vibedate 0.3.1 → 0.4.0

package/dist/{chunk-OVO2CQ7X.js → chunk-ZB56ZBAR.js}

@@ -2,7 +2,7 @@ import {
   CANDIDATES,
   loadProfile,
   matches
-} from "./chunk-3VT4EOBX.js";
+} from "./chunk-43IYNWES.js";
 
 // src/mcp.ts
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
@@ -29,7 +29,7 @@ async function runMcp() {
         `handle: ${p.handle}`,
         `harness: ${p.harness}`,
         `league: ${p.league} League`,
-        `verified: ${p.verified ? "true (read-only OAuth)" : "false (self-reported)"}`,
+        `verified: ${p.verified ? "true (real local usage)" : "false (self-reported or demo)"}`,
         "privacy: raw token usage is local-only; only the league bucket is shared."
       ];
       return { content: [textBlock(lines.join("\n"))] };

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runMcp
-} from "./chunk-OVO2CQ7X.js";
+} from "./chunk-ZB56ZBAR.js";
 import {
   CANDIDATES,
   LIVE_NOTICE,
@@ -17,6 +17,7 @@ import {
   leagueTopic,
   leaguesWithin,
   loadBlocklist,
+  loadOrCreateIdentity,
   loadPeers,
   loadProfile,
   matches,
@@ -27,8 +28,9 @@ import {
   resolveHandle,
   sameHandle,
   saveHandle,
+  signHelloClaims,
   startDiscovery
-} from "./chunk-3VT4EOBX.js";
+} from "./chunk-43IYNWES.js";
 
 // src/cli.ts
 import readline from "readline";
@@ -1398,7 +1400,7 @@ async function handle(req, res, opts) {
 }
 
