tile-identity-resolver 0.1.0__tar.gz

tile_identity_resolver-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 kbck
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

tile_identity_resolver-0.1.0/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: tile-identity-resolver
+Version: 0.1.0
+Summary: Resolve Tile identities from FEED service data without Bluetooth dependencies
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/kbck/tile-identity-resolver
+Project-URL: Repository, https://github.com/kbck/tile-identity-resolver
+Project-URL: Issues, https://github.com/kbck/tile-identity-resolver/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Operating System :: OS Independent
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest<9,>=8; extra == "test"
+Provides-Extra: dev
+Requires-Dist: pytest<9,>=8; extra == "dev"
+Requires-Dist: ruff<1,>=0.11; extra == "dev"
+Requires-Dist: build<2,>=1; extra == "dev"
+Requires-Dist: mypy<3,>=1.15; extra == "dev"
+Requires-Dist: twine<7,>=6; extra == "dev"
+Requires-Dist: check-wheel-contents<1,>=0.6; extra == "dev"
+Dynamic: license-file
+
+# Tile Identity Resolver
+
+A dependency-free Python library for identifying registered Tile trackers from
+version-2 FEED service data. Requires Python 3.10 or newer.
+
+## Install
+
+```sh
+python -m pip install tile-identity-resolver
+```
+
+## Usage
+
+```python
+from tile_identity_resolver import Tile, TileResolver
+
+# Replace these example credentials with your Tile's ID and auth key.
+tile = Tile(
+    tile_id="0011223344556677",
+    auth_key="AAECAwQFBgcICQoLDA0ODw==",
+)
+resolver = TileResolver([tile])
+
+# Pass the raw service-data value for UUID 0000feed-0000-1000-8000-00805f9b34fb.
+def handle_feed_payload(payload: bytes) -> None:
+    info = resolver.resolve(payload)
+    if info is not None:
+        print(info.tile.tile_id, info.counter, info.version, info.flags)
+```
+
+Tile IDs are eight-byte lowercase hex strings. Auth keys are sixteen-byte hex
+or padded Base64 strings. Invalid credentials raise `ValueError`.
+
+## API
+
+| API | Behavior |
+| --- | --- |
+| `TileResolver(tiles=())` | Register one or more Tiles |
+| `resolver.add(tile)` | Register a Tile; duplicate IDs raise `ValueError` |
+| `resolver.remove(tile_id)` | Remove a Tile; missing IDs raise `KeyError` |
+| `resolver.tiles` | Immutable snapshot of registered Tiles |
+| `resolver.resolve(payload)` | Return `TileInfo` for an unambiguous match, otherwise `None` |
+
+`TileInfo` contains the registered `tile`, `counter`, `version`, and `flags`.
+Remove and re-add a Tile to replace its key.
+
+Registration precomputes private IDs and uses memory per Tile. In async apps,
+prepare the resolver in a worker thread and serialize access during mutations.
+The library resolves identities only; it does not track Bluetooth addresses or
+presence, and a match does not prove freshness or proximity.
+
+## Development
+
+```sh
+python -m pip install -e '.[dev]'
+python tools/check_package.py
+```
+
+Runs tests, code checks, and package validation.
+
+## Acknowledgements
+
+Based on [Security and Privacy Analysis of Tile's Location Tracking Protocol](https://www.usenix.org/conference/usenixsecurity26/presentation/kumar-akshaya)
+by Akshaya Kumar, Anna Raymaker, and Michael A. Specter (USENIX Security 2026).
+
+Unofficial; not affiliated with Tile or Life360.
+Licensed under the [MIT License](LICENSE).

