@econ-v1/domain 6.5.0 → 6.6.0

package/dist/services/discovery-probe-service.js

@@ -0,0 +1,129 @@
+import { DomainError } from "../errors/index.js";
+export class DiscoveryProbeService {
+    #dialer;
+    #onChange;
+    #refresh;
+    #rows = new Map();
+    #generation = 0;
+    constructor(options) {
+        this.#dialer = options.dialer;
+        this.#onChange = options.onChange ?? (() => undefined);
+        this.#refresh = options.refresh;
+    }
+    snapshot() {
+        return [...this.#rows.values()];
+    }
+    /** Probes every address in parallel, replacing the previous candidate set. */
+    async probe(addresses) {
+        const generation = (this.#generation += 1);
+        const unique = dedupeText(addresses);
+        this.#rows = new Map(unique.map((address) => [address, { address, status: "probing" }]));
+        this.#emit();
+        await Promise.all(unique.map((address) => this.#probeOne(generation, address)));
+        return this.snapshot();
+    }
+    /**
+     * Promotes a previously verified candidate as the device's home-node route. Fail-closed:
+     * throws (never silently accepts) unless `probe()` most recently reported this exact
+     * address as `"verified"` — "continue anyway" on an unverified or stale candidate is not
+     * offered.
+     */
+    async promote(address) {
+        const row = this.#rows.get(address);
+        if (row === undefined || row.status !== "verified") {
+            throw new DomainError({
+                code: "invalid_request",
+                message: "Only a verified discovery candidate may be promoted as the home-node route",
+            });
+        }
+        const client = await this.#dial(address);
+        await this.#refresh.refresh(client);
+    }
+    async #probeOne(generation, rawAddress) {
+        let client;
+        try {
+            client = await this.#dial(rawAddress);
+        }
+        catch {
+            this.#setRow(generation, rawAddress, { address: rawAddress, status: "unreachable" });
+            return;
+        }
+        this.#setRow(generation, rawAddress, { address: rawAddress, status: "reachable" });
+        try {
+            const metadata = await client.invoke({
+                operation: "GET /api/v2/node/metadata",
+                payload: {},
+            });
+            const nodeId = textOrUndefined(metadata.node_id);
+            if (nodeId === undefined) {
+                // Reachable, but it never proved a stable node identity — fail-closed, never
+                // "verified" on reachability alone.
+                this.#setRow(generation, rawAddress, { address: rawAddress, status: "unreachable" });
+                return;
+            }
+            const displayName = textOrUndefined(metadata.friendly_name) ?? "Home Node";
+            this.#setRow(generation, rawAddress, {
+                address: rawAddress,
+                node: { displayName, maskedNodeId: maskNodeId(nodeId) },
+                status: "verified",
+            });
+        }
+        catch {
+            this.#setRow(generation, rawAddress, { address: rawAddress, status: "unreachable" });
+        }
+    }
+    async #dial(rawAddress) {
+        const origin = secureLanOrigin(rawAddress);
+        if (origin === undefined) {
+            throw new DomainError({ code: "invalid_request", message: "Discovery candidate address is invalid" });
+        }
+        const candidate = { address: origin, id: rawAddress, path: "lan-direct" };
+        const controller = new AbortController();
+        return await this.#dialer.dial(candidate, controller.signal);
+    }
+    #setRow(generation, address, row) {
+        if (generation !== this.#generation)
+            return; // superseded by a later probe() call
+        if (!this.#rows.has(address))
+            return;
+        this.#rows.set(address, row);
+        this.#emit();
+    }
+    #emit() {
+        this.#onChange(this.snapshot());
+    }
+}
+function dedupeText(values) {
+    return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))];
+}
+function textOrUndefined(value) {
+    return typeof value === "string" && value.trim().length > 0 ? value.trim() : undefined;
+}
+function maskNodeId(nodeId) {
+    if (nodeId.length <= 10)
+        return nodeId;
+    return `${nodeId.slice(0, 6)}····${nodeId.slice(-4)}`;
+}
+const LAN_ADDRESS_PATTERN = /^(?:https?:\/\/)?([^/?#:\s]+)(?::(\d{1,5}))?\/?$/u;
+/**
+ * Normalizes a user-typed (or metadata-sourced) LAN address into a strict HTTPS origin —
+ * the shape `probeLanCandidate`/`secureOrigin` (`@econ-v1/adapters-web`) require — or
+ * `undefined` if it is not a well-formed host[:port]. Mirrors
+ * `peer-directory-service.ts`'s `toSecureAddress`.
+ */
+export function secureLanOrigin(address) {
+    const trimmed = address.trim();
+    if (trimmed.length === 0)
+        return undefined;
+    const match = LAN_ADDRESS_PATTERN.exec(trimmed);
+    if (match === null)
+        return undefined;
+    const host = match[1];
+    if (host === undefined || host.length === 0)
+        return undefined;
+    const port = match[2] === undefined ? undefined : Number(match[2]);
+    if (port !== undefined && (port < 1 || port > 65535))
+        return undefined;
+    return port === undefined ? `https://${host}` : `https://${host}:${port}`;
+}
+//# sourceMappingURL=discovery-probe-service.js.map

