@geohar/un-bien 0.7.0

package/dist/mesh/encoding.d.ts

@@ -0,0 +1,38 @@
+export declare class MeshPublicKeyError extends Error {
+    readonly field: string;
+    constructor(field: string, message: string);
+}
+/**
+ * Strictly decodes a 32-byte Ed25519 public key accepted at a protocol boundary.
+ * The rejected value is deliberately absent from every error message.
+ */
+export declare function decodeEd25519PublicKey(raw: string, field?: string): Uint8Array;
+/** Returns an Ed25519 public key in RFC 4648 standard padded base64. */
+export declare function encodeEd25519PublicKey(bytes: Uint8Array, field?: string): string;
+/** Decodes then returns an Ed25519 public key in canonical standard base64. */
+export declare function canonicalizeEd25519PublicKey(raw: string, field?: string): string;
+/** RFC 4648 URL-safe base64 without padding. */
+export declare function toBase64UrlNoPad(bytes: Uint8Array): string;
+/** Stable metadata-only fingerprint for a validated public key. */
+export declare function publicKeyFingerprint(bytes: Uint8Array): string;
+export interface RoutingAliasInput {
+    readonly pcPubkey: string;
+    readonly nickname?: string;
+}
+/** Percent-encodes a nickname into the receiver-local routing grammar. */
+export declare function encodeRoutingAlias(rawNickname: string): string;
+/** Selects a raw nickname by encoded ASCII order, then raw UTF-8 bytes. */
+export declare function selectRoutingNickname(candidates: readonly string[]): string | undefined;
+/**
+ * Allocates a deterministic bijection from canonical Pi key to effective alias.
+ * Every colliding base is suffixed with an adaptively expanded key prefix.
+ */
+export declare function allocateRoutingAliases(inputs: readonly RoutingAliasInput[]): ReadonlyMap<string, string>;
+/**
+ * Constant-time-ish byte equality for validated public keys. Returns false
+ * immediately on length mismatch.
+ *
+ * Not strictly constant-time — Ed25519 pubkeys aren't secrets, so the
+ * short-circuit on length and the byte-by-byte compare are acceptable.
+ */
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;

package/dist/mesh/encoding.js

@@ -0,0 +1,217 @@
+import { createHash } from "node:crypto";
+/**
+ * Base64 + byte-array helpers shared by the mesh module.
+ *
+ * **Why this exists**: the mesh protocol crosses three languages (Dart in
+ * the app, Rust in the relay, TypeScript here). Each language's default
+ * base64 encoder picks a different variant — `dart:convert.base64Encode`
+ * emits **standard** (`+`, `/`, `=`-padded), while the app's pairing layer
+ * historically emitted **URL-safe** (`-`, `_`, no padding) in some places.
+ * String comparison on those two encodings fails even when the underlying
+ * 32 bytes are identical, producing silent self-revocations (see
+ * `plan/24` Wave 3 incident report).
+ *
+ * The fix is to never compare base64 strings — decode both sides to bytes
+ * and compare bytes through the strict Ed25519 boundary helper.
+ */
+const ED25519_PUBLIC_KEY_BYTES = 32;
+export class MeshPublicKeyError extends Error {
+    field;
+    constructor(field, message) {
+        super(`${field}: ${message}`);
+        this.field = field;
+        this.name = "MeshPublicKeyError";
+    }
+}
+/**
+ * Strictly decodes a 32-byte Ed25519 public key accepted at a protocol boundary.
+ * The rejected value is deliberately absent from every error message.
