agent-comms 3.9.0 → 3.11.0

package/dist/core/capability-ask.js

@@ -0,0 +1,92 @@
+/**
+ * CapabilityAskAdmission — the ask tier surfaced at the tool layer (agent-comms#165): the generic, capability-agnostic counterpart to RoomProtocol's own pendingRoomJoins and ConnectionApproval's own pendingInboundConnections, built directly on wire-mesh-core's createCapabilityRequestHandler (the ask primitive agent-comms#164's own bubble-up module already builds on top of, wire-mesh#78). Three tiers exist at the tool layer for whether an action gets a capability token: allow (a held token already answers canGrant), deny (canGrant says no and resolveBubbleUpRoute finds no route to bubble the ask up to either), and ask -- a capability-request held open pending a human decision, which is what this module gives a name and a surface to. A capability-gated verb that lands in that third tier registers a handler built by createAskHandler below instead of failing outright: the request is held open exactly as core/room's own room.join admission holds one open, surfaced to the owning agent as a capability_request delivery event a human can act on (the approval prompt), and the outcome (acceptCapabilityRequest/rejectCapabilityRequest) resolves the held request in place, minting the granted token on acceptance -- the same accept/reject/list shape room_accept/room_reject/room_pending and mesh_accept/mesh_reject/mesh_pending already establish in tool.ts, generalised the way the issue's own framing asks for ("mirror its shape for capability requests generally"). With only one user-principal identity per machine today (agent-comms#160/#161), "the right device or principal" the issue's own framing anticipates routing an ask to is currently always this device -- the same simplification core/room's own single-decision-maker admission already makes; createAskHandler is the integration point a future capability-gated verb (e.g. agent-comms#162's dm:send) registers against its own session to get a ready `(incoming) => Promise<void>` handler backed by this admission's live pending state.
+ */
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { createCapabilityRequestHandler } from "wire-mesh-core/domain/capability-request";
+import { nanoid } from "./nanoid.js";
+import { CommsError } from "./store.js";
+export class CapabilityAskAdmission {
+    deps;
+    pending = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Builds a manage-request handler for one capability's incoming capability-requests that never decides on its own: every not-malformed, not-yet-expired ask is held open and surfaced as a capability_request delivery event, exactly like handleConnectionRequest already does for an inbound mesh connection. */
+    createAskHandler(options) {
+        return createCapabilityRequestHandler({
+            capability: options.capability,
+            identity: options.identity,
+            clock: options.clock,
+            bearerDevice: options.bearerDevice,
+            timeoutMs: options.timeoutMs,
+            onRequest: (event) => {
+                this.handleCapabilityRequest(options.capability, event);
+            },
+        });
+    }
+    handleCapabilityRequest(capability, event) {
+        const requestId = nanoid();
+        this.pending.set(requestId, {
+            capability,
+            scope: event.scope,
+            requesterDevice: event.requesterDevice,
+            decide: event.decide,
+        });
+        const deliveryEvent = {
+            type: "capability_request",
+            requestId,
+            capability,
+            scopeKind: event.scope.kind,
+            ...(event.scope.path !== undefined
+                ? { scopePath: event.scope.path }
+                : {}),
+            requesterDevice: deviceIdToHex(event.requesterDevice),
+        };
+        const peerId = this.deps.getPeerId();
+        this.deps.queueDelivery(peerId, deliveryEvent);
+        const onDelivery = this.deps.getOnDelivery();
+        if (onDelivery) {
+            void onDelivery(peerId, deliveryEvent);
+        }
+    }
+    /** Every capability-request currently held open awaiting a human decision. */
+    listPendingCapabilityRequests() {
+        return [...this.pending.entries()].map(([requestId, ask]) => ({
+            requestId,
+            capability: ask.capability,
+            scopeKind: ask.scope.kind,
+            ...(ask.scope.path !== undefined ? { scopePath: ask.scope.path } : {}),
+            requesterDevice: deviceIdToHex(ask.requesterDevice),
+        }));
+    }
+    /** Approves a pending capability-request, resolving its held decide() with an accept -- wire-mesh-core's own createCapabilityRequestHandler mints the granted token and responds on this admission's behalf. `capability`, when given, grants something narrower than what was originally asked for (the primitive's own CapabilityGrantDecision allows this); absent, the request's own originally-asked-for capability is granted unchanged. */
+    async acceptCapabilityRequest(requestId, options) {
+        const pending = this.requirePending(requestId);
+        this.pending.delete(requestId);
+        await pending.decide({
+            kind: "accept",
+            capability: options.capability ?? pending.capability,
+            expires: options.expires,
+            ...(options.delegationsRemaining !== undefined
+                ? { delegationsRemaining: options.delegationsRemaining }
+                : {}),
+        });
+    }
+    /** Denies a pending capability-request, optionally with a reason surfaced to the requester in the resulting manage-error's own message field. */
+    async rejectCapabilityRequest(requestId, reason) {
+        const pending = this.requirePending(requestId);
+        this.pending.delete(requestId);
+        await pending.decide({
+            kind: "reject",
+            ...(reason !== undefined ? { reason } : {}),
+        });
+    }
+    requirePending(requestId) {
+        const pending = this.pending.get(requestId);
+        if (pending === undefined) {
+            throw new CommsError(`No pending capability request ${requestId}`, "NOT_PENDING");
+        }
+        return pending;
+    }
+}
+//# sourceMappingURL=capability-ask.js.map

package/dist/core/capability-ask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-ask.js","sourceRoot":"","sources":["../../src/core/capability-ask.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,8BAA8B,EAAE,MAAM,0CAA0C,CAAC;AAY1F,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AA+BxC,MAAM,OAAO,sBAAsB;IAGJ;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEnE,YAA6B,IAA0C;QAA1C,SAAI,GAAJ,IAAI,CAAsC;IAAG,CAAC;IAE3E,oTAAoT;IACpT,gBAAgB,CACd,OAAoD;QAEpD,OAAO,8BAA8B,CAAC;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,YAAY,EAAE,OAAO,CAAC,YAAY;YAClC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,CAAC,KAA4C,EAAE,EAAE;gBAC1D,IAAI,CAAC,uBAAuB,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAC1D,CAAC;SACF,CAAC,CAAC;IACL,CAAC;IAEO,uBAAuB,CAC7B,UAAkB,EAClB,KAA4C;QAE5C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE;YAC1B,UAAU;YACV,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,MAAM,aAAa,GAAkB;YACnC,IAAI,EAAE,oBAAoB;YAC1B,SAAS;YACT,UAAU;YACV,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI;YAC3B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;gBAChC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE;gBACjC,CAAC,CAAC,EAAE,CAAC;YACP,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC,eAAe,CAAC;SACtD,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;QAC7C,IAAI,UAAU,EAAE,CAAC;YACf,KAAK,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,6BAA6B;QAO3B,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,SAAS;YACT,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;YACzB,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,eAAe,EAAE,aAAa,CAAC,GAAG,CAAC,eAAe,CAAC;SACpD,CAAC,CAAC,CAAC;IACN,CAAC;IAED,kbAAkb;IAClb,KAAK,CAAC,uBAAuB,CAC3B,SAAiB,EACjB,OAIE;QAEF,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU;YACpD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;gBAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;gBACxD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,iJAAiJ;IACjJ,KAAK,CAAC,uBAAuB,CAC3B,SAAiB,EACjB,MAAe;QAEf,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,MAAM,OAAO,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,QAAQ;YACd,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,SAAiB;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,UAAU,CAClB,iCAAiC,SAAS,EAAE,EAC5C,aAAa,CACd,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;CACF"}

