@log0u7/opencode-mesh 0.2.0 → 0.4.0

package/dist/lib/identity.js

@@ -1,58 +1,158 @@
-import { randomUUID } from "node:crypto";
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, verify, } from "node:crypto";
 import { chmodSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { hostname as osHostname } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 export function loadOrCreateIdentity(dataDir) {
     const file = join(dataDir, "node.json");
-    const existing = tryRead(file);
+    const existing = readIdentity(file);
     if (existing) {
-        return withFingerprint(existing);
+        // A file written by <= 0.2.0 carries either no keys or a dead Ed25519
+        // JWK keypair nothing ever used. The node keeps its node_id (peers stay
+        // recognised), and the file is rewritten to the canonical shape with a
+        // fresh signing keypair so pairing proofs can be produced.
+        if (existing.migrated)
+            writeIdentity(file, existing.identity);
+        return withFingerprint(existing.identity);
     }
-    return withFingerprint(generate(dataDir, file));
+    const identity = {
+        ...freshKeys(),
+        node_id: randomUUID(),
+        hostname: hostName(),
+    };
+    writeIdentity(file, identity);
+    return withFingerprint(identity);
 }
-function tryRead(file) {
+function readIdentity(file) {
+    let raw;
     try {
-        const raw = JSON.parse(readFileSync(file, "utf8"));
-        if (typeof raw.node_id === "string" && raw.public_key && raw.private_key) {
-            return raw;
-        }
-        return null;
+        raw = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw new Error(`cannot read identity file ${file}: ${errorMessage(error)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
     }
     catch {
-        return null;
+        throw corrupt(file, "is not valid JSON");
+    }
+    const record = (parsed ?? {});
+    if (typeof record.node_id !== "string" || record.node_id.length === 0) {
+        throw corrupt(file, "has no node_id");
+    }
+    const identity = {
+        node_id: record.node_id,
+        hostname: hostName(record.hostname),
+        public_key: typeof record.public_key === "string" ? record.public_key : "",
+        private_key: typeof record.private_key === "string" ? record.private_key : "",
+    };
+    const keysUsable = isSpki(identity.public_key) && isPkcs8(identity.private_key);
+    const migrated = !keysUsable || Object.keys(record).some((key) => !KNOWN_KEYS.has(key));
+    if (!keysUsable) {
+        // Replace dead or missing keys; the node_id above is never regenerated, so
+        // peers keep recognising this node through the migration.
+        Object.assign(identity, freshKeys());
     }
+    return { identity, migrated };
+}
+const KNOWN_KEYS = new Set(["node_id", "hostname", "public_key", "private_key"]);
+// A corrupt identity file would make the node silently mint a new id, breaking
+// every peer that recognises it and orphaning queued mail. Refuse to start and
+// hand the operator a recovery path instead of reminting behind their back.
+function corrupt(file, why) {
+    return new Error(`identity file ${file} ${why}; refusing to mint a new node id. ` +
+        `Move it aside to start with a fresh identity: mv '${file}' '${file}.bak'`);
 }
-function generate(dataDir, file) {
-    // Bun implements node:crypto, so this works under OpenCode's runtime and Node.
-    const { generateKeyPairSync } = require("node:crypto");
+function freshKeys() {
     const { publicKey, privateKey } = generateKeyPairSync("ed25519");
-    const publicJwk = publicKey.export({ format: "jwk" });
-    const privateJwk = privateKey.export({ format: "jwk" });
-    const identity = {
-        node_id: randomUUID(),