 // src/cli.ts
-var VERSION = "0.3.1";
+var VERSION = "0.4.0";
 function parsePort(raw) {
   const n = Number(raw);
   if (!Number.isInteger(n) || n < 1 || n > 65535) return void 0;
@@ -1489,6 +1491,21 @@ function parseArgs(argv) {
 function leagueLabel(name) {
   return name === "below-1M" ? "below 1M (not yet in a league)" : `${name} League`;
 }
+function formatTokens(n) {
+  const trim = (v) => String(Math.round(v * 10) / 10);
+  const abs = Math.abs(n);
+  if (abs >= 1e9) return `${trim(n / 1e9)}B`;
+  if (abs >= 1e6) return `${trim(n / 1e6)}M`;
+  if (abs >= 1e3) return `${trim(n / 1e3)}k`;
+  return String(n);
+}
+function verificationText(snapshot) {
+  if (snapshot.source === "real") {
+    return `verified: real usage \u2014 ${formatTokens(snapshot.totalTokens)} tokens from ${snapshot.harness} logs`;
+  }
+  if (snapshot.source === "self-report") return "self-reported (unverified)";
+  return "demo (unverified)";
+}
 function discoveryScope(myLeague, any) {
   const names = any ? allLeagueNames() : leaguesWithin(myLeague, 1);
   const ordered = [myLeague, ...names.filter((n) => n !== myLeague)];
@@ -1510,21 +1527,38 @@ function peerDirection(myLeague, peerLeague, sameBullet = "+") {
   if (d < 0) return { bullet: "\u2193", qual: " \xB7 lower league" };
   return { bullet: sameBullet, qual: "" };
 }
+function buildHello(profile) {
+  const claims = {
+    handle: resolveHandle(),
+    league: profile.league,
+    harness: profile.harness,
+    verified: profile.verified
+  };
+  return { ...claims, ...signHelloClaims(loadOrCreateIdentity(), claims) };
+}
+function usageMark(peer) {
+  return peer.verified === true ? "\u2713" : "~";
+}
+function idMark(peer) {
+  return peer.identityVerified === true ? " \u{1F511}" : "";
+}
+var MARKS_LEGEND = "marks: \u2713 usage verified (real local logs) \xB7 ~ unverified (self-report/demo/legacy) \xB7 \u{1F511} identity-verified (signed hello)";
 async function cmdConnect() {
   const harness = process2.env["VIBEDATING_HARNESS"] ?? "claude-code";
   const handle2 = resolveHandle();
   const snapshot = await readUsage(harness);
   const profile = connectProfile(snapshot, handle2);
+  const identity = loadOrCreateIdentity();
   const lg = league(snapshot.totalTokens);
   process2.stdout.write("\n");
   process2.stdout.write(`  ${leagueLabel(lg.name)}
 `);
   process2.stdout.write(`  handle: ${profile.handle}  \xB7  harness: ${profile.harness}
 `);
-  process2.stdout.write(
-    `  verification: ${profile.verified ? "verified (read-only OAuth)" : "self-reported"}
-`
-  );
+  process2.stdout.write(`  verification: ${verificationText(snapshot)}
+`);
+  process2.stdout.write(`  identity: ed25519 ${identity.publicKeyHex.slice(0, 12)}\u2026 \u2014 signs your hello (\u{1F511})
+`);
   process2.stdout.write("\n");
   process2.stdout.write("  \u2022 raw usage stays local \xB7 only league shared\n\n");
   return 0;
@@ -1573,11 +1607,13 @@ async function cmdMatches(live) {
 `);
     process2.stdout.write(
       `${livePeers.length} live peer${livePeers.length === 1 ? "" : "s"} in range (discovered over the DHT):
-
 `
     );
+    process2.stdout.write(`  ${MARKS_LEGEND}
+
+`);
     for (const p of livePeers) {
-      process2.stdout.write(`  ${p.handle.padEnd(28)} ${p.league} \xB7 ${p.harness}
+      process2.stdout.write(`  ${p.handle.padEnd(28)} ${p.league} \xB7 ${p.harness} ${usageMark(p)}${idMark(p)}
 `);
     }
     process2.stdout.write("\n");
@@ -1613,17 +1649,15 @@ async function cmdDiscover(live, any) {
   if (live && !canShareLive()) grantLiveConsent();
   if (!canShareLive()) {
     process2.stderr.write(
-      "Live discovery is off. It shares ONLY your handle + league + harness (never raw usage)\nwith same-league peers on the public DHT. Opt in: `vibedating discover --live`\n"
+      "Live discovery is off. It shares ONLY your handle + league + harness + verified flag + identity pubkey\n(never raw usage) with same-league peers on the public DHT. Opt in: `vibedating discover --live`\n"
     );
     return 1;
   }
-  const hello = {
-    handle: resolveHandle(),
-    league: profile.league,
-    harness: profile.harness
-  };
+  const hello = buildHello(profile);
   process2.stdout.write("\n");
   process2.stdout.write(`  ${LIVE_NOTICE}
+`);
+  process2.stdout.write(`  ${MARKS_LEGEND}
 `);
   const { topics, acceptLeague } = discoveryScope(profile.league, any);
   const session = await startDiscovery({
