instar 1.3.896 → 1.3.898

package/dist/core/MutualSshHealthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshHealthController.js","sourceRoot":"","sources":["../../src/core/MutualSshHealthController.ts"],"names":[],"mappings":"AAyBA,qFAAqF;AACrF,sDAAsD;AACtD,MAAM,OAAO,yBAAyB;IAGP;IAA8C;IAA8C;IAFxG,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC9C,OAAO,GAAG,CAAC,CAAC;IACpB,YAA6B,QAA2B,EAAmB,KAA2B,EAAmB,cAAc,CAAC;QAA3G,aAAQ,GAAR,QAAQ,CAAmB;QAAmB,UAAK,GAAL,KAAK,CAAsB;QAAmB,gBAAW,GAAX,WAAW,CAAI;QACtI,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,MAAM,CAAC,gBAAgB,CAAC,YAAoB,EAAE,WAAW,GAAG,CAAC,EAAE,UAAU,GAAG,KAAK,EAAE,WAAW,GAAG,OAAO;QACtG,MAAM,OAAO,GAAG,YAAY,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,UAAU,GAAG,WAAW,CAAC;QAC7E,IAAI,OAAO,IAAI,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,YAAY,OAAO,gBAAgB,WAAW,EAAE,CAAC,CAAC;IACpJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,MAAsB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACrE,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO,IAAI,CAAC;QACvF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBACnF,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;gBAC3B,IAAI,CAAC;oBACH,IAAI,OAAO,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;oBAC1D,IAAI,OAAO,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;oBAC/D,IAAI,OAAO,KAAK,CAAC;wBAAE,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;oBAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBAChD,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC;oBAAC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;oBAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;oBACzE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;oBAC7B,OAAO,KAAK,CAAC;gBACf,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,mEAAmE;oBACnE,kEAAkE;oBAClE,8DAA8D;oBAC9D,OAAO,CAAC,OAAO,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAC;oBAClD,IAAI,OAAO,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;wBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;wBAAC,MAAM;oBAAC,CAAC;oBAChH,IAAI,OAAO,GAAG,CAAC;wBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5E,CAAC;YACH,CAAC;YACD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3B,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC;gBAAE,OAAO,CAAC,YAAY,GAAG,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;YAC3E,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;gBAAS,CAAC;YAAC,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAAC,CAAC;IAClC,CAAC;IAED,MAAM,CAAC,OAAyB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAChD,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE;YAC1B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;YAC/E,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;YAC9G,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC;YAC9I,OAAO;gBACL,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM;gBACxF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK;gBAC7F,gBAAgB,EAAE,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACzD,gBAAgB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,SAAS;aAC9F,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF;AAED,SAAS,OAAO,CAAC,MAAoF;IACnG,OAAO,GAAG,MAAM,CAAC,eAAe,KAAK,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;AACvF,CAAC;AACD,MAAM,UAAU,wBAAwB,CAAC,KAAc;IACrD,yEAAyE;IACzE,oDAAoD;IACpD,MAAM,OAAO,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACvF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAClF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,wBAAwB,CAAC,CAAC;QAAE,OAAO,gBAAgB,CAAC;IACvF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,6BAA6B,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC9G,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,uBAAuB,CAAC,CAAC;QAAE,OAAO,uBAAuB,CAAC;IAC1H,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IACxF,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACvE,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;QAAE,OAAO,iBAAiB,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AACD,SAAS,MAAM,CAAC,KAAa,EAAE,OAA0B,IAAa,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9H,SAAS,KAAK,CAAC,EAAU,IAAmB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/core/MutualSshProbeScheduler.d.ts

@@ -0,0 +1,21 @@
+export interface ScheduledSshDirection {
+    sourceMachineId: string;
+    targetMachineId: string;
+    healthy: boolean;
+}
+export interface ProbeSweepResult {
+    attempted: string[];
+    peakConcurrency: number;
+    elapsedMs: number;
+}
+/** Fair global work bucket with a 25% reserve for healthy refreshes. */
+export declare class MutualSshProbeScheduler {
+    readonly concurrency: number;
+    readonly freshnessMs: number;
+    readonly probeDeadlineMs: number;
+    constructor(concurrency?: number, freshnessMs?: number, probeDeadlineMs?: number);
+    validate(machineCount: number): void;
+    worstCaseSweepMs(machineCount: number): number;
+    sweep(directions: ScheduledSshDirection[], probe: (direction: ScheduledSshDirection) => Promise<void>): Promise<ProbeSweepResult>;
+}
+//# sourceMappingURL=MutualSshProbeScheduler.d.ts.map

package/dist/core/MutualSshProbeScheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshProbeScheduler.d.ts","sourceRoot":"","sources":["../../src/core/MutualSshProbeScheduler.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wEAAwE;AACxE,qBAAa,uBAAuB;IACtB,QAAQ,CAAC,WAAW;IAAM,QAAQ,CAAC,WAAW;IAAY,QAAQ,CAAC,eAAe;gBAAzE,WAAW,SAAI,EAAW,WAAW,SAAU,EAAW,eAAe,SAAQ;IAItG,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI;IAKpC,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM;IAIxC,KAAK,CAAC,UAAU,EAAE,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,SAAS,EAAE,qBAAqB,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,gBAAgB,CAAC;CA2BxI"}