-        hostname: hostName(),
-        public_key: publicJwk,
-        private_key: privateJwk,
+    return {
+        public_key: Buffer.from(publicKey.export({ type: "spki", format: "der" })).toString("base64"),
+        private_key: Buffer.from(privateKey.export({ type: "pkcs8", format: "der" })).toString("base64"),
     };
-    mkdirSync(dataDir, { recursive: true, mode: 0o700 });
-    // Atomic write: temp file + rename, so a crash never leaves a truncated keypair.
+}
+function isSpki(value) {
+    try {
+        const key = createPublicKey({
+            key: Buffer.from(value, "base64"),
+            format: "der",
+            type: "spki",
+        });
+        // Only the algorithm we sign with: a hand-edited RSA key must not pass
+        // validation and then break `sign(null, ...)` at send time.
+        return key.asymmetricKeyType === "ed25519";
+    }
+    catch {
+        return false;
+    }
+}
+function isPkcs8(value) {
+    try {
+        const key = createPrivateKey({
+            key: Buffer.from(value, "base64"),
+            format: "der",
+            type: "pkcs8",
+        });
+        return key.asymmetricKeyType === "ed25519";
+    }
+    catch {
+        return false;
+    }
+}
+// Pairing proofs: an Ed25519 signature binding the sender's node id to the
+// token it presents. The canonical payload lives next to the signers so the
+// sender and the verifier cannot drift.
+export function pairingProofPayload(nodeId, token) {
+    return `opencode-mesh-pair:${nodeId}:${token}`;
+}
+export function signPairingProof(privateKey, payload) {
+    const key = createPrivateKey({
+        key: Buffer.from(privateKey, "base64"),
+        format: "der",
+        type: "pkcs8",
+    });
+    return Buffer.from(sign(null, Buffer.from(payload, "utf8"), key)).toString("base64");
+}
+// The wire form of a pairing proof: `<base64 spki>.<base64 signature>`.
+export function pairingProof(identity, token) {
+    return `${identity.public_key}.${signPairingProof(identity.private_key, pairingProofPayload(identity.node_id, token))}`;
+}
+export function verifyPairingProof(publicKey, payload, proof) {
+    try {
+        const key = createPublicKey({
+            key: Buffer.from(publicKey, "base64"),
+            format: "der",
+            type: "spki",
+        });
+        return verify(null, Buffer.from(payload, "utf8"), key, Buffer.from(proof, "base64"));
+    }
+    catch {
+        return false;
+    }
+}
+function writeIdentity(file, identity) {
+    mkdirSync(dirname(file), { recursive: true, mode: 0o700 });
+    // Atomic write: temp file + rename, so a crash never leaves a truncated record.
     const tmp = `${file}.tmp-${process.pid}`;
     writeFileSync(tmp, JSON.stringify(identity, null, 2), { mode: 0o600 });
     renameSync(tmp, file);
     chmodSync(file, 0o600);
-    return identity;
 }
+// The fingerprint stays derived from the node_id (not from the signing key):
+// keys can be replaced on migration without shuffling the operator-facing
+// label for `mesh_status`.
 function withFingerprint(identity) {
-    const { createHash } = require("node:crypto");
-    // x is the raw public key coordinate in an Ed25519 JWK; hash it for a short
-    // operator-verifiable fingerprint.
-    const x = identity.public_key.x ?? "";
     return {
         ...identity,
-        fingerprint: createHash("sha256").update(x).digest("hex").slice(0, 16),
+        fingerprint: createHash("sha256").update(identity.node_id).digest("hex").slice(0, 16),
     };
 }
-function hostName() {
-    return osHostname();
+function hostName(recorded) {
+    return typeof recorded === "string" && recorded.length > 0 ? recorded : osHostname();
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
 }
 //# sourceMappingURL=identity.js.map

