@yefengr/remote-pi 0.7.4 → 0.7.6

package/dist/pairing/owner_storage.d.ts

@@ -0,0 +1,42 @@
+export interface PeerRecord {
+    name: string;
+    remote_epk: string;
+    paired_at: string;
+}
+export declare function listPeers(): Promise<PeerRecord[]>;
+declare const _ownerStorageTokenBrand: unique symbol;
+/** Opaque, process-local provenance for one canonical Owner storage slot. */
+export type OwnerStorageToken = {
+    readonly [_ownerStorageTokenBrand]: true;
+};
+export interface OwnerStorageSnapshotRecord {
+    readonly rawOwnerPubkey: unknown;
+    readonly token: OwnerStorageToken;
+}
+export type ConditionalPeerRemoval = {
+    readonly outcome: "removed";
+    readonly nextToken: OwnerStorageToken;
+} | {
+    readonly outcome: "stale" | "not_found" | "no_authority";
+};
+export declare function addPeer(record: PeerRecord): Promise<void>;
+/**
+ * Returns the set of distinct `remote_epk` values in peers.json.
+ *
+ * Each `remote_epk` is the paired Owner's Ed25519 public key and represents a
+ * machine-scoped authorization entry.
+ */
+export declare function listOwnerPubkeys(): Promise<unknown[]>;
+/**
+ * Atomically snapshots raw Owner handles and their canonical-slot provenance.
+ * The token is process-local and opaque to callers.
+ */
+export declare function snapshotOwnerPubkeys(): Promise<readonly OwnerStorageSnapshotRecord[]>;
+/**
+ * Removes one exact raw handle only when its snapshot provenance still owns
+ * the target canonical Owner slot. The final authority/token checks and sync
+ * write share the existing serialized mutation lane.
+ */
+export declare function conditionalRemovePeer(remoteEpk: string, expectedToken: OwnerStorageToken, canCommit?: () => boolean): Promise<ConditionalPeerRemoval>;
+export declare function removePeer(remoteEpk: string, canCommit?: () => boolean): Promise<boolean>;
+export {};

package/dist/pairing/owner_storage.js

@@ -0,0 +1,207 @@
+import { writeFileSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { canonicalizeEd25519PublicKey } from "./crypto.js";
+const PEERS_PATH = join(homedir(), ".pi", "remote", "peers.json");
+export async function listPeers() {
+    try {
+        const raw = await readFile(PEERS_PATH, "utf8");
+        const parsed = JSON.parse(raw);
+        return Array.isArray(parsed.peers) ? parsed.peers : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Strict container read used by serialized storage mutations. Valid records
+ * remain verbatim so one corrupt entry never erases other pairings.
+ */
+async function _readPeerContainerStrict() {
+    let raw;
+    try {
+        raw = await readFile(PEERS_PATH, "utf8");
+    }
+    catch (error) {
+        if (typeof error === "object" &&
+            error !== null &&
+            "code" in error &&
+            error.code === "ENOENT") {
+            return [];
+        }
+        throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (!Array.isArray(parsed.peers)) {
+        throw new Error("Invalid peers.json container");
+    }
+    return parsed.peers;
+}
+let _peerMutationQueue = Promise.resolve();
+const _ownerSlotTokens = new Map();
+const _ownerStorageTokenBrand = Symbol("owner-storage-token");
+function _ownerSlotKey(rawOwnerPubkey) {
+    if (typeof rawOwnerPubkey !== "string") {
+        // Invalid non-string records remain isolated; their quarantine slots never
+        // collide with a valid canonical Owner identity.