+ */
+export function decodeEd25519PublicKey(raw, field = "public key") {
+    if (typeof raw !== "string" || raw.length === 0) {
+        throw new MeshPublicKeyError(field, "invalid base64 encoding");
+    }
+    const hasStandardOnlyCharacters = /[+/]/.test(raw);
+    const hasUrlSafeOnlyCharacters = /[-_]/.test(raw);
+    if (hasStandardOnlyCharacters && hasUrlSafeOnlyCharacters) {
+        throw new MeshPublicKeyError(field, "mixed base64 alphabets");
+    }
+    const firstPaddingIndex = raw.indexOf("=");
+    const body = firstPaddingIndex === -1 ? raw : raw.slice(0, firstPaddingIndex);
+    const padding = firstPaddingIndex === -1 ? "" : raw.slice(firstPaddingIndex);
+    const bodyPattern = hasUrlSafeOnlyCharacters
+        ? /^[A-Za-z0-9_-]+$/
+        : /^[A-Za-z0-9+/]+$/;
+    if (!bodyPattern.test(body) ||
+        (padding !== "" && !/^={1,2}$/.test(padding))) {
+        throw new MeshPublicKeyError(field, "invalid base64 encoding");
+    }
+    const requiredPaddingLength = (4 - (body.length % 4)) % 4;
+    if (requiredPaddingLength === 3 ||
+        (padding.length > 0 && padding.length !== requiredPaddingLength)) {
+        throw new MeshPublicKeyError(field, "invalid base64 padding");
+    }
+    const normalizedBody = body.replaceAll("-", "+").replaceAll("_", "/");
+    const normalizedPadded = normalizedBody + "=".repeat(requiredPaddingLength);
+    const bytes = new Uint8Array(Buffer.from(normalizedPadded, "base64"));
+    if (bytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+        throw new MeshPublicKeyError(field, `wrong length (${bytes.length}, expected ${ED25519_PUBLIC_KEY_BYTES})`);
+    }
+    const canonicalPadded = Buffer.from(bytes).toString("base64");
+    const canonicalUnpadded = canonicalPadded.replace(/=+$/, "");
+    const normalizedInput = normalizedBody + padding;
+    if (normalizedInput !== canonicalPadded &&
+        normalizedInput !== canonicalUnpadded) {
+        throw new MeshPublicKeyError(field, "non-canonical base64 trailing bits");
+    }
+    return bytes;
+}
+/** Returns an Ed25519 public key in RFC 4648 standard padded base64. */
+export function encodeEd25519PublicKey(bytes, field = "public key") {
+    if (!(bytes instanceof Uint8Array) ||
+        bytes.length !== ED25519_PUBLIC_KEY_BYTES) {
+        const length = bytes instanceof Uint8Array ? bytes.length : 0;
+        throw new MeshPublicKeyError(field, `wrong length (${length}, expected ${ED25519_PUBLIC_KEY_BYTES})`);
+    }
+    return Buffer.from(bytes).toString("base64");
+}
+/** Decodes then returns an Ed25519 public key in canonical standard base64. */
+export function canonicalizeEd25519PublicKey(raw, field = "public key") {
+    return encodeEd25519PublicKey(decodeEd25519PublicKey(raw, field), field);
+}
+/** RFC 4648 URL-safe base64 without padding. */
+export function toBase64UrlNoPad(bytes) {
+    return Buffer.from(bytes)
+        .toString("base64")
+        .replaceAll("+", "-")
+        .replaceAll("/", "_")
+        .replace(/=+$/, "");
+}
+/** Stable metadata-only fingerprint for a validated public key. */
+export function publicKeyFingerprint(bytes) {
+    return createHash("sha256").update(bytes).digest("hex").slice(0, 8);
+}
+function isRoutingAliasSafeByte(byte) {
+    return ((byte >= 0x41 && byte <= 0x5a) ||
+        (byte >= 0x61 && byte <= 0x7a) ||
+        (byte >= 0x30 && byte <= 0x39) ||
+        byte === 0x2e ||
+        byte === 0x5f ||
+        byte === 0x2d);
+}
+/** Percent-encodes a nickname into the receiver-local routing grammar. */
+export function encodeRoutingAlias(rawNickname) {
+    let encoded = "";
+    for (const byte of Buffer.from(rawNickname, "utf8")) {
+        encoded += isRoutingAliasSafeByte(byte)
+            ? String.fromCharCode(byte)
+            : `%${byte.toString(16).toUpperCase().padStart(2, "0")}`;
+    }
+    return encoded;
+}
+/** Selects a raw nickname by encoded ASCII order, then raw UTF-8 bytes. */
+export function selectRoutingNickname(candidates) {
+    let selected;
+    let selectedEncoded;
+    for (const candidate of candidates) {
+        if (candidate.length === 0)
+            continue;
+        const encoded = encodeRoutingAlias(candidate);
+        if (selected === undefined ||
+            encoded < selectedEncoded ||
+            (encoded === selectedEncoded &&
+                Buffer.compare(Buffer.from(candidate), Buffer.from(selected)) < 0)) {
+            selected = candidate;
+            selectedEncoded = encoded;
+        }
+    }
+    return selected;
+}
+/**
+ * Allocates a deterministic bijection from canonical Pi key to effective alias.