@@ -1634,7 +1668,7 @@ async function cmdDiscover(live, any) {
     onPeer: (peer, isNew) => {
       const { bullet, qual } = peerDirection(profile.league, peer.league);
       process2.stdout.write(
-        `  ${bullet} ${peer.handle} (${peer.league}${qual} \xB7 ${peer.harness})${isNew ? "  \u2190 new match" : ""}
+        `  ${bullet} ${peer.handle} (${peer.league}${qual} \xB7 ${peer.harness}) ${usageMark(peer)}${idMark(peer)}${isNew ? "  \u2190 new match" : ""}
 `
       );
     }
@@ -1677,11 +1711,7 @@ async function cmdOpen(port) {
     process2.stdout.write(`
   ${LIVE_NOTICE}
 `);
-    const hello = {
-      handle: resolveHandle(),
-      league: profile.league,
-      harness: profile.harness
-    };
+    const hello = buildHello(profile);
     void startDiscovery({ hello, isBlocked: blockedChecker(), onLink: (link) => live.addLink(link) }).then((s) => {
       session = s;
     }).catch(() => {
@@ -1723,13 +1753,11 @@ async function cmdLive(dating, any, to) {
     process2.stderr.write("Could not enable live discovery. Try `vibedating discover --live`.\n");
     return 1;
   }
-  const hello = {
-    handle: resolveHandle(),
-    league: profile.league,
-    harness: profile.harness
-  };
+  const hello = buildHello(profile);
   process2.stdout.write("\n");
   process2.stdout.write(`  ${LIVE_NOTICE}
+`);
+  process2.stdout.write(`  ${MARKS_LEGEND}
 `);
   process2.stdout.write(
     target !== null ? `  targeted \u2014 auto-opening ${target} when they connect (/quit to stop)
@@ -1743,7 +1771,7 @@ async function cmdLive(dating, any, to) {
     }
     const { qual } = peerDirection(profile.league, link.hello.league);
     process2.stdout.write(
-      `  \xB7 matched ${link.hello.handle} (${link.hello.league}${qual} \xB7 ${link.hello.harness})
+      `  \xB7 matched ${link.hello.handle} (${link.hello.league}${qual} \xB7 ${link.hello.harness}) ${usageMark(link.hello)}${idMark(link.hello)}
 `
     );
     link.onMessage((m) => {
@@ -1761,7 +1789,7 @@ async function cmdLive(dating, any, to) {
       if (target !== null && !sameHandle(link.hello.handle, target)) {
         const { qual } = peerDirection(profile.league, link.hello.league);
         process2.stdout.write(
-          `  + ${link.hello.handle} (${link.hello.league}${qual}) \u2014 not your target
+          `  + ${link.hello.handle} (${link.hello.league}${qual}) ${usageMark(link.hello)}${idMark(link.hello)} \u2014 not your target
 `
         );
         link.close();
@@ -1839,13 +1867,11 @@ async function cmdFind(targetArg, any) {
     process2.stderr.write("Could not enable live discovery. Try `vibedating discover --live`.\n");
     return 1;
   }
-  const hello = {
-    handle: resolveHandle(),
-    league: profile.league,
-    harness: profile.harness
-  };
+  const hello = buildHello(profile);
   process2.stdout.write("\n");
   process2.stdout.write(`  ${LIVE_NOTICE}
+`);
+  process2.stdout.write(`  ${MARKS_LEGEND}
 `);
   process2.stdout.write(
     `  looking for ${target} in your league${any ? " (+ every league)" : " + adjacent"}\u2026
@@ -1862,11 +1888,15 @@ async function cmdFind(targetArg, any) {
       const { qual } = peerDirection(profile.league, peer.league);
       if (sameHandle(peer.handle, target)) {
         found = true;
-        process2.stdout.write(`  \u2605 found ${peer.handle} (${peer.league}${qual} \xB7 ${peer.harness})
-`);
+        process2.stdout.write(
+          `  \u2605 found ${peer.handle} (${peer.league}${qual} \xB7 ${peer.harness}) ${usageMark(peer)}${idMark(peer)}
+`
+        );
       } else {
-        process2.stdout.write(`  + ${peer.handle} (${peer.league}${qual}) \u2014 not your target
-`);
+        process2.stdout.write(
+          `  + ${peer.handle} (${peer.league}${qual}) ${usageMark(peer)}${idMark(peer)} \u2014 not your target
+`
+        );
       }
     }
   });
@@ -1965,7 +1995,10 @@ Usage:
 Privacy:
   Raw token usage is read and stored LOCALLY (~/.vibedating). Only the league
   bucket is ever shared. Live discovery (off by default) shares ONLY your
-  handle + league + harness with same-league peers \u2014 opt in with --live.
+  handle + league + harness + verified flag + identity pubkey (an ed25519 key
+  generated on first connect, stored 0600 in ~/.vibedating/identity.json) with
+  same-league peers \u2014 opt in with --live. Peers are marked: \u2713 usage verified
+  (real local logs) \xB7 ~ unverified \xB7 \u{1F511} identity-verified (signed hello).
 