package/dist/services/discovery-probe-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"discovery-probe-service.js","sourceRoot":"","sources":["../../src/services/discovery-probe-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AA6CjD,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAAiB;IACxB,SAAS,CAAmD;IAC5D,QAAQ,CAA8C;IAC/D,KAAK,GAAG,IAAI,GAAG,EAAiC,CAAC;IACjD,WAAW,GAAG,CAAC,CAAC;IAEhB,YAAY,OAAqC;QAC/C,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAClC,CAAC;IAED,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,KAAK,CAAC,SAA4B;QACtC,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,KAAK,EAAE,CAAC;QAEb,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAChF,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,OAAe;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YACnD,MAAM,IAAI,WAAW,CAAC;gBACpB,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,4EAA4E;aACtF,CAAC,CAAC;QACL,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,UAAkB,EAAE,UAAkB;QACpD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACrF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QAEnF,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAA4B;gBAC9D,SAAS,EAAE,2BAA2B;gBACtC,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,6EAA6E;gBAC7E,oCAAoC;gBACpC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;gBACrF,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,WAAW,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE;gBACnC,OAAO,EAAE,UAAU;gBACnB,IAAI,EAAE,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE;gBACvD,MAAM,EAAE,UAAU;aACnB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,UAAkB;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,wCAAwC,EAAE,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,SAAS,GAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC7F,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,CAAC,UAAkB,EAAE,OAAe,EAAE,GAA0B;QACrE,IAAI,UAAU,KAAK,IAAI,CAAC,WAAW;YAAE,OAAO,CAAC,qCAAqC;QAClF,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO;QACrC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClC,CAAC;CACF;AAED,SAAS,UAAU,CAAC,MAAyB;IAC3C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/F,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,UAAU,CAAC,MAAc;IAChC,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IACvC,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,mBAAmB,GAAG,mDAAmD,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAAe;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnE,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACvE,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC"}

package/dist/services/lan-candidate-refresh-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lan-candidate-refresh-service.d.ts","sourceRoot":"","sources":["../../src/services/lan-candidate-refresh-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,iBAAiB,EACjB,cAAc,EACd,YAAY,EACb,MAAM,gBAAgB,CAAC;AAIxB,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,0BAA0B;;gBAIzB,OAAO,EAAE,iCAAiC;IAKhD,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;CAqB3E"}
+{"version":3,"file":"lan-candidate-refresh-service.d.ts","sourceRoot":"","sources":["../../src/services/lan-candidate-refresh-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,iBAAiB,EACjB,cAAc,EACd,YAAY,EACb,MAAM,gBAAgB,CAAC;AAWxB,MAAM,WAAW,iCAAiC;IAChD,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,qBAAa,0BAA0B;;gBAIzB,OAAO,EAAE,iCAAiC;IAKhD,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,SAAS,iBAAiB,EAAE,CAAC;CAmB3E"}

