@leofcoin/chain 1.10.15 → 1.10.17

package/exports/browser/chain.js

@@ -1,9 +1,10 @@
-import { F as FormatInterface, p as proto, a as proto$1, b as proto$2, T as TransactionMessage, j as jsonStringifyBigInt, c as jsonParseBigInt, C as ContractMessage, d as Codec } from './browser-crypto-B9N9KlL4.js';
-import { B as BlockMessage, L as LastBlockMessage, P as PROTOCOL_VERSION, R as REACHED_ONE_ZERO_ZERO, C as ConnectionMonitor, a as BWMessage, S as StateMessage } from './connection-monitor-GPztgSSJ.js';
-import { M as MAX_TRANSACTION_BYTES, a as MAX_BLOCK_TRANSACTION_BYTES, b as MAX_BLOCK_TRANSACTIONS, c as MultiWallet, d as createTransactionHash, e as calculateFee, f as createContractMessage, s as signTransaction, r as randombytes, g as distributeTransactionFee, h as supportsTransactionFees, i as supportsMonetaryPolicy, v as validateBlockResourceLimits, j as calculateMonetaryPolicy, k as distributeAmount, l as aggregateValidatorFees, m as MONETARY_POLICY_AUTHORITY, n as contractFactoryMessage, o as nativeTokenMessage, p as validatorsMessage, q as nameServiceMessage, t as parseUnits, u as formatUnits } from './index-Ccn5sExe.js';
+import { F as FormatInterface, p as proto, a as proto$1, b as proto$2, T as TransactionMessage, j as jsonStringifyBigInt, c as jsonParseBigInt, C as ContractMessage, d as Codec } from './browser-crypto-CH0ua22L.js';
+import { B as BlockMessage, L as LastBlockMessage, P as PROTOCOL_VERSION, R as REACHED_ONE_ZERO_ZERO, C as ConnectionMonitor, a as BWMessage, S as StateMessage } from './connection-monitor-D-krNiRH.js';
+import { M as MAX_TRANSACTION_BYTES, a as MAX_BLOCK_TRANSACTION_BYTES, b as MAX_BLOCK_TRANSACTIONS, c as MultiWallet, d as createTransactionHash, e as calculateFee, f as createContractMessage, s as signTransaction, r as randombytes, g as distributeTransactionFee, h as supportsTransactionFees, i as supportsMonetaryPolicy, v as validateBlockResourceLimits, j as calculateMonetaryPolicy, k as distributeAmount, l as aggregateValidatorFees, m as MONETARY_POLICY_AUTHORITY, n as contractFactoryMessage, o as nativeTokenMessage, p as validatorsMessage, q as nameServiceMessage, t as parseUnits, u as formatUnits } from './index-DmuI-29u.js';
 import { f as fromBase58 } from './index-CvKt4UDE.js';
+import { g as getDefaultExportFromCjs } from './_commonjsHelpers-B85MJLTf.js';
 import { q as quorumThreshold } from './quorum-S_qdgiAY.js';
-import './sha2-piimb6xL.js';
+import './sha2-BKcEJzgd.js';
 
 const getTargets = () => Array.from([]);
 const isEnabled = (target) => {
@@ -77,10 +78,10 @@ class ProposalMessage extends FormatInterface {
   }
 }
 
-var contractFactory$1 = "IHNY2GQG2XOULCWHDBW6MDLOPW35MCZC6KT6B6IBHIVWA3QJR56UFM2EVDG";
-var nativeToken$1 = "IHNY2GQG5V74HIRRP6YPMZYDZ7YM3SR3MQX63XSYEZIZ7TWHBPDWRWVA2XA";
-var nameService$1 = "IHNY2GQGQQKXPAEB2OKLN6BQ2JA2DJBV7BF3BHFKPBFJ6DCEJDDKSPKOZE6";
-var validators$1 = "IHNY2GQH432JU2JPBPU5C6QXGLMDFLXBRNL4QA34I5BFJNSO6Y42B3POXJD";
+var contractFactory$1 = "B3OGRUBSBGSASFXWDZUI6AYITY76PYQZS4O5UDWVLSW56X5CSWTQGTGQHUGU";
+var nativeToken$1 = "B3OGRUBSA5V74HIRRP6YPMZYDZ7YM3SR3MQX63XSYEZIZ7TWHBPDWRWVA2XA";
+var nameService$1 = "B3OGRUBSBXX7EPFWHGZQGGSWBMMK7ATOSDICOW5CCFP25OMZBTRMHYGM4KFF";
+var validators$1 = "B3OGRUBSBXLCYRTXG5SRL6XNINEJNAI7CLJBKSRCXY24GMFU5ZY7TXHAGJGT";
 var addresses$1 = {
   contractFactory: contractFactory$1,
   nativeToken: nativeToken$1,
@@ -98,10 +99,6 @@ var addresses = {
   validators
 };
 
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
-
 var re = {exports: {}};
 
 var constants;
@@ -5176,6 +5173,19 @@ const pruneCanonicalTransactions = async (transactions, latestTransactionHashes,
   return pending;
 };
 
+const assertHashFormatState = async (chainStore, stateStore) => {
+  if (await chainStore.has("version")) {
+    const version = new TextDecoder().decode(await chainStore.get("version"));
+    const parsed = /^(\d+)\.(\d+)\.\d+$/.exec(version);