+        return `raw:quarantine:${typeof rawOwnerPubkey}`;
+    }
+    try {
+        return `owner:${canonicalizeEd25519PublicKey(rawOwnerPubkey, "Owner record")}`;
+    }
+    catch {
+        return `raw:string:${rawOwnerPubkey}`;
+    }
+}
+function _tokenForSlot(slot) {
+    const existing = _ownerSlotTokens.get(slot);
+    if (existing)
+        return existing;
+    const token = Object.freeze({ [_ownerStorageTokenBrand]: true });
+    _ownerSlotTokens.set(slot, token);
+    return token;
+}
+function _invalidateOwnerSlot(rawOwnerPubkey) {
+    const slot = _ownerSlotKey(rawOwnerPubkey);
+    const token = Object.freeze({ [_ownerStorageTokenBrand]: true });
+    _ownerSlotTokens.set(slot, token);
+    return token;
+}
+function _serializePeerMutation(mutation) {
+    const result = _peerMutationQueue.then(mutation, mutation);
+    _peerMutationQueue = result.then(() => undefined, () => undefined);
+    return result;
+}
+export function addPeer(record) {
+    return _serializePeerMutation(async () => {
+        const peers = await listPeers();
+        const idx = peers.findIndex((peer) => !!peer &&
+            typeof peer === "object" &&
+            peer.remote_epk === record.remote_epk);
+        if (idx >= 0) {
+            peers[idx] = record; // idempotent re-pair
+        }
+        else {
+            peers.push(record);
+        }
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        await writeFile(PEERS_PATH, JSON.stringify({ peers }, null, 2));
+        // A successful re-pair is a new storage provenance event even when the
+        // record bytes happen to be identical.
+        _invalidateOwnerSlot(record.remote_epk);
+    });
+}
+/**
+ * Returns the set of distinct `remote_epk` values in peers.json.
+ *
+ * Each `remote_epk` is the paired Owner's Ed25519 public key and represents a
+ * machine-scoped authorization entry.
+ */
+export async function listOwnerPubkeys() {
+    const peers = await listPeers();
+    const seen = new Set();
+    for (const peer of peers) {
+        if (!peer || typeof peer !== "object") {
+            seen.add(peer);
+            continue;
+        }
+        seen.add(peer.remote_epk);
+    }
+    return [...seen];
+}
+/**
+ * Atomically snapshots raw Owner handles and their canonical-slot provenance.
+ * The token is process-local and opaque to callers.
+ */
+export function snapshotOwnerPubkeys() {
+    return _serializePeerMutation(async () => {
+        const peers = await _readPeerContainerStrict();
+        const rawOwners = new Set();
+        for (const peer of peers) {
+            if (!peer || typeof peer !== "object") {
+                rawOwners.add(peer);
+            }
+            else {
+                rawOwners.add(peer.remote_epk);
+            }
+        }
+        return [...rawOwners].map((rawOwnerPubkey) => ({
+            rawOwnerPubkey,
+            token: _tokenForSlot(_ownerSlotKey(rawOwnerPubkey)),
+        }));
+    });
+}
+/**
+ * Removes one exact raw handle only when its snapshot provenance still owns
+ * the target canonical Owner slot. The final authority/token checks and sync
+ * write share the existing serialized mutation lane.
+ */
+export function conditionalRemovePeer(remoteEpk, expectedToken, canCommit) {
+    return _serializePeerMutation(async () => {
+        const slot = _ownerSlotKey(remoteEpk);
+        // Provenance belongs to the canonical Owner slot, not the exact raw
+        // spelling. A stale slot must therefore win over an absent old spelling.
+        if (_tokenForSlot(slot) !== expectedToken)
+            return { outcome: "stale" };
+        const peers = await _readPeerContainerStrict();
+        const filtered = peers.filter((peer) => !peer ||
+            typeof peer !== "object" ||
+            peer.remote_epk !== remoteEpk);
+        if (filtered.length === peers.length)
+            return { outcome: "not_found" };
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        // No await may intervene between the final token/authority checks and
+        // synchronous write, preserving the lane's fail-closed commit boundary.
