vibedate 0.3.1 → 0.4.1

package/dist/index.d.ts

@@ -1,11 +1,16 @@
-import { VibeEvent, Harness, UsageSnapshot } from '@pooriaarab/vibe-core';
-export { Harness, UsageSnapshot, createConsentLedger } from '@pooriaarab/vibe-core';
+import { VibeEvent, UsageSnapshot, UsageSource, Harness, HarnessUsageOptions } from '@pooriaarab/vibe-core';
+export { Harness, UsageSnapshot, UsageSource, createConsentLedger } from '@pooriaarab/vibe-core';
+import { KeyObject } from 'node:crypto';
 
 type Frame = {
     t: 'hello';
     handle: string;
     league: string;
     harness: string;
+    verified?: boolean;
+    pubkey?: string;
+    nonce?: string;
+    sig?: string;
 } | {
     t: 'msg';
     id: string;
@@ -57,11 +62,7 @@ interface ReceivedMedia {
 
 interface PeerLink {
     /** The validated identity of the remote peer (from the hello handshake). */
-    readonly hello: {
-        handle: string;
-        league: string;
-        harness: string;
-    };
+    readonly hello: PeerHello;
     /** Send a line of text as a `msg` frame. */
     send(text: string): void;
     /** Read a file from disk and send it as a chunked media transfer. */
@@ -99,14 +100,36 @@ declare const TOPIC_PREFIX = "vibedate:";
  * entire discovery mechanism. Pure.
  */
 declare function leagueTopic(leagueName: string): Buffer;
-/** The ONLY three fields that ever leave the machine over a peer connection. */
+/**
+ * The fields that ever leave the machine over a peer connection: handle, league,
+ * harness, and (optionally) the self-asserted usage-verification flag plus the
+ * identity proof (pubkey/nonce/sig). NEVER raw usage — no token totals, no logs.
+ * `verified`/`pubkey` are undefined for legacy peers that predate them; both
+ * `undefined` and `false` display as unverified (~).
+ */
 interface PeerHello {
     readonly handle: string;
     readonly league: string;
     readonly harness: string;
+    /**
+     * Self-asserted: the sender's usage came from real local logs (see readUsage).
+     * Bound to the sender's key by the identity signature when `pubkey` is present.
+     */
+    readonly verified?: boolean;
+    /** Raw ed25519 public key (64 hex) — the persistent identity this hello signs. */
+    readonly pubkey?: string;
+    /** Random per-hello nonce (hex) covered by the signature. */
+    readonly nonce?: string;
+    /** ed25519 signature (128 hex) over `handle|league|harness|verified|nonce`. */
+    readonly sig?: string;
+    /**
+     * LOCAL-DERIVED, never on the wire: true when this hello's signature verified
+     * against its pubkey (see classifyHelloIdentity). Marked 🔑 in the UI.
+     */
+    readonly identityVerified?: boolean;
 }
 /** One-line privacy notice printed before joining the swarm. */
-declare const LIVE_NOTICE = "live discovery: sharing only your handle + league + harness (never raw usage) with same-league peers on the public DHT";
+declare const LIVE_NOTICE = "live discovery: sharing only your handle + league + harness + verified flag + identity pubkey (never raw usage) with same-league peers on the public DHT";
 /**
  * Serialize a hello to the single JSON line sent on connect. Built key-by-key
  * from the allowlist — even if a caller sneaks extra properties onto the
@@ -124,6 +147,8 @@ declare function parseHandshake(raw: string | Buffer): PeerHello | null;
 interface StoredPeer extends PeerHello {
     readonly firstSeenAt: string;
     readonly lastSeenAt: string;
+    /** LOCAL metadata: when the last `msg` from this peer arrived (never on the wire). */
+    readonly lastMessageAt?: string;
 }
 /** Load persisted live peers, or `[]` if none/corrupt. Local-only data. */
 declare function loadPeers(dir?: string): StoredPeer[];
@@ -135,6 +160,12 @@ declare function recordPeer(hello: PeerHello, dir?: string, now?: Date): {
     peer: StoredPeer;
     isNew: boolean;
 };
+/**
+ * Stamp `lastMessageAt` on a stored peer (a `msg` just arrived from them).
+ * Local metadata only; never on the wire. Returns false when the handle isn't
+ * a known peer. Never throws — best-effort bookkeeping.
+ */
+declare function recordPeerMessage(handle: string, dir?: string, now?: Date): boolean;
 /** Injection point for the match notification (defaults to vibe-core notify). */
 type NotifySink = (event: VibeEvent) => void;
 interface DiscoveryOptions {
@@ -208,14 +239,74 @@ interface DiscoverySession {
 declare function startDiscovery(opts: DiscoveryOptions): Promise<DiscoverySession>;
 
