wire-mesh-core 4.1.1 → 4.1.3

package/dist/adapters/node-identity.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_ed25519_identity_key = require("../domain/ed25519-identity-key.cjs");
 const require_ports_identity = require("../ports/identity.cjs");
 let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
@@ -38,6 +39,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = require_domain_ed25519_identity_key.ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -54,7 +59,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -75,6 +80,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !require_domain_ed25519_identity_key.ed25519SignatureIsStrict(signature)) return false;
 	return node_crypto.webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.mjs

@@ -1,3 +1,4 @@
+import { ed25519KeyFault, ed25519SignatureIsStrict } from "../domain/ed25519-identity-key.mjs";
 import { IdentityKeyError } from "../ports/identity.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
@@ -37,6 +38,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -53,7 +58,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -74,6 +79,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !ed25519SignatureIsStrict(signature)) return false;
 	return webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/ed25519-identity-key.cjs

@@ -0,0 +1,152 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/ed25519-identity-key.ts
+/**
+* What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+*
+* A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+*/
+const BITS_PER_BYTE = 8;
+const THREE = 3;
+const FOUR = 4;
+const EIGHT = 8;
+const FIELD_BITS = 255;
+const PRIME_OFFSET = 19;
+const ORDER_BITS = 252;
+const PUBLIC_KEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+const BYTE_BITS = BigInt(BITS_PER_BYTE);
+const SIGN_BIT_BYTE = 31;
+const SIGN_BIT_MASK = 127;
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+/** The field prime, 2^255 - 19. */
+const FIELD_PRIME = (ONE << BigInt(FIELD_BITS)) - BigInt(PRIME_OFFSET);
+/** The order of the prime-order subgroup. */
+const GROUP_ORDER = (ONE << BigInt(ORDER_BITS)) + BigInt("27742317777372353535851937790883648493");
+/** The curve constant d = -121665 / 121666, as a field element. */
+const CURVE_D = BigInt("37095705934669439343138083508754565189542113879843219016388785533085940283555");
+/**
+* The y coordinates of the eight small-order points: 0 (two points of order 4), 1 (the identity element), -1 (order 2) and the two pairs of order 8. Both signs of x share each y, so a key is small-order exactly when its y is one of these, whatever its sign bit.
+*/
+const SMALL_ORDER_Y = new Set([
+	"0",
+	"1",
+	"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
+	"5fc536d880238b13933c6d305acdfd5f098eff289f4c345b027b2c28f95e826",
+	"7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7"
+].map((hex) => BigInt(`0x${hex}`)));
+function littleEndian(bytes) {
+	let value = ZERO;
+	for (let index = bytes.length - 1; index >= 0; index -= 1) value = value << BYTE_BITS | BigInt(bytes[index] ?? 0);
+	return value;
+}
+/** The y coordinate an encoding carries: the 255 low bits, with the sign bit of x cleared. */
+function encodedY(encoding) {
+	const bytes = Uint8Array.from(encoding);
+	bytes[SIGN_BIT_BYTE] = (bytes[SIGN_BIT_BYTE] ?? 0) & SIGN_BIT_MASK;
+	return littleEndian(bytes);
+}
+function modPow(base, exponent) {
+	let result = ONE;
+	let factor = base % FIELD_PRIME;
+	let remaining = exponent;
+	while (remaining > ZERO) {
+		if ((remaining & ONE) === ONE) result = result * factor % FIELD_PRIME;
+		factor = factor * factor % FIELD_PRIME;
+		remaining >>= ONE;
+	}
+	return result;
+}
+function mod(value) {
+	const reduced = value % FIELD_PRIME;
+	return reduced >= ZERO ? reduced : reduced + FIELD_PRIME;
