@econ-v1/ports 6.5.0 → 6.6.0

package/dist/identity.d.ts

@@ -17,8 +17,10 @@ export interface DeviceDelegation {
 }
 export interface DeviceConnectionMetadata {
     readonly directAddresses: readonly string[];
+    readonly homeNodeId?: string;
     readonly lastConnectedAt?: string;
     readonly relayUrl?: string;
+    readonly wanOrigin?: string;
 }
 export interface DeviceIdentity extends DevicePublicIdentity {
     readonly keyHandle: DeviceKeyHandle;

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACxD,eAAe,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,sBAAsB,IAAI,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACxE,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7C"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,cAAc,GAAG,iBAAiB,GAAG,SAAS,CAAC;AAE3D,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,cAAc,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CACpC;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAe,SAAQ,oBAAoB;IAC1D,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,cAAc,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IACpC,IAAI,CAAC,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC3E,cAAc,IAAI,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAC;IAC5D,cAAc,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAAC;IACxD,eAAe,CAAC,UAAU,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7D,sBAAsB,IAAI,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAAC;IACxE,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,sBAAsB,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAClD,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7C"}

package/dist/index.d.ts

@@ -2,8 +2,16 @@ export type { ClockPort, ClockWake, DelayPort } from "./clock.js";
 export type { CryptoPort } from "./crypto.js";
 export type { IdPort } from "./id.js";
 export type { DeviceConnectionMetadata, DeviceDelegation, DeviceIdentity, DeviceKeyHandle, DevicePublicIdentity, IdentityDiagnostics, IdentityPort, KeyCustodyMode, } from "./identity.js";
-export type { DeltaRequest, CancellationSignal, HomeNodeClient, HomeNodeRequest, PeerTransportPort, TransportPath, TransportState, } from "./network.js";
+export { createNullInstallEnvironment, } from "./install-environment.js";
+export type { InstallEnvironmentPort, InstallInstructionMode, } from "./install-environment.js";
+export type { DeltaRequest, CancellationSignal, DirectHomeNodeCandidate, DirectTransportPath, HomeNodeClient, HttpHomeNodeCandidate, HttpTransportPath, HomeNodeRequest, PeerTransportPort, TransportPath, TransportState, WebTransportCertificateHashes, WebTransportHomeNodeCandidate, } from "./network.js";
 export type { HomeNodeCandidate, HomeNodeDialer } from "./network/home-node-candidate.js";
+export { DEFAULT_CLIENT_NODE_ORIGIN } from "./network/client-node-origin.js";
+export type { HomeNodeCandidateStorePort, StoredHomeNodeCandidate, } from "./network/home-node-candidate-store.js";
+export type { L402PaymentChallenge, L402PaymentHandler, L402PaymentResult } from "./network/l402-payment.js";
+export type { NodeAddressDiscoverer, NodeDiscoveryCandidate, NodeDiscoveryResult, } from "./network/node-discovery.js";
+export { MAX_CLOSE_REASON_BYTES, MAX_DTLS_FINGERPRINT_BYTES, MAX_ICE_CANDIDATE_BYTES, MAX_ICE_CANDIDATES_PER_OFFER, MAX_OFFER_NONCE_BYTES, MAX_SDP_BYTES, MAX_SDP_MID_BYTES, MAX_WEBRTC_SIGNAL_MESSAGE_BYTES, MIN_OFFER_NONCE_BYTES, WEBRTC_SIGNAL_VERSION, } from "./network/webrtc-signaling.js";
+export type { WebRtcAnswer, WebRtcClose, WebRtcIceCandidate, WebRtcOffer, WebRtcRestart, WebRtcSignalMessage, WebRtcSignalSetup, WebRtcSignalingPort, } from "./network/webrtc-signaling.js";
 export type { PreparedStageAsset, StageAssetPort, StageCatalogEntry, StageManifest, StageUiKind, StageUiMetadata, StageUiNav, StageRegistryPort, StageRegistrySnapshot, } from "./repositories.js";
 export { CONVERSATION_MESSAGE_STATES } from "./repositories/conversation-repository.js";