+    const current = PROTOCOL_VERSION.split(".");
+    if (parsed && parsed[1] === current[0] && parsed[2] === current[1]) return;
+    throw new Error(`stored protocol ${version} is incompatible with canonical hash protocol ${PROTOCOL_VERSION}; back up existing data and use a separate migrated data root`);
+  }
+  if (await chainStore.has("lastBlock") || await stateStore?.has("lastBlock")) {
+    throw new Error("existing chainstate has no protocol version; explicit canonical hash migration required");
+  }
+};
+
 const debug = createDebugger("leofcoin/chain");
 class Chain extends VersionControl {
   constructor(config) {
@@ -5223,8 +5233,9 @@ class Chain extends VersionControl {
     this.#committingHeights = /* @__PURE__ */ new Set();
     /** Prevents casting duplicate prevote/precommit per height:round */
     this.#castedVotes = /* @__PURE__ */ new Set();
-    this.ready = new Promise((resolve) => {
+    this.ready = new Promise((resolve, reject) => {
       this.readyResolve = resolve;
+      this.readyReject = reject;
     });
     // ── Tendermint consensus handlers ────────────────────────────────────────
     /**
@@ -5408,7 +5419,7 @@ class Chain extends VersionControl {
       const hash = await this.#sendTransaction(message);
       debug(`added ${hash}`);
     };
-    this.#init();
+    this.#init().catch((error) => this.readyReject(error));
   }
   #state;
   #slotTime;
@@ -5704,15 +5715,18 @@ class Chain extends VersionControl {
         message: nameServiceMessage
       }
     ];
-    await Promise.all(
+    const prepared = await Promise.all(
       contracts.map(async ({ address, message }) => {
         message = await new ContractMessage(Uint8Array.from(message.split(",").map((string) => Number(string))));
-        await globalThis.contractStore.put(address, message.encoded);
+        if (await message.hash() !== address) throw new Error(`genesis contract hash mismatch for ${address}`);
+        return { address, encoded: message.encoded };
       })
     );
+    await Promise.all(prepared.map(({ address, encoded }) => globalThis.contractStore.put(address, encoded)));
     console.log("handle native contracts");
   }
   async #init() {
+    await assertHashFormatState(globalThis.chainStore, globalThis.stateStore);
     this.#participants = [];
     this.#participating = false;
     this.#connectionMonitor = new ConnectionMonitor();

package/exports/browser/{client-DDC8C510-3uaB70KL.js → client-C_pBoi1g-_pfKzCvX.js}

@@ -1,8 +1,8 @@
-import { i as inflate_1, c as createDebugger, d as deflate_1, L as LittlePubSub } from './node-browser-BYi7D_oa.js';
-import './browser-crypto-B9N9KlL4.js';
-import './connection-monitor-GPztgSSJ.js';
+import { i as inflate_1, c as createDebugger, d as deflate_1, L as LittlePubSub } from './node-browser-BNe-en1l.js';
+import './browser-crypto-CH0ua22L.js';
+import './connection-monitor-D-krNiRH.js';
 import './index-CvKt4UDE.js';
-import './sha2-piimb6xL.js';
+import './sha2-BKcEJzgd.js';
 
 class Api {
     _pubsub;
@@ -233,7 +233,7 @@ class SocketRequestClient {
             const init = async () => {
                 // @ts-ignore
                 if (!globalThis.WebSocket && !this.#experimentalWebsocket)
-                    globalThis.WebSocket = (await import('./browser-DvU1xNFS-DmmNUdE-.js').then(function (n) { return n.b; })).default.w3cwebsocket;
+                    globalThis.WebSocket = (await import('./browser-CCfR9KOM-CpStHgTj.js').then(function (n) { return n.b; })).default.w3cwebsocket;
                 const client = new WebSocket(this.#url, this.#protocol);
                 if (this.#experimentalWebsocket) {
                     client.addEventListener('error', this.onerror);
@@ -820,8 +820,61 @@ class WebRTCPeer {
     }
 }
 
-const getWebTransportCtor = () => {
+// WebTransport streams carry bytes, not application message boundaries.