+}
+/** sqrt(-1) modulo the prime: 2^((p - 1) / 4). */
+const SQRT_MINUS_ONE = modPow(TWO, (FIELD_PRIME - ONE) / BigInt(FOUR));
+/** A point with the given y, with either sign of x (negating a point preserves its order, so the sign does not matter to a subgroup test), or `undefined` when no point has that y. */
+function pointWithY(y) {
+	const ySquared = mod(y * y);
+	const target = mod(mod(ySquared - ONE) * modPow(mod(CURVE_D * ySquared + ONE), FIELD_PRIME - TWO));
+	const candidate = modPow(target, (FIELD_PRIME + BigInt(THREE)) / BigInt(EIGHT));
+	for (const x of [candidate, mod(candidate * SQRT_MINUS_ONE)]) if (mod(x * x) === target) return {
+		x,
+		y,
+		z: ONE,
+		t: mod(x * y)
+	};
+}
+/** The sum of two points: the unified, complete addition of Hisil, Wong, Carter and Dawson for a = -1, which doubles as the doubling. */
+function addPoints(p, q) {
+	const a = mod((p.y - p.x) * (q.y - q.x));
+	const b = mod((p.y + p.x) * (q.y + q.x));
+	const c = mod(p.t * TWO * CURVE_D * q.t);
+	const d = mod(p.z * TWO * q.z);
+	const e = b - a;
+	const f = d - c;
+	const g = d + c;
+	const h = b + a;
+	return {
+		x: mod(e * f),
+		y: mod(g * h),
+		z: mod(f * g),
+		t: mod(e * h)
+	};
+}
+const IDENTITY_POINT = {
+	x: ZERO,
+	y: ONE,
+	z: ONE,
+	t: ZERO
+};
+/** Whether the point is in the prime-order subgroup: multiplying it by the group order gives the identity element. The point and the order are public, so the double-and-add loop leaks nothing. It costs one doubling per bit of the order below the top (252) and one addition per set bit below the top (72), each a handful of field multiplications, once per distinct key. */
+function isTorsionFree(point) {
+	let result = IDENTITY_POINT;
+	for (let bit = ORDER_BITS; bit >= 0; bit -= 1) {
+		result = addPoints(result, result);
+		if ((GROUP_ORDER >> BigInt(bit) & ONE) === ONE) result = addPoints(result, point);
+	}
+	return result.x === ZERO && result.y === result.z;
+}
+/** How many key verdicts are remembered, so a key that signs many messages is checked for torsion once and a flood of distinct keys cannot grow the memory without bound. */
+const VERDICT_CAPACITY = 1024;
+const verdicts = /* @__PURE__ */ new Map();
+function keyFaultUncached(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const y = encodedY(publicKey);
+	if (y >= FIELD_PRIME) return "non_canonical";
+	const point = pointWithY(y);
+	if (point === void 0) return "not_a_point";
+	if (SMALL_ORDER_Y.has(y)) return "small_order";
+	return isTorsionFree(point) ? void 0 : "mixed_order";
+}
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+function ed25519KeyFault(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const id = require_domain_device_id.bytesToHex(publicKey);
+	if (verdicts.has(id)) {
+		const held = verdicts.get(id);
+		verdicts.delete(id);
+		verdicts.set(id, held);
+		return held;
+	}
+	const fault = keyFaultUncached(publicKey);
+	verdicts.set(id, fault);
+	for (const oldest of verdicts.keys()) {
+		if (verdicts.size <= VERDICT_CAPACITY) break;
+		verdicts.delete(oldest);
+	}
+	return fault;
+}
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+function ed25519SignatureIsStrict(signature) {
+	if (signature.length !== SIGNATURE_BYTES) return false;
+	const r = signature.subarray(0, PUBLIC_KEY_BYTES);
+	const s = signature.subarray(PUBLIC_KEY_BYTES);
+	const rY = encodedY(r);
+	return littleEndian(s) < GROUP_ORDER && rY < FIELD_PRIME && !SMALL_ORDER_Y.has(rY);
+}
+//#endregion
+exports.ed25519KeyFault = ed25519KeyFault;
+exports.ed25519SignatureIsStrict = ed25519SignatureIsStrict;

package/dist/domain/ed25519-identity-key.d.cts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion

package/dist/domain/ed25519-identity-key.d.mts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion

package/dist/domain/ed25519-identity-key.mjs

@@ -0,0 +1,150 @@
+import { bytesToHex } from "./device-id.mjs";
+//#region src/domain/ed25519-identity-key.ts
+/**
+* What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+*
+* A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+*/
+const BITS_PER_BYTE = 8;
+const THREE = 3;
+const FOUR = 4;
+const EIGHT = 8;
+const FIELD_BITS = 255;
+const PRIME_OFFSET = 19;
+const ORDER_BITS = 252;
+const PUBLIC_KEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+const BYTE_BITS = BigInt(BITS_PER_BYTE);
+const SIGN_BIT_BYTE = 31;
+const SIGN_BIT_MASK = 127;
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+/** The field prime, 2^255 - 19. */
+const FIELD_PRIME = (ONE << BigInt(FIELD_BITS)) - BigInt(PRIME_OFFSET);
+/** The order of the prime-order subgroup. */
+const GROUP_ORDER = (ONE << BigInt(ORDER_BITS)) + BigInt("27742317777372353535851937790883648493");
+/** The curve constant d = -121665 / 121666, as a field element. */
+const CURVE_D = BigInt("37095705934669439343138083508754565189542113879843219016388785533085940283555");
+/**
+* The y coordinates of the eight small-order points: 0 (two points of order 4), 1 (the identity element), -1 (order 2) and the two pairs of order 8. Both signs of x share each y, so a key is small-order exactly when its y is one of these, whatever its sign bit.
+*/
+const SMALL_ORDER_Y = new Set([
+	"0",
+	"1",
+	"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
+	"5fc536d880238b13933c6d305acdfd5f098eff289f4c345b027b2c28f95e826",
+	"7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7"
+].map((hex) => BigInt(`0x${hex}`)));
+function littleEndian(bytes) {
+	let value = ZERO;
+	for (let index = bytes.length - 1; index >= 0; index -= 1) value = value << BYTE_BITS | BigInt(bytes[index] ?? 0);
+	return value;
+}
+/** The y coordinate an encoding carries: the 255 low bits, with the sign bit of x cleared. */
+function encodedY(encoding) {
+	const bytes = Uint8Array.from(encoding);
+	bytes[SIGN_BIT_BYTE] = (bytes[SIGN_BIT_BYTE] ?? 0) & SIGN_BIT_MASK;
+	return littleEndian(bytes);
+}
+function modPow(base, exponent) {
+	let result = ONE;
+	let factor = base % FIELD_PRIME;
+	let remaining = exponent;
+	while (remaining > ZERO) {
+		if ((remaining & ONE) === ONE) result = result * factor % FIELD_PRIME;
+		factor = factor * factor % FIELD_PRIME;
+		remaining >>= ONE;
+	}
+	return result;
+}
+function mod(value) {
+	const reduced = value % FIELD_PRIME;
+	return reduced >= ZERO ? reduced : reduced + FIELD_PRIME;
+}
+/** sqrt(-1) modulo the prime: 2^((p - 1) / 4). */
+const SQRT_MINUS_ONE = modPow(TWO, (FIELD_PRIME - ONE) / BigInt(FOUR));
+/** A point with the given y, with either sign of x (negating a point preserves its order, so the sign does not matter to a subgroup test), or `undefined` when no point has that y. */
+function pointWithY(y) {
+	const ySquared = mod(y * y);
+	const target = mod(mod(ySquared - ONE) * modPow(mod(CURVE_D * ySquared + ONE), FIELD_PRIME - TWO));