tile_identity_resolver-0.1.0/README.md

@@ -0,0 +1,67 @@
+# Tile Identity Resolver
+
+A dependency-free Python library for identifying registered Tile trackers from
+version-2 FEED service data. Requires Python 3.10 or newer.
+
+## Install
+
+```sh
+python -m pip install tile-identity-resolver
+```
+
+## Usage
+
+```python
+from tile_identity_resolver import Tile, TileResolver
+
+# Replace these example credentials with your Tile's ID and auth key.
+tile = Tile(
+    tile_id="0011223344556677",
+    auth_key="AAECAwQFBgcICQoLDA0ODw==",
+)
+resolver = TileResolver([tile])
+
+# Pass the raw service-data value for UUID 0000feed-0000-1000-8000-00805f9b34fb.
+def handle_feed_payload(payload: bytes) -> None:
+    info = resolver.resolve(payload)
+    if info is not None:
+        print(info.tile.tile_id, info.counter, info.version, info.flags)
+```
+
+Tile IDs are eight-byte lowercase hex strings. Auth keys are sixteen-byte hex
+or padded Base64 strings. Invalid credentials raise `ValueError`.
+
+## API
+
+| API | Behavior |
+| --- | --- |
+| `TileResolver(tiles=())` | Register one or more Tiles |
+| `resolver.add(tile)` | Register a Tile; duplicate IDs raise `ValueError` |
+| `resolver.remove(tile_id)` | Remove a Tile; missing IDs raise `KeyError` |
+| `resolver.tiles` | Immutable snapshot of registered Tiles |
+| `resolver.resolve(payload)` | Return `TileInfo` for an unambiguous match, otherwise `None` |
+
+`TileInfo` contains the registered `tile`, `counter`, `version`, and `flags`.
+Remove and re-add a Tile to replace its key.
+
+Registration precomputes private IDs and uses memory per Tile. In async apps,
+prepare the resolver in a worker thread and serialize access during mutations.
+The library resolves identities only; it does not track Bluetooth addresses or
+presence, and a match does not prove freshness or proximity.
+
+## Development
+
+```sh
+python -m pip install -e '.[dev]'
+python tools/check_package.py
+```
+
+Runs tests, code checks, and package validation.
+
+## Acknowledgements
+
+Based on [Security and Privacy Analysis of Tile's Location Tracking Protocol](https://www.usenix.org/conference/usenixsecurity26/presentation/kumar-akshaya)
+by Akshaya Kumar, Anna Raymaker, and Michael A. Specter (USENIX Security 2026).
+
+Unofficial; not affiliated with Tile or Life360.
+Licensed under the [MIT License](LICENSE).

tile_identity_resolver-0.1.0/pyproject.toml

@@ -0,0 +1,51 @@
+[build-system]
+requires = ["setuptools>=77.0.3", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "tile-identity-resolver"
+version = "0.1.0"
+description = "Resolve Tile identities from FEED service data without Bluetooth dependencies"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+dependencies = []
+classifiers = [
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Operating System :: OS Independent",
+    "Typing :: Typed",
+]
+
+[project.urls]
+Homepage = "https://github.com/kbck/tile-identity-resolver"
+Repository = "https://github.com/kbck/tile-identity-resolver"
+Issues = "https://github.com/kbck/tile-identity-resolver/issues"
+
+[project.optional-dependencies]
+test = ["pytest>=8,<9"]
+dev = [
+    "pytest>=8,<9",
+    "ruff>=0.11,<1",
+    "build>=1,<2",
+    "mypy>=1.15,<3",
+    "twine>=6,<7",
+    "check-wheel-contents>=0.6,<1",
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+tile_identity_resolver = ["py.typed"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+
+[tool.ruff]
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F", "I"]

tile_identity_resolver-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

tile_identity_resolver-0.1.0/src/tile_identity_resolver/__init__.py

@@ -0,0 +1,6 @@
+"""Resolve configured Tiles from raw FEED service-data bytes."""
+
+from .models import Tile, TileInfo
+from .resolver import TileResolver
+
+__all__ = ["Tile", "TileInfo", "TileResolver"]

