pnasyscnct 0.2.0__tar.gz

pnasyscnct-0.2.0/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: pnasyscnct
+Version: 0.2.0
+Summary: PNASystems Connect — tailscale-style Pi remote: computer + Pi, SSH over queue, MCP
+Author: PNASystems
+Project-URL: Homepage, https://github.com/Powerentity303/PNASystems_CRP
+Project-URL: Repository, https://github.com/Powerentity303/PNASystems_CRP
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=41
+Requires-Dist: pnasys-encryption-service>=1.12
+Requires-Dist: pnasys-ses>=0.1.0
+
+# pnasyscnct — tailscale-style Pi remote (computer + Pi)
+
+One package, both ends. Install on Windows 11 (TPM 2.0) and on Pi 4/5
+(Raspberry Pi OS, headless or desktop) — via pip or via GitHub, identical:
+
+```bash
+pip install pnasyscnct
+# or:
+pip install git+https://github.com/Powerentity303/PNASystems_CRP.git
+# or the one-liner (venv-safe on Pi OS):
+curl -fsSL https://raw.githubusercontent.com/Powerentity303/PNASystems_CRP/main/installer.sh | bash
+```
+
+This gives you **both** commands: `pnasyscnct` (computer) and `pnasyscrp` (Pi).
+
+## Computer
+
+```bash
+pnasyscnct setup            # same questions + TPM-sealed vault, prints computer ID
+pnasyscnct setup --ssh      # scan for the Pi's pairing request, verify, rotate link key
+pnasyscnct ssh              # remote shell (reconnects on loss)
+pnasyscnct mcp --enckey K   # MCP server (OpenCode), SSH always active
+```
+
+OpenCode (`opencode.json`):
+
+```json
+{"mcp": {"pnasys-ssh": {"type": "local",
+  "command": ["pnasyscnct", "mcp", "--enckey", "LINK_KEY"],
+  "enabled": true}}}
+```
+
+## Pi
+
+```bash
+pnasyscrp setup             # identity + AES vault, prints access key
+pnasyscrp enable            # listener + fresh session key (10-min idle auto-off)
+pnasyscrp ssh setup         # pairing: key first, code issued, enter computer ID
+pnasyscrp ssh enable        # presence + listener (root-aware exec)
+pnasyscrp update            # reinstall latest (cache-busted)
+```
+
+Linking in short: computer `setup --ssh` scans → Pi `ssh setup` sends an
+encrypted pairing code to that computer ID → computer verifies with the
+pairing key, both adopt a fresh link key → Pi verifies the answer the same
+way. Vercel only relays opaque blobs. Pi exec runs root-aware (`sudo -n`
+when not uid 0).

pnasyscnct-0.2.0/README.md

@@ -0,0 +1,47 @@
+# pnasyscnct — tailscale-style Pi remote (computer + Pi)
+
+One package, both ends. Install on Windows 11 (TPM 2.0) and on Pi 4/5
+(Raspberry Pi OS, headless or desktop) — via pip or via GitHub, identical:
+
+```bash
+pip install pnasyscnct
+# or:
+pip install git+https://github.com/Powerentity303/PNASystems_CRP.git
+# or the one-liner (venv-safe on Pi OS):
+curl -fsSL https://raw.githubusercontent.com/Powerentity303/PNASystems_CRP/main/installer.sh | bash
+```
+
+This gives you **both** commands: `pnasyscnct` (computer) and `pnasyscrp` (Pi).
+
+## Computer
+
+```bash
+pnasyscnct setup            # same questions + TPM-sealed vault, prints computer ID
+pnasyscnct setup --ssh      # scan for the Pi's pairing request, verify, rotate link key
+pnasyscnct ssh              # remote shell (reconnects on loss)
+pnasyscnct mcp --enckey K   # MCP server (OpenCode), SSH always active
+```
+
+OpenCode (`opencode.json`):
+
+```json
+{"mcp": {"pnasys-ssh": {"type": "local",
+  "command": ["pnasyscnct", "mcp", "--enckey", "LINK_KEY"],
+  "enabled": true}}}
+```
+
+## Pi
+
+```bash
+pnasyscrp setup             # identity + AES vault, prints access key
+pnasyscrp enable            # listener + fresh session key (10-min idle auto-off)
+pnasyscrp ssh setup         # pairing: key first, code issued, enter computer ID
+pnasyscrp ssh enable        # presence + listener (root-aware exec)
+pnasyscrp update            # reinstall latest (cache-busted)
+```
+
+Linking in short: computer `setup --ssh` scans → Pi `ssh setup` sends an
+encrypted pairing code to that computer ID → computer verifies with the
+pairing key, both adopt a fresh link key → Pi verifies the answer the same
+way. Vercel only relays opaque blobs. Pi exec runs root-aware (`sudo -n`
+when not uid 0).