 export type { Conversation, ConversationListParams, ConversationLogDelta, ConversationMessage, ConversationMessageState, ConversationRepository, ConversationRepositoryEvent, MessageListParams, Notification, NotificationListParams, NotificationRepository, NotificationRepositoryEvent, RepositoryEvent, } from "./repositories/conversation-repository.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,YAAY,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,GACf,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC1F,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC3F,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC9C,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtC,YAAY,EACV,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,eAAe,EACf,oBAAoB,EACpB,mBAAmB,EACnB,YAAY,EACZ,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,mBAAmB,EACnB,cAAc,EACd,qBAAqB,EACrB,iBAAiB,EACjB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,6BAA6B,EAC7B,6BAA6B,GAC9B,MAAM,cAAc,CAAC;AACtB,YAAY,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAC1F,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,YAAY,EACV,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,wCAAwC,CAAC;AAChD,YAAY,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC7G,YAAY,EACV,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,WAAW,EACX,aAAa,EACb,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,YAAY,EACV,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AACxF,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,oBAAoB,EACpB,mBAAmB,EACnB,wBAAwB,EACxB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,YAAY,EACZ,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,GAChB,MAAM,2CAA2C,CAAC;AACnD,YAAY,EACV,YAAY,EACZ,sBAAsB,EACtB,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AAC1E,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,sBAAsB,EACtB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,uBAAuB,EACvB,mBAAmB,GACpB,MAAM,uCAAuC,CAAC;AAC/C,YAAY,EACV,YAAY,EACZ,aAAa,EACb,kBAAkB,EAClB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,YAAY,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,eAAe,EACf,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,gBAAgB,EAChB,oBAAoB,EACpB,0BAA0B,EAC1B,yBAAyB,EACzB,4BAA4B,GAC7B,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EACV,2BAA2B,EAC3B,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,4CAA4C,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAClE,YAAY,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC;AAC3F,YAAY,EACV,0BAA0B,EAC1B,mBAAmB,EACnB,WAAW,EACX,iBAAiB,EACjB,mBAAmB,EACnB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,GACrB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,3 +1,6 @@
+export { createNullInstallEnvironment, } from "./install-environment.js";
+export { DEFAULT_CLIENT_NODE_ORIGIN } from "./network/client-node-origin.js";
+export { MAX_CLOSE_REASON_BYTES, MAX_DTLS_FINGERPRINT_BYTES, MAX_ICE_CANDIDATE_BYTES, MAX_ICE_CANDIDATES_PER_OFFER, MAX_OFFER_NONCE_BYTES, MAX_SDP_BYTES, MAX_SDP_MID_BYTES, MAX_WEBRTC_SIGNAL_MESSAGE_BYTES, MIN_OFFER_NONCE_BYTES, WEBRTC_SIGNAL_VERSION, } from "./network/webrtc-signaling.js";
 export { CONVERSATION_MESSAGE_STATES } from "./repositories/conversation-repository.js";
 export { OutboxIdempotencyConflictError } from "./repositories/outbox.js";
 export { REVISIONED_REPOSITORY_DOMAINS, } from "./repositories/revisioned-repository.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAkCA,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAsBxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AA+B1E,OAAO,EACL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAYjD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AAYpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,4BAA4B,GAC7B,MAAM,0BAA0B,CAAC;AAqBlC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAW7E,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,4BAA4B,EAC5B,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,+BAA+B,EAC/B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,+BAA+B,CAAC;AAsBvC,OAAO,EAAE,2BAA2B,EAAE,MAAM,2CAA2C,CAAC;AAsBxF,OAAO,EAAE,8BAA8B,EAAE,MAAM,0BAA0B,CAAC;AA+B1E,OAAO,EACL,6BAA6B,GAC9B,MAAM,yCAAyC,CAAC;AAYjD,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,4CAA4C,CAAC;AAYpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,cAAc,CAAC"}