tile_identity_resolver-0.1.0/src/tile_identity_resolver/models.py

@@ -0,0 +1,50 @@
+"""Tile credentials and metadata decoded from a matching payload."""
+
+import base64
+from dataclasses import dataclass, field
+
+
+def _to_bytes(value: str | bytes) -> bytes:
+    """Accept raw bytes or decode hexadecimal or padded Base64 text."""
+    if isinstance(value, bytes):
+        return value
+    if not isinstance(value, str):
+        raise ValueError("Expected raw bytes, hexadecimal, or Base64 text")
+    value = value.strip()
+    if value.endswith("="):
+        return base64.b64decode(value, validate=True)
+    return bytes.fromhex(value)
+
+
+@dataclass(frozen=True, slots=True)
+class Tile:
+    """Immutable Tile credentials stored as text.
+
+    The ID is lowercase hex; the key is hex or padded Base64.
+    """
+
+    tile_id: str
+    auth_key: str = field(repr=False)
+
+    def __post_init__(self) -> None:
+        tile_id = _to_bytes(self.tile_id)
+        if len(tile_id) != 8 or tile_id.hex() != self.tile_id:
+            raise ValueError("Tile ID must be 16 lowercase hexadecimal digits")
+        if (
+            not isinstance(self.auth_key, str)
+            or len(_to_bytes(self.auth_key)) != 16
+        ):
+            raise ValueError("Auth key must decode to sixteen bytes")
+
+@dataclass(frozen=True, slots=True)
+class TileInfo:
+    """A registered Tile and metadata from one matching FEED payload.
+
+    A match does not establish freshness, proximity, or availability.
+    Flags are exposed verbatim; their meaning is not interpreted here.
+    """
+
+    tile: Tile
+    counter: int
+    version: int
+    flags: int

tile_identity_resolver-0.1.0/src/tile_identity_resolver/resolver.py

@@ -0,0 +1,110 @@
+"""Register Tile identities and resolve version-2 FEED payloads."""
+
+import hashlib
+import hmac
+from collections.abc import Iterable
+
+from .models import Tile, TileInfo, _to_bytes
+
+
+def _generate_private_ids(tile: Tile) -> dict[bytes, int]:
+    tile_id = bytes.fromhex(tile.tile_id)
+    auth_key = _to_bytes(tile.auth_key)
+    identity_message = tile_id + b"identity" + bytes(16)
+    identity_key = hmac.digest(auth_key, identity_message, hashlib.sha256)[:16]
+
+    private_ids = {}
+    for counter in range(8640):
+        counter_message = counter.to_bytes(4, "little") + bytes(28)
+        private_id = hmac.digest(
+            identity_key, counter_message, hashlib.sha256
+        )[:8]
+        private_ids[private_id] = counter
+    return private_ids
+
+
+class TileResolver:
+    """Resolve payloads against any number of registered Tiles.
+
+    Each resolver prepares and owns candidates for its registered Tiles.
+    Calls are synchronous; callers must serialize concurrent mutations.
+    """
+
+    def __init__(self, tiles: Iterable[Tile] = ()) -> None:
+        self._tiles: dict[str, Tile] = {}
+        self._private_ids: dict[str, list[bytes]] = {}
+        self._index: dict[
+            bytes, tuple[Tile, int] | dict[str, tuple[Tile, int]]
+        ] = {}
+        for tile in tiles:
+            self.add(tile)
+
+    @property
+    def tiles(self) -> tuple[Tile, ...]:
+        """Return a snapshot of Tiles in registration order."""
+        return tuple(self._tiles.values())
+
+    def add(self, tile: Tile) -> None:
+        """Register a Tile and prepare its candidate IDs.
+
+        Duplicate stable IDs raise ValueError. To change a key, remove
+        the existing Tile and add its replacement.
+        """
+        if not isinstance(tile, Tile):
+            raise TypeError("Expected a Tile")
+        if tile.tile_id in self._tiles:
+            raise ValueError("Tile ID is already registered")
+        private_ids = _generate_private_ids(tile)
+        self._tiles[tile.tile_id] = tile
+        self._private_ids[tile.tile_id] = list(private_ids)
+        for private_id, counter in private_ids.items():
+            match = (tile, counter)
+            owners = self._index.get(private_id)
+            if owners is None:
+                self._index[private_id] = match
+            elif isinstance(owners, tuple):
+                # Allocate an owners dictionary only for collisions.
+                self._index[private_id] = {
+                    owners[0].tile_id: owners,
+                    tile.tile_id: match,
+                }
+            else:
+                owners[tile.tile_id] = match
+
+    def remove(self, tile_id: str) -> None:
+        """Remove a Tile by hex ID; raise KeyError if it is unknown."""
+        del self._tiles[tile_id]
+        private_ids = self._private_ids.pop(tile_id)
+        for private_id in private_ids:
+            owners = self._index[private_id]
+            if isinstance(owners, tuple):
+                del self._index[private_id]
+            else:
+                del owners[tile_id]
+                if len(owners) == 1:
+                    self._index[private_id] = next(iter(owners.values()))
+
+    def resolve(
+        self, payload: bytes | bytearray | memoryview
+    ) -> TileInfo | None:
+        """Resolve FEED data without UUID or advertising headers.
+
+        Return None for short, unsupported, unknown, or ambiguous data.
+        Allow trailing bytes. Other input types raise TypeError.
+        No state is updated by resolving a payload.
+        """
+        if not isinstance(payload, (bytes, bytearray, memoryview)):
+            raise TypeError("Payload must be bytes, bytearray, or memoryview")
+        payload = bytes(payload)
+        if len(payload) < 10 or payload[0] != 2:
+            return None
+        match = self._index.get(payload[2:10])
+        if not isinstance(match, tuple):
+            return None
+        tile, counter = match
+        return TileInfo(
+            tile=tile,
+            counter=counter,
+            version=payload[0],
+            flags=payload[1],
+        )