package/dist/lib/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAuBjC,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAsB,CAAC;QACxE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;YACzE,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe,EAAE,IAAY;IAC7C,+EAA+E;IAC/E,MAAM,EAAE,mBAAmB,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAEvF,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;IAC7D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAQ,CAAC;IAE/D,MAAM,QAAQ,GAAsB;QAClC,OAAO,EAAE,UAAU,EAAE;QACrB,QAAQ,EAAE,QAAQ,EAAE;QACpB,UAAU,EAAE,SAAS;QACrB,WAAW,EAAE,UAAU;KACxB,CAAC;IAEF,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,iFAAiF;IACjF,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAEvB,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B;IAClD,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,aAAa,CAAiC,CAAC;IAC9E,4EAA4E;IAC5E,mCAAmC;IACnC,MAAM,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACvE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/lib/identity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,eAAe,EACf,mBAAmB,EACnB,UAAU,EACV,IAAI,EACJ,MAAM,GACP,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAY1C,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAEpC,IAAI,QAAQ,EAAE,CAAC;QACb,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,2DAA2D;QAC3D,IAAI,QAAQ,CAAC,QAAQ;YAAE,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAC9D,OAAO,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAsB;QAClC,GAAG,SAAS,EAAE;QACd,OAAO,EAAE,UAAU,EAAE;QACrB,QAAQ,EAAE,QAAQ,EAAE;KACrB,CAAC;IACF,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC9B,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAID,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAC3C,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,EAAE,CAA4B,CAAC;IACzD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtE,MAAM,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAsB;QAClC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;QAC1E,WAAW,EAAE,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE;KAC9E,CAAC;IACF,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,2EAA2E;QAC3E,0DAA0D;QAC1D,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;AAEjF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,SAAS,OAAO,CAAC,IAAY,EAAE,GAAW;IACxC,OAAO,IAAI,KAAK,CACd,iBAAiB,IAAI,IAAI,GAAG,oCAAoC;QAC9D,qDAAqD,IAAI,MAAM,IAAI,OAAO,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC7F,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CACpF,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAa;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;YACjC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,uEAAuE;QACvE,4DAA4D;QAC5D,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,gBAAgB,CAAC;YAC3B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC;YACjC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;QACH,OAAO,GAAG,CAAC,iBAAiB,KAAK,SAAS,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,wCAAwC;AACxC,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,KAAa;IAC/D,OAAO,sBAAsB,MAAM,IAAI,KAAK,EAAE,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,UAAkB,EAAE,OAAe;IAClE,MAAM,GAAG,GAAG,gBAAgB,CAAC;QAC3B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC;QACtC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,OAAO;KACd,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACvF,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAC1B,QAAsE,EACtE,KAAa;IAEb,OAAO,GAAG,QAAQ,CAAC,UAAU,IAAI,gBAAgB,CAC/C,QAAQ,CAAC,WAAW,EACpB,mBAAmB,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAC7C,EAAE,CAAC;AACN,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,OAAe,EAAE,KAAa;IAClF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,eAAe,CAAC;YAC1B,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,QAA2B;IAC9D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,gFAAgF;IAChF,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtB,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,6EAA6E;AAC7E,0EAA0E;AAC1E,2BAA2B;AAC3B,SAAS,eAAe,CAAC,QAA2B;IAClD,OAAO;QACL,GAAG,QAAQ;QACX,WAAW,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KACtF,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CAAC,QAAkB;IAClC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC"}