package/dist/install-environment.d.ts

@@ -0,0 +1,42 @@
+/** Which install affordance the shell should render for the current environment. */
+export type InstallInstructionMode = "installable" | "ios" | "safari-desktop" | "unsupported";
+/**
+ * Boundary port for PWA install detection (`client/ui`'s install-prompt UI, a later task).
+ *
+ * `client/ui` may never touch `window.beforeinstallprompt` / `navigator.standalone` /
+ * `navigator.getInstalledRelatedApps` directly (boundary rules B2/B3,
+ * `client/scripts/check-boundaries.mjs`) — this is the narrow surface
+ * `client/adapters-web`'s `createBrowserInstallEnvironment()` implements against the real
+ * globals, and the composition root (`system/pwa/src/main.ts`) registers it before the shell
+ * needs to decide whether/how to offer installation. The captured `beforeinstallprompt` event
+ * fires once, early in the page lifecycle, and is only usable once (`promptInstall`) — this
+ * port's job is to hold onto it so callers don't have to race the event themselves.
+ */
+export interface InstallEnvironmentPort {
+    /** True if the app is already running in an installed/standalone display mode. */
+    isStandalone(): boolean;
+    /** Which install affordance to show: a native prompt is available, iOS's manual-add-to-
+     * home-screen instructions apply, macOS Safari's manual-add-to-Dock instructions apply
+     * (Safari 17+ supports installing via Share → Add to Dock but never fires
+     * `beforeinstallprompt`), or neither (desktop browser with no install support, already
+     * standalone, etc). */
+    instructionMode(): InstallInstructionMode;
+    /** Subscribes to native install-prompt availability. Fires immediately if a prompt was
+     * already captured before this call; otherwise fires once the `beforeinstallprompt` event
+     * arrives. Returns an unsubscribe function. */
+    onInstallAvailable(listener: () => void): () => void;
+    /** Shows the captured native install prompt, if any. Resolves `"unavailable"` when no
+     * prompt has been captured. Clears the captured prompt on use — it can only be shown
+     * once per capture. */
+    promptInstall(): Promise<"accepted" | "dismissed" | "unavailable">;
+    /** Subscribes to the `appinstalled` event. Returns an unsubscribe function. */
+    onAppInstalled(listener: () => void): () => void;
+    /** Checks whether this app is already installed via the User-Agent-mediated related-apps
+     * API. Resolves `false` if the API is absent or the check fails. */
+    checkAlreadyInstalled(): Promise<boolean>;
+}
+/** A no-op `InstallEnvironmentPort` for environments with no install affordance (SSR, tests,
+ * platforms without a real browser behind them). Never standalone, never installable, no
+ * prompts ever fire. */
+export declare function createNullInstallEnvironment(): InstallEnvironmentPort;
+//# sourceMappingURL=install-environment.d.ts.map

package/dist/install-environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-environment.d.ts","sourceRoot":"","sources":["../src/install-environment.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,MAAM,MAAM,sBAAsB,GAAG,aAAa,GAAG,KAAK,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAE9F;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,YAAY,IAAI,OAAO,CAAC;IACxB;;;;2BAIuB;IACvB,eAAe,IAAI,sBAAsB,CAAC;IAC1C;;mDAE+C;IAC/C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACrD;;2BAEuB;IACvB,aAAa,IAAI,OAAO,CAAC,UAAU,GAAG,WAAW,GAAG,aAAa,CAAC,CAAC;IACnE,+EAA+E;IAC/E,cAAc,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;IACjD;wEACoE;IACpE,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED;;wBAEwB;AACxB,wBAAgB,4BAA4B,IAAI,sBAAsB,CAqBrE"}

package/dist/install-environment.js

@@ -0,0 +1,26 @@
+/** A no-op `InstallEnvironmentPort` for environments with no install affordance (SSR, tests,
+ * platforms without a real browser behind them). Never standalone, never installable, no
+ * prompts ever fire. */
+export function createNullInstallEnvironment() {
+    return {
+        isStandalone() {
+            return false;
+        },
+        instructionMode() {
+            return "unsupported";
+        },
+        onInstallAvailable() {
+            return () => undefined;
+        },
+        async promptInstall() {
+            return "unavailable";
+        },
+        onAppInstalled() {
+            return () => undefined;
+        },
+        async checkAlreadyInstalled() {
+            return false;
+        },
+    };
+}
+//# sourceMappingURL=install-environment.js.map

package/dist/install-environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-environment.js","sourceRoot":"","sources":["../src/install-environment.ts"],"names":[],"mappings":"AAuCA;;wBAEwB;AACxB,MAAM,UAAU,4BAA4B;IAC1C,OAAO;QACL,YAAY;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,eAAe;YACb,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,kBAAkB;YAChB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,OAAO,aAAa,CAAC;QACvB,CAAC;QACD,cAAc;YACZ,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC;QACzB,CAAC;QACD,KAAK,CAAC,qBAAqB;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/network/client-node-origin.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The Client Node PWA's cloud distribution origin — the static site an installed-from-cloud
+ * PWA is served from at first launch (e.g. `client-node.economy1.cloud`), as opposed to a
+ * `system/pwa/dist` build served directly by a running node (dev, or an on-node install).
+ *
+ * Mirrors the Rust constant of the same value, `DEFAULT_CLIENT_NODE_ORIGIN` in
+ * `core/adapters-network/src/http/server/runtime.rs` (introduced by ticket N1's CORS/PNA
+ * work) — kept in sync by hand; update both together if this value ever changes.
+ *
+ * This origin is NEVER itself a home node — it is a static site with no node behind it.
+ * `resolveInitialHomeNode` (`system/pwa/src/kernel-runtime.ts`) uses this constant to
+ * recognize "installed-from-cloud, no LAN candidate discovered yet" and refuses to seed it
+ * as a dialable bootstrap candidate. Before this constant's introduction (lan-direct-pairing
+ * plan, C3), the distribution origin was unconditionally seeded as the `wan-direct`
+ * home-node candidate on every boot, so pairing dialed the static site and got a 404.
+ */
+export declare const DEFAULT_CLIENT_NODE_ORIGIN = "https://client-node.economy1.cloud";
+//# sourceMappingURL=client-node-origin.d.ts.map