package/dist/services/lan-candidate-refresh-service.js

@@ -1,4 +1,4 @@
-import { nodeMetadataCandidates, secureAddresses } from "./peer-directory-service.js";
+const MAX_LAN_ORIGINS = 8;
 export class LanCandidateRefreshService {
     #identity;
     #now;
@@ -7,26 +7,73 @@ export class LanCandidateRefreshService {
         this.#now = options.now ?? (() => new Date().toISOString());
     }
     async refresh(home) {
-        const metadata = await home.invoke({
-            operation: "GET /api/v2/node/metadata",
+        const current = await this.#identity.loadConnectionMetadata();
+        const homeNodeId = current?.homeNodeId;
+        if (!isNodeId(homeNodeId))
+            throw new TypeError("Home node transport identity is not established");
+        const response = await home.invoke({
+            operation: "GET /api/v2/client-transport/candidates",
             payload: {},
         });
-        const current = await this.#identity.loadConnectionMetadata();
-        const refreshed = nodeMetadataCandidates(metadata);
-        const directAddresses = secureAddresses([
-            ...(current?.directAddresses ?? []),
-            ...refreshed.map((candidate) => candidate.address),
-        ]);
+        const refreshed = parseCandidates(response, homeNodeId);
         const next = {
-            directAddresses,
+            directAddresses: refreshed.lan.map((candidate) => candidate.address),
+            homeNodeId,
             lastConnectedAt: this.#now(),
             ...(current?.relayUrl === undefined ? {} : { relayUrl: current.relayUrl }),
+            wanOrigin: refreshed.wan.address,
         };
         await this.#identity.storeConnectionMetadata(next);
-        const id = refreshed[0]?.id;
-        if (id === undefined)
-            return [];
-        return directAddresses.map((address) => ({ address, id, path: "lan-direct" }));
+        return refreshed.lan;
+    }
+}
+function parseCandidates(value, expectedHomeNodeId) {
+    if (!isExactCandidateResponse(value) || value.node_id !== expectedHomeNodeId) {
+        throw new TypeError("Home node transport identity did not match");
     }
+    const lan = normalizeLanOrigins(value.lan_origins);
+    const wan = canonicalHttpsOrigin(value.wan_origin, "Home node WAN origin was invalid");
+    return {
+        lan: lan.map((address) => ({ address, id: expectedHomeNodeId, path: "lan-direct" })),
+        wan: { address: wan, id: expectedHomeNodeId, path: "wan-direct" },
+    };
+}
+function normalizeLanOrigins(origins) {
+    const normalized = new Set();
+    for (const origin of origins) {
+        normalized.add(canonicalHttpsOrigin(origin, "Home node LAN candidates were invalid"));
+        if (normalized.size === MAX_LAN_ORIGINS)
+            break;
+    }
+    return [...normalized];
+}
+function canonicalHttpsOrigin(value, message) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new TypeError(message);
+    }
+    if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.hostname === "" || url.origin !== value) {
+        throw new TypeError(message);
+    }
+    return url.origin;
+}
+function isExactCandidateResponse(value) {
+    if (!isRecord(value))
+        return false;
+    const record = value;
+    const expected = ["lan_origins", "node_id", "version", "wan_origin"];
+    if (Object.keys(record).length !== expected.length || !expected.every((key) => Object.hasOwn(record, key)))
+        return false;
+    return record.version === 1 && isNodeId(record.node_id) && typeof record.wan_origin === "string" &&
+        Array.isArray(record.lan_origins) && record.lan_origins.every((origin) => typeof origin === "string");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isNodeId(value) {
+    return typeof value === "string" && value.trim() === value && value.length > 0;
 }
 //# sourceMappingURL=lan-candidate-refresh-service.js.map