tile_identity_resolver-0.1.0/src/tile_identity_resolver.egg-info/PKG-INFO

@@ -0,0 +1,93 @@
+Metadata-Version: 2.4
+Name: tile-identity-resolver
+Version: 0.1.0
+Summary: Resolve Tile identities from FEED service data without Bluetooth dependencies
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/kbck/tile-identity-resolver
+Project-URL: Repository, https://github.com/kbck/tile-identity-resolver
+Project-URL: Issues, https://github.com/kbck/tile-identity-resolver/issues
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Operating System :: OS Independent
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: test
+Requires-Dist: pytest<9,>=8; extra == "test"
+Provides-Extra: dev
+Requires-Dist: pytest<9,>=8; extra == "dev"
+Requires-Dist: ruff<1,>=0.11; extra == "dev"
+Requires-Dist: build<2,>=1; extra == "dev"
+Requires-Dist: mypy<3,>=1.15; extra == "dev"
+Requires-Dist: twine<7,>=6; extra == "dev"
+Requires-Dist: check-wheel-contents<1,>=0.6; extra == "dev"
+Dynamic: license-file
+
+# Tile Identity Resolver
+
+A dependency-free Python library for identifying registered Tile trackers from
+version-2 FEED service data. Requires Python 3.10 or newer.
+
+## Install
+
+```sh
+python -m pip install tile-identity-resolver
+```
+
+## Usage
+
+```python
+from tile_identity_resolver import Tile, TileResolver
+
+# Replace these example credentials with your Tile's ID and auth key.
+tile = Tile(
+    tile_id="0011223344556677",
+    auth_key="AAECAwQFBgcICQoLDA0ODw==",
+)
+resolver = TileResolver([tile])
+
+# Pass the raw service-data value for UUID 0000feed-0000-1000-8000-00805f9b34fb.
+def handle_feed_payload(payload: bytes) -> None:
+    info = resolver.resolve(payload)
+    if info is not None:
+        print(info.tile.tile_id, info.counter, info.version, info.flags)
+```
+
+Tile IDs are eight-byte lowercase hex strings. Auth keys are sixteen-byte hex
+or padded Base64 strings. Invalid credentials raise `ValueError`.
+
+## API
+
+| API | Behavior |
+| --- | --- |
+| `TileResolver(tiles=())` | Register one or more Tiles |
+| `resolver.add(tile)` | Register a Tile; duplicate IDs raise `ValueError` |
+| `resolver.remove(tile_id)` | Remove a Tile; missing IDs raise `KeyError` |
+| `resolver.tiles` | Immutable snapshot of registered Tiles |
+| `resolver.resolve(payload)` | Return `TileInfo` for an unambiguous match, otherwise `None` |
+
+`TileInfo` contains the registered `tile`, `counter`, `version`, and `flags`.
+Remove and re-add a Tile to replace its key.
+
+Registration precomputes private IDs and uses memory per Tile. In async apps,
+prepare the resolver in a worker thread and serialize access during mutations.
+The library resolves identities only; it does not track Bluetooth addresses or
+presence, and a match does not prove freshness or proximity.
+
+## Development
+
+```sh
+python -m pip install -e '.[dev]'
+python tools/check_package.py
+```
+
+Runs tests, code checks, and package validation.
+
+## Acknowledgements
+
+Based on [Security and Privacy Analysis of Tile's Location Tracking Protocol](https://www.usenix.org/conference/usenixsecurity26/presentation/kumar-akshaya)
+by Akshaya Kumar, Anna Raymaker, and Michael A. Specter (USENIX Security 2026).
+
+Unofficial; not affiliated with Tile or Life360.
+Licensed under the [MIT License](LICENSE).