package/dist/network/client-node-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-node-origin.d.ts","sourceRoot":"","sources":["../../src/network/client-node-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,0BAA0B,uCAAuC,CAAC"}

package/dist/network/client-node-origin.js

@@ -0,0 +1,18 @@
+/**
+ * The Client Node PWA's cloud distribution origin — the static site an installed-from-cloud
+ * PWA is served from at first launch (e.g. `client-node.economy1.cloud`), as opposed to a
+ * `system/pwa/dist` build served directly by a running node (dev, or an on-node install).
+ *
+ * Mirrors the Rust constant of the same value, `DEFAULT_CLIENT_NODE_ORIGIN` in
+ * `core/adapters-network/src/http/server/runtime.rs` (introduced by ticket N1's CORS/PNA
+ * work) — kept in sync by hand; update both together if this value ever changes.
+ *
+ * This origin is NEVER itself a home node — it is a static site with no node behind it.
+ * `resolveInitialHomeNode` (`system/pwa/src/kernel-runtime.ts`) uses this constant to
+ * recognize "installed-from-cloud, no LAN candidate discovered yet" and refuses to seed it
+ * as a dialable bootstrap candidate. Before this constant's introduction (lan-direct-pairing
+ * plan, C3), the distribution origin was unconditionally seeded as the `wan-direct`
+ * home-node candidate on every boot, so pairing dialed the static site and got a 404.
+ */
+export const DEFAULT_CLIENT_NODE_ORIGIN = "https://client-node.economy1.cloud";
+//# sourceMappingURL=client-node-origin.js.map

package/dist/network/client-node-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-node-origin.js","sourceRoot":"","sources":["../../src/network/client-node-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,oCAAoC,CAAC"}

package/dist/network/home-node-candidate-store.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The minimal, JSON-safe shape of a verified LAN-direct home-node candidate the device
+ * remembers across reloads (lan-direct-pairing plan, C3). Always becomes `path: "lan-direct"`
+ * once turned into a `HomeNodeCandidate` — this type omits `path` because that is the only
+ * value ever stored here; it deliberately does not reuse `NodeDiscoveryCandidate`
+ * (`network/node-discovery.js`) so this port stays free of that module's discovery-flow
+ * framing (`path` there exists to type-narrow a discovery *result*, not a stored value).
+ */
+export interface StoredHomeNodeCandidate {
+    readonly address: string;
+    readonly id: string;
+}
+/**
+ * Boundary port for persisting the discovered-LAN home-node candidate.
+ *
+ * `client/ui`'s onboarding discovery screen (`shell/onboarding/screens/connect-discovery.ts`)
+ * emits a `node-discovered` DOM event carrying a verified candidate but never persists it
+ * itself — the composition root (`system/pwa/src/main.ts`) listens for that event, writes
+ * the candidate here, and reloads so `createP0KernelRuntime`
+ * (`system/pwa/src/kernel-runtime.ts`) seeds it as the boot-time home node on the next load
+ * via `resolveInitialHomeNode`. `client/ui` may never touch `localStorage` directly
+ * (boundary rules B2/B3, `client/scripts/check-boundaries.mjs`) — this is the narrow surface
+ * `client/adapters-web`'s `createBrowserHomeNodeCandidateStore()` implements against the real
+ * global, mirroring `ThemeEnvironmentPort`'s `BrowserThemeEnvironment` adapter pattern.
+ *
+ * Implementations MUST swallow storage failures (private browsing, quota) rather than
+ * throwing — a lost persist just means LAN discovery runs again on the next launch, never a
+ * hard failure.
+ */
+export interface HomeNodeCandidateStorePort {
+    /** Reads the persisted candidate, or `undefined` if unset or storage is unavailable. */
+    read(): StoredHomeNodeCandidate | undefined;
+    /** Persists a verified candidate as the device's remembered home node. */
+    write(candidate: StoredHomeNodeCandidate): void;
+    /** Clears any persisted candidate. */
+    clear(): void;
+}
+//# sourceMappingURL=home-node-candidate-store.d.ts.map