 Matching:
   discover/live match your league + adjacent (\xB11) tiers by default, so thin

package/dist/index.d.ts

@@ -1,11 +1,16 @@
-import { VibeEvent, Harness, UsageSnapshot } from '@pooriaarab/vibe-core';
-export { Harness, UsageSnapshot, createConsentLedger } from '@pooriaarab/vibe-core';
+import { VibeEvent, UsageSnapshot, UsageSource, Harness, HarnessUsageOptions } from '@pooriaarab/vibe-core';
+export { Harness, UsageSnapshot, UsageSource, createConsentLedger } from '@pooriaarab/vibe-core';
+import { KeyObject } from 'node:crypto';
 
 type Frame = {
     t: 'hello';
     handle: string;
     league: string;
     harness: string;
+    verified?: boolean;
+    pubkey?: string;
+    nonce?: string;
+    sig?: string;
 } | {
     t: 'msg';
     id: string;
@@ -57,11 +62,7 @@ interface ReceivedMedia {
 
 interface PeerLink {
     /** The validated identity of the remote peer (from the hello handshake). */
-    readonly hello: {
-        handle: string;
-        league: string;
-        harness: string;
-    };
+    readonly hello: PeerHello;
     /** Send a line of text as a `msg` frame. */
     send(text: string): void;
     /** Read a file from disk and send it as a chunked media transfer. */
@@ -99,14 +100,36 @@ declare const TOPIC_PREFIX = "vibedate:";
  * entire discovery mechanism. Pure.
  */
 declare function leagueTopic(leagueName: string): Buffer;
-/** The ONLY three fields that ever leave the machine over a peer connection. */
+/**
+ * The fields that ever leave the machine over a peer connection: handle, league,
+ * harness, and (optionally) the self-asserted usage-verification flag plus the
+ * identity proof (pubkey/nonce/sig). NEVER raw usage — no token totals, no logs.
+ * `verified`/`pubkey` are undefined for legacy peers that predate them; both
+ * `undefined` and `false` display as unverified (~).
+ */
 interface PeerHello {
     readonly handle: string;
     readonly league: string;
     readonly harness: string;
+    /**
+     * Self-asserted: the sender's usage came from real local logs (see readUsage).
+     * Bound to the sender's key by the identity signature when `pubkey` is present.
+     */
+    readonly verified?: boolean;
+    /** Raw ed25519 public key (64 hex) — the persistent identity this hello signs. */
+    readonly pubkey?: string;
+    /** Random per-hello nonce (hex) covered by the signature. */
+    readonly nonce?: string;
+    /** ed25519 signature (128 hex) over `handle|league|harness|verified|nonce`. */
+    readonly sig?: string;
+    /**
+     * LOCAL-DERIVED, never on the wire: true when this hello's signature verified
+     * against its pubkey (see classifyHelloIdentity). Marked 🔑 in the UI.
+     */
+    readonly identityVerified?: boolean;
 }
 /** One-line privacy notice printed before joining the swarm. */
-declare const LIVE_NOTICE = "live discovery: sharing only your handle + league + harness (never raw usage) with same-league peers on the public DHT";
+declare const LIVE_NOTICE = "live discovery: sharing only your handle + league + harness + verified flag + identity pubkey (never raw usage) with same-league peers on the public DHT";
 /**
  * Serialize a hello to the single JSON line sent on connect. Built key-by-key
  * from the allowlist — even if a caller sneaks extra properties onto the
@@ -124,6 +147,8 @@ declare function parseHandshake(raw: string | Buffer): PeerHello | null;
 interface StoredPeer extends PeerHello {
     readonly firstSeenAt: string;
     readonly lastSeenAt: string;
+    /** LOCAL metadata: when the last `msg` from this peer arrived (never on the wire). */
+    readonly lastMessageAt?: string;
 }
 /** Load persisted live peers, or `[]` if none/corrupt. Local-only data. */
 declare function loadPeers(dir?: string): StoredPeer[];
@@ -135,6 +160,12 @@ declare function recordPeer(hello: PeerHello, dir?: string, now?: Date): {
     peer: StoredPeer;
     isNew: boolean;
 };
+/**
+ * Stamp `lastMessageAt` on a stored peer (a `msg` just arrived from them).
+ * Local metadata only; never on the wire. Returns false when the handle isn't
+ * a known peer. Never throws — best-effort bookkeeping.
+ */
+declare function recordPeerMessage(handle: string, dir?: string, now?: Date): boolean;
 /** Injection point for the match notification (defaults to vibe-core notify). */
 type NotifySink = (event: VibeEvent) => void;
 interface DiscoveryOptions {
@@ -208,14 +239,74 @@ interface DiscoverySession {
 declare function startDiscovery(opts: DiscoveryOptions): Promise<DiscoverySession>;
 