package/dist/core/MutualSshProbeScheduler.js

@@ -0,0 +1,57 @@
+/** Fair global work bucket with a 25% reserve for healthy refreshes. */
+export class MutualSshProbeScheduler {
+    concurrency;
+    freshnessMs;
+    probeDeadlineMs;
+    constructor(concurrency = 4, freshnessMs = 300_000, probeDeadlineMs = 8_000) {
+        this.concurrency = concurrency;
+        this.freshnessMs = freshnessMs;
+        this.probeDeadlineMs = probeDeadlineMs;
+        if (concurrency < 1 || concurrency > 32)
+            throw new Error('mutual-ssh-concurrency-out-of-range');
+    }
+    validate(machineCount) {
+        const sweepMs = this.worstCaseSweepMs(machineCount);
+        if (sweepMs >= this.freshnessMs)
+            throw new Error(`mutual-ssh-capacity-invalid machines=${machineCount} sweepMs=${sweepMs} freshnessMs=${this.freshnessMs}`);
+    }
+    worstCaseSweepMs(machineCount) {
+        return Math.ceil(machineCount * (machineCount - 1) / this.concurrency) * this.probeDeadlineMs;
+    }
+    async sweep(directions, probe) {
+        const started = Date.now();
+        const healthy = directions.filter(x => x.healthy);
+        const unhealthy = directions.filter(x => !x.healthy);
+        const ordered = [];
+        const reserveEvery = Math.max(1, Math.floor(this.concurrency / Math.max(1, Math.ceil(this.concurrency * 0.25))));
+        while (healthy.length || unhealthy.length) {
+            for (let i = 0; i < reserveEvery - 1 && unhealthy.length; i += 1)
+                ordered.push(unhealthy.shift());
+            if (healthy.length)
+                ordered.push(healthy.shift());
+            else if (unhealthy.length)
+                ordered.push(unhealthy.shift());
+        }
+        let cursor = 0;
+        let active = 0;
+        let peak = 0;
+        const attempted = [];
+        const workers = Array.from({ length: Math.min(this.concurrency, ordered.length) }, async () => {
+            while (cursor < ordered.length) {
+                const item = ordered[cursor++];
+                active += 1;
+                peak = Math.max(peak, active);
+                attempted.push(`${item.sourceMachineId}->${item.targetMachineId}`);
+                try {
+                    await probe(item);
+                }
+                finally {
+                    active -= 1;
+                }
+            }
+        });
+        await Promise.all(workers);
+        return { attempted, peakConcurrency: peak, elapsedMs: Date.now() - started };
+    }
+}
+//# sourceMappingURL=MutualSshProbeScheduler.js.map

package/dist/core/MutualSshProbeScheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshProbeScheduler.js","sourceRoot":"","sources":["../../src/core/MutualSshProbeScheduler.ts"],"names":[],"mappings":"AAYA,wEAAwE;AACxE,MAAM,OAAO,uBAAuB;IACb;IAA0B;IAAgC;IAA/E,YAAqB,cAAc,CAAC,EAAW,cAAc,OAAO,EAAW,kBAAkB,KAAK;QAAjF,gBAAW,GAAX,WAAW,CAAI;QAAW,gBAAW,GAAX,WAAW,CAAU;QAAW,oBAAe,GAAf,eAAe,CAAQ;QACpG,IAAI,WAAW,GAAG,CAAC,IAAI,WAAW,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAClG,CAAC;IAED,QAAQ,CAAC,YAAoB;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,OAAO,IAAI,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,YAAY,YAAY,OAAO,gBAAgB,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9J,CAAC;IAED,gBAAgB,CAAC,YAAoB;QACnC,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;IAChG,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAmC,EAAE,KAA0D;QACzG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAA4B,EAAE,CAAC;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,OAAO,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;YAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,GAAG,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAG,CAAC,CAAC;YACnG,IAAI,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAG,CAAC,CAAC;iBAC9C,IAAI,SAAS,CAAC,MAAM;gBAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAG,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,SAAS,GAAa,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;YAC5F,OAAO,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC/B,MAAM,IAAI,CAAC,CAAC;gBACZ,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC9B,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC;oBAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;wBAAS,CAAC;oBAAC,MAAM,IAAI,CAAC,CAAC;gBAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAC/E,CAAC;CACF"}

package/dist/core/MutualSshRuntime.d.ts

@@ -0,0 +1,106 @@
+import { type DirectionalSshProof } from './MutualSshVerifier.js';
+import { type MutualSshPairHealth } from './MutualSshHealthController.js';
+import { type SshBootstrapAdvert } from './SshBootstrapAdvert.js';
+export interface MutualSshPeer {
+    machineId: string;
+    pairingEpoch: number;
+    machineFingerprint: string;
+    endpoints: string[];
+}
+export interface MutualSshRuntimeDeps {
+    stateDir: string;
+    agentId: string;
+    selfMachineId: string;
+    selfMachineFingerprint: string;
+    observerBootId: string;
+    bindHost: string;
+    bindPort: number;
+    dryRun: boolean;
+    requiredForReadiness?: boolean;
+    freshnessMs?: number;
+    cadenceMs?: number;
+    concurrency?: number;
+    listPeers(): MutualSshPeer[];
+    send(machineId: string, command: MutualSshWireCommand): Promise<unknown>;
+    sign(payload: string): string;
+    verify(machineId: string, payload: string, signature: string): boolean;