pnasyscnct-0.2.0/pyproject.toml

@@ -0,0 +1,23 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pnasyscnct"
+version = "0.2.0"
+description = "PNASystems Connect — tailscale-style Pi remote: computer + Pi, SSH over queue, MCP"
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = ["cryptography>=41", "pnasys-encryption-service>=1.12", "pnasys-ses>=0.1.0"]
+authors = [{name="PNASystems"}]
+
+[project.urls]
+Homepage = "https://github.com/Powerentity303/PNASystems_CRP"
+Repository = "https://github.com/Powerentity303/PNASystems_CRP"
+
+[project.scripts]
+pnasyscnct = "pnasyscnct.cli:main"
+pnasyscrp = "pnasyscnct.pi_cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

pnasyscnct-0.2.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

pnasyscnct-0.2.0/src/pnasyscnct/__init__.py

@@ -0,0 +1,2 @@
+"""pnasyscnct — tailscale-style Pi remote (computer + Pi sides)."""
+__version__ = "0.2.0"

pnasyscnct-0.2.0/src/pnasyscnct/cli.py

@@ -0,0 +1,307 @@
+"""pnasyscnct — computer side (Windows 11, TPM 2.0).
+
+  pnasyscnct setup            fav restaurant/animal/color + pc user/pass + local pw
+  pnasyscnct setup --ssh      link a Pi (scan for its pairing request)
+  pnasyscnct ssh              remote shell into the linked Pi (reconnects)
+  pnasyscnct mcp --enckey K   stdio MCP server, SSH always active
+  pnasyscnct selftest         offline crypto check
+"""
+from __future__ import annotations
+
+import base64
+import getpass
+import json
+import os
+import sys
+import time
+import uuid
+from pathlib import Path
+
+from pnasyscnct import link as L
+from pnasyscnct.common import (decrypt_local, derive_key_iv, encrypt_local,
+                               generate_session_key, interleave3, make_access_sha1024,
+                               make_access_variant, make_pi_blob, secure_pack,
+                               secure_unpack, sha256_hex)
+
+HOME = Path.home()
+SAFE = HOME / ".pnasys_crp"
+VAULT = SAFE / ".vault"
+CREDS = VAULT / "creds.txt"
+ACCESS = VAULT / "access.enc.json"
+
+
+def _ensure() -> None:
+    SAFE.mkdir(mode=0o700, parents=True, exist_ok=True)
+    VAULT.mkdir(mode=0o700, parents=True, exist_ok=True)
+
+
+def _save_state(s: dict) -> None:
+    _ensure()
+    cur = L.load_state()
+    cur.update(s)
+    (SAFE / "state.json").write_text(json.dumps(cur, indent=2))
+
+
+def cmd_setup() -> int:
+    _ensure()
+    print("pnasyscnct setup (computer)")
+    fav_rest = input("Favorite restaurant: ").strip()
+    fav_animal = input("Favorite animal: ").strip()
+    fav_color = input("Favorite color: ").strip()
+    pc_user = input("Computer username: ").strip()
+    pc_pass = getpass.getpass("Computer password: ")
+    local_pw = getpass.getpass("Local encryption password (anything): ")
+    if not all([fav_rest, fav_animal, fav_color, pc_user, pc_pass, local_pw]):
+        print("All fields required.", file=sys.stderr)
+        return 2
+    _ = derive_key_iv(local_pw)
+    CREDS.write_text(json.dumps(encrypt_local(f"{pc_user}\n{pc_pass}\n".encode(), local_pw)))
+    computer_id = uuid.uuid4().hex
+    uuid1 = str(uuid.uuid4())
+    blob = make_pi_blob(uuid1, fav_color, fav_rest)
+    _, _u2, access = make_access_variant(uuid1, fav_color, fav_rest)
+    _ = fav_animal, make_access_sha1024(blob, uuid1, fav_color, fav_rest)
+    ACCESS.write_text(json.dumps(encrypt_local(access.encode(), local_pw)))
+    from pnasys_ses import SecureEncryptionService as SES
+
+    SES.CreateEncryptedFile(json.dumps({"computer_id": computer_id}), "cnct_self", local_pw)
+    _save_state({"setup_done": True, "computer_id": computer_id})
+    for f in (CREDS, ACCESS):
+        try:
+            os.chmod(f, 0o600)
+        except Exception:
+            pass
+    print(f"Computer ID: {computer_id}")
+    print("Setup complete. Vault sealed with TPM (pnasys-ses).")
+    return 0
+
+
+def _unlock() -> tuple[str, dict]:
+    """Prompt local pw; return (pw, {"computer_id": ...}). Never prints secrets."""
+    from pnasys_ses import SecureEncryptionService as SES
+
+    pw = getpass.getpass("Local encryption password: ")
+    try:
+        link = json.loads(SES.DecryptEncryptedFile("cnct_link", pw))
+        print("Vault unlocked (linked).")
+        return pw, link
+    except Exception:
+        pass
+    try:
+        me = json.loads(SES.DecryptEncryptedFile("cnct_self", pw))
+        print("Vault unlocked.")
+        return pw, me
+    except Exception:
+        print("Wrong password or no setup. Run: pnasyscnct setup", file=sys.stderr)
+        sys.exit(2)
+
+
+def cmd_setup_ssh() -> int:
+    """Scan for a Pi pairing request, verify, rotate to a fresh link key."""
+    pw, me = _unlock()
+    computer_id = me.get("computer_id") or L.load_state().get("computer_id", "")
+    if not computer_id:
+        print("No computer ID. Run: pnasyscnct setup", file=sys.stderr)
+        return 2
+    print(f"Scanning for Pi pairing requests (computer {computer_id[:8]}...). Ctrl+C to stop.")
+    req = None
+    while req is None:
+        try:
+            r = L.link_poll(computer_id)
+        except KeyboardInterrupt:
+            print("\nStopped.")
+            return 130
+        except Exception as e:
+            print(f"scan error, retrying: {e}")
+            time.sleep(3)
+            continue
+        if r.get("empty"):
+            continue
+        req = r
+    print("Pairing request received.")
+    pair_key = getpass.getpass("Pairing encryption key (the one entered on the Pi): ")
+    new_key = getpass.getpass("NEW link encryption key (choose now, Pi will adopt it): ")
+    if not new_key:
+        print("A new link key is required.", file=sys.stderr)
+        return 2
+    try:
+        inner = secure_unpack(pair_key, req["blob"])
+        pi_ident = inner["pi_ident"]
+    except Exception:
+        print("Decrypt failed — wrong pairing key?", file=sys.stderr)
+        return 1
+    ans = secure_pack(pair_key, {"computer_id": computer_id, "link_key": new_key,
+                                 "ok": True, "ts": int(time.time())})
+    r = L.link_answer(computer_id, ans, for_pi=pi_ident)
+    if not r.get("ok"):
+        print(f"Answer failed: {r}", file=sys.stderr)
+        return 1
+    L.pc_save_link(computer_id, pi_ident, new_key, pw)
+    print("Linked. Pi verified and both sides hold the fresh link key.")
+    return 0
+
+
+def _shell(pi_ident: str, link_key: str) -> int:
+    print(f"Remote shell (link {pi_ident[:8]}...). :put local remote | :get remote local | :exit")
+    while True:
+        try:
+            line = input("pi# ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print()
+            return 0
+        if not line:
+            continue
+        if line in (":exit", ":quit"):
+            return 0
+        try:
+            if line.startswith(":put "):
+                _, local, remote = line.split(None, 2)
+                raw = Path(local).expanduser().read_bytes()
+                import base64 as _b64
+
+                op = {"kind": "write", "path": remote, "data_b64": _b64.b64encode(raw).decode()}
+                if len(raw) > 4_000_000:
+                    print("Large file: streaming in encrypted chunks...")
+                    _stream_write(pi_ident, link_key, remote, raw)
+                    continue
+            elif line.startswith(":get "):
+                _, remote, local = line.split(None, 2)
+                op = {"kind": "read", "path": remote}
+            else:
+                op = {"kind": "exec", "cmd": line[:4000]}
+            rid = f"sh{int(time.time() * 1000)}"
+            blob = secure_pack(link_key, op)
+            r = L.enqueue(_access_for(link_key, pi_ident), "secure", {"blob": blob}, rid)
+            if not r.get("ok"):
+                print(f"send failed: {r.get('error', r)} — retrying...")
+                time.sleep(3)
+                continue
+            res = L.wait_result(pi_ident, rid, 180)
+            if res.get("pending"):
+                print("(no reply yet — Pi may be offline; result kept, retry :status)")
+                continue
+            inner = secure_unpack(link_key, res["enc"])
+            if inner.get("out"):
+                print(inner["out"], end="" if inner["out"].endswith("\n") else "\n")
+            if inner.get("data_b64"):
+                out = input("save output to local path: ").strip()
+                if out:
+                    import base64 as _b64
+
+                    Path(out).expanduser().write_bytes(_b64.b64decode(inner["data_b64"]))