+        if (_tokenForSlot(slot) !== expectedToken)
+            return { outcome: "stale" };
+        if (canCommit) {
+            let authorized = false;
+            try {
+                authorized = canCommit();
+            }
+            catch {
+                return { outcome: "no_authority" };
+            }
+            if (!authorized)
+                return { outcome: "no_authority" };
+        }
+        writeFileSync(PEERS_PATH, JSON.stringify({ peers: filtered }, null, 2));
+        return { outcome: "removed", nextToken: _invalidateOwnerSlot(remoteEpk) };
+    });
+}
+export function removePeer(remoteEpk, canCommit) {
+    return _serializePeerMutation(async () => {
+        const peers = await listPeers();
+        const filtered = peers.filter((peer) => !peer ||
+            typeof peer !== "object" ||
+            peer.remote_epk !== remoteEpk);
+        if (filtered.length === peers.length)
+            return false;
+        await mkdir(dirname(PEERS_PATH), { recursive: true });
+        const serialized = JSON.stringify({ peers: filtered }, null, 2);
+        if (canCommit) {
+            // Guarded commits are atomic with their final authority check: fail
+            // closed on false/throw, then synchronously persist the small JSON rewrite.
+            let authorized = false;
+            try {
+                authorized = canCommit();
+            }
+            catch {
+                return false;
+            }
+            if (!authorized)
+                return false;
+            writeFileSync(PEERS_PATH, serialized);
+        }
+        else {
+            // Manual removals keep the established asynchronous storage behavior.
+            await writeFile(PEERS_PATH, serialized);
+        }
+        const removed = true;
+        if (removed)
+            _invalidateOwnerSlot(remoteEpk);
+        return removed;
+    });
+}
+//# sourceMappingURL=owner_storage.js.map

package/dist/pairing/owner_storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owner_storage.js","sourceRoot":"","sources":["../../src/pairing/owner_storage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAE3D,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AAQlE,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;QACtD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,wBAAwB;IACrC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IACE,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,IAAI,KAAK;YACd,KAA4B,CAAC,IAAI,KAAK,QAAQ,EAC/C,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwB,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,IAAI,kBAAkB,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;AAC1D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;AAC9D,MAAM,uBAAuB,GAAkB,MAAM,CAAC,qBAAqB,CAAC,CAAC;AAgB7E,SAAS,aAAa,CAAC,cAAuB;IAC5C,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACvC,2EAA2E;QAC3E,iDAAiD;QACjD,OAAO,kBAAkB,OAAO,cAAc,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,4BAA4B,CAAC,cAAc,EAAE,cAAc,CAAC,EAAE,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,cAAc,cAAc,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAsB,CAAC;IACtF,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,cAAuB;IACnD,MAAM,IAAI,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,CAAsB,CAAC;IACtF,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,sBAAsB,CAAI,QAA0B;IAC3D,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC3D,kBAAkB,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,MAAkB;IACxC,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAe,CAAC;QAC7C,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CACnC,CAAC,CAAC,IAAI;YACN,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU,CACpE,CAAC;QACF,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACb,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,qBAAqB;QAC5C,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChE,uEAAuE;QACvE,uCAAuC;QACvC,oBAAoB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAe,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAW,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,GAAG,CAAE,IAAiC,CAAC,UAAU,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,IAAI,GAAG,EAAW,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;iBAAM,CAAC;gBACN,SAAS,CAAC,GAAG,CAAE,IAAiC,CAAC,UAAU,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;YAC7C,cAAc;YACd,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,cAAc,CAAC,CAAC;SACpD,CAAC,CAAC,CAAC;IACN,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAiB,EACjB,aAAgC,EAChC,SAAyB;IAEzB,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QACtC,oEAAoE;QACpE,yEAAyE;QACzE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACvE,MAAM,KAAK,GAAG,MAAM,wBAAwB,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,CAAC,IAAI;YACL,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,SAAS,CAC5D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;QACtE,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,sEAAsE;QACtE,wEAAwE;QACxE,IAAI,aAAa,CAAC,IAAI,CAAC,KAAK,aAAa;YAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;QACvE,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;YAAC,CAAC;YAC/E,IAAI,CAAC,UAAU;gBAAE,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;QACtD,CAAC;QACD,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,oBAAoB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,SAAiB,EACjB,SAAyB;IAEzB,OAAO,sBAAsB,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,SAAS,EAAe,CAAC;QAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACrC,CAAC,IAAI;YACL,OAAO,IAAI,KAAK,QAAQ;YACvB,IAAiC,CAAC,UAAU,KAAK,SAAS,CAC5D,CAAC;QACF,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACnD,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEtD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,SAAS,EAAE,CAAC;YACd,oEAAoE;YACpE,4EAA4E;YAC5E,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC;gBAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,KAAK,CAAC;YAAC,CAAC;YACzD,IAAI,CAAC,UAAU;gBAAE,OAAO,KAAK,CAAC;YAC9B,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACxC,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,MAAM,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QAC1C,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC;QACrB,IAAI,OAAO;YAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/pairing/qr.d.ts

@@ -1,59 +1,20 @@
-/** Default ephemeral-token lifetime (also the QR rotation period). */
 export declare const TOKEN_TTL_MS = 60000;
-/** Bounds for a caller-supplied pairing TTL (e.g. `/remote-pi pair --ttl <s>`). */
 export declare const PAIR_TTL_MIN_MS = 10000;
 export declare const PAIR_TTL_MAX_MS = 600000;
-/** Clamp an arbitrary ttl (ms) into the safe pairing range; NaN → default. */
 export declare function clampPairTtlMs(ttlMs: number): number;
-/** Encapsulates the single active QR token. One instance per Pi process. */
 export declare class QRSession {
     private active;
-    /** Generates a fresh 16-byte random token encoded as base64url. */
     generateToken(): string;
-    /**
-     * Issues a new active token, invalidating any previous one.
-     * Returns the token and its expiry timestamp.
-     */
     issueToken(ttlMs?: number): {
         token: string;
         expiresAt: number;
     };
-    /** Validates and atomically consumes a token. */
     consumeToken(token: string): "ok" | "expired" | "consumed" | "unknown";
     clear(): void;
 }
 export declare const qrSession: QRSession;
-export declare function buildQRUri(token: string, longtermEdPk: Uint8Array, // Ed25519 — only peer ID after E2E rollback
-sessionName: string, 
-/**
- * Pi room id (12 chars, base64url) derived from cwd. App routes pair_request
- * to this room so the relay delivers it to the right Pi instance among N
- * paralelos com mesmo epk. Adicionado no fix do plano 17 (sem `rm` o app
- * cai em room=main e o relay drops com "dest not found").
- */
-roomId?: string): string;
-/**
- * Returns the QR ASCII as a string (pure Unicode block characters —
- * `█ ▀ ▄` and space, NO ANSI escapes — qrcode-terminal v0.12 small mode
- * is escape-free, see lib/main.js:48-53).
- *
- * The caller can either write the string to stderr (legacy path, breaks
- * the Pi TUI layout) or inject it via `pi.sendMessage` (renders inside
- * the chat panel as proper content).
- */
+/** Builds the endpoint-aware pairing URI. */
+export declare function buildQRUri(token: string, longtermEdPk: Uint8Array, sessionName: string, endpointId: string, runtimeInstanceId: string): string;
 export declare function renderQRAscii(uri: string): string;
-/**
- * Legacy stderr writer — kept for the standalone CLI mode
- * (`pi-extension/src/index.ts` bottom block, which runs outside a Pi TUI).
- * Inside the Pi TUI extension flow, use `renderQRAscii` + `pi.sendMessage`
- * instead — direct stderr writes from inside an extension break the TUI's
- * scrollable output widget (the QR overflows the panel and other writes
- * collide with the prompt area).
- */
 export declare function displayQR(uri: string): void;
-/**
- * Starts a rotating QR session: generates a new QR every 60s, printing it
- * to stdout. Returns a `stop()` function that cancels the rotation and clears
- * the active token.