+ * Every colliding base is suffixed with an adaptively expanded key prefix.
+ */
+export function allocateRoutingAliases(inputs) {
+    const preparedByKey = new Map();
+    for (const [index, input] of inputs.entries()) {
+        const keyBytes = decodeEd25519PublicKey(input.pcPubkey, `routingAliases[${index}].pcPubkey`);
+        const pcPubkey = encodeEd25519PublicKey(keyBytes);
+        if (preparedByKey.has(pcPubkey)) {
+            throw new Error("mesh: duplicate routing identity");
+        }
+        const keyUrl = toBase64UrlNoPad(keyBytes);
+        const base = input.nickname
+            ? encodeRoutingAlias(input.nickname)
+            : `pc-${keyUrl.slice(0, 8)}`;
+        preparedByKey.set(pcPubkey, { pcPubkey, keyUrl, base });
+    }
+    const prepared = [...preparedByKey.values()].sort((left, right) => left.pcPubkey < right.pcPubkey
+        ? -1
+        : left.pcPubkey > right.pcPubkey
+            ? 1
+            : 0);
+    const groupsByBase = new Map();
+    for (const identity of prepared) {
+        const group = groupsByBase.get(identity.base);
+        if (group)
+            group.push(identity);
+        else
+            groupsByBase.set(identity.base, [identity]);
+    }
+    const reservedBases = new Set(groupsByBase.keys());
+    const aliasByKey = new Map();
+    const allocatedAliases = new Set();
+    for (const group of groupsByBase.values()) {
+        if (group.length !== 1)
+            continue;
+        const identity = group[0];
+        aliasByKey.set(identity.pcPubkey, identity.base);
+        allocatedAliases.add(identity.base);
+    }
+    const collidingGroups = [...groupsByBase.entries()]
+        .filter(([, group]) => group.length > 1)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+    for (const [base, group] of collidingGroups) {
+        const fullPrefixLength = group[0].keyUrl.length;
+        let allocated = false;
+        for (let prefixLength = 8; prefixLength <= fullPrefixLength; prefixLength++) {
+            const candidates = group.map((identity) => `${base}~${identity.keyUrl.slice(0, prefixLength)}`);
+            const uniqueCandidates = new Set(candidates);
+            const conflicts = candidates.some((candidate) => reservedBases.has(candidate) || allocatedAliases.has(candidate));
+            if (uniqueCandidates.size !== group.length || conflicts)
+                continue;
+            for (let index = 0; index < group.length; index++) {
+                const identity = group[index];
+                const alias = candidates[index];
+                aliasByKey.set(identity.pcPubkey, alias);
+                allocatedAliases.add(alias);
+            }
+            allocated = true;
+            break;
+        }
+        if (!allocated) {
+            throw new Error("mesh: routing alias collision invariant failed");
+        }
+    }
+    return new Map(prepared.map((identity) => [
+        identity.pcPubkey,
+        aliasByKey.get(identity.pcPubkey),
+    ]));
+}
+/**
+ * Constant-time-ish byte equality for validated public keys. Returns false
+ * immediately on length mismatch.
+ *
+ * Not strictly constant-time — Ed25519 pubkeys aren't secrets, so the
+ * short-circuit on length and the byte-by-byte compare are acceptable.