package/dist/lib/locks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,wBAAgB,OAAO,CACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAwBT;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM5F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGpE"}
+{"version":3,"file":"locks.d.ts","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,wBAAgB,OAAO,CACrB,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC9F,OAAO,CAiCT;AAED,wBAAgB,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAM5F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,EAAE,CAGpE"}

package/dist/lib/locks.js

@@ -1,21 +1,29 @@
 export function tryLock(db, input) {
     const expiresAt = input.now + input.ttl_ms;
     db.conn.run("DELETE FROM locks WHERE expires_at <= ?", [input.now]);
+    // Claim atomically: a second opencode process sharing this dataDir that races
+    // for the same path loses the insert (ON CONFLICT DO NOTHING) instead of
+    // throwing a UNIQUE constraint error out of mesh_lock.
+    db.conn.run("INSERT INTO locks (path, owner_node, owner_session, expires_at) VALUES (?, ?, ?, ?) ON CONFLICT(path) DO NOTHING", [input.path, input.owner_node, input.owner_session, expiresAt]);
+    const claimed = (db.conn.get("SELECT changes() AS changes")?.changes ?? 0) > 0;
+    if (claimed) {
+        return true;
+    }
     const existing = db.conn.get("SELECT * FROM locks WHERE path = ?", [input.path]);
-    if (existing) {
-        if (existing.owner_node === input.owner_node) {
-            // Same owner refreshes its claim.
-            db.conn.run("UPDATE locks SET expires_at = ?, owner_session = ? WHERE path = ?", [
-                expiresAt,
-                input.owner_session,
-                input.path,
-            ]);
-            return true;
-        }
+    if (!existing) {
+        // Raced with a release between the insert and this read; not granted.
         return false;
     }
-    db.conn.run("INSERT INTO locks (path, owner_node, owner_session, expires_at) VALUES (?, ?, ?, ?)", [input.path, input.owner_node, input.owner_session, expiresAt]);
-    return true;
+    if (existing.owner_node === input.owner_node) {
+        // Same owner refreshes its claim.
+        db.conn.run("UPDATE locks SET expires_at = ?, owner_session = ? WHERE path = ?", [
+            expiresAt,
+            input.owner_session,
+            input.path,
+        ]);
+        return true;
+    }
+    return false;
 }
 export function releaseLock(db, input) {
     db.conn.run("DELETE FROM locks WHERE path = ? AND owner_node = ?", [