+    emitJournalProof?(proof: DirectionalSshProof): void;
+    audit?(event: Record<string, unknown>): void;
+    notifySecurity?(event: Record<string, unknown>): void;
+}
+export type MutualSshWireCommand = {
+    type: 'ssh-bootstrap-advert';
+    advert: SshBootstrapAdvert;
+} | {
+    type: 'ssh-proof-publish';
+    proof: DirectionalSshProof;
+};
+/** Production coordinator for endpoint lifecycle, signed adverts, directional probes and rollback. */
+export declare class MutualSshRuntime {
+    private readonly d;
+    private readonly identityManager;
+    private readonly admissionStore;
+    private readonly verifier;
+    private readonly controller;
+    private readonly scheduler;
+    private identity;
+    private endpoint;
+    private listen;
+    private readonly adverts;
+    private readonly candidateAdverts;
+    private readonly hostKeys;
+    private readonly proofs;
+    private readonly bootstrapFailures;
+    private readonly knownPeers;
+    private timer;
+    private hostOverlapTimer;
+    private servePreviousHost;
+    private running;
+    private stopped;
+    private readonly startedAtWall;
+    private readonly proofFile;
+    constructor(d: MutualSshRuntimeDeps);
+    start(): Promise<void>;
+    tick(): Promise<void>;
+    handleAdvert(raw: unknown, authenticatedSender: string): {
+        advert: SshBootstrapAdvert;
+    };
+    handleProof(raw: unknown, authenticatedSender: string): {
+        accepted: true;
+    };
+    /** Delayed journal delivery is observational only and fails closed when stale. */
+    handleJournalProof(raw: unknown, authenticatedSender: string): boolean;
+    status(): {
+        enabled: true;
+        dryRun: boolean;
+        listener: boolean;
+        readinessRequired: boolean;
+        ready: boolean;
+        enrollmentState: 'paired' | 'ssh-bootstrap' | 'ssh-bootstrap-blocked' | 'ssh-proving' | 'ready';
+        blockedReasons: string[];
+        directions: MutualSshPairHealth[];
+        pairs: Array<{
+            machines: string[];
+            mutual: boolean;
+        }>;
+    };
+    revoke(machineId: string): void;
+    rollback(): Promise<void>;
+    private startEndpoint;
+    private ensureEndpoint;
+    private localAdvert;
+    private exchangeAdvert;
+    private installAdvert;
+    private targetFor;
+    private acceptProof;
+    private promoteProvenHostKey;
+    private clearPeerEvidence;
+    private maybeRetirePreviousHost;
+    private retirePreviousHost;
+    private proofFresh;
+    private key;
+    private audit;
+    private invalidatePersistedProofs;
+    private persistProofs;
+}
+//# sourceMappingURL=MutualSshRuntime.d.ts.map

package/dist/core/MutualSshRuntime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshRuntime.d.ts","sourceRoot":"","sources":["../../src/core/MutualSshRuntime.ts"],"names":[],"mappings":"AAKA,OAAO,EAAmD,KAAK,mBAAmB,EAAuB,MAAM,wBAAwB,CAAC;AACxI,OAAO,EAAuD,KAAK,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAI/H,OAAO,EAA2D,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE3H,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,OAAO,CAAC;IAChB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,IAAI,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzE,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;IAC9B,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,gBAAgB,CAAC,CAAC,KAAK,EAAE,mBAAmB,GAAG,IAAI,CAAC;IACpD,KAAK,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACvD;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,kBAAkB,CAAA;CAAE,GAC5D;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,mBAAmB,CAAA;CAAE,CAAC;AAI9D,sGAAsG;AACtG,qBAAa,gBAAgB;IAuBf,OAAO,CAAC,QAAQ,CAAC,CAAC;IAtB9B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAqB;IACrD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAwB;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAA4B;IACvD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAA0B;IACpD,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,QAAQ,CAAmC;IACnD,OAAO,CAAC,MAAM,CAA+C;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAyC;IAC1E,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;IACjE,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAA6B;IAC/D,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,KAAK,CAA+B;IAC5C,OAAO,CAAC,gBAAgB,CAA+B;IACvD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAc;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEN,CAAC,EAAE,oBAAoB;IAwB9C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IA8C3B,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,GAAG;QAAE,MAAM,EAAE,kBAAkB,CAAA;KAAE;IAUvF,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,GAAG;QAAE,QAAQ,EAAE,IAAI,CAAA;KAAE;IAqB1E,kFAAkF;IAClF,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,GAAG,OAAO;IAUtE,MAAM,IAAI;QAAE,OAAO,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,OAAO,CAAC;QAAC,KAAK,EAAE,OAAO,CAAC;QAAC,eAAe,EAAE,QAAQ,GAAG,eAAe,GAAG,uBAAuB,GAAG,aAAa,GAAG,OAAO,CAAC;QAAC,cAAc,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,mBAAmB,EAAE,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;YAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;YAAC,MAAM,EAAE,OAAO,CAAA;SAAE,CAAC,CAAA;KAAE;IAyBhU,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAKzB,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;YAYjB,aAAa;YAkBb,cAAc;IAiB5B,OAAO,CAAC,WAAW;YAmBL,cAAc;IAO5B,OAAO,CAAC,aAAa;IA8BrB,OAAO,CAAC,SAAS;IAiBjB,OAAO,CAAC,WAAW;IAMnB,OAAO,CAAC,oBAAoB;IAY5B,OAAO,CAAC,iBAAiB;IAUzB,OAAO,CAAC,uBAAuB;YAUjB,kBAAkB;IAYhC,OAAO,CAAC,UAAU;IAGlB,OAAO,CAAC,GAAG;IACX,OAAO,CAAC,KAAK;IAEb,OAAO,CAAC,yBAAyB;IAUjC,OAAO,CAAC,aAAa;CAOtB"}