+const MAX_FRAME_BYTES = 64 * 1024;
+const encodeFrame = (payload) => {
+    if (!(payload instanceof Uint8Array) || !payload.length || payload.length > MAX_FRAME_BYTES) {
+        throw new Error('invalid transport frame length');
+    }
+    const frame = new Uint8Array(payload.length + 4);
+    new DataView(frame.buffer).setUint32(0, payload.length);
+    frame.set(payload, 4);
+    return frame;
+};
+class FrameReader {
+    constructor(reader) { this.reader = reader; this.chunk = new Uint8Array(); this.offset = 0; }
+    async exact(length, allowEnd = false) {
+        const result = new Uint8Array(length);
+        let written = 0;
+        while (written < length) {
+            if (this.offset === this.chunk.length) {
+                const { done, value } = await this.reader.read();
+                if (done) {
+                    if (allowEnd && written === 0)
+                        return null;
+                    throw new Error('truncated transport frame');
+                }
+                this.chunk = value;
+                this.offset = 0;
+                if (!value?.length)
+                    continue;
+            }
+            const count = Math.min(length - written, this.chunk.length - this.offset);
+            result.set(this.chunk.subarray(this.offset, this.offset + count), written);
+            this.offset += count;
+            written += count;
+        }
+        return result;
+    }
+    async read() {
+        const header = await this.exact(4, true);
+        if (!header)
+            return null;
+        const length = new DataView(header.buffer).getUint32(0);
+        if (!length || length > MAX_FRAME_BYTES)
+            throw new Error('invalid transport frame length');
+        return this.exact(length);
+    }
+}
+const jsonBytes = (value) => new TextEncoder().encode(JSON.stringify(value));
+const parseJson = (bytes) => JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
+
+const getWebTransportCtor = async () => {
     const candidate = globalThis;
+    if (!candidate.WebTransport && candidate.process?.versions?.node) {
+        const { WebTransport } = await import('./index.browser-CFfJpgKV.js');
+        return WebTransport;
+    }
     if (!candidate.WebTransport) {
         throw new Error('WebTransport is not available in this runtime');
     }
@@ -855,7 +908,12 @@ class WebTransportPeer {
             kind: 'webtransport-bidi',
             isConnected: () => this.connected,
             sendRaw: (payload) => {
-                void this.#sendRaw(payload);
+                void this.#sendRaw(payload).catch(error => {
+                    if (!this.#destroyed) {
+                        this.#emit('error', error);
+                        this.destroy();
+                    }
+                });
             }
         }, {
             maxMessageSize: MAX_MESSAGE_SIZE,
@@ -866,7 +924,7 @@ class WebTransportPeer {
             }
         });
         queueMicrotask(() => {
-            void this.#open(options.url);
+            void this.#open(options);
         });
     }
     #createMessageId() {
@@ -893,41 +951,55 @@ class WebTransportPeer {
         for (const handler of listeners)
             handler(...args);
     }
-    async #open(url) {
+    async #open(options) {
         try {
-            const WebTransportCtor = getWebTransportCtor();
-            const session = new WebTransportCtor(url);
+            const ticket = await options.getTicket();
+            if (this.#destroyed)
+                return;
+            const WebTransportCtor = await getWebTransportCtor();
+            const session = new WebTransportCtor(options.url);
             this.#session = session;
+            void session.closed.then(() => this.destroy(), error => {
+                if (!this.#destroyed) {
+                    this.#emit('error', error);
+                    this.destroy();
+                }
+            });
             await session.ready;
+            if (this.#destroyed)
+                return;
             const stream = (await session.createBidirectionalStream());
+            if (this.#destroyed)
+                return;
             this.#reader = stream.readable.getReader();
             this.#writer = stream.writable.getWriter();
+            const frames = new FrameReader(this.#reader);
+            await this.#writer.write(encodeFrame(jsonBytes({ protocol: 'swarm-relay/1', ticket })));