package/dist/core/dm-token-verification.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Receiver-side verification of a `dm:send` capability token (agent-comms#162): the receiver-controlled admission list a user principal issues, parallel to room-token-verification.ts's own `room:member` obligations but rooted at the user principal's device-id (user-identity.ts) rather than a room's own owner -- a `dm:send` grant admits a bearer device into THIS user's communication scope across every bridge slot sharing that principal, not into one specific room path. Layered on verifyCapabilityToken the same way verifyRoomToken is: obligations 2/4/5 (bearer match, ordinary token-claims checks, delegations-remaining narrowing) live there already; this module adds the dm:send-specific obligations -- the presented token must actually carry the dm:send capability (not merely happen to share a scope shape), its scope must name this exact user principal, and its delegation chain must root at that same user principal (never at the bearer itself, or self-issued authority would let any sender simply mint its own admission).
+ */
+import { type TokenVerdictReason, type VerifyCapabilityTokenOptions } from "wire-mesh-core/domain/tokens";
+import type { CapabilityToken, DeviceId, TokenClaims } from "wire-mesh-core/generated/protocol";
+/** The one capability a user principal issues to admit a device into its own DM-communication scope (agent-comms#162) -- checked receiver-side wherever an unsolicited DM contact is admitted, the way room-token-verification.ts's ROOM_MEMBER_CAPABILITY gates every ordinary room-membership verb. */
+export declare const DM_SEND_CAPABILITY = "dm:send";
+/** The scope kind a dm:send grant's own scope always carries -- the resource being granted is "communication with this user principal", named by that principal's own device-id, never a specific bridge slot's peer-id, since a dm:send grant admits a bearer into the user's whole communication scope rather than one particular device. */
+export declare const DM_SEND_SCOPE_KIND = "user";
+export type DmSendTokenVerdictReason = TokenVerdictReason | "wrong_capability" | "wrong_scope_kind" | "wrong_scope_path" | "wrong_chain_root";
+export type DmSendTokenVerdict = {
+    ok: true;
+    claims: TokenClaims;
+} | {
+    ok: false;
+    reason: DmSendTokenVerdictReason;
+};
+export interface VerifyDmSendTokenOptions extends Omit<VerifyCapabilityTokenOptions, "expectedBearer"> {
+    /** The peer identity actually authenticated on the arriving connection -- the requester presenting this token as its own authority to contact userPrincipalDeviceId, never a relay-asserted or gossip-derived value. Mandatory here, matching verifyRoomToken's own mandatory expectedBearer: every dm:send check gates a specific counterparty, unlike verifyCapabilityToken's own optional field for a caller presenting a token to authorise itself. */
+    expectedBearer: DeviceId;
+    /** This receiving node's own user-principal device-id (user-identity.ts's loadOrCreateUserIdentity), the only issuer a dm:send grant may validly root at. */
+    userPrincipalDeviceId: DeviceId;
+}
+/**
+ * Verifies a `dm:send` capability token against the receiver's own user-principal identity: the token must carry the dm:send capability, its scope must be kind "user" with path equal to userPrincipalDeviceId exactly, and its delegation chain must root at userPrincipalDeviceId itself -- a self-issued or third-party-issued token naming the right scope by coincidence still fails here, since rootIssuer is checked independently of scope.path.
+ */
+export declare function verifyDmSendToken(token: CapabilityToken, options: Readonly<VerifyDmSendTokenOptions>): Promise<DmSendTokenVerdict>;
+//# sourceMappingURL=dm-token-verification.d.ts.map

package/dist/core/dm-token-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-token-verification.d.ts","sourceRoot":"","sources":["../../src/core/dm-token-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EAClC,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EACV,eAAe,EACf,QAAQ,EACR,WAAW,EACZ,MAAM,mCAAmC,CAAC;AAE3C,ySAAyS;AACzS,eAAO,MAAM,kBAAkB,YAAY,CAAC;AAE5C,+UAA+U;AAC/U,eAAO,MAAM,kBAAkB,SAAS,CAAC;AAEzC,MAAM,MAAM,wBAAwB,GAChC,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,GAClB,kBAAkB,CAAC;AAEvB,MAAM,MAAM,kBAAkB,GAC1B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAEpD,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CACpD,4BAA4B,EAC5B,gBAAgB,CACjB;IACC,2bAA2b;IAC3b,cAAc,EAAE,QAAQ,CAAC;IACzB,6JAA6J;IAC7J,qBAAqB,EAAE,QAAQ,CAAC;CACjC;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,eAAe,EACtB,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GAC1C,OAAO,CAAC,kBAAkB,CAAC,CA0B7B"}

package/dist/core/dm-token-verification.js

@@ -0,0 +1,38 @@
+/**
+ * Receiver-side verification of a `dm:send` capability token (agent-comms#162): the receiver-controlled admission list a user principal issues, parallel to room-token-verification.ts's own `room:member` obligations but rooted at the user principal's device-id (user-identity.ts) rather than a room's own owner -- a `dm:send` grant admits a bearer device into THIS user's communication scope across every bridge slot sharing that principal, not into one specific room path. Layered on verifyCapabilityToken the same way verifyRoomToken is: obligations 2/4/5 (bearer match, ordinary token-claims checks, delegations-remaining narrowing) live there already; this module adds the dm:send-specific obligations -- the presented token must actually carry the dm:send capability (not merely happen to share a scope shape), its scope must name this exact user principal, and its delegation chain must root at that same user principal (never at the bearer itself, or self-issued authority would let any sender simply mint its own admission).
+ */
+import { verifyCapabilityToken, } from "wire-mesh-core/domain/tokens";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+/** The one capability a user principal issues to admit a device into its own DM-communication scope (agent-comms#162) -- checked receiver-side wherever an unsolicited DM contact is admitted, the way room-token-verification.ts's ROOM_MEMBER_CAPABILITY gates every ordinary room-membership verb. */
+export const DM_SEND_CAPABILITY = "dm:send";
+/** The scope kind a dm:send grant's own scope always carries -- the resource being granted is "communication with this user principal", named by that principal's own device-id, never a specific bridge slot's peer-id, since a dm:send grant admits a bearer into the user's whole communication scope rather than one particular device. */
+export const DM_SEND_SCOPE_KIND = "user";
+/**
+ * Verifies a `dm:send` capability token against the receiver's own user-principal identity: the token must carry the dm:send capability, its scope must be kind "user" with path equal to userPrincipalDeviceId exactly, and its delegation chain must root at userPrincipalDeviceId itself -- a self-issued or third-party-issued token naming the right scope by coincidence still fails here, since rootIssuer is checked independently of scope.path.
+ */
+export async function verifyDmSendToken(token, options) {
+    const verdict = await verifyCapabilityToken(token, {
+        identity: options.identity,
+        clock: options.clock,
+        revocation: options.revocation,
+        expectedBearer: options.expectedBearer,
+    });
+    if (!verdict.ok) {
+        return verdict;
+    }
+    if (verdict.claims.capability !== DM_SEND_CAPABILITY) {
+        return { ok: false, reason: "wrong_capability" };
+    }
+    if (verdict.claims.scope.kind !== DM_SEND_SCOPE_KIND) {
+        return { ok: false, reason: "wrong_scope_kind" };
+    }
+    const expectedPath = deviceIdToHex(options.userPrincipalDeviceId);
+    if (verdict.claims.scope.path !== expectedPath) {
+        return { ok: false, reason: "wrong_scope_path" };
+    }
+    if (deviceIdToHex(verdict.rootIssuer) !== expectedPath) {
+        return { ok: false, reason: "wrong_chain_root" };
+    }
+    return { ok: true, claims: verdict.claims };
+}
+//# sourceMappingURL=dm-token-verification.js.map