+	const candidate = modPow(target, (FIELD_PRIME + BigInt(THREE)) / BigInt(EIGHT));
+	for (const x of [candidate, mod(candidate * SQRT_MINUS_ONE)]) if (mod(x * x) === target) return {
+		x,
+		y,
+		z: ONE,
+		t: mod(x * y)
+	};
+}
+/** The sum of two points: the unified, complete addition of Hisil, Wong, Carter and Dawson for a = -1, which doubles as the doubling. */
+function addPoints(p, q) {
+	const a = mod((p.y - p.x) * (q.y - q.x));
+	const b = mod((p.y + p.x) * (q.y + q.x));
+	const c = mod(p.t * TWO * CURVE_D * q.t);
+	const d = mod(p.z * TWO * q.z);
+	const e = b - a;
+	const f = d - c;
+	const g = d + c;
+	const h = b + a;
+	return {
+		x: mod(e * f),
+		y: mod(g * h),
+		z: mod(f * g),
+		t: mod(e * h)
+	};
+}
+const IDENTITY_POINT = {
+	x: ZERO,
+	y: ONE,
+	z: ONE,
+	t: ZERO
+};
+/** Whether the point is in the prime-order subgroup: multiplying it by the group order gives the identity element. The point and the order are public, so the double-and-add loop leaks nothing. It costs one doubling per bit of the order below the top (252) and one addition per set bit below the top (72), each a handful of field multiplications, once per distinct key. */
+function isTorsionFree(point) {
+	let result = IDENTITY_POINT;
+	for (let bit = ORDER_BITS; bit >= 0; bit -= 1) {
+		result = addPoints(result, result);
+		if ((GROUP_ORDER >> BigInt(bit) & ONE) === ONE) result = addPoints(result, point);
+	}
+	return result.x === ZERO && result.y === result.z;
+}
+/** How many key verdicts are remembered, so a key that signs many messages is checked for torsion once and a flood of distinct keys cannot grow the memory without bound. */
+const VERDICT_CAPACITY = 1024;
+const verdicts = /* @__PURE__ */ new Map();
+function keyFaultUncached(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const y = encodedY(publicKey);
+	if (y >= FIELD_PRIME) return "non_canonical";
+	const point = pointWithY(y);
+	if (point === void 0) return "not_a_point";
+	if (SMALL_ORDER_Y.has(y)) return "small_order";
+	return isTorsionFree(point) ? void 0 : "mixed_order";
+}
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+function ed25519KeyFault(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const id = bytesToHex(publicKey);
+	if (verdicts.has(id)) {
+		const held = verdicts.get(id);
+		verdicts.delete(id);
+		verdicts.set(id, held);
+		return held;
+	}
+	const fault = keyFaultUncached(publicKey);
+	verdicts.set(id, fault);
+	for (const oldest of verdicts.keys()) {
+		if (verdicts.size <= VERDICT_CAPACITY) break;
+		verdicts.delete(oldest);
+	}
+	return fault;
+}
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+function ed25519SignatureIsStrict(signature) {
+	if (signature.length !== SIGNATURE_BYTES) return false;
+	const r = signature.subarray(0, PUBLIC_KEY_BYTES);
+	const s = signature.subarray(PUBLIC_KEY_BYTES);
+	const rY = encodedY(r);
+	return littleEndian(s) < GROUP_ORDER && rY < FIELD_PRIME && !SMALL_ORDER_Y.has(rY);
+}
+//#endregion
+export { ed25519KeyFault, ed25519SignatureIsStrict };

