing only your handle + league + harness (never raw usage) with same-league peers on the public DHT";
+var LIVE_NOTICE = "live discovery: sharing only your handle + league + harness + verified flag + identity pubkey (never raw usage) with same-league peers on the public DHT";
 var MAX_HANDLE_LEN2 = 64;
 var MAX_LEAGUE_LEN = 32;
 var MAX_HARNESS_LEN = 64;
@@ -557,7 +671,12 @@ function serializeHandshake(hello) {
   return JSON.stringify({
     handle: hello.handle,
     league: hello.league,
-    harness: hello.harness
+    harness: hello.harness,
+    ...hello.verified !== void 0 ? { verified: hello.verified } : {},
+    ...hello.pubkey !== void 0 ? { pubkey: hello.pubkey } : {},
+    ...hello.nonce !== void 0 ? { nonce: hello.nonce } : {},
+    ...hello.sig !== void 0 ? { sig: hello.sig } : {}
+    // identityVerified is LOCAL-derived and deliberately never serialized.
   });
 }
 function parseHandshake(raw) {
@@ -580,18 +699,36 @@ function parseHandshake(raw) {
     return null;
   }
   const harness = rec["harness"];
+  const verified = rec["verified"];
+  if (verified !== void 0 && typeof verified !== "boolean") return null;
+  const pubkey = rec["pubkey"];
+  if (pubkey !== void 0 && (typeof pubkey !== "string" || !/^[0-9a-fA-F]{64}$/.test(pubkey))) {
+    return null;
+  }
+  const nonce = rec["nonce"];
+  if (nonce !== void 0 && (typeof nonce !== "string" || !/^[0-9a-fA-F]{1,64}$/.test(nonce))) {
+    return null;
+  }
+  const sig = rec["sig"];
+  if (sig !== void 0 && (typeof sig !== "string" || !/^[0-9a-fA-F]{128}$/.test(sig))) {
+    return null;
+  }
   return {
     handle,
     league: league2,
-    harness: typeof harness === "string" && harness.length > 0 && harness.length <= MAX_HARNESS_LEN ? harness : "unknown"
+    harness: typeof harness === "string" && harness.length > 0 && harness.length <= MAX_HARNESS_LEN ? harness : "unknown",
+    ...typeof verified === "boolean" ? { verified } : {},
+    ...typeof pubkey === "string" ? { pubkey } : {},
+    ...typeof nonce === "string" ? { nonce } : {},
+    ...typeof sig === "string" ? { sig } : {}
   };
 }
 function peersPath(dir) {
-  return path3.join(dir, "peers.json");
+  return path4.join(dir, "peers.json");
 }
 function loadPeers(dir = defaultStateDir()) {
   try {
-    const raw = readFileSync2(peersPath(dir), "utf8");
+    const raw = readFileSync3(peersPath(dir), "utf8");
     const data = JSON.parse(raw);
     return Array.isArray(data.peers) ? data.peers : [];
   } catch {
@@ -601,23 +738,50 @@ function loadPeers(dir = defaultStateDir()) {
 function recordPeer(hello, dir = defaultStateDir(), now = /* @__PURE__ */ new Date()) {
   const peers = loadPeers(dir);
   const at = now.toISOString();
-  const clean = { handle: hello.handle, league: hello.league, harness: hello.harness };
+  const clean = {
+    handle: hello.handle,
+    league: hello.league,
+    harness: hello.harness,
+    ...hello.verified !== void 0 ? { verified: hello.verified } : {},
+    ...hello.pubkey !== void 0 ? { pubkey: hello.pubkey } : {},
+    ...hello.identityVerified !== void 0 ? { identityVerified: hello.identityVerified } : {}
+  };
   const existing = peers.findIndex((p) => p.handle === clean.handle);
   let isNew;
   let peer;
   if (existing >= 0) {
     isNew = false;
-    peer = { ...peers[existing], ...clean, lastSeenAt: at };
+    const prev = peers[existing];
+    peer = {
+      ...clean,
+      firstSeenAt: prev.firstSeenAt,
+      lastSeenAt: at,
+      // lastMessageAt is local metadata — carried over, never reset by a hello.