+            const ready = parseJson(await frames.read());
+            if (ready.protocol !== 'swarm-relay/1' || ready.peerId !== this.peerId || String(ready.version) !== this.version) {
+                throw new Error('invalid WebTransport relay handshake');
+            }
+            if (this.#destroyed)
+                return;
             this.#connected = true;
             this.#emit('connect');
-            void this.#readLoop();
-            void session.closed.catch((error) => {
-                if (this.#destroyed)
-                    return;
-                this.#emit('error', error instanceof Error ? error : new Error(String(error)));
-            });
+            void this.#readLoop(frames);
         }
         catch (error) {
             this.#emit('error', error instanceof Error ? error : new Error(String(error)));
             this.destroy();
         }
     }
-    async #readLoop() {
+    async #readLoop(frames) {
         const reader = this.#reader;
         if (!reader)
             return;
         try {
             while (!this.#destroyed) {
                 // eslint-disable-next-line no-await-in-loop
-                const { done, value } = await reader.read();
-                if (done)
-                    break;
+                const value = await frames.read();
                 if (!value)
-                    continue;
+                    break;
                 this.bw.down += value.length;
                 this.#emit('data', value);
             }
@@ -943,7 +1015,7 @@ class WebTransportPeer {
     async #sendRaw(payload) {
         if (!this.#writer)
             throw new Error('WebTransport writer is not ready');
-        await this.#writer.write(payload);
+        await this.#writer.write(encodeFrame(payload));
     }
     on(event, handler) {
         const listeners = this.#listeners.get(event) ?? new Set();
@@ -973,13 +1045,13 @@ class WebTransportPeer {
         this.#destroyed = true;
         this.#connected = false;
         try {
-            void this.#reader?.cancel?.();
+            void this.#reader?.cancel?.().catch(() => { });
         }
         catch (e) { }
         this.#reader?.releaseLock?.();
         this.#reader = null;
         try {
-            void this.#writer?.close?.();
+            void this.#writer?.close?.().catch(() => { });
         }
         catch (e) { }
         this.#writer?.releaseLock?.();
@@ -1007,6 +1079,7 @@ class CircuitPeer {
     #destroyed = false;
     #connected = false;
     #sendViaCircuit;
+    #core;
     initiator = true;
     peerId;
     channelName;
@@ -1020,12 +1093,40 @@ class CircuitPeer {
         this.channelName = `circuit:${options.from}:${options.to}`;
         this.version = String(options.version);
         this.#sendViaCircuit = options.sendViaCircuit;
-        setTimeout(() => {
-            if (this.#destroyed)
-                return;
-            this.#connected = true;
-            this.#emit('connect');
-        }, 0);
+        this.#core = new PeerCore({
+            kind: 'circuit',
+            isConnected: () => this.connected,
+            sendRaw: data => {
+                void this.#sendViaCircuit({ id: this.#createMessageId(), data: Array.from(data) }).catch(error => {
+                    if (this.#destroyed)
+                        return;
+                    this.#emit('error', error);
+                    this.destroy();
+                });
+            }
+        }, {
+            // JSON byte arrays expand up to four characters per byte. Keep the whole
+            // WebSocket frame below its default 64 KiB limit, including wrapper/ID.
+            maxMessageSize: 14_000,
+            compressionThreshold: 0.98,
+            getPubSub,
+            onPayloadSend: bytes => { this.bw.up += bytes; }
+        });
+        queueMicrotask(async () => {
+            try {
+                await options.handshake();
+                if (this.#destroyed)
+                    return;
+                this.#connected = true;
+                this.#emit('connect');
+            }
+            catch (error) {
+                if (this.#destroyed)
+                    return;
+                this.#emit('error', error);
+                this.destroy();
+            }
+        });
     }
     #createMessageId() {
         const randomUUID = globalThis.crypto?.randomUUID;
@@ -1055,43 +1156,21 @@ class CircuitPeer {
         // Circuit transport does not use SDP/ICE signaling.
