Checkpoint peering identity and opt-in discovery

discovery/store.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+const crypto = require('node:crypto');
+
+class DiscoveryStore {
+  constructor(dataDir) { this.file = path.join(path.resolve(dataDir), 'discovery.json'); }
+  load() {
+    try {
+      const data = JSON.parse(fs.readFileSync(this.file, 'utf8'));
+      if (data.schema !== 1 || !Number.isSafeInteger(data.revision) || !data.candidates || !data.feeds || !data.lastRun)
+        throw new Error('Invalid discovery store schema');
+      return data;
+    } catch (error) {
+      if (error.code === 'ENOENT') return { schema: 1, revision: 0, candidates: {}, feeds: {}, lastRun: { status: 'never' } };
+      throw new Error(`Discovery store unavailable; refusing to overwrite it: ${error.message}`);
+    }
+  }
+  publish(value) {
+    const prior = this.load();
+    const data = { schema: 1, revision: prior.revision + 1, candidates: value.candidates, feeds: value.feeds,
+      lastRun: { status: 'success', startedAt: value.startedAt, finishedAt: new Date().toISOString(),
+        candidateCount: Object.keys(value.candidates).length, examined: value.examined, clipped: value.clipped } };
+    fs.mkdirSync(path.dirname(this.file), { recursive: true });
+    const temp = `${this.file}.${crypto.randomBytes(6).toString('hex')}.tmp`;
+    try {
+      fs.writeFileSync(temp, JSON.stringify(data, null, 2) + '\n', { mode: 0o600 });
+      if (fs.existsSync(this.file)) fs.copyFileSync(this.file, `${this.file}.prev`);
+      fs.renameSync(temp, this.file);
+    } finally { try { fs.rmSync(temp, { force: true }); } catch {} }
+    return data;
+  }
+}
+module.exports = { DiscoveryStore };