- */
-export declare function startQRRotation(longtermEdPk: Uint8Array, sessionName: string, roomId?: string): () => void;
+export declare function startQRRotation(longtermEdPk: Uint8Array, sessionName: string, endpointId: string, runtimeInstanceId: string): () => void;

package/dist/pairing/qr.js

@@ -1,34 +1,24 @@
 import { randomBytes } from "node:crypto";
 import qrTerminal from "qrcode-terminal";
-/** Default ephemeral-token lifetime (also the QR rotation period). */
 export const TOKEN_TTL_MS = 60_000;
-/** Bounds for a caller-supplied pairing TTL (e.g. `/remote-pi pair --ttl <s>`). */
 export const PAIR_TTL_MIN_MS = 10_000;
 export const PAIR_TTL_MAX_MS = 600_000;
-/** Clamp an arbitrary ttl (ms) into the safe pairing range; NaN → default. */
 export function clampPairTtlMs(ttlMs) {
     if (!Number.isFinite(ttlMs))
         return TOKEN_TTL_MS;
     return Math.min(PAIR_TTL_MAX_MS, Math.max(PAIR_TTL_MIN_MS, Math.floor(ttlMs)));
 }
-/** Encapsulates the single active QR token. One instance per Pi process. */
 export class QRSession {
     active = null;
-    /** Generates a fresh 16-byte random token encoded as base64url. */
     generateToken() {
         return randomBytes(16).toString("base64url");
     }
-    /**
-     * Issues a new active token, invalidating any previous one.
-     * Returns the token and its expiry timestamp.
-     */
     issueToken(ttlMs = TOKEN_TTL_MS) {
         const token = this.generateToken();
         const expiresAt = Date.now() + ttlMs;
         this.active = { token, expiresAt, consumed: false };
         return { token, expiresAt };
     }
-    /** Validates and atomically consumes a token. */
     consumeToken(token) {
         if (!this.active || this.active.token !== token)
             return "unknown";
@@ -44,74 +34,34 @@ export class QRSession {
     }
 }
 export const qrSession = new QRSession();
-// ── URI + display ─────────────────────────────────────────────────────────────
-export function buildQRUri(token, longtermEdPk, // Ed25519 — only peer ID after E2E rollback
-sessionName, 
-/**
- * Pi room id (12 chars, base64url) derived from cwd. App routes pair_request
- * to this room so the relay delivers it to the right Pi instance among N
- * paralelos com mesmo epk. Adicionado no fix do plano 17 (sem `rm` o app
- * cai em room=main e o relay drops com "dest not found").
- */
-roomId) {
-    // `r` (relay URL) removed in plano 14 — relay now comes from app config /
-    // pi-ext env|config|default chain. Keeps QR ~30-50 chars shorter.
-    // `n` (session name) is kept: the app uses it for the pre-pair_ok preview
-    // screen (showing the agent name immediately after scan, before the
-    // handshake completes). Dropping it briefly shrank the QR but the QR
-    // size no longer matters now that the copy-paste URI is rendered via
-    // `pi.sendMessage` into the chat panel (not the QR overflow area).
-    const epkB64 = Buffer.from(longtermEdPk).toString("base64url");
+/** Builds the endpoint-aware pairing URI. */
+export function buildQRUri(token, longtermEdPk, sessionName, endpointId, runtimeInstanceId) {
     const params = new URLSearchParams({
         t: token,
-        epk: epkB64,
+        epk: Buffer.from(longtermEdPk).toString("base64url"),
         n: sessionName.slice(0, 80),
+        ep: endpointId,
+        rt: runtimeInstanceId,
     });
-    if (roomId)
-        params.set("rm", roomId);
     return `remotepi://pair?${params.toString()}`;
 }
-/**
- * Returns the QR ASCII as a string (pure Unicode block characters —
- * `█ ▀ ▄` and space, NO ANSI escapes — qrcode-terminal v0.12 small mode
- * is escape-free, see lib/main.js:48-53).
- *
- * The caller can either write the string to stderr (legacy path, breaks
- * the Pi TUI layout) or inject it via `pi.sendMessage` (renders inside
- * the chat panel as proper content).
- */
 export function renderQRAscii(uri) {
     let out = "";
     qrTerminal.generate(uri, { small: true }, (qrcode) => { out = qrcode; });
     return out;
 }
-/**
- * Legacy stderr writer — kept for the standalone CLI mode
- * (`pi-extension/src/index.ts` bottom block, which runs outside a Pi TUI).
- * Inside the Pi TUI extension flow, use `renderQRAscii` + `pi.sendMessage`
- * instead — direct stderr writes from inside an extension break the TUI's
- * scrollable output widget (the QR overflows the panel and other writes
- * collide with the prompt area).