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
-const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
@@ -280,73 +280,129 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
-	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
-	function start(peer) {
+	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
+	function reportFault(error) {
+		const report = (faultError) => {
+			console.error("the local fault callback failed", faultError);
+		};
+		try {
+			const result = options.onFault?.(error);
+			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+		} catch (faultError) {
+			report(faultError);
+		}
+	}
+	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
+	function abandon(entry, error) {
+		const failure = error instanceof Error ? error : new Error(String(error));
+		if (channels.get(entry.key) === entry) channels.delete(entry.key);
+		entry.settle.reject(failure);
+		entry.sent.reject(failure);
+	}
+	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
+	function start(peer, { answering, track } = {
+		answering: false,
+		track: true
+	}) {
 		const key = require_domain_device_id.deviceIdToHex(peer);
-		const settle = Promise.withResolvers();
 		const pending = beginHandshake(identity, peer);
 		const entry = {
 			status: "awaiting",
 			pending,
-			settle
+			settle: Promise.withResolvers(),
+			key,
+			sent: Promise.withResolvers()
 		};
-		channels.set(key, entry);
-		pending.then(async ({ hello }) => sendHello(peer, hello)).catch((error) => {
-			settle.reject(error instanceof Error ? error : new Error(String(error)));
-			if (channels.get(key) === entry) channels.delete(key);
+		entry.settle.promise.catch(() => void 0);
+		entry.sent.promise.catch(() => void 0);
+		pending.then(async ({ hello }) => {
+			try {
+				await sendHello(peer, hello);
+			} catch (error) {
+				abandon(entry, error);
+				entry.settle.promise.then((channel) => {
+					const held = channels.get(key);
+					if (held?.status === "established" && held.channel === channel) channels.delete(key);
+				}, () => void 0);
+				if (answering && track) reportFault(error);
+				return;
+			}
+			entry.sent.resolve(void 0);
+		}, (error) => {
+			abandon(entry, error);
 		});
+		if (track) channels.set(key, entry);
 		return entry;
 	}
+	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
+	async function complete({ entry, hello, peer, replaces }) {
+		const { key } = entry;
+		const established = await establishChannelFrom(identity, {
+			pending: await entry.pending,
+			remote: hello,
+			peer,
+			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+		});
+		if (established === void 0) {
+			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
+			return;
+		}
+		if (replaces !== void 0) await entry.sent.promise;
+		if (channels.get(key) !== (replaces ?? entry)) return;
+		const channel = {
+			...established,
+			seal: async (frame) => {
+				try {
+					return await established.seal(frame);
+				} catch (error) {
+					const held = channels.get(key);
+					if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+					throw error;
+				}
+			}
+		};
+		channels.set(key, {
+			status: "established",
+			channel,
+			remoteEphemeralKey: hello["ephemeral-key"]
+		});
+		entry.settle.resolve(channel);
+	}
 	return {
 		ensure: async (peer) => {
-			const existing = channels.get(require_domain_device_id.deviceIdToHex(peer));
+			const key = require_domain_device_id.deviceIdToHex(peer);
+			const existing = channels.get(key);
 			if (existing?.status === "established") return existing.channel;
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			let verdict;
+			let entry;
 			try {
-				verdict = await verifyHello(identity, hello);
+				const verdict = await verifyHello(identity, hello);
+				if (!verdict.ok) return;
+				const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
+				const current = channels.get(key);
+				if (current?.status === "established" && require_domain_token_scope.bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
+				const replaces = current?.status === "established" ? current : void 0;
+				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
+					answering: true,
+					track: replaces === void 0
+				});
+				await complete({
+					entry,
+					hello,
+					peer: verdict.peer,
+					replaces
+				});
 			} catch (error) {
-				options.onFault?.(error);
-				return;
-			}
-			if (!verdict.ok) return;
-			const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
-			const current = channels.get(key);
-			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const established = await establishChannelFrom(identity, {
-				pending: await entry.pending,
-				remote: hello,
-				peer: verdict.peer,
-				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
-			});
-			if (established === void 0) {
-				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-				if (channels.get(key) === entry) channels.delete(key);
-				return;
+				if (entry !== void 0) abandon(entry, error);
+				reportFault(error);
 			}
-			const channel = {
-				...established,
-				seal: async (frame) => {
-					try {
-						return await established.seal(frame);
-					} catch (error) {
-						const held = channels.get(key);
-						if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-						throw error;
-					}
-				}
-			};
-			channels.set(key, {
-				status: "established",
-				channel
-			});
-			entry.settle.resolve(channel);
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const entry = channels.get(require_domain_device_id.deviceIdToHex(claimedFrom));
+			const key = require_domain_device_id.deviceIdToHex(claimedFrom);
+			const entry = channels.get(key);
 			if (entry?.status !== "established") return;
 			const frame = await entry.channel.open(data);
 			return frame === void 0 ? void 0 : {
@@ -355,13 +411,13 @@ function createRelayChannels(identity, sendHello, options = {}) {
 			};
 		},
 		reset: (reason) => {
-			for (const entry of channels.values()) if (entry.status === "awaiting") entry.settle.reject(new Error(reason));
+			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
 			channels.clear();
 		},
 		forget: (peer) => {
 			const key = require_domain_device_id.deviceIdToHex(peer);
 			const entry = channels.get(key);
-			if (entry?.status === "awaiting") entry.settle.reject(/* @__PURE__ */ new Error("the relay pairing was lost"));
+			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
 			channels.delete(key);
 		}
 	};