 /**
- * vibedating — dating by token usage.
+ * Persistent ed25519 identity — binds a handle to a keypair so a peer cannot
+ * impersonate it.
  *
- * v0 library surface: league bucketing, local usage reading, and in-league
- * matching against a seeded set of candidate profiles. Raw usage never leaves
- * the machine; only the league bucket is shared.
+ * The keypair lives at `~/.vibedating/identity.json` (mode 0600), generated on
+ * first use and reused across runs. A hello that carries a `pubkey` must also
+ * carry a valid `sig` over the canonical claims string
+ * `handle|league|harness|verified|nonce`; anything else claiming a key is an
+ * impersonation attempt and the peer is DROPPED. A hello with no `pubkey` at
+ * all is a legacy peer — accepted, but never identity-verified.
  *
- * Builds on `@pooriaarab/vibe-core` (UsageSnapshot / Harness / consent ledger).
+ * node:crypto only — no new dependency. The private key never leaves the file;
+ * only the raw public key (64 hex) and signatures (128 hex) travel on hellos.
+ */
+
+/** A loaded identity: the raw public key (wire form) plus both key objects. */
+interface Identity {
+    /** Raw 32-byte ed25519 public key, hex (64 chars) — the wire form. */
+    readonly publicKeyHex: string;
+    readonly publicKey: KeyObject;
+    readonly privateKey: KeyObject;
+    /** ISO timestamp of key generation (first connect). */
+    readonly createdAt: string;
+}
+/** The hello fields a signature commits to (a PeerHello minus its proof). */
+interface HelloClaims {
+    readonly handle: string;
+    readonly league: string;
+    readonly harness: string;
+    readonly verified?: boolean;
+}
+/** The wire proof attached to a hello: pubkey + nonce + signature, all hex. */
+interface IdentityProof {
+    readonly pubkey: string;
+    readonly nonce: string;
+    readonly sig: string;
+}
+/**
+ * Load the persistent keypair, generating + storing it (mode 0600) on first
+ * use. A missing or corrupt file is (re)generated — never throws on disk
+ * content. Idempotent across runs: same file → same key → same pubkey.
+ */
+declare function loadOrCreateIdentity(dir?: string): Identity;
+/**
+ * The canonical string an identity signature commits to:
+ * `handle|league|harness|verified|nonce` — verified rendered as `true`/`false`.
+ * Pure; both sides compute it byte-identically or the signature cannot verify.
+ */
+declare function canonicalHelloClaims(claims: HelloClaims & {
+    nonce: string;
+}): string;
+/**
+ * Sign hello claims with the persistent identity. A fresh random 16-byte nonce
+ * per call, so two hellos never share a signature. Returns only the wire proof
+ * fields — the private key stays put.
  */
+declare function signHelloClaims(identity: Identity, claims: HelloClaims): IdentityProof;
+/**
+ * Verify a claimed proof against hello claims. NEVER throws — any anomaly
+ * (bad hex, bad key, bad signature) is simply `false`.
+ */
+declare function verifyHelloClaims(claims: HelloClaims, proof: IdentityProof): boolean;
+/** What an incoming hello's identity material amounts to. */
+type IdentityVerdict = 'verified' | 'legacy' | 'drop';
+/**
+ * Classify an incoming hello's identity claim. Pure decision, no IO — the
+ * caller (discovery) turns 'drop' into "never recorded, never paired".
+ */
+declare function classifyHelloIdentity(hello: HelloClaims & Partial<IdentityProof>): IdentityVerdict;
 
 /**
  * A usage league (volume bucket). `max` is inclusive; the top tier is open-ended
@@ -277,26 +368,34 @@ declare const TOKENS_ENV = "VIBEDATING_TOKENS";
  */
 declare const DEMO_TOTAL_TOKENS = 23400000;
 /**
- * v0 usage reader. Resolution order:
- *
- *   1. (future) read-only OAuth → `verified: true`. **NOT implemented in v0** —
- *      see {@link tryReadVerifiedUsage}. This arm is the deliberate seam.
- *   2. a self-reported value from the {@link TOKENS_ENV} env var → `verified: false`.
- *   3. the demo value {@link DEMO_TOTAL_TOKENS} → `verified: false`.
- *
- * The snapshot's `totalTokens` is the only thing that must never leave the
- * machine; everything downstream consumes only the league bucket.
+ * A usage snapshot with honest provenance. `source` says where `totalTokens`
+ * came from; `verified` is true ONLY for `source === 'real'` (measured from
+ * the harness's own local session logs). The token total is the one thing that
+ * must never leave the machine; everything downstream consumes only the league
+ * bucket plus the verified flag.
  */
-declare function readUsage(harness?: Harness): Promise<UsageSnapshot>;
+interface LocalUsageSnapshot extends UsageSnapshot {
+    /** Where the total came from: measured locally, self-reported, or demo. */
+    readonly source: UsageSource;
+    /** Short human-facing provenance note from the reader (local display only). */
+    readonly detail?: string;
+}
 /**
- * Future home of read-only OAuth verification. Returns `null` in v0.
+ * Usage reader, backed by vibe-core's {@link readHarnessUsage}. Resolution order:
+ *
+ *   1. a self-reported value — explicit `opts.selfReportTokens`, or the
+ *      {@link TOKENS_ENV} env var (suffix-friendly: `12M`, `1.2B`), or vibe-core's
+ *      own `VIBE_TOKENS` env → `source: 'self-report'` → `verified: false`.
+ *   2. the harness's REAL local session logs (claude-code / codex / gemini / pi /
+ *      kimi), read from disk by vibe-core → `source: 'real'` → `verified: true`.
+ *   3. the demo value {@link DEMO_TOTAL_TOKENS} → `source: 'demo'` →
+ *      `verified: false`.
  *
- * Implementing this (reading a real, provider-attested usage scope) flips the
- * snapshot to `verified: true` and is what makes the league trustworthy. Kept as
- * an explicit, named seam rather than a TODO comment so the privacy contract is
- * visible at the call site.
+ * The demo arm keeps vibedating's own demo total (10M league, non-empty demo
+ * pool) rather than vibe-core's smaller placeholder, so demo behavior is
+ * unchanged. Raw usage never leaves the machine.
  */
-declare function tryReadVerifiedUsage(_harness: Harness): Promise<UsageSnapshot | null>;
+declare function readUsage(harness?: Harness, opts?: HarnessUsageOptions): Promise<LocalUsageSnapshot>;
 /**
  * Parse a self-reported token count: a plain integer (`23400000`), or a suffixed
  * value (`12M`, `1.2B`, `500k`, `500K`). Returns `undefined` for anything that is
@@ -324,4 +423,4 @@ declare const CANDIDATES: readonly Candidate[];
  */
 declare function matches(myLeague: string, candidates?: readonly Candidate[]): Candidate[];
 