package/dist/core/MutualSshRuntime.js

@@ -0,0 +1,423 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { MachineSshIdentity } from './MachineSshIdentity.js';
+import { MachineSshEndpoint } from './MachineSshEndpoint.js';
+import { MutualSshVerifier, canonicalDirectionalSshProof } from './MutualSshVerifier.js';
+import { MutualSshHealthController, classifyMutualSshFailure } from './MutualSshHealthController.js';
+import { MutualSshProbeScheduler } from './MutualSshProbeScheduler.js';
+import { SshPeerAdmissionStore } from './SshPeerAdmissionStore.js';
+import { SshHostKeyLifecycle, canonicalHostKeyProposal } from './SshHostKeyLifecycle.js';
+import { canonicalSshBootstrapAdvert, validateSshBootstrapAdvert } from './SshBootstrapAdvert.js';
+/** Production coordinator for endpoint lifecycle, signed adverts, directional probes and rollback. */
+export class MutualSshRuntime {
+    d;
+    identityManager;
+    admissionStore;
+    verifier = new MutualSshVerifier();
+    controller;
+    scheduler;
+    identity;
+    endpoint = null;
+    listen = null;
+    adverts = new Map();
+    candidateAdverts = new Map();
+    hostKeys = new Map();
+    proofs = new Map();
+    bootstrapFailures = new Map();
+    knownPeers = new Set();
+    timer = null;
+    hostOverlapTimer = null;
+    servePreviousHost = true;
+    running = false;
+    stopped = false;
+    startedAtWall = Date.now();
+    proofFile;
+    constructor(d) {
+        this.d = d;
+        const freshness = d.freshnessMs ?? 300_000;
+        const concurrency = d.concurrency ?? 4;
+        MutualSshHealthController.validateCapacity(d.listPeers().length + 1, concurrency, 8_000, freshness);
+        this.identityManager = new MachineSshIdentity(d.stateDir, d.agentId, d.selfMachineId);
+        this.admissionStore = new SshPeerAdmissionStore(d.stateDir);
+        this.scheduler = new MutualSshProbeScheduler(concurrency, freshness, 8_000);
+        this.controller = new MutualSshHealthController(this.verifier, {
+            refreshAdvert: async (target) => { await this.exchangeAdvert(target.targetMachineId); },
+            reconcileAdmission: async (target) => { const advert = this.adverts.get(target.targetMachineId); if (advert)
+                this.installAdvert(advert); },
+            rotateSourceKey: async (target) => {
+                this.identity = this.identityManager.ensure({ forceClientRotation: true });
+                target.sourceClientKeyGeneration = this.identity.clientGeneration;
+                target.clientPrivateKeyPath = this.identity.clientPrivateKeyPath;
+                target.expectedSourceClientKeyFingerprint = MachineSshIdentity.fingerprint(this.identity.clientPublicKey);
+                await this.exchangeAdvert(target.targetMachineId);
+            },
+            notifySecurity: async (target) => this.d.notifySecurity?.({ type: 'host-key-change', target: target.targetMachineId }),
+            notifyExhausted: async (target, failure) => this.audit({ type: 'repair-exhausted', target: target.targetMachineId, failure }),
+        }, concurrency);
+        this.proofFile = path.join(d.stateDir, 'machine-ssh', 'directional-proofs.json');
+        this.invalidatePersistedProofs();
+    }
+    async start() {
+        this.identity = this.identityManager.ensure();
+        if (!this.d.dryRun)
+            await this.ensureEndpoint();
+        await this.tick();
+        this.timer = setInterval(() => { void this.tick(); }, this.d.cadenceMs ?? 60_000);
+        this.timer.unref?.();
+    }
+    async tick() {
+        if (this.running || this.stopped)
+            return;
+        this.running = true;
+        try {
+            if (!this.d.dryRun && !this.endpoint)
+                await this.ensureEndpoint();
+            const checkedIdentity = this.identityManager.ensure();
+            if (checkedIdentity.clientGeneration !== this.identity.clientGeneration || checkedIdentity.hostGeneration !== this.identity.hostGeneration) {
+                const hostChanged = checkedIdentity.hostGeneration !== this.identity.hostGeneration;
+                this.audit({ type: 'local-key-rotation', clientGeneration: checkedIdentity.clientGeneration, hostGeneration: checkedIdentity.hostGeneration });
+                this.identity = checkedIdentity;
+                if (hostChanged && !this.d.dryRun) {
+                    this.servePreviousHost = true;
+                    await this.endpoint?.close();
+                    this.endpoint = null;
+                    this.listen = null;
+                    await this.ensureEndpoint();
+                }
+            }
+            const peers = this.d.listPeers().filter(peer => peer.machineId !== this.d.selfMachineId);
+            const livePeerIds = new Set(peers.map(peer => peer.machineId));
+            for (const machineId of this.knownPeers)
+                if (!livePeerIds.has(machineId))
+                    this.revoke(machineId);
+            for (const machineId of livePeerIds)
+                this.knownPeers.add(machineId);
+            this.scheduler.validate(peers.length + 1);
+            for (const peer of peers) {
+                try {
+                    await this.exchangeAdvert(peer.machineId);
+                    this.bootstrapFailures.delete(peer.machineId);
+                }
+                catch (error) {
+                    // @silent-fallback-ok — an advert exchange failure is retained as a
+                    // named readiness blocker and retried on the next bounded sweep.