tile_identity_resolver-0.1.0/src/tile_identity_resolver.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/tile_identity_resolver/__init__.py
+src/tile_identity_resolver/models.py
+src/tile_identity_resolver/py.typed
+src/tile_identity_resolver/resolver.py
+src/tile_identity_resolver.egg-info/PKG-INFO
+src/tile_identity_resolver.egg-info/SOURCES.txt
+src/tile_identity_resolver.egg-info/dependency_links.txt
+src/tile_identity_resolver.egg-info/requires.txt
+src/tile_identity_resolver.egg-info/top_level.txt
+tests/test_resolver.py

tile_identity_resolver-0.1.0/src/tile_identity_resolver.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

tile_identity_resolver-0.1.0/src/tile_identity_resolver.egg-info/requires.txt

@@ -0,0 +1,11 @@
+
+[dev]
+pytest<9,>=8
+ruff<1,>=0.11
+build<2,>=1
+mypy<3,>=1.15
+twine<7,>=6
+check-wheel-contents<1,>=0.6
+
+[test]
+pytest<9,>=8

tile_identity_resolver-0.1.0/src/tile_identity_resolver.egg-info/top_level.txt

@@ -0,0 +1 @@
+tile_identity_resolver

tile_identity_resolver-0.1.0/tests/test_resolver.py

@@ -0,0 +1,277 @@
+"""Test protocol derivation, matching, and registration lifecycle."""
+
+import base64
+import hashlib
+import hmac
+from dataclasses import FrozenInstanceError
+
+import pytest
+
+from tile_identity_resolver import Tile, TileInfo, TileResolver
+from tile_identity_resolver import resolver as implementation
+
+TILE_ID = "0011223344556677"
+OTHER_ID = "8899aabbccddeeff"
+KEY = base64.b64encode(bytes(range(16))).decode()
+OTHER_KEY = base64.b64encode(bytes(reversed(range(16)))).decode()
+
+
+def payload_for(tile: Tile, counter: int, flags: int = 0) -> bytes:
+    """Construct a payload using explicit protocol message layouts."""
+    key = base64.b64decode(tile.auth_key)
+    seed = hmac.new(
+        key,
+        bytes.fromhex(tile.tile_id) + b"identity" + bytes(16),
+        hashlib.sha256,
+    ).digest()[:16]
+    identity = hmac.new(
+        seed, counter.to_bytes(4, "little") + bytes(28), hashlib.sha256
+    ).digest()[:8]
+    return bytes([2, flags]) + identity
+
+
+@pytest.fixture
+def tiles():
+    return (
+        Tile(TILE_ID, KEY),
+        Tile(OTHER_ID, OTHER_KEY),
+    )
+
+
+@pytest.mark.parametrize(
+    "tile_id",
+    [
+        None, bytes(8), bytearray(8), "", "xyz", "00", "00" * 9,
+        OTHER_ID.upper(), " " + TILE_ID,
+    ],
+)
+def test_invalid_tile_id(tile_id):
+    with pytest.raises(ValueError):
+        Tile(tile_id, KEY)
+
+
+@pytest.mark.parametrize(
+    "auth_key",
+    [
+        None, bytes(16), bytearray(16), "bad-key", "", "\u2603", "====",
+        base64.b64encode(bytes(15)).decode(),
+        base64.b64encode(bytes(17)).decode(),
+    ],
+)
+def test_invalid_key_is_not_echoed(auth_key):
+    with pytest.raises(ValueError) as caught:
+        Tile(TILE_ID, auth_key)
+    if isinstance(auth_key, str) and auth_key:
+        assert auth_key not in str(caught.value)
+
+
+@pytest.mark.parametrize(
+    "auth_key",
+    [KEY, " " + KEY + " ", KEY[:-3] + "x==", bytes(range(16)).hex()],
+)
+def test_supported_key_formats(auth_key):
+    tile = Tile(TILE_ID, auth_key)
+    assert tile.auth_key == auth_key
+    reference = Tile(TILE_ID, KEY)
+    result = TileResolver([tile]).resolve(payload_for(reference, 1))
+    assert result == TileInfo(tile, 1, 2, 0)
+
+
+def test_multiple_tiles_return_registered_objects_and_metadata(tiles):
+    keys, wallet = tiles
+    resolver = TileResolver(tiles)