package/dist/services/lan-candidate-refresh-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"lan-candidate-refresh-service.js","sourceRoot":"","sources":["../../src/services/lan-candidate-refresh-service.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,sBAAsB,EAAE,eAAe,EAAyB,MAAM,6BAA6B,CAAC;AAO7G,MAAM,OAAO,0BAA0B;IAC5B,SAAS,CAAe;IACxB,IAAI,CAAe;IAE5B,YAAY,OAA0C;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAmB;YACnD,SAAS,EAAE,2BAA2B;YACtC,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QAC9D,MAAM,SAAS,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,eAAe,GAAG,eAAe,CAAC;YACtC,GAAG,CAAC,OAAO,EAAE,eAAe,IAAI,EAAE,CAAC;YACnC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;SACnD,CAAC,CAAC;QACH,MAAM,IAAI,GAA6B;YACrC,eAAe;YACf,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;SAC3E,CAAC;QACF,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAChC,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAqB,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;CACF"}
+{"version":3,"file":"lan-candidate-refresh-service.js","sourceRoot":"","sources":["../../src/services/lan-candidate-refresh-service.ts"],"names":[],"mappings":"AAeA,MAAM,eAAe,GAAG,CAAC,CAAC;AAO1B,MAAM,OAAO,0BAA0B;IAC5B,SAAS,CAAe;IACxB,IAAI,CAAe;IAE5B,YAAY,OAA0C;QACpD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAoB;QAChC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,sBAAsB,EAAE,CAAC;QAC9D,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,CAAC;QACvC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAA+B;YAC/D,SAAS,EAAE,yCAAyC;YACpD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,eAAe,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACxD,MAAM,IAAI,GAA6B;YACrC,eAAe,EAAE,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC;YACpE,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,IAAI,EAAE;YAC5B,GAAG,CAAC,OAAO,EAAE,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC1E,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,OAAO;SACjC,CAAC;QACF,MAAM,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;QACnD,OAAO,SAAS,CAAC,GAAG,CAAC;IACvB,CAAC;CACF;AAED,SAAS,eAAe,CACtB,KAAmC,EACnC,kBAA0B;IAE1B,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,kBAAkB,EAAE,CAAC;QAC7E,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,EAAE,kCAAkC,CAAC,CAAC;IACvF,OAAO;QACL,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACpF,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,YAAY,EAAE;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,OAA0B;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,MAAM,EAAE,uCAAuC,CAAC,CAAC,CAAC;QACtF,IAAI,UAAU,CAAC,IAAI,KAAK,eAAe;YAAE,MAAM;IACjD,CAAC;IACD,OAAO,CAAC,GAAG,UAAU,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,OAAe;IAC1D,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,QAAQ,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QAC3H,MAAM,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC;IACrB,MAAM,QAAQ,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACzH,OAAO,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAC9F,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC1G,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACjF,CAAC"}

package/dist/services/onboarding-status-service.d.ts

@@ -0,0 +1,46 @@
+import type { HomeNodeClient } from "@econ-v1/ports";
+/**
+ * The #1815 onboarding-status coordinator (Tasks B+C). Derives which shell surface an
+ * unclaimed/claimed/unreachable node should show, so onboarding can mount by default for a
+ * fresh (unclaimed) node instead of only behind the `?onboarding=1` dev flag
+ * (`docs/superpowers/plans/2026-07-26-client-node-onboarding-status-coordinator.md`).
+ *
+ * Derivation order (fail-safe: an unrecognized outcome never invents "ready" or
+ * "needs-onboarding" — it falls back to `needs-pairing`, the pre-#1815 default path):
+ *   1. The browser already holds a valid device session → `ready` (never calls the node).
+ *   2. The node is reachable and reports `claimed: false` (no owner yet) → `needs-onboarding`,
+ *      scenario `new` (first-owner setup creates the owner).
+ *   3. The node is reachable and reports `claimed: true` (has an owner) → `needs-pairing`
+ *      (additional-device pairing — the existing default behavior).
+ *   4. The node has not been reached at all (a `TransportError` from `node.invoke`, e.g. no
+ *      route/candidate promoted yet) → `bootstrap-required` (drive discovery first).
+ *   5. Any other failure or an unrecognized response shape → `needs-pairing` (no regression
+ *      from the pre-#1815 default — the shell still shows the pairing gate, which handles
+ *      both "already paired" and "not yet paired" on its own).
+ */
+export type OnboardingLifecycleState = "bootstrap-required" | "needs-onboarding" | "needs-pairing" | "ready";
+export interface OnboardingLifecycleStatusRow {
+    readonly id: "onboarding-status";
+    /** Present only when `state === "needs-onboarding"` — always `"new"` today (first-owner
+     * setup); a future scenario would be added here, not overloaded onto this field. */
+    readonly scenario?: "new";
+    readonly state: OnboardingLifecycleState;
+}
+/** The subset of `GET /api/auth/onboarding-status`'s wire shape this service reads. */
+export interface OnboardingStatusWire {
+    readonly claimed?: unknown;
+}
+export interface OnboardingStatusServiceOptions {
+    /** Synchronous read of whether the browser currently holds an established device session
+     * (`DeviceSessionClient.currentSession() !== undefined` in the composition root). Kept as
+     * a plain predicate — rather than this service depending on `DeviceSessionClient` itself —
+     * so the service stays platform-free and trivially fakeable in tests. */
+    readonly hasActiveSession: () => boolean;
+    readonly node: Pick<HomeNodeClient, "invoke">;
+}
+export declare class OnboardingStatusService {
+    #private;
+    constructor(options: OnboardingStatusServiceOptions);
+    status(): Promise<OnboardingLifecycleStatusRow>;
+}
+//# sourceMappingURL=onboarding-status-service.d.ts.map