package/dist/core/dm-token-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-token-verification.js","sourceRoot":"","sources":["../../src/core/dm-token-verification.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,qBAAqB,GAGtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAOhE,ySAAyS;AACzS,MAAM,CAAC,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAE5C,+UAA+U;AAC/U,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAuBzC;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAsB,EACtB,OAA2C;IAE3C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,KAAK,EAAE;QACjD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,kBAAkB,EAAE,CAAC;QACrD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,YAAY,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC"}

package/dist/core/gossip-directory.d.ts

@@ -1,8 +1,11 @@
 /**
- * mergeKnownDevices — the mesh-wide gossip-directory aggregation WireMeshTransport's own listKnownDevices reads from. Split out purely to keep wire-mesh-transport.ts under the repo's max-lines cap, the same reason connection-approval.ts, room-router.ts, hub-session.ts, and peer-lifecycle.ts were each split from their own owning file.
+ * gossip-directory — the mesh-wide gossip-directory aggregation WireMeshTransport's own listKnownDevices reads from, plus per-event directory lookups (a specific peer's presence advert). Split out purely to keep wire-mesh-transport.ts under the repo's max-lines cap, the same reason connection-approval.ts, room-router.ts, hub-session.ts, and peer-lifecycle.ts were each split from their own owning file.
  */
 import type { DirectoryEntry } from "wire-mesh-core/domain/mesh-session";
 import type { PeerAdvert } from "wire-mesh-core/generated/protocol";
+import { AgentStatus } from "./types.js";
 /** Merges one session event's own directory into the mesh-wide knownDevices view (mutated in place), keeping the newer advert (by snapshot-seconds) whenever a device-id is already known from an earlier event or a different session. */
 export declare function mergeKnownDevices(knownDevices: Map<string, PeerAdvert>, directory: readonly DirectoryEntry[]): void;
+/** Reads a presence extension from one specific device's own gossiped self-advert, if this event's directory carries a fresh one for exactly that device-id -- never for any other device-id a multi-hop directory might mention, since only the session's own authenticated peer's advert is that session's business to report. Returns undefined for a missing presence/status key, or a value that isn't a recognised AgentStatus -- an advert simply not participating in this convention, not an error (the same verifier obligation peer-advert's own open extension tail is documented under). */
+export declare function findPresenceAdvert(deviceIdHex: string, directory: readonly DirectoryEntry[]): AgentStatus | undefined;
 //# sourceMappingURL=gossip-directory.d.ts.map

package/dist/core/gossip-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gossip-directory.d.ts","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AAEpE,2OAA2O;AAC3O,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACrC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,IAAI,CAWN"}
+{"version":3,"file":"gossip-directory.d.ts","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAGzC,2OAA2O;AAC3O,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACrC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,IAAI,CAWN;AAED,ykBAAykB;AACzkB,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,WAAW,GAAG,SAAS,CAOzB"}

package/dist/core/gossip-directory.js

@@ -1,7 +1,9 @@
 /**
- * mergeKnownDevices — the mesh-wide gossip-directory aggregation WireMeshTransport's own listKnownDevices reads from. Split out purely to keep wire-mesh-transport.ts under the repo's max-lines cap, the same reason connection-approval.ts, room-router.ts, hub-session.ts, and peer-lifecycle.ts were each split from their own owning file.
+ * gossip-directory — the mesh-wide gossip-directory aggregation WireMeshTransport's own listKnownDevices reads from, plus per-event directory lookups (a specific peer's presence advert). Split out purely to keep wire-mesh-transport.ts under the repo's max-lines cap, the same reason connection-approval.ts, room-router.ts, hub-session.ts, and peer-lifecycle.ts were each split from their own owning file.
  */
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { AgentStatus } from "./types.js";
+import { PRESENCE_GOSSIP_KEY } from "./wire-mesh-transport.js";
 /** Merges one session event's own directory into the mesh-wide knownDevices view (mutated in place), keeping the newer advert (by snapshot-seconds) whenever a device-id is already known from an earlier event or a different session. */
 export function mergeKnownDevices(knownDevices, directory) {
     for (const entry of directory) {
@@ -13,4 +15,12 @@ export function mergeKnownDevices(knownDevices, directory) {
         }
     }
 }
+/** Reads a presence extension from one specific device's own gossiped self-advert, if this event's directory carries a fresh one for exactly that device-id -- never for any other device-id a multi-hop directory might mention, since only the session's own authenticated peer's advert is that session's business to report. Returns undefined for a missing presence/status key, or a value that isn't a recognised AgentStatus -- an advert simply not participating in this convention, not an error (the same verifier obligation peer-advert's own open extension tail is documented under). */
+export function findPresenceAdvert(deviceIdHex, directory) {
+    const entry = directory.find((candidate) => deviceIdToHex(candidate.device) === deviceIdHex);
+    if (entry === undefined)
+        return undefined;
+    const status = entry.advert[PRESENCE_GOSSIP_KEY];
+    return AgentStatus.is(status) ? status : undefined;
+}
 //# sourceMappingURL=gossip-directory.js.map

package/dist/core/gossip-directory.js.map

@@ -1 +1 @@
-{"version":3,"file":"gossip-directory.js","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAIhE,2OAA2O;AAC3O,MAAM,UAAU,iBAAiB,CAC/B,YAAqC,EACrC,SAAoC;IAEpC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IACE,QAAQ,KAAK,SAAS;YACtB,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAChE,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"gossip-directory.js","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAE/D,2OAA2O;AAC3O,MAAM,UAAU,iBAAiB,CAC/B,YAAqC,EACrC,SAAoC;IAEpC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,IACE,QAAQ,KAAK,SAAS;YACtB,KAAK,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,QAAQ,CAAC,kBAAkB,CAAC,EAChE,CAAC;YACD,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC;AAED,ykBAAykB;AACzkB,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,SAAoC;IAEpC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAC1B,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,CAC/D,CAAC;IACF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAY,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1D,OAAO,WAAW,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC"}