+                    print(f"saved {out}")
+            if inner.get("rc") not in (None, 0):
+                print(f"[rc={inner.get('rc')}] {inner.get('err', '')}")
+            elif inner.get("error"):
+                print(f"Pi error: {inner['error']}")
+        except (EOFError, KeyboardInterrupt):
+            print()
+            return 0
+        except Exception as e:
+            print(f"link error ({e}) — reconnecting...")
+            time.sleep(3)
+
+
+def _access_for(link_key: str, pi_ident: str) -> str:
+    """Registration check needs the access key — but SSH uses link identity.
+
+    The Pi registered under its access key; pairing stored pi_ident. For
+    enqueue auth we send pi_ident as the selector: the server accepts either
+    a registered access key or a paired pi_ident for kind=secure.
+    """
+    return f"ident:{pi_ident}"
+
+
+def _stream_write(pi_ident: str, link_key: str, remote: str, raw: bytes) -> None:
+    from pnasyscnct.common import secure_pack as _sp
+
+    import base64 as _b64
+
+    rid = f"sw{int(time.time() * 1000)}"
+    n = 500_000
+    parts = [_sp(link_key, {"chunk": _b64.b64encode(raw[i:i + n]).decode()})
+             for i in range(0, len(raw), n)] or [_sp(link_key, {"chunk": ""})]
+    r = L.enqueue(f"ident:{pi_ident}", "secure",
+                  {"blob": _sp(link_key, {"kind": "write-parts", "path": remote,
+                                          "parts": parts})}, rid)
+    if not r.get("ok"):
+        print(f"stream failed: {r.get('error', r)}")
+        return
+    res = L.wait_result(pi_ident, rid, 300)
+    ok = res.get("ok") if isinstance(res, dict) else False
+    print(f"streamed {len(raw)} bytes in {len(parts)} encrypted chunks (ok={ok})")
+
+
+def cmd_ssh() -> int:
+    pw, link = _unlock()
+    if "link_key" not in link:
+        print("Not linked yet. Run: pnasyscnct setup --ssh", file=sys.stderr)
+        return 2
+    L.ssh_join(link["computer_id"], link["pi_ident"],
+               secure_pack(link["link_key"], {"hello": "pc", "ts": int(time.time())}))
+    print("Session open. Reconnects automatically on failure.")
+    while True:
+        rc = _shell(link["pi_ident"], link["link_key"])
+        if rc == 0:
+            return 0
+        print("Shell exited abnormally — rejoining in 5s (Ctrl+C to quit)...")
+        try:
+            time.sleep(5)
+        except KeyboardInterrupt:
+            return 130
+
+
+def cmd_mcp(enckey: str) -> int:
+    from pnasyscnct.mcp_server import serve
+
+    st = L.load_state()
+    if not st.get("pi_ident") or not st.get("computer_id"):
+        print("Not linked yet. Run: pnasyscnct setup --ssh", file=sys.stderr)
+        return 2
+    if not enckey:
+        print("--enckey (the link encryption key) is required.", file=sys.stderr)
+        return 2
+    print("MCP server starting (SSH session active).", file=sys.stderr)
+    serve(link_key=enckey, pi_ident=st["pi_ident"], computer_id=st["computer_id"])
+    return 0
+
+
+def cmd_selftest() -> int:
+    pw = "selftest-pw"
+    key, iv = derive_key_iv(pw)
+    assert len(key) == 32 and len(iv) == 12
+    b = encrypt_local(b"hello-pc", pw)
+    assert decrypt_local(b, pw) == b"hello-pc"
+    sk = generate_session_key()
+    assert len(sk.split("=")) == 6
+    blob = secure_pack("k", {"kind": "exec", "cmd": "x"})
+    assert secure_unpack("k", blob)["cmd"] == "x"
+    print("selftest OK: AES vault, session keygen, secure pack/unpack")
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    if not argv or argv[0] in ("-h", "--help", "help"):
+        print("Usage: pnasyscnct {setup [--ssh]|ssh|mcp --enckey KEY|selftest}")
+        return 0
+    if argv[0] == "setup" and "--ssh" in argv[1:]:
+        return cmd_setup_ssh()
+    if argv[0] == "setup":
+        return cmd_setup()
+    if argv[0] == "ssh":
+        return cmd_ssh()
+    if argv[0] == "mcp":
+        key = ""
+        for i, a in enumerate(argv[1:]):
+            if a == "--enckey" and i + 1 < len(argv[1:]):
+                key = argv[1:][i + 1]
+        return cmd_mcp(key)
+    if argv[0] == "selftest":
+        return cmd_selftest()
+    print(f"Unknown command: {argv[0]}", file=sys.stderr)
+    return 2
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