package/dist/services/onboarding-status-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-status-service.d.ts","sourceRoot":"","sources":["../../src/services/onboarding-status-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,wBAAwB,GAChC,oBAAoB,GACpB,kBAAkB,GAClB,eAAe,GACf,OAAO,CAAC;AAEZ,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,EAAE,EAAE,mBAAmB,CAAC;IACjC;wFACoF;IACpF,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,wBAAwB,CAAC;CAC1C;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C;;;6EAGyE;IACzE,QAAQ,CAAC,gBAAgB,EAAE,MAAM,OAAO,CAAC;IACzC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;CAC/C;AAED,qBAAa,uBAAuB;;gBAItB,OAAO,EAAE,8BAA8B;IAK7C,MAAM,IAAI,OAAO,CAAC,4BAA4B,CAAC;CAoBtD"}

package/dist/services/onboarding-status-service.js

@@ -0,0 +1,32 @@
+import { TransportError } from "../errors/index.js";
+export class OnboardingStatusService {
+    #hasActiveSession;
+    #node;
+    constructor(options) {
+        this.#hasActiveSession = options.hasActiveSession;
+        this.#node = options.node;
+    }
+    async status() {
+        if (this.#hasActiveSession())
+            return { id: "onboarding-status", state: "ready" };
+        let claimed;
+        try {
+            const response = await this.#node.invoke({
+                operation: "GET /api/auth/onboarding-status",
+                payload: {},
+            });
+            claimed = typeof response.claimed === "boolean" ? response.claimed : undefined;
+        }
+        catch (error) {
+            if (error instanceof TransportError)
+                return { id: "onboarding-status", state: "bootstrap-required" };
+            return { id: "onboarding-status", state: "needs-pairing" };
+        }
+        if (claimed === undefined)
+            return { id: "onboarding-status", state: "needs-pairing" };
+        return claimed
+            ? { id: "onboarding-status", state: "needs-pairing" }
+            : { id: "onboarding-status", scenario: "new", state: "needs-onboarding" };
+    }
+}
+//# sourceMappingURL=onboarding-status-service.js.map

package/dist/services/onboarding-status-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"onboarding-status-service.js","sourceRoot":"","sources":["../../src/services/onboarding-status-service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAkDpD,MAAM,OAAO,uBAAuB;IACzB,iBAAiB,CAAgB;IACjC,KAAK,CAAiC;IAE/C,YAAY,OAAuC;QACjD,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,IAAI,IAAI,CAAC,iBAAiB,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAEjF,IAAI,OAA4B,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,MAAM,CAAuB;gBAC7D,SAAS,EAAE,iCAAiC;gBAC5C,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,OAAO,GAAG,OAAO,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,IAAI,KAAK,YAAY,cAAc;gBAAE,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;YACrG,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QAC7D,CAAC;QAED,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;QACtF,OAAO,OAAO;YACZ,CAAC,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,eAAe,EAAE;YACrD,CAAC,CAAC,EAAE,EAAE,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC9E,CAAC;CACF"}

