@linkedclaw/keystore

Key-only, atomic, create-if-absent persistence of L1 handshake identities. TS mirror of the Python linkedclaw-keystore; the on-disk JSON format is byte-compatible (snake_case keys, b64url values) so the two are portable.

import { loadOrCreateIdentity } from "@linkedclaw/keystore";

const id = loadOrCreateIdentity("/var/lib/agent/identity.json", { withX25519: true });
// id.ed25519Private / id.keyId / id.x25519Private (if withX25519)
// id.ed25519Public / id.x25519Public — derived

Depends only on @linkedclaw/crypto + Node stdlib. Loading never regenerates an existing identity (restart-safe — closes the #24 handshake-mismatch-on-restart bug); first-create is exclusive so concurrent creators converge on a single winner instead of clobbering each other.