+    assert resolver.tiles == tiles
+    keys_info = resolver.resolve(payload_for(keys, 1093, flags=255))
+    wallet_info = resolver.resolve(payload_for(wallet, 256, flags=7))
+    assert keys_info == TileInfo(keys, 1093, 2, 255)
+    assert wallet_info == TileInfo(wallet, 256, 2, 7)
+    assert keys_info.tile is keys
+    assert wallet_info.tile is wallet
+
+
+def test_results_are_immutable_snapshots(tiles):
+    tile = tiles[0]
+    resolver = TileResolver([tile])
+    info = resolver.resolve(payload_for(tile, 1))
+    resolver.resolve(payload_for(tile, 2))
+    assert info.counter == 1
+    with pytest.raises(FrozenInstanceError):
+        info.counter = 5
+
+
+def test_tiles_are_immutable(tiles):
+    tile = tiles[0]
+    with pytest.raises(FrozenInstanceError):
+        tile.auth_key = OTHER_KEY
+    with pytest.raises(FrozenInstanceError):
+        tile.tile_id = OTHER_ID
+
+
+def test_auth_key_is_hidden_from_repr(tiles):
+    tile = tiles[0]
+    assert KEY not in repr(tile)
+    assert KEY not in repr(TileInfo(tile, 1, 2, 0))
+
+
+@pytest.mark.parametrize("counter", [0, 1, 255, 256, 8639, 8640])
+def test_counter_boundaries(tiles, counter):
+    tile = tiles[0]
+    result = TileResolver([tile]).resolve(payload_for(tile, counter))
+    if counter == 8640:
+        assert result is None
+    else:
+        assert result.counter == counter
+
+
+@pytest.mark.parametrize("factory", [bytes, bytearray, memoryview])
+def test_bytes_like_input_and_trailing_data(tiles, factory):
+    tile = tiles[0]
+    payload = factory(payload_for(tile, 1) + b"extra")
+    result = TileResolver([tile]).resolve(payload)
+    assert result == TileInfo(tile, 1, 2, 0)
+
+
+@pytest.mark.parametrize(
+    "payload",
+    [
+        b"",
+        b"\x02",
+        b"\x02\xff1234567",
+        b"\x01\x0012345678",
+        b"\x02\x00unknown!",
+    ],
+)
+def test_malformed_unsupported_and_unknown_payloads(tiles, payload):
+    assert TileResolver(tiles).resolve(payload) is None
+
+
+@pytest.mark.parametrize("payload", [None, "0200", 123, [2, 0]])
+def test_non_bytes_input_raises_type_error(payload):
+    with pytest.raises(TypeError, match="Payload must be"):
+        TileResolver().resolve(payload)
+
+
+def test_duplicate_ids(tiles):
+    resolver = TileResolver(tiles)
+    with pytest.raises(ValueError, match="already registered"):
+        resolver.add(Tile(OTHER_ID, KEY))
+    assert resolver.tiles == tiles
+    with pytest.raises(TypeError, match="Expected a Tile"):
+        resolver.add(TILE_ID)
+    with pytest.raises(ValueError, match="already registered"):
+        TileResolver([tiles[0], tiles[0]])
+
+
+def test_remove_and_replace_key(tiles):
+    tile, other = tiles
+    resolver = TileResolver(tiles)
+    old_payload = payload_for(tile, 1)
+    resolver.remove(TILE_ID)
+    assert resolver.resolve(old_payload) is None
+    assert resolver.resolve(payload_for(other, 1)).tile is other
+    replacement = Tile(TILE_ID, OTHER_KEY)
+    resolver.add(replacement)
+    assert resolver.resolve(old_payload) is None
+    assert resolver.resolve(payload_for(replacement, 1)).tile is replacement
+    resolver.remove(OTHER_ID)
+    resolver.remove(TILE_ID)
+    assert resolver.tiles == ()
+    assert resolver.resolve(payload_for(replacement, 1)) is None
+    with pytest.raises(KeyError):
+        resolver.remove(TILE_ID)
+    with pytest.raises(KeyError):
+        resolver.remove("invalid")
+
+