package/dist/services/release-manifest-verifier.d.ts

@@ -0,0 +1,37 @@
+import type { CryptoPort } from "@econ-v1/ports";
+import { type SignedReleaseManifest } from "../models/release-manifest.js";
+/**
+ * The #1815 Phase 1 release-manifest verifier (gap-audit §3 "Phase 1"; lifecycle spec §9).
+ * Pure with respect to the manifest's *content* — the only injected capability is the
+ * `CryptoPort` subset it needs (`digestSha256`, `verifyEd25519`), so this runs identically
+ * in a unit test (fake crypto) and in the browser service worker (real WebCrypto, see
+ * `client/adapters-web/src/identity/webcrypto-crypto-port.ts`). Never throws: every failure
+ * path resolves to one of the six stable reason codes below so a caller can log/telemetry it
+ * without risking a raw error message (and its potential detail) leaking anywhere.
+ *
+ * Check order is deliberate: structural validity first (so nothing downstream ever reads an
+ * un-typechecked field), then signature (nothing about an unauthenticated manifest's content
+ * is trusted for the policy checks that follow), then the manifest's own internal
+ * self-consistency, then policy (channel/protocol/schema).
+ */
+export declare const RELEASE_MANIFEST_REJECTION_REASONS: readonly ["malformed", "bad-signature", "hash-mismatch", "incompatible-protocol", "incompatible-schema", "channel-not-allowed"];
+export type ReleaseManifestRejectionReason = (typeof RELEASE_MANIFEST_REJECTION_REASONS)[number];
+export type ReleaseManifestVerification = {
+    readonly manifest: SignedReleaseManifest;
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly reason: ReleaseManifestRejectionReason;
+};
+export interface ReleaseManifestTrustedKey {
+    readonly keyId: string;
+    readonly publicKey: Uint8Array;
+}
+export interface ReleaseManifestVerifyOptions {
+    readonly allowedChannels: readonly string[];
+    readonly cryptoPort: Pick<CryptoPort, "digestSha256" | "verifyEd25519">;
+    readonly currentProtocolVersion: number;
+    readonly currentStorageSchemaVersion: number;
+}
+export declare function verifyReleaseManifest(candidate: unknown, trustedPublicKeys: readonly ReleaseManifestTrustedKey[], options: ReleaseManifestVerifyOptions): Promise<ReleaseManifestVerification>;
+//# sourceMappingURL=release-manifest-verifier.d.ts.map

package/dist/services/release-manifest-verifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-manifest-verifier.d.ts","sourceRoot":"","sources":["../../src/services/release-manifest-verifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAGjD,OAAO,EAIL,KAAK,qBAAqB,EAC3B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kCAAkC,iIAOrC,CAAC;AAEX,MAAM,MAAM,8BAA8B,GAAG,CAAC,OAAO,kCAAkC,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjG,MAAM,MAAM,2BAA2B,GACnC;IAAE,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAA;CAAE,GAC/D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,8BAA8B,CAAA;CAAE,CAAC;AAE5E,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,cAAc,GAAG,eAAe,CAAC,CAAC;IACxE,QAAQ,CAAC,sBAAsB,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,2BAA2B,EAAE,MAAM,CAAC;CAC9C;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,OAAO,EAClB,iBAAiB,EAAE,SAAS,yBAAyB,EAAE,EACvD,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,2BAA2B,CAAC,CAmCtC"}