package/dist/core/hub-forwarding.d.ts

@@ -0,0 +1,13 @@
+/**
+ * hub-forwarding -- agent-comms#155's gateway forwarding, split from wire-mesh-transport.ts under the repo's max-lines cap. Outbound: filters a directory of gossiped local devices down to the ones eligible for cross-machine advertisement (an agent/self-bearing entry, meaning only ever a "visible" agent -- see AGENT_SELF_GOSSIP_KEY's own doc for why no separate visibility check is needed here) and pushes them onto a connected HubSession, best-effort. Local-to-remote routing: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
+ */
+import type { CapabilityScope, CapabilityToken, ManageCommand, PeerAdvert } from "wire-mesh-core/generated/protocol";
+import type { DirectoryEntry, ManageOutcome } from "wire-mesh-core/domain/mesh-session";
+import type { HubSession } from "./hub-session.js";
+/** Forwards every directory entry carrying an agent/self extension onto hub, if hub currently holds a live connection -- a no-op otherwise, which is every local peer except whichever one is currently the gateway. Called both from WireMeshTransport's own watchForDisconnect (as each local peer session's directory changes) and from connectHub's own initial catch-up push, so this side's already-known local devices reach the hub immediately on taking over the gateway role rather than waiting for their own next periodic gossip tick. Forwards unconditionally on every call (no caching or dedup against a previous call), mirroring relay-hub.ts's own "forward every gossip frame, as received" philosophy: an advert's own snapshot-seconds/addresses are meant to keep propagating as a liveness heartbeat, so suppressing a "duplicate" would silently stop legitimate freshness updates from reaching remote gateways. A forward that fails is reported via onError and swallowed, matching every other best-effort gossip send in this codebase. */
+export declare function forwardAdvertsToHub(hub: Readonly<Pick<HubSession, "isConnected" | "advertiseDevices">>, directory: readonly DirectoryEntry[], onError: ((error: Error) => void) | undefined): void;
+/** Catches the hub up with every local device already known at the moment this side becomes the gateway (connectHub's own trailing call, right after hub.connect resolves) -- without this, a device whose own last gossip arrived before this coordinator took over the gateway role would never be (re-)advertised until its own next periodic gossip tick (hub-side state is rebuilt from scratch on every takeover, per coordinator-gateway.ts's own class doc). Reuses forwardAdvertsToHub's own eligibility filter, so only ever a visible, agent/self-bearing device is pushed, exactly as an ordinary directory-change forward would. */
+export declare function pushHubCatchUp(hub: Readonly<Pick<HubSession, "isConnected" | "advertiseDevices">>, knownDevices: ReadonlyMap<string, Readonly<PeerAdvert>>, onError: ((error: Error) => void) | undefined): void;
+/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only via this machine's gateway connection (agent-comms#155's local-to-remote leg). Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side isn't currently the gateway. */
+export declare function routeRoomRequestViaHub(hub: Readonly<Pick<HubSession, "isConnected" | "sendRoomRequest">>, memberId: string, command: ManageCommand, scope: Readonly<CapabilityScope>, token?: CapabilityToken): Promise<ManageOutcome>;
+//# sourceMappingURL=hub-forwarding.d.ts.map

package/dist/core/hub-forwarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-forwarding.d.ts","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,UAAU,EACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EACV,cAAc,EACd,aAAa,EACd,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,2gCAA2gC;AAC3gC,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAC,EACnE,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,GAC5C,IAAI,CASN;AAED,inBAAinB;AACjnB,wBAAgB,cAAc,CAC5B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAC,EACnE,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EACvD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,GAC5C,IAAI,CAMN;AAED,4cAA4c;AAC5c,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,iBAAiB,CAAC,CAAC,EAClE,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC,CAGxB"}

package/dist/core/hub-forwarding.js

@@ -0,0 +1,30 @@
+/**
+ * hub-forwarding -- agent-comms#155's gateway forwarding, split from wire-mesh-transport.ts under the repo's max-lines cap. Outbound: filters a directory of gossiped local devices down to the ones eligible for cross-machine advertisement (an agent/self-bearing entry, meaning only ever a "visible" agent -- see AGENT_SELF_GOSSIP_KEY's own doc for why no separate visibility check is needed here) and pushes them onto a connected HubSession, best-effort. Local-to-remote routing: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
+ */
+import { AGENT_SELF_GOSSIP_KEY } from "./wire-mesh-transport.js";
+/** Forwards every directory entry carrying an agent/self extension onto hub, if hub currently holds a live connection -- a no-op otherwise, which is every local peer except whichever one is currently the gateway. Called both from WireMeshTransport's own watchForDisconnect (as each local peer session's directory changes) and from connectHub's own initial catch-up push, so this side's already-known local devices reach the hub immediately on taking over the gateway role rather than waiting for their own next periodic gossip tick. Forwards unconditionally on every call (no caching or dedup against a previous call), mirroring relay-hub.ts's own "forward every gossip frame, as received" philosophy: an advert's own snapshot-seconds/addresses are meant to keep propagating as a liveness heartbeat, so suppressing a "duplicate" would silently stop legitimate freshness updates from reaching remote gateways. A forward that fails is reported via onError and swallowed, matching every other best-effort gossip send in this codebase. */
+export function forwardAdvertsToHub(hub, directory, onError) {
+    if (!hub.isConnected)
+        return;
+    const eligible = directory.filter((entry) => entry.advert[AGENT_SELF_GOSSIP_KEY] !== undefined);
+    if (eligible.length === 0)
+        return;
+    hub.advertiseDevices(eligible).catch((error) => {
+        onError?.(error instanceof Error ? error : new Error(String(error)));
+    });
+}
+/** Catches the hub up with every local device already known at the moment this side becomes the gateway (connectHub's own trailing call, right after hub.connect resolves) -- without this, a device whose own last gossip arrived before this coordinator took over the gateway role would never be (re-)advertised until its own next periodic gossip tick (hub-side state is rebuilt from scratch on every takeover, per coordinator-gateway.ts's own class doc). Reuses forwardAdvertsToHub's own eligibility filter, so only ever a visible, agent/self-bearing device is pushed, exactly as an ordinary directory-change forward would. */
+export function pushHubCatchUp(hub, knownDevices, onError) {
+    const catchUp = [...knownDevices.values()].map((advert) => ({
+        device: advert.device,
+        advert,
+    }));
+    forwardAdvertsToHub(hub, catchUp, onError);
+}
+/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only via this machine's gateway connection (agent-comms#155's local-to-remote leg). Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side isn't currently the gateway. */
+export async function routeRoomRequestViaHub(hub, memberId, command, scope, token) {
+    if (!hub.isConnected)
+        return { result: "error", code: "not_connected" };
+    return hub.sendRoomRequest(memberId, command, scope, token);
+}
+//# sourceMappingURL=hub-forwarding.js.map

package/dist/core/hub-forwarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-forwarding.js","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAaH,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AAEjE,2gCAA2gC;AAC3gC,MAAM,UAAU,mBAAmB,CACjC,GAAmE,EACnE,SAAoC,EACpC,OAA6C;IAE7C,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,SAAS,CAC7D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACtD,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,inBAAinB;AACjnB,MAAM,UAAU,cAAc,CAC5B,GAAmE,EACnE,YAAuD,EACvD,OAA6C;IAE7C,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM;KACP,CAAC,CAAC,CAAC;IACJ,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,4cAA4c;AAC5c,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAkE,EAClE,QAAgB,EAChB,OAAsB,EACtB,KAAgC,EAChC,KAAuB;IAEvB,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACxE,OAAO,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC"}