     }
     send(data, id = this.#createMessageId()) {
+        if (new TextEncoder().encode(id).length > 1024) {
+            this.#emit('error', new Error('circuit message id exceeds 1024 bytes'));
+            return;
+        }
         if (this.#destroyed) {
             this.#emit('error', new Error('circuit peer is destroyed'));
             return;
         }
-        this.bw.up += data.length;
-        void this.#sendViaCircuit({ id, data: Array.from(data) }).catch((error) => {
-            this.#emit('error', error instanceof Error ? error : new Error(String(error)));
-        });
+        this.#core.send(data, id);
     }
     request(data, id = this.#createMessageId()) {
-        const pubsub = getPubSub();
-        if (!pubsub) {
-            return Promise.reject(new Error('globalThis.pubsub is not available'));
+        if (new TextEncoder().encode(id).length > 1024) {
+            return Promise.reject(new Error('circuit message id exceeds 1024 bytes'));
         }
-        return new Promise((resolve, reject) => {
-            let timeout;
-            let settled = false;
-            const finish = (fn) => {
-                if (settled)
-                    return;
-                settled = true;
-                clearTimeout(timeout);
-                try {
-                    pubsub.unsubscribe(id, onResponse);
-                }
-                catch (e) { }
-                fn();
-            };
-            const onResponse = ({ data: response }) => {
-                finish(() => resolve(response));
-            };
-            timeout = setTimeout(() => {
-                finish(() => reject(new Error(`request for ${id} timed out`)));
-            }, 30_000);
-            pubsub.subscribe(id, onResponse);
-            this.send(data, id);
-        });
+        return this.#core.request(data, id);
     }
     async getNetworkStats() {
         return null;
@@ -1164,6 +1243,8 @@ class Client {
     #fallbackCircuitMethod = 'swarm:fallback:send';
     #testHooks;
     #webTransportUrlTemplate;
+    #discoverWebTransport = true;
+    #relayUrls = new WeakMap();
     #circuitHandlers = new Map();
     #pendingCircuitRequests = new Map();
     #circuitRequestTimeoutMs = 30_000;
@@ -1202,7 +1283,9 @@ class Client {
             ? options.transport.kinds
             : options.transport?.kind
                 ? [options.transport.kind]
-                : ['webrtc', 'webtransport'];
+                : (options.transport?.webtransport?.urlTemplate
+                    ? ['webrtc', 'webtransport']
+                    : ['webrtc']);
         this.#supportedTransports = new Set(this.#normalizeTransportKinds(configuredKinds));
         if (!this.#supportedTransports.size)
             this.#supportedTransports.add('webrtc');
@@ -1213,6 +1296,11 @@ class Client {
                 ? 'webrtc'
                 : 'webtransport';
         this.#webTransportUrlTemplate = options.transport?.webtransport?.urlTemplate;
+        this.#discoverWebTransport = !options.transport?.kind && !options.transport?.kinds ||
+            !!options.transport?.kinds?.includes('webtransport') || options.transport?.kind === 'webtransport';
+        if (this.#discoverWebTransport && (typeof globalThis.WebTransport === 'function' || globalThis.process?.versions?.node)) {
+            this.#supportedTransports.add('webtransport');
+        }
         const wrtcBackend = options.transport?.webrtc?.backend ||
             globalThis.process?.env?.NETPEER_SWARM_WRTC_BACKEND ||
             'vandeurenglenn';
@@ -1230,6 +1318,9 @@ class Client {
         if (options?.retry)
             this.#retryOptions = { ...this.#retryOptions, ...options.retry };
         this.#circuitHandlers.set(this.#fallbackCircuitMethod, (payload, context) => this.#handleFallbackCircuitPayload(payload, context));
+        this.#circuitHandlers.set('swarm:fallback:hello', () => ({
+            peerId: this.peerId, version: this.version, encoding: 'peer-core/1'
+        }));
         if (!this.#testHooks?.skipInit) {
             this._init();
         }
@@ -1368,6 +1459,30 @@ class Client {
         const onServerData = (message) => {
             globalThis.pubsub.publish('server:data', message);
         };
+        const onRelayReady = (message) => {
+            if (!this.#discoverWebTransport || message?.protocol !== 'swarm-relay/1' || typeof message.url !== 'string')
+                return;
+            let url;
+            try {
+                url = new URL(message.url);
+            }
+            catch {
+                return;
+            }
+            if (url.protocol !== 'https:' || url.username || url.password || url.hash)
+                return;
+            if (this.#relayUrls.get(starConnection) === url.href)
+                return;
+            this.#relayUrls.set(starConnection, url.href);
+            this.#supportedTransports.add('webtransport');
+            // Update capabilities on this same authenticated star connection. The
+            // server sends relay metadata before its peer snapshot, so fallback can
+            // resolve a real endpoint without users configuring transport URLs.