package/dist/services/release-manifest-verifier.js

@@ -0,0 +1,84 @@
+import { canonicalOutboxPayload } from "../models/outbox.js";
+import { parseSignedReleaseManifest, unsignedReleaseManifestToJson, } from "../models/release-manifest.js";
+/**
+ * The #1815 Phase 1 release-manifest verifier (gap-audit §3 "Phase 1"; lifecycle spec §9).
+ * Pure with respect to the manifest's *content* — the only injected capability is the
+ * `CryptoPort` subset it needs (`digestSha256`, `verifyEd25519`), so this runs identically
+ * in a unit test (fake crypto) and in the browser service worker (real WebCrypto, see
+ * `client/adapters-web/src/identity/webcrypto-crypto-port.ts`). Never throws: every failure
+ * path resolves to one of the six stable reason codes below so a caller can log/telemetry it
+ * without risking a raw error message (and its potential detail) leaking anywhere.
+ *
+ * Check order is deliberate: structural validity first (so nothing downstream ever reads an
+ * un-typechecked field), then signature (nothing about an unauthenticated manifest's content
+ * is trusted for the policy checks that follow), then the manifest's own internal
+ * self-consistency, then policy (channel/protocol/schema).
+ */
+export const RELEASE_MANIFEST_REJECTION_REASONS = [
+    "malformed",
+    "bad-signature",
+    "hash-mismatch",
+    "incompatible-protocol",
+    "incompatible-schema",
+    "channel-not-allowed",
+];
+export async function verifyReleaseManifest(candidate, trustedPublicKeys, options) {
+    const manifest = parseSignedReleaseManifest(candidate);
+    if (manifest === undefined)
+        return { ok: false, reason: "malformed" };
+    const trustedKey = trustedPublicKeys.find((key) => key.keyId === manifest.signingKeyId);
+    if (trustedKey === undefined)
+        return { ok: false, reason: "bad-signature" };
+    const signatureBytes = hexToBytes(manifest.signature);
+    if (signatureBytes === undefined)
+        return { ok: false, reason: "malformed" };
+    const canonicalPayload = new TextEncoder().encode(canonicalOutboxPayload(unsignedReleaseManifestToJson(manifest)));
+    let signatureValid;
+    try {
+        signatureValid = await options.cryptoPort.verifyEd25519(canonicalPayload, signatureBytes, trustedKey.publicKey);
+    }
+    catch {
+        return { ok: false, reason: "bad-signature" };
+    }
+    if (!signatureValid)
+        return { ok: false, reason: "bad-signature" };
+    const expectedShellVersion = await deriveShellVersion(manifest.shellAssets, options.cryptoPort);
+    if (expectedShellVersion !== manifest.shellVersion)
+        return { ok: false, reason: "hash-mismatch" };
+    if (!options.allowedChannels.includes(manifest.channel))
+        return { ok: false, reason: "channel-not-allowed" };
+    if (isOutOfRange(options.currentProtocolVersion, manifest.protocolCompatibility)) {
+        return { ok: false, reason: "incompatible-protocol" };
+    }
+    if (isOutOfRange(options.currentStorageSchemaVersion, manifest.storageSchemaCompatibility)) {
+        return { ok: false, reason: "incompatible-schema" };
+    }
+    return { manifest, ok: true };
+}
+/** Mirrors `system/pwa/scripts/build-service-worker.mjs`'s `shellVersion` derivation
+ * (sha256 of the URL-sorted asset list, first 16 hex chars) so a validly-signed manifest
+ * whose signer computed `shellVersion` inconsistently with its own `shellAssets` is caught
+ * even though the signature itself only proves authenticity, not internal consistency. */
+async function deriveShellVersion(shellAssets, cryptoPort) {
+    const sorted = [...shellAssets].sort((left, right) => left.url.localeCompare(right.url));
+    const payload = JSON.stringify(sorted.map((asset) => ({ sha256: asset.sha256, url: asset.url })));
+    const digest = await cryptoPort.digestSha256(new TextEncoder().encode(payload));
+    return digest.slice(0, 16);
+}
+function isOutOfRange(value, range) {
+    return value < range.min || value > range.max;
+}
+function hexToBytes(hex) {
+    if (hex.length % 2 !== 0)
+        return undefined;
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let index = 0; index < bytes.length; index += 1) {
+        const byteHex = hex.slice(index * 2, index * 2 + 2);
+        const byte = Number.parseInt(byteHex, 16);
+        if (Number.isNaN(byte))
+            return undefined;
+        bytes[index] = byte;
+    }
+    return bytes;
+}
+//# sourceMappingURL=release-manifest-verifier.js.map

package/dist/services/release-manifest-verifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-manifest-verifier.js","sourceRoot":"","sources":["../../src/services/release-manifest-verifier.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,0BAA0B,EAC1B,6BAA6B,GAG9B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG;IAChD,WAAW;IACX,eAAe;IACf,eAAe;IACf,uBAAuB;IACvB,qBAAqB;IACrB,qBAAqB;CACb,CAAC;AAoBX,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAkB,EAClB,iBAAuD,EACvD,OAAqC;IAErC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAEtE,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,YAAY,CAAC,CAAC;IACxF,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAE5E,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAE5E,MAAM,gBAAgB,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAC/C,sBAAsB,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,CAChE,CAAC;IACF,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,cAAc,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,gBAAgB,EAAE,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAEnE,MAAM,oBAAoB,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAChG,IAAI,oBAAoB,KAAK,QAAQ,CAAC,YAAY;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAElG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAE7G,IAAI,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,CAAC;QACjF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IAED,IAAI,YAAY,CAAC,OAAO,CAAC,2BAA2B,EAAE,QAAQ,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAC3F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED;;;0FAG0F;AAC1F,KAAK,UAAU,kBAAkB,CAC/B,WAA4C,EAC5C,UAA4C;IAE5C,MAAM,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAqD;IACxF,OAAO,KAAK,GAAG,KAAK,CAAC,GAAG,IAAI,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC;IACtB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/services/transport-manager.d.ts