+def test_collisions_fail_closed_and_removal_restores_unique_match(monkeypatch):
+    def shared_candidates(tile):
+        counter = 1 if tile.tile_id == TILE_ID else 2
+        return {b"sharedid": counter}
+
+    monkeypatch.setattr(
+        implementation, "_generate_private_ids", shared_candidates
+    )
+    keys = Tile(TILE_ID, KEY)
+    wallet = Tile(OTHER_ID, OTHER_KEY)
+    resolver = TileResolver([keys])
+    payload = b"\x02\xffsharedid"
+    assert resolver.resolve(payload) == TileInfo(keys, 1, 2, 255)
+    resolver.add(wallet)
+    assert resolver.resolve(payload) is None
+    resolver.remove(TILE_ID)
+    assert resolver.resolve(payload) == TileInfo(wallet, 2, 2, 255)
+    resolver.remove(OTHER_ID)
+    assert resolver.resolve(payload) is None
+
+
+@pytest.mark.parametrize("survivor", [0, 1, 2])
+def test_three_way_collision_removal_and_reregistration(
+    monkeypatch, survivor
+):
+    registered = (
+        Tile(TILE_ID, KEY),
+        Tile(OTHER_ID, OTHER_KEY),
+        Tile("1122334455667788", KEY),
+    )
+
+    def candidates(tile):
+        return {
+            b"sharedid": registered.index(tile),
+            bytes.fromhex(tile.tile_id): 10,
+        }
+
+    monkeypatch.setattr(implementation, "_generate_private_ids", candidates)
+    resolver = TileResolver(registered)
+    shared_payload = b"\x02\x00sharedid"
+    assert resolver.resolve(shared_payload) is None
+    removed = [tile for i, tile in enumerate(registered) if i != survivor]
+    resolver.remove(removed[0].tile_id)
+    assert resolver.resolve(shared_payload) is None
+    resolver.remove(removed[1].tile_id)
+    expected = TileInfo(registered[survivor], survivor, 2, 0)
+    assert resolver.resolve(shared_payload) == expected
+    for tile in removed:
+        unique_payload = b"\x02\x00" + bytes.fromhex(tile.tile_id)
+        assert resolver.resolve(unique_payload) is None
+    resolver.add(removed[0])
+    assert resolver.resolve(shared_payload) is None
+    resolver.remove(removed[0].tile_id)
+    assert resolver.resolve(shared_payload) == expected
+    resolver.remove(registered[survivor].tile_id)
+    assert resolver.resolve(shared_payload) is None
+    assert resolver.tiles == ()
+
+
+def test_tile_construction_does_not_prepare_candidates(monkeypatch):
+    def fail(tile):
+        pytest.fail("Tile construction must not generate private IDs")
+
+    monkeypatch.setattr(implementation, "_generate_private_ids", fail)
+    tile = Tile(TILE_ID, KEY)
+    assert tile.tile_id == TILE_ID
+
+
+def test_resolve_does_not_repeat_preparation(tiles, monkeypatch):
+    tile = tiles[0]
+    resolver = TileResolver([tile])
+
+    def fail(tile):
+        pytest.fail("Resolving should use prepared IDs")
+
+    monkeypatch.setattr(implementation, "_generate_private_ids", fail)
+    assert resolver.resolve(payload_for(tile, 1)) == TileInfo(tile, 1, 2, 0)
+
+
+def test_preparation_failure_leaves_registration_unchanged(tiles, monkeypatch):
+    tile, other = tiles
+    resolver = TileResolver([tile])
+
+    def fail(tile):
+        raise RuntimeError("Preparation failed")
+
+    monkeypatch.setattr(implementation, "_generate_private_ids", fail)
+    with pytest.raises(RuntimeError, match="Preparation failed"):
+        resolver.add(other)
+    assert resolver.tiles == (tile,)
+    assert resolver.resolve(payload_for(tile, 1)).tile is tile
+    assert resolver.resolve(payload_for(other, 1)) is None