package/dist/core/hub-session.d.ts

@@ -1,11 +1,11 @@
 /**
  * HubSession -- the relay-hub connection mode (agent-comms#151), split from wire-mesh-transport.ts under the max-lines cap the same way connection-approval.ts and its siblings were. A hub connection (wss://mesh.exadev.io/) is a RELAY, not a coordinator: no connect_request/introduce approval applies. The session's own self-advert is forwarded by the hub to every other connected agent and the hub answers with a catch-up of everyone already there, so peers discover each other purely through gossip. Messages ride relay-connect pairings -- sendManageRequest's own targetDevice routing, which the session layer wraps as relay-data to exactly that device.
  */
-import { type AcceptedMeshSession } from "wire-mesh-core/domain/mesh-session";
-import type { Frame } from "wire-mesh-core/generated/protocol";
+import { type AcceptedMeshSession, type DirectoryEntry, type IncomingManageRequest, type ManageOutcome } from "wire-mesh-core/domain/mesh-session";
+import type { CapabilityScope, CapabilityToken, Frame, ManageCommand } from "wire-mesh-core/generated/protocol";
 import type { IdentityPort } from "wire-mesh-core/ports/identity";
 import type { Connection } from "wire-mesh-core/ports/transport";
-import type { TransportEvents } from "./transport.js";
+import type { ConnectionHandle, TransportEvents } from "./transport.js";
 import type { MeshMessage } from "./wire-protocol.js";
 export interface HubSessionDeps {
     /** Resolves this node's own identity port once ready. */
@@ -19,10 +19,16 @@ export interface HubSessionDeps {
     onFrame: (connection: Readonly<Connection>, frame: Readonly<Frame>) => void | Promise<void>;
     /** Tracks the session for shutdown -- every session the transport ever creates, always. */
     trackForShutdown: (session: AcceptedMeshSession) => void;
+    /** Fires with every remote (non-self) directory entry the hub's own gossip/catch-up surfaces, every time the session's directory changes (agent-comms#155's own remote-directory-merge leg) -- the transport merges these into its own mesh-wide knownDevices the same way it already merges a local peer session's directory, so a hub-learned agent surfaces in listAgents/getAgent with no separate lookup path. */
+    onDirectory: (entries: readonly DirectoryEntry[]) => void;
+    /** Dispatches an already-received, non-legacy-frame request (a real core/room verb: room.send, room.notify, room.join, ...) to WireMeshTransport's own roomRouter, the identical dispatch a local peer session's own drainSession already uses -- the outbound half of agent-comms#155's "remote to local" routing leg. Deferred the same lazy-`this`-capture way DeliveryEngine's own sendRoomRequestToMember closure is, since roomRouter is constructed after this class's own instance in WireMeshTransport's constructor. */
+    handleRoomRequest: (request: IncomingManageRequest, handle: Readonly<ConnectionHandle>) => Promise<void>;
 }
 export declare class HubSession {
     private readonly deps;
     private session;
+    /** The raw connection underlying `session` -- MeshSession's own sendGossipUpdate only ever advertises this side's own single device, so advertising OTHER (local mesh) devices onto the hub (agent-comms#155's outbound leg) needs a raw gossip frame sent directly, bypassing that per-session single-self-advert limit. */
+    private connection;
     private readonly hubPeersKnown;
     constructor(deps: Readonly<HubSessionDeps>);
     /** This node's own device-id, hex-encoded -- the identifier hub peers address it by. */
@@ -35,10 +41,14 @@ export declare class HubSession {
     peers(): readonly string[];
     /** Dials the hub and participates as a peer (see the class doc for the discovery and routing model). */
     connect(url: string): Promise<void>;
-    /** Dispatches inbound relayed manage-requests: each is handled with a handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests), so onMessage and every downstream consumer see the true origin, never the hub. Replies ride respond()'s own relay routing back. A state_sync/state_update is dropped before ever reaching onMessage/applyPatch -- see isStateMutatingMessage's own doc for why: the hub has no per-peer admission control yet (that lands in agent-comms#156), so accepting one from an arbitrary hub peer would let it directly patch this side's mesh state (a security review finding on agent-comms#169, which is what first wired a hub connection into production's default coordinator path at all). */
+    /** Dispatches inbound relayed manage-requests: each is handled with a handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests), so every downstream consumer sees the true origin, never the hub -- the same discipline extends to a real room-domain verb (agent-comms#155's "remote to local" leg) as it already applied to the legacy opaque-frame path. A legacy FRAME_VERB carrying state_sync/state_update is dropped before ever reaching onMessage/applyPatch -- see isStateMutatingMessage's own doc for why: the hub has no per-peer admission control yet (that lands in agent-comms#156), so accepting one from an arbitrary hub peer would let it directly patch this side's mesh state (a security review finding on agent-comms#169). A real room-domain verb (room.send, room.join, room.notify, ...) carries no equivalent risk -- it is independently gated by its own room:member capability token, verified regardless of which transport path it arrived over -- so it is dispatched to the same roomVerbHandlers a local peer session's own drainSession uses, via handleRoomRequest, against THIS side's own local mesh state. Known limitation, inherited from wire-mesh-core's own session layer rather than something agent-comms can fix here: a session tracks at most one active relay pairing per remote device (mesh-session.ts's own single relayPeerDevice slot), so a request relayed here is dispatched as "addressed to this gateway's own agent" unconditionally -- there is no target-device disambiguation available to route it on to a DIFFERENT local peer this gateway also advertises. Forwarding this gateway's own agent's traffic is therefore correct; a remote request genuinely meant for another local peer behind this same gateway is not yet distinguishable from one meant for this gateway's own agent. */
     private consume;
     private watchDisconnect;
     /** Sends one message to a hub-discovered peer through the hub's relay pairing. */
     sendToPeer(peerDeviceHex: string, message: MeshMessage): Promise<void>;
+    /** Gossips a raw `gossip` frame carrying every given entry's own advert onto the hub, over the raw connection rather than sendGossipUpdate (which can only ever advertise this side's own single device) -- the outbound leg of agent-comms#155's gateway forwarding. relay-hub.ts registers each advert's own `device` field against the CONNECTION it arrives on, so every entry passed here becomes reachable, cross-machine, as "via this gateway" -- callers are responsible for only ever passing entries that are actually meant to be advertised (WireMeshTransport filters to local, visible-agent-bearing entries before calling this). Throws if this side isn't currently connected to a hub, matching sendToPeer's own contract -- callers gate on isConnected first. */
+    advertiseDevices(entries: readonly DirectoryEntry[]): Promise<void>;
+    /** Sends a real core/room manage-request to a specific hub-reachable peer, through the hub's relay-connect/relay-data pairing -- the local-to-remote leg of agent-comms#155's routing, mirroring MeshTransport.sendRoomRequest's own not_connected/outcome contract so WireMeshTransport can fall back to this uniformly when memberId isn't a local peer session. Bounded by HUB_ROOM_REQUEST_TIMEOUT_MS (see its own doc) since an unreachable target-device is silently dropped by the hub with no error frame, unlike a local session's own connection-level failure. */
+    sendRoomRequest(peerDeviceHex: string, command: ManageCommand, scope: Readonly<CapabilityScope>, token?: CapabilityToken): Promise<ManageOutcome>;
 }
 //# sourceMappingURL=hub-session.d.ts.map