+ */
+export function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++) {
+        if (a[i] !== b[i])
+            return false;
+    }
+    return true;
+}
+//# sourceMappingURL=encoding.js.map

package/dist/mesh/encoding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/mesh/encoding.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,wBAAwB,GAAG,EAAE,CAAC;AAEpC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEhC;IADX,YACW,KAAa,EACtB,OAAe;QAEf,KAAK,CAAC,GAAG,KAAK,KAAK,OAAO,EAAE,CAAC,CAAC;QAHrB,UAAK,GAAL,KAAK,CAAQ;QAItB,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAW,EACX,KAAK,GAAG,YAAY;IAEpB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,yBAAyB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,MAAM,wBAAwB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,yBAAyB,IAAI,wBAAwB,EAAE,CAAC;QAC1D,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,iBAAiB,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC7E,MAAM,WAAW,GAAG,wBAAwB;QAC1C,CAAC,CAAC,kBAAkB;QACpB,CAAC,CAAC,kBAAkB,CAAC;IACvB,IACE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;QACvB,CAAC,OAAO,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,EAC7C,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1D,IACE,qBAAqB,KAAK,CAAC;QAC3B,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,qBAAqB,CAAC,EAChE,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC;IAChE,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACtE,MAAM,gBAAgB,GAAG,cAAc,GAAG,GAAG,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB,EAAE,CAAC;QAC9C,MAAM,IAAI,kBAAkB,CAC1B,KAAK,EACL,iBAAiB,KAAK,CAAC,MAAM,cAAc,wBAAwB,GAAG,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC9D,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAG,cAAc,GAAG,OAAO,CAAC;IACjD,IACE,eAAe,KAAK,eAAe;QACnC,eAAe,KAAK,iBAAiB,EACrC,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,KAAK,EAAE,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CACpC,KAAiB,EACjB,KAAK,GAAG,YAAY;IAEpB,IACE,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC;QAC9B,KAAK,CAAC,MAAM,KAAK,wBAAwB,EACzC,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,IAAI,kBAAkB,CAC1B,KAAK,EACL,iBAAiB,MAAM,cAAc,wBAAwB,GAAG,CACjE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B,CAC1C,GAAW,EACX,KAAK,GAAG,YAAY;IAEpB,OAAO,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;AAC3E,CAAC;AAED,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACtB,QAAQ,CAAC,QAAQ,CAAC;SAClB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,oBAAoB,CAAC,KAAiB;IACpD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACtE,CAAC;AAOD,SAAS,sBAAsB,CAAC,IAAY;IAC1C,OAAO,CACL,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QAC9B,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC;QAC9B,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,IAAI,CACd,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,kBAAkB,CAAC,WAAmB;IACpD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,sBAAsB,CAAC,IAAI,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC;YAC3B,CAAC,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qBAAqB,CACnC,UAA6B;IAE7B,IAAI,QAA4B,CAAC;IACjC,IAAI,eAAmC,CAAC;IACxC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACrC,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;QAC9C,IACE,QAAQ,KAAK,SAAS;YACtB,OAAO,GAAG,eAAgB;YAC1B,CAAC,OAAO,KAAK,eAAe;gBAC1B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,EACpE,CAAC;YACD,QAAQ,GAAG,SAAS,CAAC;YACrB,eAAe,GAAG,OAAO,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAoC;IAEpC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAC;IAC9D,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,QAAQ,GAAG,sBAAsB,CACrC,KAAK,CAAC,QAAQ,EACd,kBAAkB,KAAK,YAAY,CACpC,CAAC;QACF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ;YACzB,CAAC,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC;YACpC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC/B,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAChE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;QAC5B,CAAC,CAAC,CAAC,CAAC;QACJ,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,QAAQ;YAC9B,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,CAAC,CACR,CAAC;IACF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkC,CAAC;IAC/D,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YAC3B,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC3C,KAAK,MAAM,KAAK,IAAI,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