+            starConnection.send({ url: 'join', params: {
+                    version: this.version, peerId: this.peerId,
+                    transport: { kind: this.#preferredTransportKind, kinds: [...this.#supportedTransports] }
+                } });
+        };
         starConnection.pubsub.subscribe('peer:joined', onPeerJoined);
         starConnection.pubsub.subscribe('peer:left', onPeerLeft);
         starConnection.pubsub.subscribe('star:joined', onStarJoined);
@@ -1375,6 +1490,7 @@ class Client {
         starConnection.pubsub.subscribe('signal', onSignal);
         starConnection.pubsub.subscribe('circuit', onCircuit);
         starConnection.pubsub.subscribe('server:data', onServerData);
+        starConnection.pubsub.subscribe('relay:ready', onRelayReady);
         this.#starListeners[starId] = [
             { topic: 'peer:joined', handler: onPeerJoined },
             { topic: 'peer:left', handler: onPeerLeft },
@@ -1382,7 +1498,8 @@ class Client {
             { topic: 'star:left', handler: onStarLeft },
             { topic: 'signal', handler: onSignal },
             { topic: 'circuit', handler: onCircuit },
-            { topic: 'server:data', handler: onServerData }
+            { topic: 'server:data', handler: onServerData },
+            { topic: 'relay:ready', handler: onRelayReady }
         ];
     }
     #starJoined = (id) => {
@@ -1588,12 +1705,12 @@ class Client {
             peer = this.#createRTCPeerConnection(peerId, attempt.star, attempt.version, attempt.initiator);
         }
         else if (transportKind === 'webtransport') {
-            const url = this.#resolveWebTransportUrl(peerId);
+            const url = this.#resolveWebTransportUrl(peerId, attempt.star);
             if (!url) {
                 this.#advanceTransportAttempt(peerId);
                 return;
             }
-            peer = this.#createWebTransportConnection(peerId, url, attempt.version);
+            peer = this.#createWebTransportConnection(peerId, url, attempt.version, attempt.star);
         }
         else {
             peer = this.#createCircuitConnection(peerId, attempt.version);
@@ -1640,7 +1757,25 @@ class Client {
         if (!peer) {
             peer = this.#createCircuitConnection(context.from, this.version);
         }
-        this.#noticeMessage(decoded.data, decoded.id, context.from, peer);
+        if (!peer)
+            throw new Error('circuit peer unavailable');
+        if (!peer.connected) {
+            const waitingPeer = peer;
+            await new Promise((resolve, reject) => {
+                const finish = (error) => {
+                    clearTimeout(timer);
+                    waitingPeer.off('connect', onConnect);
+                    waitingPeer.off('close', onClose);
+                    error ? reject(error) : resolve();
+                };
+                const onConnect = () => finish();
+                const onClose = () => finish(new Error('circuit peer closed during handshake'));
+                const timer = setTimeout(() => finish(new Error('circuit handshake timed out')), this.#transportConnectTimeoutMs);
+                waitingPeer.on('connect', onConnect);
+                waitingPeer.on('close', onClose);
+            });
+        }
+        this.#peerData(peer, decoded.data);
         return { ok: true };
     }
     #createCircuitId() {
@@ -1698,15 +1833,22 @@ class Client {
                 this.#pendingCircuitRequests.delete(id);
                 reject(new Error(`circuit request for ${id} timed out`));
             }, timeoutMs);
-            this.#pendingCircuitRequests.set(id, { resolve, reject, timeout });
-            this.#sendCircuit(starConnection, {
-                to: peerId,
-                from: this.peerId,
-                id,
-                phase: 'request',
-                method,
-                data: this.#encodeCircuitData(data)
-            });
+            this.#pendingCircuitRequests.set(id, { resolve, reject, timeout, peerId, starConnection });
+            try {
+                this.#sendCircuit(starConnection, {
+                    to: peerId,
+                    from: this.peerId,
+                    id,
+                    phase: 'request',
+                    method,
+                    data: this.#encodeCircuitData(data)