package/dist/core/hub-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hub-session.d.ts","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClC,yHAAyH;IACzH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,wEAAwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,sIAAsI;IACtI,OAAO,EAAE,CACP,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;CAC1D;AAED,qBAAa,UAAU;IAIT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,OAAO,CAAkC;IACjD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEtB,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC;IAE3D,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAKrC,kOAAkO;IAClO,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,mKAAmK;IAC7J,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,qFAAqF;IACrF,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B,wGAAwG;IAClG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAoCzC,guBAAguB;IAChuB,OAAO,CAAC,OAAO;YAkBD,eAAe;IAS7B,kFAAkF;IAC5E,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAW7E"}
+{"version":3,"file":"hub-session.d.ts","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAE5C,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,KAAK,EACL,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAatD,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClC,yHAAyH;IACzH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,wEAAwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,sIAAsI;IACtI,OAAO,EAAE,CACP,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACzD,uZAAuZ;IACvZ,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;IAC1D,kgBAAkgB;IAClgB,iBAAiB,EAAE,CACjB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,KAC/B,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB;AAED,qBAAa,UAAU;IAMT,OAAO,CAAC,QAAQ,CAAC,IAAI;IALjC,OAAO,CAAC,OAAO,CAAkC;IACjD,6TAA6T;IAC7T,OAAO,CAAC,UAAU,CAAyB;IAC3C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEtB,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC;IAE3D,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAKrC,kOAAkO;IAClO,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,mKAAmK;IAC7J,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAQjC,qFAAqF;IACrF,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B,wGAAwG;IAClG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCzC,oyDAAoyD;IACpyD,OAAO,CAAC,OAAO;YAuBD,eAAe;IAU7B,kFAAkF;IAC5E,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAY5E,svBAAsvB;IAChvB,gBAAgB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,6iBAA6iB;IACviB,eAAe,CACnB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC;CAa1B"}

package/dist/core/hub-session.js

@@ -5,10 +5,14 @@ import { acceptMeshSession, } from "wire-mesh-core/domain/mesh-session";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
 import { extractMessage } from "./room-router.js";
 import { connectWsUrl } from "./ws-dial.js";
-import { buildCommand, DOMAIN, FRAME_SCOPE } from "./wire-mesh-transport.js";
+import { buildCommand, DOMAIN, FRAME_SCOPE, FRAME_VERB, } from "./wire-mesh-transport.js";
+/** How long a room-domain request routed through the hub's relay-connect/relay-data pairing waits for a response before giving up. Unlike an ordinary local peer session, a relay-connect naming an unknown target-device is silently dropped by the hub (spec/relay-hub's own documented behaviour -- no error frame exists for "no such device"), so a request to a device that turns out not to be reachable via any gateway would otherwise hang forever rather than surfacing as a normal "not reachable" outcome. */
+const HUB_ROOM_REQUEST_TIMEOUT_MS = 15_000;
 export class HubSession {
     deps;
     session;
+    /** The raw connection underlying `session` -- MeshSession's own sendGossipUpdate only ever advertises this side's own single device, so advertising OTHER (local mesh) devices onto the hub (agent-comms#155's outbound leg) needs a raw gossip frame sent directly, bypassing that per-session single-self-advert limit. */
+    connection;
     hubPeersKnown = new Set();
     constructor(deps) {
         this.deps = deps;
@@ -28,6 +32,7 @@ export class HubSession {
         if (session === undefined)
             return;
         this.session = undefined;
+        this.connection = undefined;
         await session.close();
     }
     /** The device ids (hex) of peers discovered through the hub's gossiped directory. */
@@ -51,18 +56,20 @@ export class HubSession {
             return;
         }
         this.session = session;
+        this.connection = connection;
         this.deps.trackForShutdown(session);
-        // Merge the hub's directory (its catch-up arrives as the first session events) and keep refreshing it on every subsequent one.
+        // Merge the hub's directory (its catch-up arrives as the first session events) and keep refreshing it on every subsequent one. Every remote entry is also surfaced via onDirectory, so the transport can merge it into its own mesh-wide knownDevices (agent-comms#155's remote-directory-merge leg).
         void (async () => {
+            const ownHex = deviceIdToHex(identity.deviceId);
             for await (const event of session.events) {
                 if (this.deps.isShuttingDown())
                     break;
-                for (const entry of event.directory) {
-                    const hex = deviceIdToHex(entry.device);
-                    if (hex !== deviceIdToHex(identity.deviceId)) {
-                        this.hubPeersKnown.add(hex);
-                    }
+                const remoteEntries = event.directory.filter((entry) => deviceIdToHex(entry.device) !== ownHex);
+                for (const entry of remoteEntries) {
+                    this.hubPeersKnown.add(deviceIdToHex(entry.device));
                 }
+                if (remoteEntries.length > 0)
+                    this.deps.onDirectory(remoteEntries);
                 if (event.state.status === "closed")
                     break;
             }
@@ -72,7 +79,7 @@ export class HubSession {
             await this.watchDisconnect(session);
         })();
     }
-    /** Dispatches inbound relayed manage-requests: each is handled with a handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests), so onMessage and every downstream consumer see the true origin, never the hub. Replies ride respond()'s own relay routing back. A state_sync/state_update is dropped before ever reaching onMessage/applyPatch -- see isStateMutatingMessage's own doc for why: the hub has no per-peer admission control yet (that lands in agent-comms#156), so accepting one from an arbitrary hub peer would let it directly patch this side's mesh state (a security review finding on agent-comms#169, which is what first wired a hub connection into production's default coordinator path at all). */
+    /** Dispatches inbound relayed manage-requests: each is handled with a handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests), so every downstream consumer sees the true origin, never the hub -- the same discipline extends to a real room-domain verb (agent-comms#155's "remote to local" leg) as it already applied to the legacy opaque-frame path. A legacy FRAME_VERB carrying state_sync/state_update is dropped before ever reaching onMessage/applyPatch -- see isStateMutatingMessage's own doc for why: the hub has no per-peer admission control yet (that lands in agent-comms#156), so accepting one from an arbitrary hub peer would let it directly patch this side's mesh state (a security review finding on agent-comms#169). A real room-domain verb (room.send, room.join, room.notify, ...) carries no equivalent risk -- it is independently gated by its own room:member capability token, verified regardless of which transport path it arrived over -- so it is dispatched to the same roomVerbHandlers a local peer session's own drainSession uses, via handleRoomRequest, against THIS side's own local mesh state. Known limitation, inherited from wire-mesh-core's own session layer rather than something agent-comms can fix here: a session tracks at most one active relay pairing per remote device (mesh-session.ts's own single relayPeerDevice slot), so a request relayed here is dispatched as "addressed to this gateway's own agent" unconditionally -- there is no target-device disambiguation available to route it on to a DIFFERENT local peer this gateway also advertises. Forwarding this gateway's own agent's traffic is therefore correct; a remote request genuinely meant for another local peer behind this same gateway is not yet distinguishable from one meant for this gateway's own agent. */
     consume(session) {
         void (async () => {
             for await (const request of session.incomingManageRequests) {
@@ -82,11 +89,16 @@ export class HubSession {
                     ? deviceIdToHex(request.fromDevice)
                     : "hub-peer";
                 this.hubPeersKnown.add(senderHex);
-                const message = extractMessage(request.command);
-                if (message !== undefined && !isStateMutatingMessage(message)) {
-                    this.deps.events.onMessage({ id: senderHex }, message);
+                const handle = { id: senderHex };
+                if (request.command.verb === FRAME_VERB) {
+                    const message = extractMessage(request.command);
+                    if (message !== undefined && !isStateMutatingMessage(message)) {
+                        this.deps.events.onMessage(handle, message);
+                    }
+                    await request.respond({ result: "ok" }).catch(() => undefined);
+                    continue;
                 }
-                await request.respond({ result: "ok" }).catch(() => undefined);
+                await this.deps.handleRoomRequest(request, handle);
             }
         })();
     }
@@ -97,6 +109,7 @@ export class HubSession {
         }
         if (this.session === session) {
             this.session = undefined;
+            this.connection = undefined;
         }
     }
     /** Sends one message to a hub-discovered peer through the hub's relay pairing. */
@@ -107,6 +120,25 @@ export class HubSession {
         }
         await session.sendManageRequest(buildCommand(message), FRAME_SCOPE, hexToBytes(peerDeviceHex));
     }
+    /** Gossips a raw `gossip` frame carrying every given entry's own advert onto the hub, over the raw connection rather than sendGossipUpdate (which can only ever advertise this side's own single device) -- the outbound leg of agent-comms#155's gateway forwarding. relay-hub.ts registers each advert's own `device` field against the CONNECTION it arrives on, so every entry passed here becomes reachable, cross-machine, as "via this gateway" -- callers are responsible for only ever passing entries that are actually meant to be advertised (WireMeshTransport filters to local, visible-agent-bearing entries before calling this). Throws if this side isn't currently connected to a hub, matching sendToPeer's own contract -- callers gate on isConnected first. */
+    async advertiseDevices(entries) {
+        const connection = this.connection;
+        if (connection === undefined) {
+            throw new Error("not connected to a hub");
+        }
+        await connection.send({
+            type: "gossip",
+            peers: entries.map((entry) => entry.advert),
+        });
+    }
+    /** Sends a real core/room manage-request to a specific hub-reachable peer, through the hub's relay-connect/relay-data pairing -- the local-to-remote leg of agent-comms#155's routing, mirroring MeshTransport.sendRoomRequest's own not_connected/outcome contract so WireMeshTransport can fall back to this uniformly when memberId isn't a local peer session. Bounded by HUB_ROOM_REQUEST_TIMEOUT_MS (see its own doc) since an unreachable target-device is silently dropped by the hub with no error frame, unlike a local session's own connection-level failure. */
+    async sendRoomRequest(peerDeviceHex, command, scope, token) {
+        const session = this.session;
+        if (session === undefined) {
+            return { result: "error", code: "not_connected" };
+        }
+        return session.sendManageRequest(command, scope, hexToBytes(peerDeviceHex), token, HUB_ROOM_REQUEST_TIMEOUT_MS);
+    }
 }
 function hexToBytes(hex) {
     const bytes = new Uint8Array(new ArrayBuffer(hex.length / 2));