+                    this.bootstrapFailures.set(peer.machineId, classifyMutualSshFailure(error));
+                }
+            }
+            if (this.d.dryRun) {
+                this.audit({ type: 'dry-run', wouldProbe: peers.length });
+                return;
+            }
+            const targets = peers.flatMap(peer => { const target = this.targetFor(peer); return target ? [target] : []; });
+            await this.scheduler.sweep(targets.map(target => ({ sourceMachineId: target.sourceMachineId, targetMachineId: target.targetMachineId, healthy: this.proofFresh(this.proofs.get(this.key(target.sourceMachineId, target.targetMachineId))) })), async (direction) => {
+                const target = targets.find(row => row.sourceMachineId === direction.sourceMachineId && row.targetMachineId === direction.targetMachineId);
+                if (!target)
+                    return;
+                const proof = await this.controller.check(target);
+                if (!proof)
+                    return;
+                this.promoteProvenHostKey(target.targetMachineId, proof.targetHostKeyGeneration);
+                this.acceptProof(proof, this.d.selfMachineId);
+                this.d.emitJournalProof?.(proof);
+                await this.d.send(target.targetMachineId, { type: 'ssh-proof-publish', proof });
+            });
+        }
+        finally {
+            this.running = false;
+        }
+    }
+    handleAdvert(raw, authenticatedSender) {
+        const advert = validateSshBootstrapAdvert(raw, authenticatedSender, this.d.agentId);
+        const { machineSignature, ...unsigned } = advert;
+        if (!this.d.verify(authenticatedSender, canonicalSshBootstrapAdvert(unsigned), machineSignature))
+            throw new Error('ssh-advert-machine-signature-invalid');
+        const peer = this.d.listPeers().find(row => row.machineId === authenticatedSender);
+        if (!peer || peer.pairingEpoch !== advert.pairingEpoch)
+            throw new Error('ssh-advert-epoch-mismatch');
+        this.installAdvert(advert);
+        return { advert: this.localAdvert(peer.pairingEpoch) };
+    }
+    handleProof(raw, authenticatedSender) {
+        if (!raw || typeof raw !== 'object')
+            throw new Error('ssh-proof-invalid');
+        const proof = raw;
+        if (proof.sourceMachineId !== authenticatedSender || proof.targetMachineId !== this.d.selfMachineId || typeof proof.machineSignature !== 'string')
+            throw new Error('ssh-proof-principal-mismatch');
+        for (const value of [proof.observerBootId, proof.endpointId, proof.targetHostKeyFingerprint, proof.challengeDigest, proof.machineSignature])
+            if (typeof value !== 'string' || value.length < 1 || value.length > 512)
+                throw new Error('ssh-proof-invalid');
+        if (!Number.isSafeInteger(proof.pairingEpoch) || !Number.isSafeInteger(proof.sourceClientKeyGeneration) || !Number.isSafeInteger(proof.targetHostKeyGeneration))
+            throw new Error('ssh-proof-invalid');
+        if (!Number.isFinite(Date.parse(proof.verifiedAt)) || !Number.isFinite(Date.parse(proof.expiresAt)))
+            throw new Error('ssh-proof-invalid');
+        const peer = this.d.listPeers().find(row => row.machineId === authenticatedSender);
+        if (!peer || peer.pairingEpoch !== proof.pairingEpoch)
+            throw new Error('ssh-proof-epoch-mismatch');
+        const advert = this.adverts.get(authenticatedSender);
+        if (!advert || advert.observerBootId !== proof.observerBootId || advert.clientKeyGeneration !== proof.sourceClientKeyGeneration)
+            throw new Error('ssh-proof-source-generation-mismatch');
+        if (proof.targetHostKeyGeneration !== this.identity.hostGeneration)
+            throw new Error('ssh-proof-target-generation-mismatch');
+        if (Date.parse(proof.verifiedAt) < this.startedAtWall)
+            throw new Error('ssh-proof-precedes-runtime-boot');
+        if (!this.d.verify(authenticatedSender, canonicalDirectionalSshProof(proof), proof.machineSignature))
+            throw new Error('ssh-proof-signature-invalid');
+        if (!this.proofFresh(proof))
+            throw new Error('ssh-proof-expired');
+        const wallRemaining = Date.parse(proof.expiresAt) - Date.now();
+        this.acceptProof({ ...proof, monotonicDeadlineMs: performance.now() + Math.max(0, Math.min(wallRemaining, this.d.freshnessMs ?? 300_000)) }, authenticatedSender);
+        this.maybeRetirePreviousHost();
+        return { accepted: true };
+    }
+    /** Delayed journal delivery is observational only and fails closed when stale. */
+    handleJournalProof(raw, authenticatedSender) {
+        try {
+            this.handleProof(raw, authenticatedSender);
+            return true;
+        }
+        catch (error) {
+            // @silent-fallback-ok — journal replication is an observational backup;
+            // invalid/stale evidence is audited and must never enter readiness state.