package/dist/network/home-node-candidate-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-node-candidate-store.d.ts","sourceRoot":"","sources":["../../src/network/home-node-candidate-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,0BAA0B;IACzC,wFAAwF;IACxF,IAAI,IAAI,uBAAuB,GAAG,SAAS,CAAC;IAC5C,0EAA0E;IAC1E,KAAK,CAAC,SAAS,EAAE,uBAAuB,GAAG,IAAI,CAAC;IAChD,sCAAsC;IACtC,KAAK,IAAI,IAAI,CAAC;CACf"}

package/dist/network/home-node-candidate-store.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=home-node-candidate-store.js.map

package/dist/network/home-node-candidate-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"home-node-candidate-store.js","sourceRoot":"","sources":["../../src/network/home-node-candidate-store.ts"],"names":[],"mappings":""}

package/dist/network/l402-payment.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The domain-level shape of an L402 payment challenge — mirrors
+ * `L402PaymentChallengeDetails` in
+ * `client/adapters-web/src/network/client-rpc/response-error.ts` (the
+ * carrier-side representation of a `402 PaymentRequired` `node/client-rpc/1`
+ * response) without this port depending on that adapter package. Never log
+ * `macaroon`/`invoice` (Constitution Principle VIII) — both are
+ * credential/payment-secret material, not diagnostic detail.
+ */
+export interface L402PaymentChallenge {
+    readonly amountSats: number;
+    readonly description: string;
+    readonly invoice: string;
+    readonly macaroon: string;
+}
+/** The Lightning preimage produced once `invoice` is paid — combined with `macaroon` to form the `LSAT <macaroon>:<preimage>` token the retried request carries. */
+export interface L402PaymentResult {
+    readonly preimage: string;
+}
+/**
+ * Pluggable port the kernel/composition root supplies to pay an L402
+ * challenge surfaced by a `node/client-rpc/1` carrier (ticket #1866:
+ * WebTransport/WebRTC — the same challenge the HTTP carrier's
+ * `WWW-Authenticate` 402 flow already exposes to callers).
+ *
+ * Paying an invoice is a domain/UI concern — it may require prompting the
+ * operator, routing through an external Lightning wallet, or invoking a
+ * not-yet-wired authoritative-wallet capability — never something a
+ * transport-layer carrier should decide on its own. The carrier and the
+ * managed-client retry orchestration only need to know whether payment
+ * succeeded and, if so, the resulting preimage; they never see how it was
+ * obtained. When no handler is supplied, the challenge is surfaced to the
+ * caller unchanged (never a silent no-op, never a fabricated payment).
+ */
+export interface L402PaymentHandler {
+    pay(challenge: L402PaymentChallenge): Promise<L402PaymentResult>;
+}
+//# sourceMappingURL=l402-payment.d.ts.map

package/dist/network/l402-payment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"l402-payment.d.ts","sourceRoot":"","sources":["../../src/network/l402-payment.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,oKAAoK;AACpK,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,kBAAkB;IACjC,GAAG,CAAC,SAAS,EAAE,oBAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClE"}

package/dist/network/l402-payment.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=l402-payment.js.map

package/dist/network/l402-payment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"l402-payment.js","sourceRoot":"","sources":["../../src/network/l402-payment.ts"],"names":[],"mappings":""}

package/dist/network/node-discovery.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The pre-pairing "verify a user-entered address is really a node" port
+ * (ticket #1893-follow-on / `docs/superpowers/plans/2026-07-27-lan-direct-pairing.md`).
+ *
+ * This is deliberately lighter-weight than `HomeNodeDialer`: no session, no auth headers,
+ * no expected node id to prove against — the caller doesn't know which node (if any) is at
+ * the address yet. It only proves the responder's PUBLIC origin proof
+ * (`GET /.well-known/client-node-origin`) is well-formed and matches the address dialed.
+ * Contrast with `DiscoveryProbeService`/`HomeNodeDialer`, which re-prove a candidate against
+ * an *already-known* home-node id (post-pairing "did my node move on the LAN" re-discovery).
+ */
+export interface NodeDiscoveryCandidate {
+    readonly address: string;
+    readonly id: string;
+    readonly path: "lan-direct";
+}
+export type NodeDiscoveryResult = {
+    readonly status: "verified";
+    readonly candidate: NodeDiscoveryCandidate;
+} | {
+    readonly status: "reached-but-invalid";
+    readonly reason: string;
+} | {
+    readonly status: "unreachable-or-untrusted";
+};
+export interface NodeAddressDiscoverer {
+    discover(rawAddress: string): Promise<NodeDiscoveryResult>;
+}
+//# sourceMappingURL=node-discovery.d.ts.map

package/dist/network/node-discovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-discovery.d.ts","sourceRoot":"","sources":["../../src/network/node-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,sBAAsB,CAAA;CAAE,GAC3E;IAAE,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC5D"}