package/dist/core/hub-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"hub-session.js","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,GAElB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAMhE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAmB7E,MAAM,OAAO,UAAU;IAIQ;IAHrB,OAAO,CAAkC;IAChC,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnD,YAA6B,IAA8B;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAE/D,wFAAwF;IACxF,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/C,OAAO,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,kOAAkO;IAClO,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IACpC,CAAC;IAED,mKAAmK;IACnK,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,qFAAqF;IACrF,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAC9D,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpC,+HAA+H;QAC/H,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,MAAM;gBACtC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;oBACpC,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;oBACxC,IAAI,GAAG,KAAK,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;wBAC7C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC9B,CAAC;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM;YAC7C,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,guBAAguB;IACxtB,OAAO,CAAC,OAA4B;QAC1C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAC3D,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,MAAM;gBACtC,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,KAAK,SAAS;oBAC9B,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;oBACnC,CAAC,CAAC,UAAU,CAAC;gBACjB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;gBAChD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,OAAO,CAAC,CAAC;gBACzD,CAAC;gBACD,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACjE,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAA4B;QACxD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,UAAU,CAAC,aAAqB,EAAE,OAAoB;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,CAAC,iBAAiB,CAC7B,YAAY,CAAC,OAAO,CAAC,EACrB,WAAW,EACX,UAAU,CAAC,aAAa,CAAC,CAC1B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,45BAA45B;AAC55B,SAAS,sBAAsB,CAAC,OAAoB;IAClD,OAAO,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"hub-session.js","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,GAKlB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAWhE,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EACL,YAAY,EACZ,MAAM,EACN,WAAW,EACX,UAAU,GACX,MAAM,0BAA0B,CAAC;AAElC,2fAA2f;AAC3f,MAAM,2BAA2B,GAAG,MAAM,CAAC;AA0B3C,MAAM,OAAO,UAAU;IAMQ;IALrB,OAAO,CAAkC;IACjD,6TAA6T;IACrT,UAAU,CAAyB;IAC1B,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnD,YAA6B,IAA8B;QAA9B,SAAI,GAAJ,IAAI,CAA0B;IAAG,CAAC;IAE/D,wFAAwF;IACxF,KAAK,CAAC,YAAY;QAChB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/C,OAAO,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC1C,CAAC;IAED,kOAAkO;IAClO,IAAI,WAAW;QACb,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;IACpC,CAAC;IAED,mKAAmK;IACnK,KAAK,CAAC,UAAU;QACd,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC5B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAED,qFAAqF;IACrF,KAAK;QACH,OAAO,CAAC,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,wGAAwG;IACxG,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC;QAC/C,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,EAAE,QAAQ,EAAE,CAAC,MAAM,CAAC,EAAE;YACtE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAC9D,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC;SAC9C,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;YAC/B,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpC,sSAAsS;QACtS,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAChD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBACzC,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,MAAM;gBACtC,MAAM,aAAa,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,CAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,MAAM,CAClD,CAAC;gBACF,KAAK,MAAM,KAAK,IAAI,aAAa,EAAE,CAAC;oBAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBACtD,CAAC;gBACD,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC;gBACnE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAAE,MAAM;YAC7C,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,oyDAAoyD;IAC5xD,OAAO,CAAC,OAA4B;QAC1C,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC;gBAC3D,IAAI,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;oBAAE,MAAM;gBACtC,MAAM,SAAS,GACb,OAAO,CAAC,UAAU,KAAK,SAAS;oBAC9B,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC;oBACnC,CAAC,CAAC,UAAU,CAAC;gBACjB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAClC,MAAM,MAAM,GAA+B,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;gBAC7D,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;oBACxC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAChD,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;wBAC9D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;oBAC9C,CAAC;oBACD,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBACD,MAAM,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACrD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,OAA4B;QACxD,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACzC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ;gBAAE,MAAM;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;YACzB,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,UAAU,CAAC,aAAqB,EAAE,OAAoB;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,OAAO,CAAC,iBAAiB,CAC7B,YAAY,CAAC,OAAO,CAAC,EACrB,WAAW,EACX,UAAU,CAAC,aAAa,CAAC,CAC1B,CAAC;IACJ,CAAC;IAED,svBAAsvB;IACtvB,KAAK,CAAC,gBAAgB,CAAC,OAAkC;QACvD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,CAAC;YACpB,IAAI,EAAE,QAAQ;YACd,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,6iBAA6iB;IAC7iB,KAAK,CAAC,eAAe,CACnB,aAAqB,EACrB,OAAsB,EACtB,KAAgC,EAChC,KAAuB;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QACpD,CAAC;QACD,OAAO,OAAO,CAAC,iBAAiB,CAC9B,OAAO,EACP,KAAK,EACL,UAAU,CAAC,aAAa,CAAC,EACzB,KAAK,EACL,2BAA2B,CAC5B,CAAC;IACJ,CAAC;CACF;AAED,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,45BAA45B;AAC55B,SAAS,sBAAsB,CAAC,OAAoB;IAClD,OAAO,OAAO,CAAC,MAAM,KAAK,YAAY,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,CAAC;AAC9E,CAAC"}