+                });
+            }
+            catch (error) {
+                clearTimeout(timeout);
+                this.#pendingCircuitRequests.delete(id);
+                reject(error);
+            }
         });
     }
     #inComingCircuit = async ({ from, to, id, phase, method, data, error }, starConnection) => {
@@ -1716,6 +1858,10 @@ class Client {
             const pending = this.#pendingCircuitRequests.get(id);
             if (!pending)
                 return;
+            if (pending.starConnection !== starConnection)
+                return;
+            if (from !== pending.peerId && !(from === 'server' && error))
+                return;
             clearTimeout(pending.timeout);
             this.#pendingCircuitRequests.delete(id);
             if (error) {
@@ -1789,17 +1935,16 @@ class Client {
     connectWebTransport(peerId, url) {
         this.#createWebTransportConnection(peerId, url, this.version);
     }
-    #resolveWebTransportUrl(peerId) {
-        const urlTemplate = this.#webTransportUrlTemplate;
+    #resolveWebTransportUrl(peerId, starConnection) {
+        const urlTemplate = this.#webTransportUrlTemplate || (starConnection && this.#relayUrls.get(starConnection));
         if (!urlTemplate) {
-            console.warn('WebTransport requires transport.webtransport.urlTemplate in client options');
             return null;
         }
         return urlTemplate
             .replace('{peerId}', encodeURIComponent(peerId))
             .replace('{selfId}', encodeURIComponent(this.peerId));
     }
-    #createWebTransportConnection(peerId, url, version) {
+    #createWebTransportConnection(peerId, url, version, starConnection) {
         if (this.#connections[peerId]) {
             debug(`peer ${peerId} already connected`);
             return null;
@@ -1824,7 +1969,27 @@ class Client {
             from: this.peerId,
             to: peerId,
             version,
-            url
+            url,
+            getTicket: async () => {
+                const star = starConnection || this.#pickStarConnection();
+                if (!star)
+                    throw new Error('no connected star available for WebTransport ticket');
+                let timer;
+                try {
+                    const response = await Promise.race([
+                        star.request({ url: 'webtransport-ticket', params: { from: this.peerId, to: peerId } }),
+                        new Promise((_, reject) => {
+                            timer = setTimeout(() => reject(new Error('WebTransport ticket request timed out')), this.#transportConnectTimeoutMs);
+                        })
+                    ]);
+                    if (typeof response?.ticket !== 'string')
+                        throw new Error('star did not authorize WebTransport relay');
+                    return response.ticket;
+                }
+                finally {
+                    clearTimeout(timer);
+                }
+            }
         });
         peer.on('connect', () => this.#peerConnect(peer));
         peer.on('close', () => this.#peerClose(peer));
@@ -1858,6 +2023,12 @@ class Client {
             from: this.peerId,
             to: peerId,
             version,
+            handshake: async () => {
+                const response = await this.circuitRequest(peerId, 'swarm:fallback:hello', undefined, this.#transportConnectTimeoutMs);
+                if (response?.peerId !== peerId || String(response?.version) !== String(version) || response.encoding !== 'peer-core/1') {
+                    throw new Error('invalid circuit handshake response');
+                }
+            },
             sendViaCircuit: (payload) => this.circuitRequest(peerId, this.#fallbackCircuitMethod, payload)
         });
         peer.on('connect', () => this.#peerConnect(peer));
@@ -2174,6 +2345,11 @@ class Client {
         peer.destroy();
     };
     async close() {
+        for (const pending of this.#pendingCircuitRequests.values()) {
+            clearTimeout(pending.timeout);
+            pending.reject(new Error('client closed'));
+        }
+        this.#pendingCircuitRequests.clear();
         for (const peerId of this.#peerTransportAttempts.keys()) {
             this.#clearTransportAttempt(peerId);
         }