package/dist/network/node-discovery.js

@@ -0,0 +1,13 @@
+/**
+ * The pre-pairing "verify a user-entered address is really a node" port
+ * (ticket #1893-follow-on / `docs/superpowers/plans/2026-07-27-lan-direct-pairing.md`).
+ *
+ * This is deliberately lighter-weight than `HomeNodeDialer`: no session, no auth headers,
+ * no expected node id to prove against — the caller doesn't know which node (if any) is at
+ * the address yet. It only proves the responder's PUBLIC origin proof
+ * (`GET /.well-known/client-node-origin`) is well-formed and matches the address dialed.
+ * Contrast with `DiscoveryProbeService`/`HomeNodeDialer`, which re-prove a candidate against
+ * an *already-known* home-node id (post-pairing "did my node move on the LAN" re-discovery).
+ */
+export {};
+//# sourceMappingURL=node-discovery.js.map

package/dist/network/node-discovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-discovery.js","sourceRoot":"","sources":["../../src/network/node-discovery.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG"}

package/dist/network/webrtc-signaling.d.ts

@@ -0,0 +1,101 @@
+import type { CancellationSignal } from "../network.js";
+/**
+ * Authenticated WebRTC signaling over HTTPS/WSS (ticket #1824, "N3").
+ *
+ * iroh-router signaling is explicitly deferred; this is the browser-side
+ * contract for the HTTPS/WSS signaling adapter instead. It carries only
+ * setup, offer, answer, candidate, restart, and close — never a peer
+ * connection or DataChannel. Field names mirror the Rust wire types in
+ * `core/adapters-network/src/webrtc_signal/messages.rs` exactly (including
+ * snake_case) since both sides serialize the same JSON envelope.
+ *
+ * `WebRtcHomeNodeClient` (the WebRTC carrier, ticket "N4") depends on this
+ * narrow port rather than on any concrete transport, so the signaling
+ * transport can change without touching WebRTC connection logic.
+ */
+export declare const WEBRTC_SIGNAL_VERSION = 1;
+/** Maximum serialized size of one signaling WebSocket text frame. */
+export declare const MAX_WEBRTC_SIGNAL_MESSAGE_BYTES: number;
+/** Maximum SDP body size (offer, answer, or restart). */
+export declare const MAX_SDP_BYTES: number;
+export declare const MIN_OFFER_NONCE_BYTES = 16;
+export declare const MAX_OFFER_NONCE_BYTES = 128;
+/** Maximum DTLS fingerprint size: `<algorithm> <hex-pairs>`. */
+export declare const MAX_DTLS_FINGERPRINT_BYTES = 200;
+/** Maximum size of one trickle-ICE candidate line. */
+export declare const MAX_ICE_CANDIDATE_BYTES = 1024;
+export declare const MAX_SDP_MID_BYTES = 64;
+/** Maximum number of trickle-ICE candidates accepted for one bound offer. */
+export declare const MAX_ICE_CANDIDATES_PER_OFFER = 32;
+export declare const MAX_CLOSE_REASON_BYTES = 256;
+export interface WebRtcSignalSetup {
+    readonly headers: Readonly<Record<string, string>>;
+    readonly type: "setup";
+    readonly version: number;
+}
+export interface WebRtcOffer {
+    readonly dtls_fingerprint: string;
+    readonly offer_nonce: string;
+    readonly sdp: string;
+    readonly type: "offer";
+    readonly version: number;
+}
+export interface WebRtcAnswer {
+    readonly dtls_fingerprint: string;
+    readonly offer_nonce: string;
+    readonly sdp: string;
+    readonly type: "answer";
+}
+export interface WebRtcIceCandidate {
+    readonly candidate: string;
+    readonly offer_nonce: string;
+    readonly sdp_mid?: string;
+    readonly sdp_mline_index?: number;
+    readonly type: "candidate";
+}
+export interface WebRtcRestart {
+    readonly dtls_fingerprint: string;
+    readonly offer_nonce: string;
+    readonly previous_offer_nonce: string;
+    readonly sdp: string;
+    readonly type: "restart";
+    readonly version: number;
+}
+export interface WebRtcClose {
+    readonly offer_nonce?: string;
+    readonly reason?: string;
+    readonly type: "close";
+}
+export type WebRtcSignalMessage = WebRtcAnswer | WebRtcClose | WebRtcIceCandidate | WebRtcOffer | WebRtcRestart | WebRtcSignalSetup;
+/**
+ * Browser-side signaling contract. A production implementation opens one
+ * authenticated WSS connection, sends the setup frame with the caller's
+ * bearer + delegation headers, and maps offer/restart replies to their
+ * answers. This is signaling transport only — no peer connection or
+ * DataChannel is created here.
+ */
+export interface WebRtcSignalingPort {
+    close(close?: {
+        readonly offer_nonce?: string;
+        readonly reason?: string;
+    }): Promise<void>;
+    connect(setupHeaders: Readonly<Record<string, string>>, signal?: CancellationSignal): Promise<void>;
+    sendCandidate(candidate: {
+        readonly candidate: string;
+        readonly offer_nonce: string;
+        readonly sdp_mid?: string;
+        readonly sdp_mline_index?: number;
+    }): Promise<void>;
+    sendOffer(offer: {
+        readonly dtls_fingerprint: string;
+        readonly offer_nonce: string;
+        readonly sdp: string;
+    }): Promise<WebRtcAnswer>;
+    sendRestart(restart: {
+        readonly dtls_fingerprint: string;
+        readonly offer_nonce: string;
+        readonly previous_offer_nonce: string;
+        readonly sdp: string;
+    }): Promise<WebRtcAnswer>;
+}
+//# sourceMappingURL=webrtc-signaling.d.ts.map