+            this.audit({ type: 'journal-proof-rejected', sourceMachineId: authenticatedSender, reason: error instanceof Error ? error.message : 'invalid' });
+            return false;
+        }
+    }
+    status() {
+        const targets = this.d.listPeers().flatMap(peer => { const target = this.targetFor(peer); return target ? [target] : []; });
+        const directions = this.controller.health(targets).map(row => ({ ...row, proof: this.proofs.get(this.key(row.sourceMachineId, row.targetMachineId)) ?? row.proof }));
+        const pairs = this.d.listPeers().map(peer => {
+            const local = this.proofs.get(this.key(this.d.selfMachineId, peer.machineId));
+            const remote = this.proofs.get(this.key(peer.machineId, this.d.selfMachineId));
+            const advert = this.adverts.get(peer.machineId);
+            return {
+                machines: [this.d.selfMachineId, peer.machineId],
+                mutual: Boolean(advert && MutualSshVerifier.mutual(local, remote, Date.now(), {
+                    monotonicNow: performance.now(),
+                    liveBootIds: new Set([this.d.observerBootId, advert.observerBootId]),
+                    sourceClientGenerations: new Map([[this.d.selfMachineId, this.identity.clientGeneration], [peer.machineId, advert.clientKeyGeneration]]),
+                    targetHostGenerations: new Map([[this.d.selfMachineId, this.identity.hostGeneration], [peer.machineId, advert.hostKeyGeneration]]),
+                })),
+            };
+        });
+        const peerCount = this.d.listPeers().filter(peer => peer.machineId !== this.d.selfMachineId).length;
+        const proofReady = peerCount === 0 || (pairs.length === peerCount && pairs.every(pair => pair.mutual));
+        const readinessRequired = this.d.requiredForReadiness === true && !this.stopped;
+        const ready = !readinessRequired || proofReady;
+        const enrollmentState = this.stopped || peerCount === 0 ? 'ready' : this.bootstrapFailures.size > 0 ? 'ssh-bootstrap-blocked' : this.d.dryRun || this.adverts.size < peerCount || !this.endpoint ? 'ssh-bootstrap' : proofReady ? 'ready' : 'ssh-proving';
+        return { enabled: true, dryRun: this.d.dryRun, listener: this.endpoint !== null, readinessRequired, ready, enrollmentState, blockedReasons: [...new Set(this.bootstrapFailures.values())].sort(), directions, pairs };
+    }
+    revoke(machineId) {
+        this.clearPeerEvidence(machineId);
+        this.knownPeers.delete(machineId);
+    }
+    async rollback() {
+        this.stopped = true;
+        if (this.timer)
+            clearInterval(this.timer);
+        if (this.hostOverlapTimer)
+            clearTimeout(this.hostOverlapTimer);
+        this.timer = null;
+        this.hostOverlapTimer = null;
+        await Promise.race([this.endpoint?.close() ?? Promise.resolve(), new Promise(resolve => setTimeout(resolve, 10_000))]);
+        this.endpoint = null;
+        this.listen = null;
+        for (const peer of this.d.listPeers())
+            this.admissionStore.revoke(peer.machineId);
+    }
+    async startEndpoint() {
+        this.endpoint = new MachineSshEndpoint({
+            hostPrivateKeyPath: this.identity.hostPrivateKeyPath, admissionStore: this.admissionStore,
+            hostPrivateKeyPaths: [this.identity.hostPrivateKeyPath, ...(this.servePreviousHost && this.identity.previousHostPrivateKeyPath ? [this.identity.previousHostPrivateKeyPath] : [])],
+            machineId: this.d.selfMachineId, machineFingerprint: this.d.selfMachineFingerprint,
+            hostGeneration: this.identity.hostGeneration,
+            respond: (challenge, admission) => {
+                const unsigned = { ...challenge, machineId: this.d.selfMachineId, machineFingerprint: this.d.selfMachineFingerprint, sourceClientKeyFingerprint: MachineSshIdentity.fingerprint(admission.publicKey) };
+                return { ...unsigned, signature: this.d.sign(JSON.stringify({ nonce: unsigned.nonce, pairingEpoch: unsigned.pairingEpoch, observerBootId: unsigned.observerBootId, clientGeneration: unsigned.clientGeneration, hostGeneration: unsigned.hostGeneration, machineId: unsigned.machineId, sourceClientKeyFingerprint: unsigned.sourceClientKeyFingerprint, machineFingerprint: unsigned.machineFingerprint })) };
+            },
+        });
+        this.listen = await this.endpoint.listen(this.d.bindHost, this.d.bindPort);
+        if (this.servePreviousHost && this.identity.previousHostPrivateKeyPath && !this.hostOverlapTimer) {
+            this.hostOverlapTimer = setTimeout(() => { void this.retirePreviousHost(); }, 600_000);
+            this.hostOverlapTimer.unref?.();
+        }
+    }
+    async ensureEndpoint() {
+        try {
+            await this.startEndpoint();
+            this.bootstrapFailures.delete(this.d.selfMachineId);
+        }
+        catch (error) {
+            // @silent-fallback-ok — endpoint bootstrap failure is retained as a
+            // stable blocked reason and retried by the bounded repair controller.
+            await this.endpoint?.close().catch(() => {
+                // @silent-fallback-ok — best-effort cleanup of an endpoint that already
+                // failed to bind; the original bootstrap failure remains authoritative.