package/dist/lib/locks.js.map

@@ -1 +1 @@
-{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,OAAO,CACrB,EAAU,EACV,KAA+F;IAE/F,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAE3C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpE,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oCAAoC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YAC7C,kCAAkC;YAClC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mEAAmE,EAAE;gBAC/E,SAAS;gBACT,KAAK,CAAC,aAAa;gBACnB,KAAK,CAAC,IAAI;aACX,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,EAAE,CAAC,IAAI,CAAC,GAAG,CACT,qFAAqF,EACrF,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAC/D,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,KAA2C;IACjF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE;QACjE,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,UAAU;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,KAAsB;IAC1D,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,mCAAmC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"locks.js","sourceRoot":"","sources":["../../src/lib/locks.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,OAAO,CACrB,EAAU,EACV,KAA+F;IAE/F,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IAE3C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAEpE,8EAA8E;IAC9E,yEAAyE;IACzE,uDAAuD;IACvD,EAAE,CAAC,IAAI,CAAC,GAAG,CACT,kHAAkH,EAClH,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,CAC/D,CAAC;IACF,MAAM,OAAO,GACX,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oCAAoC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1F,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC7C,kCAAkC;QAClC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,mEAAmE,EAAE;YAC/E,SAAS;YACT,KAAK,CAAC,aAAa;YACnB,KAAK,CAAC,IAAI;SACX,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,EAAU,EAAE,KAA2C;IACjF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,EAAE;QACjE,KAAK,CAAC,IAAI;QACV,KAAK,CAAC,UAAU;KACjB,CAAC,CAAC;IACH,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAsB,6BAA6B,CAAC,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU,EAAE,KAAsB;IAC1D,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yCAAyC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,mCAAmC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAClF,CAAC;AASD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,KAAK,EAAE,GAAG,CAAC,aAAa;QACxB,OAAO,EAAE,GAAG,CAAC,UAAU;QACvB,UAAU,EAAE,GAAG,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC"}

package/dist/lib/peers.d.ts

@@ -1,10 +1,12 @@
 import type { MeshDb } from "./db.js";
 import type { Peer } from "../types/peer.js";
+export declare const PAIRING_TOKEN_TTL_MS: number;
 export type PeerInput = {
     node_id: string;
     hostname: string;
     fingerprint: string;
     addresses?: string[];
+    public_key?: string;
 };
 export declare function pairWithToken(db: MeshDb, peer: {
     node_id: string;
@@ -12,15 +14,25 @@ export declare function pairWithToken(db: MeshDb, peer: {
     fingerprint: string;
     token: string;
     addresses?: string[];
+    public_key?: string;
 }): void;
 export declare function createPairingToken(db: MeshDb): string;
-export declare function authenticateToken(db: MeshDb, token: string, from: string | null): Peer | null;
+export declare function authenticateToken(db: MeshDb, token: string, from: string | null, proof?: string): Peer | null;
+export declare function prunePendingTokens(db: MeshDb): void;
 export declare function listPeers(db: MeshDb): Peer[];
+export declare function findPeerById(db: MeshDb, nodeId: string): Peer | null;
 export declare function findPeerByToken(db: MeshDb, token: string): Peer | null;
+export declare function findSendablePeer(db: MeshDb, query: string): {
+    node_id: string;
+    addresses: string[];
+    token: string | null;
+} | null;
+export declare function resolvePeerUrl(db: MeshDb, query: string): string | null;
 export declare function upsertDiscoveredPeer(db: MeshDb, peer: {
     node_id: string;
     hostname: string;
     fingerprint: string;
     addresses: string[];
+    public_key?: string;
 }): void;
 //# sourceMappingURL=peers.d.ts.map