 /**
- * vibedating — dating by token usage.
+ * Persistent ed25519 identity — binds a handle to a keypair so a peer cannot
+ * impersonate it.
  *
- * v0 library surface: league bucketing, local usage reading, and in-league
- * matching against a seeded set of candidate profiles. Raw usage never leaves
- * the machine; only the league bucket is shared.
+ * The keypair lives at `~/.vibedating/identity.json` (mode 0600), generated on
+ * first use and reused across runs. A hello that carries a `pubkey` must also
+ * carry a valid `sig` over the canonical claims string
+ * `handle|league|harness|verified|nonce`; anything else claiming a key is an
+ * impersonation attempt and the peer is DROPPED. A hello with no `pubkey` at
+ * all is a legacy peer — accepted, but never identity-verified.
  *
- * Builds on `@pooriaarab/vibe-core` (UsageSnapshot / Harness / consent ledger).
+ * node:crypto only — no new dependency. The private key never leaves the file;
+ * only the raw public key (64 hex) and signatures (128 hex) travel on hellos.
+ */
+
+/** A loaded identity: the raw public key (wire form) plus both key objects. */
+interface Identity {
+    /** Raw 32-byte ed25519 public key, hex (64 chars) — the wire form. */
+    readonly publicKeyHex: string;
+    readonly publicKey: KeyObject;
+    readonly privateKey: KeyObject;
+    /** ISO timestamp of key generation (first connect). */
+    readonly createdAt: string;
+}
+/** The hello fields a signature commits to (a PeerHello minus its proof). */
+interface HelloClaims {
+    readonly handle: string;
+    readonly league: string;
+    readonly harness: string;
+    readonly verified?: boolean;
+}
+/** The wire proof attached to a hello: pubkey + nonce + signature, all hex. */
+interface IdentityProof {
+    readonly pubkey: string;
+    readonly nonce: string;
+    readonly sig: string;
+}
+/**
+ * Load the persistent keypair, generating + storing it (mode 0600) on first
+ * use. A missing or corrupt file is (re)generated — never throws on disk
+ * content. Idempotent across runs: same file → same key → same pubkey.
+ */
+declare function loadOrCreateIdentity(dir?: string): Identity;
+/**
+ * The canonical string an identity signature commits to:
+ * `handle|league|harness|verified|nonce` — verified rendered as `true`/`false`.
+ * Pure; both sides compute it byte-identically or the signature cannot verify.
+ */
+declare function canonicalHelloClaims(claims: HelloClaims & {
+    nonce: string;
+}): string;
+/**
+ * Sign hello claims with the persistent identity. A fresh random 16-byte nonce
+ * per call, so two hellos never share a signature. Returns only the wire proof
+ * fields — the private key stays put.
  */
+declare function signHelloClaims(identity: Identity, claims: HelloClaims): IdentityProof;
+/**
+ * Verify a claimed proof against hello claims. NEVER throws — any anomaly
+ * (bad hex, bad key, bad signature) is simply `false`.
+ */
+declare function verifyHelloClaims(claims: HelloClaims, proof: IdentityProof): boolean;
+/** What an incoming hello's identity material amounts to. */
+type IdentityVerdict = 'verified' | 'legacy' | 'drop';
+/**
+ * Classify an incoming hello's identity claim. Pure decision, no IO — the
+ * caller (discovery) turns 'drop' into "never recorded, never paired".
+ */
+declare function classifyHelloIdentity(hello: HelloClaims & Partial<IdentityProof>): IdentityVerdict;
 