;QAC3B,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,eAAe,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;SAChD,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,eAAe,EAAE,CAAC;QAC5C,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QACjD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,KACE,IAAI,YAAY,GAAG,CAAC,EACpB,YAAY,IAAI,gBAAgB,EAChC,YAAY,EAAE,EACd,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAC1B,CAAC,QAAQ,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,EAAE,CAClE,CAAC;YACF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAC/B,CAAC,SAAS,EAAE,EAAE,CACZ,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,CAClE,CAAC;YACF,IAAI,gBAAgB,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS;gBAAE,SAAS;YAElE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;gBAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAE,CAAC;gBACjC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;gBACzC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS,GAAG,IAAI,CAAC;YACjB,MAAM;QACR,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,OAAO,IAAI,GAAG,CACZ,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;QACzB,QAAQ,CAAC,QAAQ;QACjB,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAE;KACnC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/mesh/self_revoke.d.ts

@@ -0,0 +1,73 @@
+import { type MeshClient } from "./client.js";
+import { type MeshTopologySnapshot } from "./siblings.js";
+export interface SelfRevokeStorageSnapshotRecord {
+    readonly rawOwnerPubkey: unknown;
+    /** Storage-issued opaque provenance for this canonical Owner slot. */
+    readonly token: unknown;
+}
+export type SelfRevokeRemovalResult = {
+    readonly outcome: "removed";
+    readonly nextToken: unknown;
+} | {
+    readonly outcome: "stale" | "not_found" | "no_authority";
+};
+export interface SelfRevokeStorage {
+    snapshotOwnerPubkeys(): Promise<readonly SelfRevokeStorageSnapshotRecord[]>;
+    conditionalRemovePeer(remoteEpk: string, expectedToken: unknown, canCommit?: () => boolean): Promise<SelfRevokeRemovalResult>;
+}
+export interface SelfRevokeOptions {
+    client: MeshClient;
+    storage: SelfRevokeStorage;
+    /** This Pi's long-term Ed25519 pubkey, raw 32 bytes. */
+    myPubkey: Uint8Array;
+    intervalMs?: number;
+    /** Raw storage handle first; canonical runtime Owner identity second. */
+    onRevoke?: (rawOwnerPubkey: string, canonicalOwnerPubkey: string) => void | Promise<void>;
+    onAuthoritativeOwners?: (canonicalOwnerPubkeys: readonly string[]) => void | Promise<void>;
+    onTopologyChanged?: (snapshot: MeshTopologySnapshot) => void | Promise<void>;
+    log?: {
+        info(msg: string): void;
+        warn(msg: string): void;
+        error(msg: string): void;
+    };
+}
+export declare class SelfRevoke {
+    private readonly client;
+    private readonly storage;
+    private readonly myPubkey;
+    private readonly intervalMs;
+    private readonly onRevoke?;
+    private readonly onAuthoritativeOwners?;
+    private readonly onTopologyChanged?;
+    private readonly log;
+    /**
+     * Accepted anti-rollback floor, deliberately independent from pending I/O.
+     * https://github.com/jacobaraujo7/remote_pi/issues/73: this in-memory floor
+     * resets on process restart, allowing pre-revocation membership replay.
+     */
+    private readonly lastSeenVersion;
+    private readonly pendingRevocations;
+    private readonly membershipByOwner;
+    private previousTopology;
+    private sweepInFlight;
+    private timer;
+    /** Invalidates authority held by an async sweep when this producer stops/re-pairs. */
+    private lifecycleGeneration;
+    constructor(opts: SelfRevokeOptions);
+    start(): void;
+    stop(): void;
+    /** Called before a same-process pairing mutation enters the storage lane. */
+    invalidateStorageAuthority(): void;
+    /** Schedules one post-mutation authoritative sweep after any stale sweep exits. */
+    requestFreshCheck(): Promise<void>;
+    checkOnce(): Promise<void>;
+    private _runSweep;
+    private _hasAuthority;
+    private _canonicalOwnerSlots;
+    private _pruneStateNotIn;
+    private _checkOwnerSlot;
+    /** Returns true only when storage proves the pending snapshot was re-paired. */
+    private _retryPending;
+    private _invokeRevokeCallback;
+    private _publishTopology;
+}