package/dist/lib/peers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../src/lib/peers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAIF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,GACA,IAAI,CAkBN;AAID,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAOrD;AAID,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CA4B7F;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,CAE5C;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGtE;AAED,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAAE,GACpF,IAAI,CASN"}
+{"version":3,"file":"peers.d.ts","sourceRoot":"","sources":["../../src/lib/peers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAEtC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAI7C,eAAO,MAAM,oBAAoB,QAAa,CAAC;AAE/C,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAMF,wBAAgB,aAAa,CAC3B,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,IAAI,CAoBN;AAID,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAOrD;AAMD,wBAAgB,iBAAiB,CAC/B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GACb,IAAI,GAAG,IAAI,CA0Cb;AAyCD,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAInD;AAED,wBAAgB,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,EAAE,CAE5C;AAED,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGpE;AAED,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGtE;AAGD,wBAAgB,gBAAgB,CAC9B,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,GACZ;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CAGvE;AAKD,wBAAgB,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQvE;AAQD,wBAAgB,oBAAoB,CAClC,EAAE,EAAE,MAAM,EACV,IAAI,EAAE;IACJ,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,IAAI,CAkBN"}

package/dist/lib/peers.js

@@ -1,17 +1,25 @@
 import { randomBytes } from "node:crypto";
+import { pairingProofPayload, verifyPairingProof } from "./identity.js";
+// A pairing offer is only useful while the operator can relay it out of band.
+// Past this age the token is dropped instead of becoming a permanent credential.
+export const PAIRING_TOKEN_TTL_MS = 5 * 60_000;
 // Complete pairing with a token the peer generated (shared out of band).
 // Only the pairing call and the peer know it; the server compares on every request.
+// The pinned public_key is preserved when the call provides none (manual pairing):
+// pairing must never be able to erase a proof key it did not attest.
 export function pairWithToken(db, peer) {
     const now = Date.now();
-    db.conn.run(`INSERT INTO peers (node_id, hostname, fingerprint, addresses, paired, token, last_seen)
-     VALUES (?, ?, ?, ?, 1, ?, ?)
+    db.conn.run(`INSERT INTO peers (node_id, hostname, fingerprint, addresses, paired, token, public_key, last_seen)
+     VALUES (?, ?, ?, ?, 1, ?, ?, ?)
      ON CONFLICT(node_id) DO UPDATE SET hostname = excluded.hostname,
-       fingerprint = excluded.fingerprint, paired = 1, token = excluded.token, last_seen = excluded.last_seen`, [
+       fingerprint = excluded.fingerprint, paired = 1, token = excluded.token,
+       public_key = COALESCE(excluded.public_key, peers.public_key), last_seen = excluded.last_seen`, [
         peer.node_id,
         peer.hostname,
         peer.fingerprint,
         JSON.stringify(peer.addresses ?? []),
         peer.token,
+        peer.public_key ?? null,
         now,
     ]);
     db.conn.run("DELETE FROM pending_tokens WHERE token = ?", [peer.token]);
@@ -26,13 +34,16 @@ export function createPairingToken(db) {
     ]);
     return token;
 }
-// Check a bearer token: known paired peer, or a pending pairing token (which
-// then completes pairing for the claimed sender node).
-export function authenticateToken(db, token, from) {
+// Check a bearer token: known paired peer, or a live pending pairing token.
+// The pending path requires the claimed sender to be a node this host already
+// knows, and (the rebind-window fix) a proof signed by the sender's pinned
+// key: a leaked offer alone cannot rotate a paired credential.
+export function authenticateToken(db, token, from, proof) {
     const paired = findPeerByToken(db, token);
     if (paired) {
         return paired;
     }
+    prunePendingTokens(db);
     const pending = db.conn.get("SELECT token FROM pending_tokens WHERE token = ?", [token]);
     if (!pending) {
         return null;
@@ -41,30 +52,114 @@ export function authenticateToken(db, token, from) {
     if (from === null || from.length === 0) {
         return null;
     }
-    pairWithToken(db, { node_id: from, hostname: "pending", fingerprint: "pending", token });
-    return {
-        node_id: from,
-        hostname: "pending",
-        fingerprint: "pending",
-        addresses: [],
-        paired: true,
+    const known = findPeerById(db, from);
+    if (!known) {
+        return null;
+    }
+    // Proof of possession: the sender signs opencode-mesh-pair:<node_id>:<token>
+    // with the key pinned for it (first bind: the proof carries its own key).
+    const attested = attestedProof(known, token, proof);
+    if (attested === null) {
+        return null;
+    }
+    pairWithToken(db, {
+        node_id: known.node_id,
+        hostname: known.hostname,