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -137,8 +137,8 @@ addresses?: readonly string[],
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
 onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
-/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
-onLocalFault?: (error: unknown) => void): MeshSession;
+/** Told of a failure that is local to this session and did not end it, while handling a hello from a peer: an identity port that failed to check or sign, an answering hello that could not be sent, a channel that could not be established. The hello is dropped, any half-made handshake for that peer is discarded, and the peer is told nothing, so no failure in handling a hello ends the session. Called once per failing hello; if it throws, or returns a promise that rejects, that is reported once to the console and swallowed. Omit for a caller with no use for it. */
+onLocalFault?: (error: unknown) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -137,8 +137,8 @@ addresses?: readonly string[],
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
 onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
-/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
-onLocalFault?: (error: unknown) => void): MeshSession;
+/** Told of a failure that is local to this session and did not end it, while handling a hello from a peer: an identity port that failed to check or sign, an answering hello that could not be sent, a channel that could not be established. The hello is dropped, any half-made handshake for that peer is discarded, and the peer is told nothing, so no failure in handling a hello ends the session. Called once per failing hello; if it throws, or returns a promise that rejects, that is reported once to the console and swallowed. Omit for a caller with no use for it. */
+onLocalFault?: (error: unknown) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -1,6 +1,6 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
-import { IdentityKeyError } from "../ports/identity.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
@@ -279,73 +279,129 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
-	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
-	function start(peer) {
+	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
+	function reportFault(error) {
+		const report = (faultError) => {
+			console.error("the local fault callback failed", faultError);
+		};
+		try {
+			const result = options.onFault?.(error);
+			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+		} catch (faultError) {
+			report(faultError);
+		}
+	}
+	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
+	function abandon(entry, error) {
+		const failure = error instanceof Error ? error : new Error(String(error));
+		if (channels.get(entry.key) === entry) channels.delete(entry.key);
+		entry.settle.reject(failure);
+		entry.sent.reject(failure);
+	}
+	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
+	function start(peer, { answering, track } = {
+		answering: false,
+		track: true
+	}) {
 		const key = deviceIdToHex(peer);
-		const settle = Promise.withResolvers();
 		const pending = beginHandshake(identity, peer);
 		const entry = {
 			status: "awaiting",
 			pending,
-			settle
+			settle: Promise.withResolvers(),
+			key,
+			sent: Promise.withResolvers()
 		};
-		channels.set(key, entry);
-		pending.then(async ({ hello }) => sendHello(peer, hello)).catch((error) => {
-			settle.reject(error instanceof Error ? error : new Error(String(error)));
-			if (channels.get(key) === entry) channels.delete(key);
+		entry.settle.promise.catch(() => void 0);
+		entry.sent.promise.catch(() => void 0);
+		pending.then(async ({ hello }) => {
+			try {
+				await sendHello(peer, hello);
+			} catch (error) {
+				abandon(entry, error);
+				entry.settle.promise.then((channel) => {
+					const held = channels.get(key);
+					if (held?.status === "established" && held.channel === channel) channels.delete(key);
+				}, () => void 0);
+				if (answering && track) reportFault(error);
+				return;
+			}
+			entry.sent.resolve(void 0);
+		}, (error) => {
+			abandon(entry, error);
 		});
+		if (track) channels.set(key, entry);
 		return entry;
 	}
+	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
+	async function complete({ entry, hello, peer, replaces }) {
+		const { key } = entry;
+		const established = await establishChannelFrom(identity, {
+			pending: await entry.pending,
+			remote: hello,
+			peer,
+			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+		});
+		if (established === void 0) {
+			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
+			return;
+		}
+		if (replaces !== void 0) await entry.sent.promise;
+		if (channels.get(key) !== (replaces ?? entry)) return;
+		const channel = {
+			...established,
+			seal: async (frame) => {
+				try {
+					return await established.seal(frame);
+				} catch (error) {
+					const held = channels.get(key);
+					if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+					throw error;
+				}
+			}
+		};
+		channels.set(key, {
+			status: "established",
+			channel,
+			remoteEphemeralKey: hello["ephemeral-key"]
+		});
+		entry.settle.resolve(channel);
+	}
 	return {
 		ensure: async (peer) => {
-			const existing = channels.get(deviceIdToHex(peer));
+			const key = deviceIdToHex(peer);
+			const existing = channels.get(key);
 			if (existing?.status === "established") return existing.channel;
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			let verdict;
+			let entry;
 			try {
-				verdict = await verifyHello(identity, hello);
+				const verdict = await verifyHello(identity, hello);
+				if (!verdict.ok) return;
+				const key = deviceIdToHex(verdict.peer.deviceId);
+				const current = channels.get(key);
+				if (current?.status === "established" && bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
+				const replaces = current?.status === "established" ? current : void 0;
+				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
+					answering: true,
+					track: replaces === void 0
+				});
+				await complete({
+					entry,
+					hello,
+					peer: verdict.peer,
+					replaces
+				});
 			} catch (error) {
-				options.onFault?.(error);
-				return;
-			}
-			if (!verdict.ok) return;
-			const key = deviceIdToHex(verdict.peer.deviceId);
-			const current = channels.get(key);
-			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const established = await establishChannelFrom(identity, {
-				pending: await entry.pending,
-				remote: hello,
-				peer: verdict.peer,
-				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
-			});
-			if (established === void 0) {
-				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-				if (channels.get(key) === entry) channels.delete(key);
-				return;
+				if (entry !== void 0) abandon(entry, error);
+				reportFault(error);
 			}
-			const channel = {
-				...established,
-				seal: async (frame) => {
-					try {
-						return await established.seal(frame);
-					} catch (error) {
-						const held = channels.get(key);
-						if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-						throw error;
-					}
-				}
-			};
-			channels.set(key, {
-				status: "established",
-				channel
-			});
-			entry.settle.resolve(channel);
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const entry = channels.get(deviceIdToHex(claimedFrom));
+			const key = deviceIdToHex(claimedFrom);
+			const entry = channels.get(key);
 			if (entry?.status !== "established") return;
 			const frame = await entry.channel.open(data);
 			return frame === void 0 ? void 0 : {
@@ -354,13 +410,13 @@ function createRelayChannels(identity, sendHello, options = {}) {
 			};
 		},
 		reset: (reason) => {
-			for (const entry of channels.values()) if (entry.status === "awaiting") entry.settle.reject(new Error(reason));
+			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
 			channels.clear();
 		},
 		forget: (peer) => {
 			const key = deviceIdToHex(peer);
 			const entry = channels.get(key);
-			if (entry?.status === "awaiting") entry.settle.reject(/* @__PURE__ */ new Error("the relay pairing was lost"));
+			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
 			channels.delete(key);
 		}
 	};