package/dist/network/webrtc-signaling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webrtc-signaling.d.ts","sourceRoot":"","sources":["../../src/network/webrtc-signaling.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAExD;;;;;;;;;;;;;GAaG;AAEH,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC,qEAAqE;AACrE,eAAO,MAAM,+BAA+B,QAAY,CAAC;AACzD,yDAAyD;AACzD,eAAO,MAAM,aAAa,QAAY,CAAC;AACvC,eAAO,MAAM,qBAAqB,KAAK,CAAC;AACxC,eAAO,MAAM,qBAAqB,MAAM,CAAC;AACzC,gEAAgE;AAChE,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAC9C,sDAAsD;AACtD,eAAO,MAAM,uBAAuB,OAAO,CAAC;AAC5C,eAAO,MAAM,iBAAiB,KAAK,CAAC;AACpC,6EAA6E;AAC7E,eAAO,MAAM,4BAA4B,KAAK,CAAC;AAC/C,eAAO,MAAM,sBAAsB,MAAM,CAAC;AAE1C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;IACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,MAAM,mBAAmB,GAC3B,YAAY,GACZ,WAAW,GACX,kBAAkB,GAClB,WAAW,GACX,aAAa,GACb,iBAAiB,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1F,OAAO,CAAC,YAAY,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpG,aAAa,CAAC,SAAS,EAAE;QACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClB,SAAS,CAAC,KAAK,EAAE;QACf,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1B,WAAW,CAAC,OAAO,EAAE;QACnB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC;QACtC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;CAC3B"}

package/dist/network/webrtc-signaling.js

@@ -0,0 +1,30 @@
+/**
+ * Authenticated WebRTC signaling over HTTPS/WSS (ticket #1824, "N3").
+ *
+ * iroh-router signaling is explicitly deferred; this is the browser-side
+ * contract for the HTTPS/WSS signaling adapter instead. It carries only
+ * setup, offer, answer, candidate, restart, and close — never a peer
+ * connection or DataChannel. Field names mirror the Rust wire types in
+ * `core/adapters-network/src/webrtc_signal/messages.rs` exactly (including
+ * snake_case) since both sides serialize the same JSON envelope.
+ *
+ * `WebRtcHomeNodeClient` (the WebRTC carrier, ticket "N4") depends on this
+ * narrow port rather than on any concrete transport, so the signaling
+ * transport can change without touching WebRTC connection logic.
+ */
+export const WEBRTC_SIGNAL_VERSION = 1;
+/** Maximum serialized size of one signaling WebSocket text frame. */
+export const MAX_WEBRTC_SIGNAL_MESSAGE_BYTES = 32 * 1024;
+/** Maximum SDP body size (offer, answer, or restart). */
+export const MAX_SDP_BYTES = 16 * 1024;
+export const MIN_OFFER_NONCE_BYTES = 16;
+export const MAX_OFFER_NONCE_BYTES = 128;
+/** Maximum DTLS fingerprint size: `<algorithm> <hex-pairs>`. */
+export const MAX_DTLS_FINGERPRINT_BYTES = 200;
+/** Maximum size of one trickle-ICE candidate line. */
+export const MAX_ICE_CANDIDATE_BYTES = 1024;
+export const MAX_SDP_MID_BYTES = 64;
+/** Maximum number of trickle-ICE candidates accepted for one bound offer. */
+export const MAX_ICE_CANDIDATES_PER_OFFER = 32;
+export const MAX_CLOSE_REASON_BYTES = 256;
+//# sourceMappingURL=webrtc-signaling.js.map