 /**
  * A usage league (volume bucket). `max` is inclusive; the top tier is open-ended
@@ -277,26 +368,34 @@ declare const TOKENS_ENV = "VIBEDATING_TOKENS";
  */
 declare const DEMO_TOTAL_TOKENS = 23400000;
 /**
- * v0 usage reader. Resolution order:
- *
- *   1. (future) read-only OAuth → `verified: true`. **NOT implemented in v0** —
- *      see {@link tryReadVerifiedUsage}. This arm is the deliberate seam.
- *   2. a self-reported value from the {@link TOKENS_ENV} env var → `verified: false`.
- *   3. the demo value {@link DEMO_TOTAL_TOKENS} → `verified: false`.
- *
- * The snapshot's `totalTokens` is the only thing that must never leave the
- * machine; everything downstream consumes only the league bucket.
+ * A usage snapshot with honest provenance. `source` says where `totalTokens`
+ * came from; `verified` is true ONLY for `source === 'real'` (measured from
+ * the harness's own local session logs). The token total is the one thing that
+ * must never leave the machine; everything downstream consumes only the league
+ * bucket plus the verified flag.
  */
-declare function readUsage(harness?: Harness): Promise<UsageSnapshot>;
+interface LocalUsageSnapshot extends UsageSnapshot {
+    /** Where the total came from: measured locally, self-reported, or demo. */
+    readonly source: UsageSource;
+    /** Short human-facing provenance note from the reader (local display only). */
+    readonly detail?: string;
+}
 /**
- * Future home of read-only OAuth verification. Returns `null` in v0.
+ * Usage reader, backed by vibe-core's {@link readHarnessUsage}. Resolution order:
+ *
+ *   1. a self-reported value — explicit `opts.selfReportTokens`, or the
+ *      {@link TOKENS_ENV} env var (suffix-friendly: `12M`, `1.2B`), or vibe-core's
+ *      own `VIBE_TOKENS` env → `source: 'self-report'` → `verified: false`.
+ *   2. the harness's REAL local session logs (claude-code / codex / gemini / pi /
+ *      kimi), read from disk by vibe-core → `source: 'real'` → `verified: true`.
+ *   3. the demo value {@link DEMO_TOTAL_TOKENS} → `source: 'demo'` →
+ *      `verified: false`.
  *
- * Implementing this (reading a real, provider-attested usage scope) flips the
- * snapshot to `verified: true` and is what makes the league trustworthy. Kept as
- * an explicit, named seam rather than a TODO comment so the privacy contract is
- * visible at the call site.
+ * The demo arm keeps vibedating's own demo total (10M league, non-empty demo
+ * pool) rather than vibe-core's smaller placeholder, so demo behavior is
+ * unchanged. Raw usage never leaves the machine.
  */
-declare function tryReadVerifiedUsage(_harness: Harness): Promise<UsageSnapshot | null>;
+declare function readUsage(harness?: Harness, opts?: HarnessUsageOptions): Promise<LocalUsageSnapshot>;
 /**
  * Parse a self-reported token count: a plain integer (`23400000`), or a suffixed
  * value (`12M`, `1.2B`, `500k`, `500K`). Returns `undefined` for anything that is
@@ -324,4 +423,4 @@ declare const CANDIDATES: readonly Candidate[];
  */
 declare function matches(myLeague: string, candidates?: readonly Candidate[]): Candidate[];
 