-export { BELOW_LEAGUE, CANDIDATES, type Candidate, DEMO_TOTAL_TOKENS, type DiscoveryOptions, type DiscoverySession, LEAGUES, LIVE_NOTICE, type League, type PeerHello, type StoredPeer, TOKENS_ENV, TOPIC_PREFIX, allLeagueNames, league, leagueIndex, leagueTopic, leaguesWithin, loadPeers, matches, parseHandshake, parseTokensEnv, readUsage, recordPeer, serializeHandshake, startDiscovery, tryReadVerifiedUsage };
+export { BELOW_LEAGUE, CANDIDATES, type Candidate, DEMO_TOTAL_TOKENS, type DiscoveryOptions, type DiscoverySession, type HelloClaims, type Identity, type IdentityProof, type IdentityVerdict, LEAGUES, LIVE_NOTICE, type League, type LocalUsageSnapshot, type PeerHello, type StoredPeer, TOKENS_ENV, TOPIC_PREFIX, allLeagueNames, canonicalHelloClaims, classifyHelloIdentity, league, leagueIndex, leagueTopic, leaguesWithin, loadOrCreateIdentity, loadPeers, matches, parseHandshake, parseTokensEnv, readUsage, recordPeer, recordPeerMessage, serializeHandshake, signHelloClaims, startDiscovery, verifyHelloClaims };

package/dist/index.js

@@ -7,21 +7,26 @@ import {
   TOKENS_ENV,
   TOPIC_PREFIX,
   allLeagueNames,
+  canonicalHelloClaims,
+  classifyHelloIdentity,
   createConsentLedger,
   league,
   leagueIndex,
   leagueTopic,
   leaguesWithin,
+  loadOrCreateIdentity,
   loadPeers,
   matches,
   parseHandshake,
   parseTokensEnv,
   readUsage,
   recordPeer,
+  recordPeerMessage,
   serializeHandshake,
+  signHelloClaims,
   startDiscovery,
-  tryReadVerifiedUsage
-} from "./chunk-3VT4EOBX.js";
+  verifyHelloClaims
+} from "./chunk-43IYNWES.js";
 export {
   BELOW_LEAGUE,
   CANDIDATES,
@@ -31,18 +36,23 @@ export {
   TOKENS_ENV,
   TOPIC_PREFIX,
   allLeagueNames,
+  canonicalHelloClaims,
+  classifyHelloIdentity,
   createConsentLedger,
   league,
   leagueIndex,
   leagueTopic,
   leaguesWithin,
+  loadOrCreateIdentity,
   loadPeers,
   matches,
   parseHandshake,
   parseTokensEnv,
   readUsage,
   recordPeer,
+  recordPeerMessage,
   serializeHandshake,
+  signHelloClaims,
   startDiscovery,
-  tryReadVerifiedUsage
+  verifyHelloClaims
 };

package/dist/mcp.js

@@ -1,7 +1,7 @@
 import {
   runMcp
-} from "./chunk-OVO2CQ7X.js";
-import "./chunk-3VT4EOBX.js";
+} from "./chunk-ZB56ZBAR.js";
+import "./chunk-43IYNWES.js";
 export {
   runMcp
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibedate",
-  "version": "0.3.1",
+  "version": "0.4.1",
   "description": "Dating by tokens — matched by usage league across agentic CLIs. Raw usage stays local; only your league is shared. CLI + local web app + MCP. Local-first.",
   "type": "module",
   "license": "MIT",
@@ -29,7 +29,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "@pooriaarab/vibe-core": "^0.2.0",
+    "@pooriaarab/vibe-core": "^0.3.0",
     "hyperswarm": "^4.17.0"
   },
   "devDependencies": {