- */
 export function displayQR(uri) {
-    const qrcode = renderQRAscii(uri);
-    process.stderr.write(`\n📱 Scan to pair:\n\n${qrcode}\n`);
+    process.stderr.write(`\nScan to pair:\n\n${renderQRAscii(uri)}\n`);
 }
-/**
- * Starts a rotating QR session: generates a new QR every 60s, printing it
- * to stdout. Returns a `stop()` function that cancels the rotation and clears
- * the active token.
- */
-export function startQRRotation(longtermEdPk, sessionName, roomId) {
+export function startQRRotation(longtermEdPk, sessionName, endpointId, runtimeInstanceId) {
     let timer = null;
     let stopped = false;
     const rotate = () => {
         if (stopped)
             return;
         const { token, expiresAt } = qrSession.issueToken();
-        const uri = buildQRUri(token, longtermEdPk, sessionName, roomId);
-        displayQR(uri);
-        console.log(`⏱  Renews at ${new Date(expiresAt).toLocaleTimeString()} — waiting for scan…`);
+        displayQR(buildQRUri(token, longtermEdPk, sessionName, endpointId, runtimeInstanceId));
+        console.log(`Renews at ${new Date(expiresAt).toLocaleTimeString()} — waiting for scan…`);
         timer = setTimeout(rotate, TOKEN_TTL_MS);
     };
     rotate();

package/dist/pairing/qr.js.map

@@ -1 +1 @@
-{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,mFAAmF;AACnF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,8EAA8E;AAC9E,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAQD,4EAA4E;AAC5E,MAAM,OAAO,SAAS;IACZ,MAAM,GAAuB,IAAI,CAAC;IAE1C,mEAAmE;IACnE,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,QAAgB,YAAY;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,iDAAiD;IACjD,YAAY,CACV,KAAa;QAEb,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,iFAAiF;AAEjF,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,YAAwB,EAAE,4CAA4C;AACtE,WAAmB;AACnB;;;;;GAKG;AACH,MAAe;IAEf,0EAA0E;IAC1E,kEAAkE;IAClE,0EAA0E;IAC1E,oEAAoE;IACpE,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,EAAE,KAAK;QACR,GAAG,EAAE,MAAM;QACX,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,MAAM,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,YAAwB,EACxB,WAAmB,EACnB,MAAe;IAEf,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACpD,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QACjE,SAAS,CAAC,GAAG,CAAC,CAAC;QACf,OAAO,CAAC,GAAG,CACT,gBAAgB,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAC/E,CAAC;QACF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEF,MAAM,EAAE,CAAC;IAET,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"qr.js","sourceRoot":"","sources":["../../src/pairing/qr.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,UAAU,MAAM,iBAAiB,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AACtC,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC;AAEvC,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,YAAY,CAAC;IACjD,OAAO,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAQD,MAAM,OAAO,SAAS;IACZ,MAAM,GAAuB,IAAI,CAAC;IAE1C,aAAa;QACX,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,UAAU,CAAC,QAAgB,YAAY;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED,YAAY,CAAC,KAAa;QACxB,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO,SAAS,CAAC;QAClE,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,UAAU,CAAC;QAC5C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;CACF;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,IAAI,SAAS,EAAE,CAAC;AAEzC,6CAA6C;AAC7C,MAAM,UAAU,UAAU,CACxB,KAAa,EACb,YAAwB,EACxB,WAAmB,EACnB,UAAkB,EAClB,iBAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,CAAC,EAAE,KAAK;QACR,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACpD,CAAC,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3B,EAAE,EAAE,UAAU;QACd,EAAE,EAAE,iBAAiB;KACtB,CAAC,CAAC;IACH,OAAO,mBAAmB,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,UAAU,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,EAAE,EAAE,GAAG,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sBAAsB,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,YAAwB,EACxB,WAAmB,EACnB,UAAkB,EAClB,iBAAyB;IAEzB,IAAI,KAAK,GAAyC,IAAI,CAAC;IACvD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,EAAE;QAClB,IAAI,OAAO;YAAE,OAAO;QACpB,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC;QACpD,SAAS,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC,CAAC;QACvF,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,CAAC;QACzF,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC,CAAC;IACF,MAAM,EAAE,CAAC;IACT,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,SAAS,CAAC,KAAK,EAAE,CAAC;IACpB,CAAC,CAAC;AACJ,CAAC"}