+        fingerprint: known.fingerprint,
+        addresses: known.addresses,
+        public_key: attested,
         token,
-        last_seen: Date.now(),
-    };
+    });
+    return known;
+}
+// Returns the public key to pin for this binding, or null when the proof does
+// not attest the sender. Rules:
+// - wire form is exactly `<base64 spki>.<base64 sig>`: no extra dots (base64
+//   decoders skip '.', so a trailing dot would otherwise verify);
+// - unpaired known node: the proof's key is pinned once its signature checks;
+// - paired node with a pinned key: the proof key must BE the pinned key;
+// - paired node without a pinned key (legacy/manual rows): no remote attested
+//   rebind at all. Rotation goes through the operator (re-run mesh_pair).
+function attestedProof(known, token, proof) {
+    if (proof === undefined || proof.length === 0) {
+        return null;
+    }
+    const separator = proof.indexOf(".");
+    if (separator <= 0 || separator === proof.length - 1) {
+        return null;
+    }
+    const presentedKey = proof.slice(0, separator);
+    const signature = proof.slice(separator + 1);
+    if (signature.includes(".")) {
+        return null;
+    }
+    const payload = pairingProofPayload(known.node_id, token);
+    if (known.paired) {
+        // Rotation of a live credential: the pinned key is the only authority.
+        if (known.public_key === null || presentedKey !== known.public_key) {
+            return null;
+        }
+    }
+    else if (known.public_key !== null && presentedKey !== known.public_key) {
+        // First bind, but discovery already pinned a different key: spoof guard.
+        return null;
+    }
+    return verifyPairingProof(presentedKey, payload, signature) ? presentedKey : null;
+}
+// Pairing offers are single-shot credentials with a short life: bulk delete on
+// every check keeps the table bounded without a background timer.
+export function prunePendingTokens(db) {
+    db.conn.run("DELETE FROM pending_tokens WHERE created_at <= ?", [
+        Date.now() - PAIRING_TOKEN_TTL_MS,
+    ]);
 }
 export function listPeers(db) {
     return db.conn.all("SELECT * FROM peers ORDER BY hostname").map(rowToPeer);
 }
+export function findPeerById(db, nodeId) {
+    const row = db.conn.get("SELECT * FROM peers WHERE node_id = ?", [nodeId]);
+    return row ? rowToPeer(row) : null;
+}
 export function findPeerByToken(db, token) {
     const row = db.conn.get("SELECT * FROM peers WHERE token = ? AND paired = 1", [token]);
     return row ? rowToPeer(row) : null;
 }
+// Paired peers only: discovery alone never makes a peer sendable.
+export function findSendablePeer(db, query) {
+    const peers = listPeers(db).filter((p) => p.paired);
+    return peers.find((p) => p.node_id === query) ?? peers.find((p) => p.hostname === query) ?? null;
+}
+// Peer addresses must carry a port: discovery attaches the advertised port and
+// mesh_pair transmits a full host:port. Returning null instead of guessing the
+// local port keeps a stale address from silently reaching the wrong socket.
+export function resolvePeerUrl(db, query) {
+    const peers = listPeers(db).filter((p) => p.paired);
+    const peer = peers.find((p) => p.node_id === query) ?? peers.find((p) => p.hostname === query) ?? null;
+    // A bare IPv6 literal also ends in ":<digits>", so the bracketed form is the
+    // only one that can be told apart unambiguously.
+    const address = peer?.addresses.find(hasPort);
+    return address !== undefined ? `http://${address}` : null;
+}
+function hasPort(address) {
+    // Bracketed IPv6, with an optional zone id (`[fe80::1%eth0]:4399`) and the
+    // v4-mapped dotted form (`[::ffff:192.168.1.10]:4399`).
+    return /^\[[0-9a-f:.]+(?:%[^\]]+)?\]:\d+$/i.test(address) || /^[^:]+:\d+$/.test(address);
+}
 export function upsertDiscoveredPeer(db, peer) {
     const now = Date.now();
-    db.conn.run(`INSERT INTO peers (node_id, hostname, fingerprint, addresses, paired, token, last_seen)
-     VALUES (?, ?, ?, ?, 0, NULL, ?)
+    db.conn.run(`INSERT INTO peers (node_id, hostname, fingerprint, addresses, paired, token, public_key, last_seen)
+     VALUES (?, ?, ?, ?, 0, NULL, ?, ?)
      ON CONFLICT(node_id) DO UPDATE SET hostname = excluded.hostname,
-       fingerprint = excluded.fingerprint, addresses = excluded.addresses, last_seen = excluded.last_seen`, [peer.node_id, peer.hostname, peer.fingerprint, JSON.stringify(peer.addresses), now]);
+       fingerprint = excluded.fingerprint, addresses = excluded.addresses,
+       public_key = CASE WHEN peers.paired = 1 THEN peers.public_key ELSE excluded.public_key END,
+       last_seen = excluded.last_seen`, [
+        peer.node_id,
+        peer.hostname,
+        peer.fingerprint,
+        JSON.stringify(peer.addresses),
+        peer.public_key ?? null,
+        now,
+    ]);
 }
 function rowToPeer(row) {
     return {
@@ -74,6 +169,7 @@ function rowToPeer(row) {
         addresses: parseAddresses(row.addresses),
         paired: row.paired === 1,
         token: row.token,
+        public_key: row.public_key,
         last_seen: row.last_seen,
     };
 }