pnasyscnct-0.2.0/src/pnasyscnct/common.py

@@ -0,0 +1,151 @@
+"""Shared crypto: AES-256-GCM at-rest, pnasys transport, keygen, identity math.
+
+- AES key  = SHA256(password).digest()  (32B)
+- AES iv   = SHA256(reverse(b64(reverse(password)))).digest()[:12]
+- Transport (pnasys-encryption-service): session/link keys, exact ops.
+- Session/link code generator: exact PNASystemsKeyGenerator.py logic.
+- Pi identity: interleave blob + SHA1024 + uuid2 variant (unchanged spec).
+"""
+from __future__ import annotations
+
+import base64
+import datetime
+import hashlib
+import os
+import secrets
+import uuid
+
+
+def sha256_hex(s: str) -> str:
+    return hashlib.sha256(s.encode("utf-8")).hexdigest()
+
+
+def derive_key_iv(password: str) -> tuple[bytes, bytes]:
+    key = hashlib.sha256(password.encode("utf-8")).digest()
+    rev_b64 = base64.b64encode(password[::-1].encode("utf-8")).decode("ascii")[::-1]
+    return key, hashlib.sha256(rev_b64.encode("utf-8")).digest()[:12]
+
+
+def encrypt_local(plaintext: bytes, password: str) -> dict:
+    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+    key, _ = derive_key_iv(password)
+    nonce = os.urandom(12)
+    return {"nonce_b64": base64.b64encode(nonce).decode("ascii"),
+            "ct_b64": base64.b64encode(AESGCM(key).encrypt(nonce, plaintext, None)).decode("ascii")}
+
+
+def decrypt_local(bundle: dict, password: str) -> bytes:
+    from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+
+    key, _ = derive_key_iv(password)
+    return AESGCM(key).decrypt(base64.b64decode(bundle["nonce_b64"]),
+                               base64.b64decode(bundle["ct_b64"]), None)
+
+
+def secure_pack(key: str, op: dict) -> str:
+    import json as _json
+
+    from pnasys_encryption_service import EncryptString
+
+    return EncryptString(_json.dumps(op, separators=(",", ":")), key)
+
+
+def secure_unpack(key: str, token: str) -> dict:
+    import json as _json
+
+    from pnasys_encryption_service import DecryptString
+
+    return _json.loads(DecryptString(token, key))
+
+
+# --- session/link code generator (exact PNASystemsKeyGenerator.py) ---
+
+def RandomService(Minimum, Maximum) -> int:
+    return Minimum + secrets.randbelow(Maximum - Minimum + 1)
+
+
+def ToHexSHA256(Input: str) -> str:
+    return hashlib.sha256(Input.encode("utf-8")).hexdigest()
+
+
+def GetRandomNumber() -> int:
+    A = 0
+    B = RandomService(123821, 98169809)
+    C = RandomService(838390, 67867189)
+    if B == C:
+        B += RandomService(1, 100)
+    if B > C:
+        A = round(B / C)
+    else:
+        A = round(C / B)
+    return A
+
+
+def ReverseString(String: str) -> str:
+    return String[::-1]
+
+
+def generate_session_key() -> str:
+    from pnasys_encryption_service import GenerateEncryptionKey
+
+    EncryptionKeyBase = GenerateEncryptionKey()
+    try:
+        EncryptionKeyPart1 = str(uuid.uuid8())  # exact original call
+    except AttributeError:
+        EncryptionKeyPart1 = str(uuid.uuid4())  # stdlib has no uuid8
+    EncryptionKeyPart2 = (EncryptionKeyPart1
+                          + datetime.datetime.now().strftime("%d/%m/%Y")
+                          + os.getcwd() + str(GetRandomNumber()))
+    EncryptionKeyPart3 = ReverseString(EncryptionKeyPart2)
+    EncryptionKeyPart4 = (EncryptionKeyPart2 + "-" + EncryptionKeyBase + "-"
+                          + ReverseString(EncryptionKeyBase) + "-" + EncryptionKeyPart3)
+    Hash1 = ToHexSHA256(EncryptionKeyPart4)
+    Hash2 = ToHexSHA256(EncryptionKeyBase)
+    Hash3 = ToHexSHA256(Hash1 + EncryptionKeyBase + ReverseString(EncryptionKeyBase)
+                        + ReverseString(EncryptionKeyBase) + ReverseString(Hash1))
+    return (Hash1 + "=" + Hash2 + "=" + Hash3 + "=" + ReverseString(Hash3)
+            + "=" + ReverseString(Hash2) + "=" + ReverseString(Hash1))
+
+
+# --- identity math (unchanged spec) ---
+
+def interleave3(a: str, b: str, c: str) -> str:
+    out: list[str] = []
+    for i in range(max(len(a), len(b), len(c))):
+        if i < len(a):
+            out.append(a[i])
+        if i < len(b):
+            out.append(b[i])
+        if i < len(c):
+            out.append(c[i])
+    return "".join(out)
+
+
+def make_pi_blob(uuid4str: str, favcolor: str, favrest: str) -> str:
+    return interleave3(sha256_hex(uuid4str), sha256_hex(favcolor), sha256_hex(favrest))
+
+
+def make_access_sha1024(combined: str, uuid4str: str, favcolor: str, favrest: str) -> str:
+    p1 = sha256_hex(combined)
+    p2 = sha256_hex(f"{uuid4str}-{p1}-{p1[::-1]}-{uuid4str[::-1]}")
+    p3 = sha256_hex(f"{favcolor}-{p2}-{p2[::-1]}-{favcolor[::-1]}")
+    p4 = sha256_hex(f"{favrest}-{p3}-{p3[::-1]}-{favrest[::-1]}")
+    return f"{p1}-{p2}-{p3}-{p4}"
+
+
+def make_access_variant(uuid1: str, favcolor: str, favrest: str, uuid2: str | None = None):
+    uuid2 = uuid2 or str(uuid.uuid4())
+    combined2 = interleave3(sha256_hex(f"{uuid1}-{uuid2}"),
+                            sha256_hex(f"{favcolor}-{uuid2}"),
+                            sha256_hex(f"{favrest}-{uuid2}"))
+    return combined2, uuid2, make_access_sha1024(combined2, uuid2, favcolor, favrest)
+
+
+def derive_pi_encryption_key(accesskey: str) -> str:
+    akh = sha256_hex(accesskey)
+    h1 = sha256_hex(accesskey + akh)
+    h2 = sha256_hex(akh + h1 + accesskey)
+    h3 = sha256_hex(h2 + accesskey + h1)
+    h4 = sha256_hex(h1 + akh + h2)
+    return f"{h1}-{h3}-{h4}-{h2}"