package/dist/domain/notice-board.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";

package/dist/domain/notice-board.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/room-rekey.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/room-rekey.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/room.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_group_key = require("./group-key.cjs");
 const require_domain_room_token_verification = require("./room-token-verification.cjs");
 let cbor2 = require("cbor2");
@@ -79,7 +80,7 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "wrong_room"
 	};
-	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/room.d.cts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";

package/dist/domain/room.d.mts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";

package/dist/domain/room.mjs

@@ -1,4 +1,5 @@
 import { roomNoticeClaimsSchema } from "../generated/protocol.mjs";
+import { verifiesOrRefuses } from "../ports/identity.mjs";
 import { isEncryptedContentType } from "./group-key.mjs";
 import { verifyRoomToken } from "./room-token-verification.mjs";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
@@ -78,7 +79,7 @@ async function verifyRoomNotice(notice, options) {
 		ok: false,
 		reason: "wrong_room"
 	};
-	if (!await options.identity.verify(claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["poster-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/tokens.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_sequential = require("../sequential-CtQVlW8M.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_domain_token_predicates = require("./token-predicates.cjs");
@@ -118,7 +119,7 @@ async function verifyTokenChain(token, options, { subjectClaims, depth, seen } =
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};
@@ -299,7 +300,7 @@ async function verifyRevocationEntry(entry, options) {
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await require_ports_identity.verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/domain/tokens.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CthkHRzB.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-lg4TtUxm.cjs";
 import { PredicateNode } from "trilean";