package/dist/core/mcp-registry-retry.d.ts

@@ -4,6 +4,6 @@ export declare const RETRY_BACKOFF_MULTIPLIER = 2;
 export declare const MAX_TOTAL_RETRY_MS: number;
 /** The next delay in the doubling-with-cap backoff schedule, given the delay just used. */
 export declare function nextRetryDelayMs(previousDelayMs: number): number;
-/** Recognises a publish failure worth retrying (npm propagation lag, or a transient 5xx from the registry's own infrastructure) as opposed to any other failure -- a genuinely invalid publish request, for instance, which retrying can never fix. */
+/** Recognises a publish failure worth retrying (npm propagation lag, a transient 5xx from the registry's own infrastructure, a connection-level failure that never reached the registry, or a login JWT that expired mid-retry-window) as opposed to any other failure -- a genuinely invalid publish request or authorisation failure, for instance, which retrying can never fix. */
 export declare function isRetryablePublishFailure(output: string): boolean;
 //# sourceMappingURL=mcp-registry-retry.d.ts.map

package/dist/core/mcp-registry-retry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-registry-retry.d.ts","sourceRoot":"","sources":["../../src/core/mcp-registry-retry.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAI1C,eAAO,MAAM,kBAAkB,QAC+B,CAAC;AAE/D,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAKhE;AAiBD,uPAAuP;AACvP,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEjE"}
+{"version":3,"file":"mcp-registry-retry.d.ts","sourceRoot":"","sources":["../../src/core/mcp-registry-retry.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,sBAAsB,QAAS,CAAC;AAC7C,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAC1C,eAAO,MAAM,wBAAwB,IAAI,CAAC;AAI1C,eAAO,MAAM,kBAAkB,QAC+B,CAAC;AAE/D,2FAA2F;AAC3F,wBAAgB,gBAAgB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAKhE;AAgCD,uXAAuX;AACvX,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAOjE"}

package/dist/core/mcp-registry-retry.js

@@ -23,8 +23,21 @@ const SERVER_ERROR_STATUS_PATTERN = /server returned status 5\d{2}\b/;
 function isRetryableServerError(output) {
     return SERVER_ERROR_STATUS_PATTERN.test(output);
 }
-/** Recognises a publish failure worth retrying (npm propagation lag, or a transient 5xx from the registry's own infrastructure) as opposed to any other failure -- a genuinely invalid publish request, for instance, which retrying can never fix. */
+// Confirmed as a third retryable failure mode (ExaDev/agent-comms, 2026-09-17, issue #180, run 35249771867, v3.9.0): the registry request never got as far as an HTTP response at all, a raw connection-level failure from mcp-publisher's own Go HTTP client (a DNS/dial/timeout/reset at the TCP layer), which matches neither the propagation-lag text nor the 5xx status pattern above since there is no status line to match against. This is transient infrastructure the same way a 5xx is: the request itself may well have been valid, retrying it can plausibly succeed.
+const CONNECTION_ERROR_PATTERN = /\b(?:dial tcp|i\/o timeout|connection refused|connection reset|no such host)\b/;
+function isConnectionError(output) {
+    return CONNECTION_ERROR_PATTERN.test(output);
+}
+// Confirmed as a fourth retryable failure mode (ExaDev/agent-comms, 2026-09-17, issue #180, run 35239013253, v3.9.0): mcp-publisher logs in with `login github-oidc` once before the retry loop starts, and a retry attempt late enough in the MAX_TOTAL_RETRY_MS budget can present a JWT that expired in the meantime, producing a 401 that no amount of retrying the same token will ever fix. It's retryable only because the caller re-runs the login step before every retry attempt (see scripts/publish-mcp-registry.ts), which mints a fresh token, so this classifier deliberately matches only the specific "expired" 401 body, not a 401 in general, since a genuine authorisation failure (wrong scope, revoked credential) would 401 again regardless of how fresh the token is.
+const EXPIRED_JWT_STATUS_PATTERN = /server returned status 401\b/;
+function isExpiredJwt(output) {
+    return EXPIRED_JWT_STATUS_PATTERN.test(output) && output.includes("expired");
+}
+/** Recognises a publish failure worth retrying (npm propagation lag, a transient 5xx from the registry's own infrastructure, a connection-level failure that never reached the registry, or a login JWT that expired mid-retry-window) as opposed to any other failure -- a genuinely invalid publish request or authorisation failure, for instance, which retrying can never fix. */
 export function isRetryablePublishFailure(output) {
-    return isNpmPropagationLag(output) || isRetryableServerError(output);
+    return (isNpmPropagationLag(output) ||
+        isRetryableServerError(output) ||
+        isConnectionError(output) ||
+        isExpiredJwt(output));
 }
 //# sourceMappingURL=mcp-registry-retry.js.map

package/dist/core/mcp-registry-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-registry-retry.js","sourceRoot":"","sources":["../../src/core/mcp-registry-retry.ts"],"names":[],"mappings":"AAAA,mgBAAmgB;AAEngB,sSAAsS;AACtS,EAAE;AACF,6bAA6b;AAC7b,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uBAAuB,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,eAAuB;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,eAAe,GAAG,wBAAwB,EAC1C,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,kLAAkL;AAClL,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,yxBAAyxB;AACzxB,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAEtE,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,uPAAuP;AACvP,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,OAAO,mBAAmB,CAAC,MAAM,CAAC,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACvE,CAAC"}
+{"version":3,"file":"mcp-registry-retry.js","sourceRoot":"","sources":["../../src/core/mcp-registry-retry.ts"],"names":[],"mappings":"AAAA,mgBAAmgB;AAEngB,sSAAsS;AACtS,EAAE;AACF,6bAA6b;AAC7b,MAAM,CAAC,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAC7C,MAAM,CAAC,MAAM,kBAAkB,GAAG,OAAO,CAAC;AAC1C,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAC1C,MAAM,uBAAuB,GAAG,EAAE,CAAC;AACnC,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,CAAC,MAAM,kBAAkB,GAC7B,uBAAuB,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAE/D,2FAA2F;AAC3F,MAAM,UAAU,gBAAgB,CAAC,eAAuB;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,eAAe,GAAG,wBAAwB,EAC1C,kBAAkB,CACnB,CAAC;AACJ,CAAC;AAED,kLAAkL;AAClL,SAAS,mBAAmB,CAAC,MAAc;IACzC,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChC,MAAM,CAAC,QAAQ,CAAC,6CAA6C,CAAC,CAC/D,CAAC;AACJ,CAAC;AAED,yxBAAyxB;AACzxB,MAAM,2BAA2B,GAAG,iCAAiC,CAAC;AAEtE,SAAS,sBAAsB,CAAC,MAAc;IAC5C,OAAO,2BAA2B,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,mjBAAmjB;AACnjB,MAAM,wBAAwB,GAC5B,gFAAgF,CAAC;AAEnF,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,wBAAwB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC/C,CAAC;AAED,+vBAA+vB;AAC/vB,MAAM,0BAA0B,GAAG,8BAA8B,CAAC;AAElE,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC/E,CAAC;AAED,uXAAuX;AACvX,MAAM,UAAU,yBAAyB,CAAC,MAAc;IACtD,OAAO,CACL,mBAAmB,CAAC,MAAM,CAAC;QAC3B,sBAAsB,CAAC,MAAM,CAAC;QAC9B,iBAAiB,CAAC,MAAM,CAAC;QACzB,YAAY,CAAC,MAAM,CAAC,CACrB,CAAC;AACJ,CAAC"}