@@ -1,22 +1,41 @@
-import type { DelayPort, HomeNodeCandidate, HomeNodeClient, TransportState } from "@econ-v1/ports";
+import type { DelayPort, DirectHomeNodeCandidate, DirectTransportPath, HomeNodeClient, TransportState } from "@econ-v1/ports";
 export interface TransportManagerOptions {
-    readonly candidates: readonly HomeNodeCandidate[];
-    readonly dial: (candidate: HomeNodeCandidate, signal: AbortSignal) => Promise<HomeNodeClient>;
+    readonly candidates: readonly DirectHomeNodeCandidate[];
+    readonly dial: (candidate: DirectHomeNodeCandidate, signal: AbortSignal) => Promise<HomeNodeClient>;
     readonly delay?: DelayPort;
-    /** Delay before the next lower-priority candidate is allowed to race. */
+    /** Retained for source compatibility; candidates are selected by closed priority tiers. */
     readonly priorityGraceMs?: number;
     /** Upper bound for one candidate dial. */
     readonly candidateTimeoutMs?: number;
     readonly now?: () => string;
     readonly onState?: (state: TransportState) => void;
 }
-/** Fixed-priority home-node transport policy. Adapters own I/O; this class owns selection. */
+export interface TransportConnectOptions {
+    readonly higherPriorityThan?: DirectTransportPath;
+    readonly path?: DirectTransportPath;
+}
+/**
+ * Direct (non-relayed) home-node transport policy: browser-trusted LAN
+ * HTTPS, then hash-pinned LAN WebTransport, then WAN HTTPS/WSS (ticket
+ * #1823). Adapters own I/O; this class owns selection only.
+ */
 export declare class TransportManager {
     #private;
     constructor(options: TransportManagerOptions);
     get state(): TransportState;
+    get selectedCandidate(): DirectHomeNodeCandidate | undefined;
     subscribe(listener: (state: TransportState) => void): () => void;
-    connect(): Promise<HomeNodeClient>;
+    replaceCandidates(candidates: readonly DirectHomeNodeCandidate[]): void;
+    connect(options?: TransportConnectOptions): Promise<HomeNodeClient>;
+    markConnected(path: DirectTransportPath): void;
     markOffline(): void;
+    abort(): void;
 }
+/**
+ * Canonicalize a bare HTTPS origin. Named for its HTTP origin, but this rule
+ * — exact `https://` scheme, no credentials, no path/query/fragment — is the
+ * same origin shape a WebTransport candidate's `address` uses too (ticket
+ * #1823): the client-RPC path is appended when dialing, not advertised.
+ */
+export declare function canonicalHttpCandidateOrigin(value: string): string;
 //# sourceMappingURL=transport-manager.d.ts.map

package/dist/services/transport-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transport-manager.d.ts","sourceRoot":"","sources":["../../src/services/transport-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,cAAc,EAAiB,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAElH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAClD,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,iBAAiB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAC9F,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,yEAAyE;IACzE,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED,8FAA8F;AAC9F,qBAAa,gBAAgB;;gBAYf,OAAO,EAAE,uBAAuB;IAU5C,IAAI,KAAK,IAAI,cAAc,CAAwB;IAEnD,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;IAK1D,OAAO,IAAI,OAAO,CAAC,cAAc,CAAC;IAWxC,WAAW,IAAI,IAAI;CAmGpB"}
+{"version":3,"file":"transport-manager.d.ts","sourceRoot":"","sources":["../../src/services/transport-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAK9H,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,CAAC;IACxD,QAAQ,CAAC,IAAI,EAAE,CAAC,SAAS,EAAE,uBAAuB,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IACpG,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC;IAC3B,2FAA2F;IAC3F,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,0CAA0C;IAC1C,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAID;;;;GAIG;AACH,qBAAa,gBAAgB;;gBAef,OAAO,EAAE,uBAAuB;IAS5C,IAAI,KAAK,IAAI,cAAc,CAAwB;IACnD,IAAI,iBAAiB,IAAI,uBAAuB,GAAG,SAAS,CAE3D;IAED,SAAS,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,GAAG,MAAM,IAAI;IAKhE,iBAAiB,CAAC,UAAU,EAAE,SAAS,uBAAuB,EAAE,GAAG,IAAI;IAIvE,OAAO,CAAC,OAAO,GAAE,uBAA4B,GAAG,OAAO,CAAC,cAAc,CAAC;IAYvE,aAAa,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI;IAI9C,WAAW,IAAI,IAAI;IAInB,KAAK,IAAI,IAAI;CA+Fd;AA4BD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBlE"}