package/dist/lib/peers.js.map

@@ -1 +1 @@
-{"version":3,"file":"peers.js","sourceRoot":"","sources":["../../src/lib/peers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAY1C,yEAAyE;AACzE,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,IAMC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,EAAE,CAAC,IAAI,CAAC,GAAG,CACT;;;8GAG0G,EAC1G;QACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;QACV,GAAG;KACJ,CACF,CAAC;IACF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yEAAyE,EAAE;QACrF,KAAK;QACL,IAAI,CAAC,GAAG,EAAE;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,6EAA6E;AAC7E,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,EAAU,EAAE,KAAa,EAAE,IAAmB;IAC9E,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CACzB,kDAAkD,EAClD,CAAC,KAAK,CAAC,CACR,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,SAAS;QACnB,WAAW,EAAE,SAAS;QACtB,SAAS,EAAE,EAAE;QACb,MAAM,EAAE,IAAI;QACZ,KAAK;QACL,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,uCAAuC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oDAAoD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,IAAqF;IAErF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,EAAE,CAAC,IAAI,CAAC,GAAG,CACT;;;0GAGsG,EACtG,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,CACrF,CAAC;AACJ,CAAC;AAYD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"peers.js","sourceRoot":"","sources":["../../src/lib/peers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG1C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGxE,8EAA8E;AAC9E,iFAAiF;AACjF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,GAAG,MAAM,CAAC;AAU/C,yEAAyE;AACzE,oFAAoF;AACpF,mFAAmF;AACnF,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAC3B,EAAU,EACV,IAOC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAEvB,EAAE,CAAC,IAAI,CAAC,GAAG,CACT;;;;oGAIgG,EAChG;QACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK;QACV,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,GAAG;KACJ,CACF,CAAC;IACF,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,4CAA4C,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,yEAAyE;AACzE,6DAA6D;AAC7D,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yEAAyE,EAAE;QACrF,KAAK;QACL,IAAI,CAAC,GAAG,EAAE;KACX,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,8EAA8E;AAC9E,2EAA2E;AAC3E,+DAA+D;AAC/D,MAAM,UAAU,iBAAiB,CAC/B,EAAU,EACV,KAAa,EACb,IAAmB,EACnB,KAAc;IAEd,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAEvB,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CACzB,kDAAkD,EAClD,CAAC,KAAK,CAAC,CACR,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,aAAa,CAAC,EAAE,EAAE;QAChB,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,QAAQ;QACpB,KAAK;KACN,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,6EAA6E;AAC7E,kEAAkE;AAClE,8EAA8E;AAC9E,yEAAyE;AACzE,8EAA8E;AAC9E,0EAA0E;AAC1E,SAAS,aAAa,CAAC,KAAW,EAAE,KAAa,EAAE,KAAyB;IAC1E,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC,IAAI,SAAS,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAE1D,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,uEAAuE;QACvE,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,YAAY,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;SAAM,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,YAAY,KAAK,KAAK,CAAC,UAAU,EAAE,CAAC;QAC1E,yEAAyE;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,kBAAkB,CAAC,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,+EAA+E;AAC/E,kEAAkE;AAClE,MAAM,UAAU,kBAAkB,CAAC,EAAU;IAC3C,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,kDAAkD,EAAE;QAC9D,IAAI,CAAC,GAAG,EAAE,GAAG,oBAAoB;KAClC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,EAAU;IAClC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,uCAAuC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,EAAU,EAAE,MAAc;IACrD,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,uCAAuC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,EAAU,EAAE,KAAa;IACvD,MAAM,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAU,oDAAoD,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAChG,OAAO,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,gBAAgB,CAC9B,EAAU,EACV,KAAa;IAEb,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;AACnG,CAAC;AAED,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,KAAa;IACtD,MAAM,KAAK,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC;IAC5F,6EAA6E;IAC7E,iDAAiD;IACjD,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,2EAA2E;IAC3E,wDAAwD;IACxD,OAAO,oCAAoC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,EAAU,EACV,IAMC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,EAAE,CAAC,IAAI,CAAC,GAAG,CACT;;;;;sCAKkC,EAClC;QACE,IAAI,CAAC,OAAO;QACZ,IAAI,CAAC,QAAQ;QACb,IAAI,CAAC,WAAW;QAChB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,UAAU,IAAI,IAAI;QACvB,GAAG;KACJ,CACF,CAAC;AACJ,CAAC;AAaD,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC;QACxC,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,CAAC;QACxB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,UAAU,EAAE,GAAG,CAAC,UAAU;QAC1B,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,GAAW;IACjC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/serve.d.ts

@@ -3,10 +3,12 @@ import type { MeshDb } from "./db.js";
 export type MeshServerOptions = {
     db: MeshDb;
     port: number;
+    bind?: "loopback" | "lan";
 };
 export type MeshServer = {
     server: Server;
     port: number;
+    address: string;
 };
 export declare function startMeshServer(options: MeshServerOptions): Promise<MeshServer>;
 //# sourceMappingURL=serve.d.ts.map

package/dist/lib/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/lib/serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,MAAM,EAAkB,MAAM,WAAW,CAAC;AAGzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAMtC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAKF,wBAAsB,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAuBrF"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../../src/lib/serve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAmB,MAAM,EAAkB,MAAM,WAAW,CAAC;AAGzE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAUtC,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,UAAU,GAAG,KAAK,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAIF,wBAAsB,eAAe,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CA6BrF"}