+            });
+            this.endpoint = null;
+            this.listen = null;
+            this.bootstrapFailures.set(this.d.selfMachineId, classifyMutualSshFailure(error));
+        }
+    }
+    localAdvert(pairingEpoch) {
+        const now = Date.now();
+        const issuedAt = new Date(now).toISOString();
+        const transition = this.identity.hostGeneration > 1 ? {
+            agentId: this.d.agentId, machineId: this.d.selfMachineId, pairingEpoch,
+            generation: this.identity.hostGeneration, previousGeneration: this.identity.hostGeneration - 1,
+            publicKey: this.identity.hostPublicKey, issuedAt,
+        } : null;
+        const unsigned = {
+            machineId: this.d.selfMachineId, agentId: this.d.agentId, pairingEpoch,
+            observerBootId: this.d.observerBootId, clientKeyGeneration: this.identity.clientGeneration,
+            hostKeyGeneration: this.identity.hostGeneration, clientPublicKey: this.identity.clientPublicKey,
+            sshHostPublicKeys: [this.identity.hostPublicKey], endpoints: this.listen && !isLoopback(this.listen.host) ? [{ ...this.listen, source: 'configured' }] : [],
+            issuedAt, expiresAt: new Date(now + Math.min(300_000, this.d.freshnessMs ?? 300_000)).toISOString(),
+            ...(transition ? { hostKeyTransitionSignature: this.d.sign(canonicalHostKeyProposal(transition)) } : {}),
+        };
+        return { ...unsigned, machineSignature: this.d.sign(canonicalSshBootstrapAdvert(unsigned)) };
+    }
+    async exchangeAdvert(machineId) {
+        const peer = this.d.listPeers().find(row => row.machineId === machineId);
+        if (!peer)
+            return;
+        const response = await this.d.send(machineId, { type: 'ssh-bootstrap-advert', advert: this.localAdvert(peer.pairingEpoch) });
+        if (response?.advert)
+            this.handleAdvert(response.advert, machineId);
+    }
+    installAdvert(advert) {
+        let prior = this.adverts.get(advert.machineId);
+        if (prior && (advert.pairingEpoch < prior.pairingEpoch || (advert.pairingEpoch === prior.pairingEpoch && (advert.clientKeyGeneration < prior.clientKeyGeneration || advert.hostKeyGeneration < prior.hostKeyGeneration))))
+            throw new Error('ssh-advert-rollback-rejected');
+        if (prior && advert.pairingEpoch > prior.pairingEpoch) {
+            this.clearPeerEvidence(advert.machineId);
+            prior = undefined;
+        }
+        if (prior && advert.hostKeyGeneration === prior.hostKeyGeneration && advert.sshHostPublicKeys[0] !== prior.sshHostPublicKeys[0]) {
+            this.d.notifySecurity?.({ type: 'host-key-substitution', machineId: advert.machineId });
+            throw new Error('ssh-host-key-substitution');
+        }
+        if (prior && advert.hostKeyGeneration > prior.hostKeyGeneration) {
+            if (!advert.hostKeyTransitionSignature)
+                throw new Error('ssh-host-key-transition-signature-missing');
+            const lifecycle = this.hostKeys.get(advert.machineId) ?? new SshHostKeyLifecycle({ generation: prior.hostKeyGeneration, publicKey: prior.sshHostPublicKeys[0] });
+            this.hostKeys.set(advert.machineId, lifecycle);
+            const proposal = {
+                agentId: advert.agentId, machineId: advert.machineId, pairingEpoch: advert.pairingEpoch,
+                generation: advert.hostKeyGeneration, previousGeneration: prior.hostKeyGeneration,
+                publicKey: advert.sshHostPublicKeys[0], issuedAt: advert.issuedAt, machineSignature: advert.hostKeyTransitionSignature,
+            };
+            lifecycle.propose(proposal, {
+                verifyMachine: row => this.d.verify(advert.machineId, canonicalHostKeyProposal(row), row.machineSignature),
+                verifyPreviousHost: () => false,
+            });
+            this.candidateAdverts.set(advert.machineId, advert);
+            this.d.notifySecurity?.({ type: 'host-key-quarantined', machineId: advert.machineId, generation: advert.hostKeyGeneration });
+            return;
+        }
+        this.adverts.set(advert.machineId, advert);
+        if (!this.hostKeys.has(advert.machineId))
+            this.hostKeys.set(advert.machineId, new SshHostKeyLifecycle({ generation: advert.hostKeyGeneration, publicKey: advert.sshHostPublicKeys[0] }));
+        if (!this.d.dryRun)
+            this.admissionStore.reconcile([...this.adverts.values()].map(row => ({ agentId: row.agentId, machineId: row.machineId, pairingEpoch: row.pairingEpoch, clientGeneration: row.clientKeyGeneration, observerBootId: row.observerBootId, publicKey: row.clientPublicKey, expiresAt: row.expiresAt })));
+    }
+    targetFor(peer) {
+        const advert = this.candidateAdverts.get(peer.machineId) ?? this.adverts.get(peer.machineId);
+        const endpoint = advert?.endpoints[0];
+        if (!advert || !endpoint)
+            return null;
+        return {
+            sourceMachineId: this.d.selfMachineId, targetMachineId: peer.machineId,
+            host: endpoint.host, port: endpoint.port, endpointId: `${endpoint.source}:${createHash('sha256').update(`${endpoint.host}:${endpoint.port}`).digest('hex').slice(0, 12)}`,