package/dist/network/webrtc-signaling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webrtc-signaling.js","sourceRoot":"","sources":["../../src/network/webrtc-signaling.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC,qEAAqE;AACrE,MAAM,CAAC,MAAM,+BAA+B,GAAG,EAAE,GAAG,IAAI,CAAC;AACzD,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AACxC,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AACzC,gEAAgE;AAChE,MAAM,CAAC,MAAM,0BAA0B,GAAG,GAAG,CAAC;AAC9C,sDAAsD;AACtD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AACpC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,CAAC;AAC/C,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC"}

package/dist/network.d.ts

@@ -1,7 +1,40 @@
-export type TransportPath = "iroh-relay" | "lan-direct" | "offline" | "wan-direct";
+import type { HomeNodeCandidate } from "./network/home-node-candidate.js";
+export type TransportPath = "iroh-relay" | "lan-direct" | "lan-webtransport" | "offline" | "wan-direct" | "webrtc-direct";
+export type HttpTransportPath = "lan-direct" | "wan-direct";
+/**
+ * The three tiers `TransportManager` (client/domain) selects and dials
+ * directly, in priority order: browser-trusted LAN HTTPS, then hash-pinned
+ * LAN WebTransport, then WAN HTTPS/WSS (ticket #1823). Distinct from
+ * `HttpTransportPath` because a WebTransport candidate is not an HTTP
+ * candidate — it carries certificate hashes, not a bearer-auth HTTPS origin.
+ */
+export type DirectTransportPath = "lan-direct" | "lan-webtransport" | "wan-direct";
+export interface HttpHomeNodeCandidate extends HomeNodeCandidate {
+    /** Marks the authenticated installation origin used before a home-node trust anchor is known. */
+    readonly identityBinding?: "bootstrap";
+    readonly path: HttpTransportPath;
+}
+/** SHA-256 certificate hashes bound to one hash-pinned WebTransport candidate. */
+export interface WebTransportCertificateHashes {
+    readonly algorithm: "sha-256";
+    readonly current: string;
+    readonly next: string;
+}
+/**
+ * One hash-pinned LAN WebTransport candidate (ticket #1823). `address` is
+ * the bare HTTPS origin (e.g. `https://192.0.2.10:4433`); the client-RPC path
+ * is appended internally when dialing, matching how the Rust WebTransport
+ * adapter is deployed (`core/adapters-network::webtransport`).
+ */
+export interface WebTransportHomeNodeCandidate extends HomeNodeCandidate {
+    readonly certificateHashes: WebTransportCertificateHashes;
+    readonly path: "lan-webtransport";
+}
+/** The union `TransportManager` dials — every candidate on the direct ladder. */
+export type DirectHomeNodeCandidate = HttpHomeNodeCandidate | WebTransportHomeNodeCandidate;
 export type TransportState = {
     readonly changedAt: string;
-    readonly path: "lan-direct" | "wan-direct" | "iroh-relay";
+    readonly path: "lan-direct" | "lan-webtransport" | "wan-direct" | "iroh-relay" | "webrtc-direct";
     readonly status: "connected";
 } | {
     readonly changedAt: string;

package/dist/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../src/network.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,SAAS,GAAG,YAAY,CAAC;AAEnF,MAAM,MAAM,cAAc,GACtB;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACvH;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CAClF"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../src/network.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,YAAY,GAAG,kBAAkB,GAAG,SAAS,GAAG,YAAY,GAAG,eAAe,CAAC;AAE1H,MAAM,MAAM,iBAAiB,GAAG,YAAY,GAAG,YAAY,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,YAAY,GAAG,kBAAkB,GAAG,YAAY,CAAC;AAEnF,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,iGAAiG;IACjG,QAAQ,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC;AAED,kFAAkF;AAClF,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,6BAA8B,SAAQ,iBAAiB;IACtE,QAAQ,CAAC,iBAAiB,EAAE,6BAA6B,CAAC;IAC1D,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;CACnC;AAED,iFAAiF;AACjF,MAAM,MAAM,uBAAuB,GAAG,qBAAqB,GAAG,6BAA6B,CAAC;AAE5F,MAAM,MAAM,cAAc,GACtB;IACE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,GAAG,kBAAkB,GAAG,YAAY,GAAG,YAAY,GAAG,eAAe,CAAC;IACjG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B,GACD;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC;AAEzF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,YAAY,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IACnD,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,kBAAkB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;CAClF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@econ-v1/ports",
-  "version": "6.5.0",
+  "version": "6.6.0",
   "description": "Platform-neutral ports for Node client applications",
   "license": "MIT OR Apache-2.0",
   "author": "Node contributors",