package/dist/pairing/storage.d.ts

@@ -1,4 +1,6 @@
 import { type Ed25519Keypair } from "./crypto.js";
+export { addPeer, listPeers, listOwnerPubkeys, snapshotOwnerPubkeys, conditionalRemovePeer, removePeer, } from "./owner_storage.js";
+export type { PeerRecord, OwnerStorageToken, OwnerStorageSnapshotRecord, ConditionalPeerRemoval, } from "./owner_storage.js";
 /** Raised when the keyring is unreadable on a platform where it's a core OS
  *  service (macOS Keychain, Windows Credential Manager) AND no prior file
  *  identity exists. We refuse to generate a NEW identity here because that
@@ -9,7 +11,7 @@ export declare class KeyringUnavailableError extends Error {
 }
 /** Raised when no identity can be resolved (keyring unreadable, no identity
  *  file) BUT `peers.json` already lists paired devices. Minting a fresh key
- *  here would make SelfRevoke wipe those pairings — see issues #95 / #69. */
+ *  here would make those existing pairings unusable — see issues #95 / #69. */
 export declare class PairedIdentityMissingError extends Error {
     constructor(pairedCount: number, cause: unknown);
 }
@@ -70,51 +72,7 @@ export declare function _setKeyringRetryForTest(attempts: number | null, delayMs
  * runs at most once per machine (the old entry is deleted after copy).
  */
 export declare function getOrCreateEd25519Keypair(): Promise<Ed25519Keypair>;
-export interface PeerRecord {
-    name: string;
-    remote_epk: string;
-    paired_at: string;
-}
-export declare function listPeers(): Promise<PeerRecord[]>;
-declare const _ownerStorageTokenBrand: unique symbol;
-/** Opaque, process-local provenance for one canonical Owner storage slot. */
-export type OwnerStorageToken = {
-    readonly [_ownerStorageTokenBrand]: true;
-};
-export interface OwnerStorageSnapshotRecord {
-    readonly rawOwnerPubkey: unknown;
-    readonly token: OwnerStorageToken;
-}
-export type ConditionalPeerRemoval = {
-    readonly outcome: "removed";
-    readonly nextToken: OwnerStorageToken;
-} | {
-    readonly outcome: "stale" | "not_found" | "no_authority";
-};
-export declare function addPeer(record: PeerRecord): Promise<void>;
-/**
- * Returns the set of distinct `remote_epk` values in peers.json.
- *
- * In the current pairing model (plan/23 + plan/24), each `remote_epk` is the
- * Owner's Ed25519 pubkey — and we treat each as a distinct Owner the Pi has
- * been paired with. Used by the mesh self-revoke poller (plan/24 Wave 3) to
- * know which Owners' mesh blobs to fetch.
- */
-export declare function listOwnerPubkeys(): Promise<unknown[]>;
-/**
- * Atomically snapshots raw Owner handles and their canonical-slot provenance.
- * The token is deliberately process-local and opaque to callers.
- */
-export declare function snapshotOwnerPubkeys(): Promise<readonly OwnerStorageSnapshotRecord[]>;
-/**
- * Removes one exact raw handle only when its snapshot provenance still owns
- * the target canonical Owner slot. The final authority/token checks and sync
- * write share the existing serialized mutation lane.
- */
-export declare function conditionalRemovePeer(remoteEpk: string, expectedToken: OwnerStorageToken, canCommit?: () => boolean): Promise<ConditionalPeerRemoval>;
-export declare function removePeer(remoteEpk: string, canCommit?: () => boolean): Promise<boolean>;
 /** Test-only: expose the identity-file path so tests can clean it. */
 export declare const _IDENTITY_FILE_FOR_TEST: string;
 /** Test-only: expose unlink for cleanup. */
 export declare const _unlinkIdentityFileForTest: () => Promise<void>;
-export {};