+            pairingEpoch: peer.pairingEpoch, observerBootId: this.d.observerBootId,
+            sourceClientKeyGeneration: this.identity.clientGeneration, targetHostKeyGeneration: advert.hostKeyGeneration,
+            targetHostPublicKey: advert.sshHostPublicKeys[0], clientPrivateKeyPath: this.identity.clientPrivateKeyPath,
+            expectedMachineFingerprint: peer.machineFingerprint,
+            expectedSourceClientKeyFingerprint: MachineSshIdentity.fingerprint(this.identity.clientPublicKey),
+            verifyMachineResponse: (payload, signature) => this.d.verify(peer.machineId, payload, signature),
+            signProof: payload => this.d.sign(payload),
+        };
+    }
+    acceptProof(proof, origin) {
+        if (proof.sourceMachineId !== origin)
+            throw new Error('ssh-proof-origin-mismatch');
+        this.proofs.set(this.key(proof.sourceMachineId, proof.targetMachineId), proof);
+        this.persistProofs();
+    }
+    promoteProvenHostKey(machineId, generation) {
+        const candidate = this.candidateAdverts.get(machineId);
+        const lifecycle = this.hostKeys.get(machineId);
+        if (!candidate || !lifecycle || candidate.hostKeyGeneration !== generation)
+            return;
+        lifecycle.proveCandidate(generation);
+        lifecycle.promote(generation, true);
+        this.candidateAdverts.delete(machineId);
+        this.adverts.set(machineId, candidate);
+        this.admissionStore.reconcile([...this.adverts.values()].map(row => ({ agentId: row.agentId, machineId: row.machineId, pairingEpoch: row.pairingEpoch, clientGeneration: row.clientKeyGeneration, observerBootId: row.observerBootId, publicKey: row.clientPublicKey, expiresAt: row.expiresAt })));
+        this.audit({ type: 'host-key-promoted', machineId, generation });
+    }
+    clearPeerEvidence(machineId) {
+        this.admissionStore.revoke(machineId);
+        this.endpoint?.revoke(machineId);
+        this.adverts.delete(machineId);
+        this.candidateAdverts.delete(machineId);
+        this.hostKeys.delete(machineId);
+        for (const key of [...this.proofs.keys()])
+            if (key.startsWith(`${machineId}->`) || key.endsWith(`->${machineId}`))
+                this.proofs.delete(key);
+        this.persistProofs();
+    }
+    maybeRetirePreviousHost() {
+        if (!this.servePreviousHost || !this.identity.previousHostPrivateKeyPath)
+            return;
+        const peers = this.d.listPeers().filter(peer => peer.machineId !== this.d.selfMachineId);
+        const allProven = peers.length > 0 && peers.every(peer => {
+            const proof = this.proofs.get(this.key(peer.machineId, this.d.selfMachineId));
+            return this.proofFresh(proof) && proof?.targetHostKeyGeneration === this.identity.hostGeneration && proof.pairingEpoch === peer.pairingEpoch;
+        });
+        if (allProven)
+            void this.retirePreviousHost();
+    }
+    async retirePreviousHost() {
+        if (!this.servePreviousHost || this.stopped)
+            return;
+        this.servePreviousHost = false;
+        if (this.hostOverlapTimer)
+            clearTimeout(this.hostOverlapTimer);
+        this.hostOverlapTimer = null;
+        await this.endpoint?.close();
+        this.endpoint = null;
+        this.listen = null;
+        await this.ensureEndpoint();
+        this.audit({ type: 'local-host-key-overlap-retired', generation: this.identity.hostGeneration });
+    }
+    proofFresh(proof) {
+        return Boolean(proof && Date.parse(proof.expiresAt) > Date.now() && (proof.monotonicDeadlineMs === undefined || proof.monotonicDeadlineMs > performance.now()));
+    }
+    key(source, target) { return `${source}->${target}`; }
+    audit(event) { this.d.audit?.({ ...event, at: new Date().toISOString() }); }
+    invalidatePersistedProofs() {
+        try {
+            if (fs.lstatSync(this.proofFile).isSymbolicLink())
+                throw new Error('ssh-proof-store-symlink-refused');
+            JSON.parse(fs.readFileSync(this.proofFile, 'utf8'));
+            // Proof authority is process-local. A restart gets a new observer boot id and
+            // must actively re-observe both directions instead of reviving wall-clock data.
+            this.persistProofs();
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw error;
+        }
+    }
+    persistProofs() {
+        fs.mkdirSync(path.dirname(this.proofFile), { recursive: true, mode: 0o700 });
+        if (fs.existsSync(this.proofFile) && fs.lstatSync(this.proofFile).isSymbolicLink())
+            throw new Error('ssh-proof-store-symlink-refused');
+        const tmp = `${this.proofFile}.${process.pid}.${randomUUID()}.tmp`;
+        fs.writeFileSync(tmp, `${JSON.stringify({ version: 1, proofs: [...this.proofs.values()].map(({ monotonicDeadlineMs: _, ...proof }) => proof) }, null, 2)}\n`, { mode: 0o600 });
+        fs.renameSync(tmp, this.proofFile);
+    }
+}
+function isLoopback(host) { return host === 'localhost' || host === '::1' || host.startsWith('127.'); }
+//# sourceMappingURL=MutualSshRuntime.js.map