-export { BELOW_LEAGUE, CANDIDATES, type Candidate, DEMO_TOTAL_TOKENS, type DiscoveryOptions, type DiscoverySession, LEAGUES, LIVE_NOTICE, type League, type PeerHello, type StoredPeer, TOKENS_ENV, TOPIC_PREFIX, allLeagueNames, league, leagueIndex, leagueTopic, leaguesWithin, loadPeers, matches, parseHandshake, parseTokensEnv, readUsage, recordPeer, serializeHandshake, startDiscovery, tryReadVerifiedUsage };
+export { BELOW_LEAGUE, CANDIDATES, type Candidate, DEMO_TOTAL_TOKENS, type DiscoveryOptions, type DiscoverySession, type HelloClaims, type Identity, type IdentityProof, type IdentityVerdict, LEAGUES, LIVE_NOTICE, type League, type LocalUsageSnapshot, type PeerHello, type StoredPeer, TOKENS_ENV, TOPIC_PREFIX, allLeagueNames, canonicalHelloClaims, classifyHelloIdentity, league, leagueIndex, leagueTopic, leaguesWithin, loadOrCreateIdentity, loadPeers, matches, parseHandshake, parseTokensEnv, readUsage, recordPeer, recordPeerMessage, serializeHandshake, signHelloClaims, startDiscovery, verifyHelloClaims };

package/dist/index.js

@@ -7,21 +7,26 @@ import {
   TOKENS_ENV,
   TOPIC_PREFIX,
   allLeagueNames,
+  canonicalHelloClaims,
+  classifyHelloIdentity,
   createConsentLedger,
   league,
   leagueIndex,
   leagueTopic,
   leaguesWithin,
+  loadOrCreateIdentity,
   loadPeers,
   matches,
   parseHandshake,
   parseTokensEnv,
   readUsage,
   recordPeer,
+  recordPeerMessage,
   serializeHandshake,
+  signHelloClaims,
   startDiscovery,
-  tryReadVerifiedUsage
-} from "./chunk-3VT4EOBX.js";
+  verifyHelloClaims
+} from "./chunk-43IYNWES.js";
 export {
   BELOW_LEAGUE,
   CANDIDATES,
@@ -31,18 +36,23 @@ export {
   TOKENS_ENV,
   TOPIC_PREFIX,
   allLeagueNames,
+  canonicalHelloClaims,
+  classifyHelloIdentity,
   createConsentLedger,
   league,
   leagueIndex,
   leagueTopic,
   leaguesWithin,
+  loadOrCreateIdentity,
   loadPeers,
   matches,
   parseHandshake,
   parseTokensEnv,
   readUsage,
   recordPeer,
+  recordPeerMessage,
   serializeHandshake,
+  signHelloClaims,
   startDiscovery,
-  tryReadVerifiedUsage
+  verifyHelloClaims
 };

package/dist/mcp.js

@@ -1,7 +1,7 @@
 import {
   runMcp
-} from "./chunk-OVO2CQ7X.js";
-import "./chunk-3VT4EOBX.js";
+} from "./chunk-ZB56ZBAR.js";
+import "./chunk-43IYNWES.js";
 export {
   runMcp
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibedate",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Dating by tokens — matched by usage league across agentic CLIs. Raw usage stays local; only your league is shared. CLI + local web app + MCP. Local-first.",
   "type": "module",
   "license": "MIT",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@pooriaarab/vibe-core": "^0.2.0",
+    "@pooriaarab/vibe-core": "^0.3.0",
     "hyperswarm": "^4.17.0"
   },
   "devDependencies": {