+      ...prev.lastMessageAt !== void 0 ? { lastMessageAt: prev.lastMessageAt } : {}
+    };
     peers[existing] = peer;
   } else {
     isNew = true;
     peer = { ...clean, firstSeenAt: at, lastSeenAt: at };
     peers.push(peer);
   }
-  mkdirSync2(dir, { recursive: true });
-  writeFileSync3(peersPath(dir), JSON.stringify({ peers }, null, 2) + "\n", "utf8");
+  mkdirSync3(dir, { recursive: true });
+  writeFileSync4(peersPath(dir), JSON.stringify({ peers }, null, 2) + "\n", "utf8");
   return { peer, isNew };
 }
+function recordPeerMessage(handle, dir = defaultStateDir(), now = /* @__PURE__ */ new Date()) {
+  try {
+    const peers = loadPeers(dir);
+    const idx = peers.findIndex((p) => p.handle === handle);
+    if (idx < 0) return false;
+    peers[idx] = { ...peers[idx], lastMessageAt: now.toISOString() };
+    mkdirSync3(dir, { recursive: true });
+    writeFileSync4(peersPath(dir), JSON.stringify({ peers }, null, 2) + "\n", "utf8");
+    return true;
+  } catch {
+    return false;
+  }
+}
 async function startDiscovery(opts) {
   const { hello, stateDir = defaultStateDir(), onPeer, onLink, notify = vibeCoreNotify } = opts;
   const isBlocked2 = opts.isBlocked;
@@ -630,7 +794,16 @@ async function startDiscovery(opts) {
   swarm.on("connection", (socket, info) => {
     const remoteKey = info.publicKey.toString("hex");
     socket.write(
-      serializeFrame({ t: "hello", handle: hello.handle, league: hello.league, harness: hello.harness }) + "\n"
+      serializeFrame({
+        t: "hello",
+        handle: hello.handle,
+        league: hello.league,
+        harness: hello.harness,
+        ...hello.verified !== void 0 ? { verified: hello.verified } : {},
+        ...hello.pubkey !== void 0 ? { pubkey: hello.pubkey } : {},
+        ...hello.nonce !== void 0 ? { nonce: hello.nonce } : {},
+        ...hello.sig !== void 0 ? { sig: hello.sig } : {}
+      }) + "\n"
     );
     let buf = "";
     let handedOff = false;
@@ -645,11 +818,18 @@ async function startDiscovery(opts) {
         const frame = parseFrame(line);
         if (frame === null) continue;
         if (frame.t !== "hello") continue;
+        const verdict = classifyHelloIdentity(frame);
+        if (verdict === "drop") continue;
         const peer = {
           handle: frame.handle,
           league: frame.league,
-          harness: frame.harness
+          harness: frame.harness,
+          ...frame.verified !== void 0 ? { verified: frame.verified } : {},
+          ...verdict === "verified" && frame.pubkey !== void 0 ? { pubkey: frame.pubkey, identityVerified: true } : {}
         };
+        if (peer.pubkey !== void 0 && peer.pubkey === hello.pubkey || peer.pubkey === void 0 && hello.pubkey === void 0 && peer.handle === hello.handle) {
+          continue;
+        }
         if (!acceptLeague(peer.league)) continue;
         if (isBlocked2 !== void 0 && isBlocked2(peer.handle)) continue;
         peers.set(remoteKey, peer);
@@ -672,6 +852,9 @@ async function startDiscovery(opts) {
         socket.off("data", onData);
         if (onLink !== void 0) {
           const link = createPeerLink(socket, peer, buf);
+          link.onMessage(() => {
+            recordPeerMessage(peer.handle, stateDir);
+          });
           onLink(link);
         }
         buf = "";
@@ -757,23 +940,24 @@ function leaguesWithin(name, width) {
 var TOKENS_ENV = "VIBEDATING_TOKENS";
 var DEMO_TOTAL_TOKENS = 234e5;
 var MS_PER_DAY = 864e5;
-async function readUsage(harness = "claude-code") {
-  const verified = await tryReadVerifiedUsage(harness);
-  if (verified) return verified;
-  const injected = parseTokensEnv(process.env[TOKENS_ENV]);
-  const totalTokens = injected ?? DEMO_TOTAL_TOKENS;
+async function readUsage(harness = "claude-code", opts = {}) {
+  const merged = { ...opts };
+  if (merged.selfReportTokens === void 0) {
+    const injected = parseTokensEnv(process.env[TOKENS_ENV]);
+    if (injected !== void 0) merged.selfReportTokens = injected;
+  }
+  const result = await readHarnessUsage(harness, merged);
   const now = /* @__PURE__ */ new Date();
   return {
     harness,
-    totalTokens,
-    verified: false,
+    totalTokens: result.source === "demo" ? DEMO_TOTAL_TOKENS : result.totalTokens,
+    verified: result.source === "real",
+    source: result.source,
+    ...result.detail !== void 0 ? { detail: result.detail } : {},
     windowStart: new Date(now.getTime() - 30 * MS_PER_DAY).toISOString(),
     windowEnd: now.toISOString()
   };
 }
-async function tryReadVerifiedUsage(_harness) {
-  return null;
-}
 var TOKEN_MULT = {
   "": 1,
   k: 1e3,
@@ -864,6 +1048,11 @@ export {
   isBlocked,
   addBlock,
   removeBlock,
+  loadOrCreateIdentity,
+  canonicalHelloClaims,
+  signHelloClaims,
+  verifyHelloClaims,
+  classifyHelloIdentity,
   TOPIC_PREFIX,
   leagueTopic,
   LIVE_NOTICE,
@@ -871,6 +1060,7 @@ export {
   parseHandshake,
   loadPeers,
   recordPeer,
+  recordPeerMessage,
   startDiscovery,
   LEAGUES,
   BELOW_LEAGUE,
@@ -881,7 +1071,6 @@ export {
   TOKENS_ENV,
   DEMO_TOTAL_TOKENS,
   readUsage,
-  tryReadVerifiedUsage,
   parseTokensEnv,
   CANDIDATES,
   matches,