package/dist/domain/tokens.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-zLL5kQGJ.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-CrieP1WI.mjs";
 import { PredicateNode } from "trilean";

package/dist/domain/tokens.mjs

@@ -1,5 +1,6 @@
 import { capabilityTokenSchema, capabilityVerbSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { verifiesOrRefuses } from "../ports/identity.mjs";
 import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
 import { conditionsListSchema, evaluateConditions, evaluateNarrowing } from "./token-predicates.mjs";
@@ -117,7 +118,7 @@ async function verifyTokenChain(token, options, { subjectClaims, depth, seen } =
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};
@@ -298,7 +299,7 @@ async function verifyRevocationEntry(entry, options) {
 		reason: "malformed"
 	};
 	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
+	if (!await verifiesOrRefuses(options.identity, claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
 		ok: false,
 		reason: "bad_signature"
 	};

package/dist/{identity-C5jq53NV.d.cts → identity-CthkHRzB.d.cts}

@@ -9,6 +9,8 @@ declare class IdentityKeyError extends Error {
     cause: unknown;
   }>);
 }
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+declare function verifiesOrRefuses(identity: Readonly<Pick<IdentityPort, "verify">>, key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -25,4 +27,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };
+export { verifiesOrRefuses as i, IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/{identity-BioGOV9M.d.mts → identity-zLL5kQGJ.d.mts}

@@ -9,6 +9,8 @@ declare class IdentityKeyError extends Error {
     cause: unknown;
   }>);
 }
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+declare function verifiesOrRefuses(identity: Readonly<Pick<IdentityPort, "verify">>, key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -25,4 +27,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };
+export { verifiesOrRefuses as i, IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/ports/identity.cjs

@@ -9,5 +9,15 @@ var IdentityKeyError = class extends Error {
 		this.fault = fault;
 	}
 };
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+async function verifiesOrRefuses(identity, key, message, signature) {
+	try {
+		return await identity.verify(key, message, signature);
+	} catch (error) {
+		if (error instanceof IdentityKeyError) return false;
+		throw error;
+	}
+}
 //#endregion
 exports.IdentityKeyError = IdentityKeyError;
+exports.verifiesOrRefuses = verifiesOrRefuses;

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-C5jq53NV.cjs";
-export { IdentityKeyError, IdentityKeyFault, IdentityPort };
+import { i as verifiesOrRefuses, n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-CthkHRzB.cjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort, verifiesOrRefuses };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-BioGOV9M.mjs";
-export { IdentityKeyError, IdentityKeyFault, IdentityPort };
+import { i as verifiesOrRefuses, n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-zLL5kQGJ.mjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort, verifiesOrRefuses };

package/dist/ports/identity.mjs

@@ -8,5 +8,14 @@ var IdentityKeyError = class extends Error {
 		this.fault = fault;
 	}
 };
+/** Verifies a signature and treats a key the port cannot use as a signature that does not verify, so a verifier of attacker-supplied bytes always gets a verdict: an `IdentityKeyError` is a refusal of those bytes, while any other error is a failure of the port and propagates. */
+async function verifiesOrRefuses(identity, key, message, signature) {
+	try {
+		return await identity.verify(key, message, signature);
+	} catch (error) {
+		if (error instanceof IdentityKeyError) return false;
+		throw error;
+	}
+}
 //#endregion
-export { IdentityKeyError };
+export { IdentityKeyError, verifiesOrRefuses };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -106,6 +106,10 @@
       "import": "./dist/domain/direct-manage-request.mjs",
       "require": "./dist/domain/direct-manage-request.cjs"
     },
+    "./domain/ed25519-identity-key": {
+      "import": "./dist/domain/ed25519-identity-key.mjs",
+      "require": "./dist/domain/ed25519-identity-key.cjs"
+    },
     "./domain/erasure-coding": {
       "import": "./dist/domain/erasure-coding.mjs",
       "require": "./dist/domain/erasure-coding.cjs"