wire-mesh-core 1.53.0 → 1.54.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ft as RelayDataFrame } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ft as RelayDataFrame } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-CNFRVx9w.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-CNFRVx9w.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-De0zHlaA.cjs";
+import { r as Transport } from "../transport-CbXX1Xd-.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-C7KVkhgb.mjs";
+import { r as Transport } from "../transport-DG9ouGe-.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-De0zHlaA.cjs";
+import { r as Transport } from "../transport-CbXX1Xd-.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-C7KVkhgb.mjs";
+import { r as Transport } from "../transport-DG9ouGe-.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-De0zHlaA.cjs";
+import { t as Connection } from "../transport-CbXX1Xd-.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-C7KVkhgb.mjs";
+import { t as Connection } from "../transport-DG9ouGe-.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-Cl8sQo7o.cjs";
+import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-CVyPoJ6l.mjs";
+import { a as RevocationCheck } from "../tokens-BVrgBeqF.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-CNFRVx9w.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-CNFRVx9w.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-CNFRVx9w.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-CNFRVx9w.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-CNFRVx9w.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.cjs

@@ -13,8 +13,43 @@ function createRelayPairings() {
 	};
 }
 //#endregion
-//#region src/domain/mesh-session.ts
-const MS_PER_SECOND = 1e3;
+//#region src/domain/ping-round-trips.ts
+function createPingRoundTrips() {
+	const pending = [];
+	function cancel(sentAt) {
+		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
+		if (index === -1) return false;
+		pending.splice(index, 1);
+		return true;
+	}
+	return {
+		resolveOldest(nowMs) {
+			const entry = pending.shift();
+			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
+		},
+		rejectAll(reason) {
+			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
+		},
+		async sendAndAwait(sentAt, sendPing, timeoutMs) {
+			const rtt = new Promise((resolve, reject) => {
+				pending.push({
+					sentAt,
+					resolve,
+					reject
+				});
+			});
+			await sendPing();
+			if (timeoutMs === void 0) return rtt;
+			return Promise.race([rtt, new Promise((_resolve, reject) => {
+				setTimeout(() => {
+					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+				}, timeoutMs);
+			})]);
+		}
+	};
+}
+//#endregion
+//#region src/domain/gossip-extensions.ts
 /** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
 const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
 	"device",
@@ -30,6 +65,9 @@ function validateGossipExtensions(extensions) {
 		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
 	}
 }
+//#endregion
+//#region src/domain/mesh-session.ts
+const MS_PER_SECOND = 1e3;
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 const HANDSHAKE_TIMEOUT_MS = 3e3;
 function localHandshake(domains) {
@@ -62,6 +100,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	const incomingBacklog = [];
 	const revocationWaiters = [];
 	const revocationBacklog = [];
+	const pingRoundTrips = createPingRoundTrips();
 	function snapshot() {
 		return {
 			state,
@@ -101,6 +140,11 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			...token !== null ? { token } : {}
 		};
 	}
+	/** The "not connected" guard every send* method on the public session needs, deduplicated into one place rather than repeated inline at each call site: throws unless there is a live connection AND the session's own state machine agrees it is "connected" (transmit's own connection===null check alone doesn't cover the latter). Returns the connection itself, narrowed non-null, for a caller that needs to send directly on it (sendPing/sendPingMeasureRtt); a caller that only needs the throwing side effect (sendManageRequest and friends, which go through transmit instead) calls this and discards the result. */
+	function requireConnectedLink() {
+		if (connection === null || state.status !== "connected") throw new Error("not connected");
+		return connection;
+	}
 	/** Sends a frame, wrapping it as relay-data first when viaRelay is set -- the single choke point every outbound manage-request/manage-response passes through, so a consumer of sendManageRequest/respond never needs its own relay-wrapping logic. When relaying, toDevice is stamped onto the outer relay-data-frame's own `to-device` field so the hub addresses it to the correct pairing directly (wire-mesh#30) rather than falling back to whichever pairing it last saw -- the one case this is omitted is a response to a request that itself arrived with no from-device to echo back, which is left to that same hub fallback exactly as an unaddressed relay-data always has been. */
 	async function transmit(frame, viaRelay, toDevice) {
 		if (connection === null) throw new Error("not connected");
@@ -178,6 +222,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
+		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) emitRevocationEntry(entry);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
@@ -220,6 +265,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
+		pingRoundTrips.rejectAll("disconnected before a pong arrived");
 		if (reconnect !== null && attempt < reconnect.maxAttempts) {
 			attempt += 1;
 			const currentAttempt = attempt;
@@ -378,20 +424,32 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await doConnect(address, localDomains);
 			},
 			async sendPing() {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				const link = requireConnectedLink();
 				const ping = { type: "ping" };
 				frameLog.push({
 					direction: "sent",
 					frame: ping
 				});
-				await connection.send(ping);
+				await link.send(ping);
 				emit();
 			},
+			async sendPingMeasureRtt(timeoutMs) {
+				const link = requireConnectedLink();
+				return pingRoundTrips.sendAndAwait(clock.now(), async () => {
+					const ping = { type: "ping" };
+					frameLog.push({
+						direction: "sent",
+						frame: ping
+					});
+					await link.send(ping);
+					emit();
+				}, timeoutMs);
+			},
 			setToken(token) {
 				currentToken = token;
 			},
 			async sendManageRequest(command, scope, targetDevice, token, timeoutMs) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				if (targetDevice !== void 0) await ensureRelayPairing(targetDevice);
 				const frame = buildManageRequest(command, scope, token);
 				const requestId = frame["request-id"];
@@ -418,7 +476,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				})]);
 			},
 			async sendRevocationAnnounce(entries) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				const frame = {
 					type: "revocation-announce",
 					entries: [...entries]
@@ -431,7 +489,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				emit();
 			},
 			async sendGossipUpdate(extensions) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				const frame = buildSelfAdvert(extensions);
 				frameLog.push({
 					direction: "sent",
@@ -441,7 +499,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				emit();
 			},
 			async sendDataFrame(frame) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				frameLog.push({
 					direction: "sent",
 					frame
@@ -460,6 +518,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					reconnectTimer = null;
 				}
 				rejectPendingManageRequests("connection closed before a response arrived");
+				pingRoundTrips.rejectAll("connection closed before a pong arrived");
 				if (connection !== null) await connection.close();
 				if (state.status === "connected" || state.status === "connecting" || state.status === "reconnecting") state = {
 					status: "closed",

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-CNFRVx9w.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-PhUVprXA.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-De0zHlaA.cjs";
+import { r as Transport, t as Connection } from "../transport-CbXX1Xd-.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -79,6 +79,8 @@ export interface MeshSession {
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
+  /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
+  sendPingMeasureRtt: (timeoutMs?: number) => Promise<number>;
   /** Attaches this token to every `manage-request` sent from now on. */
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-CNFRVx9w.mjs";
-import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-PhUVprXA.mjs";
+import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-C7KVkhgb.mjs";
+import { r as Transport, t as Connection } from "../transport-DG9ouGe-.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -79,6 +79,8 @@ export interface MeshSession {
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
+  /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
+  sendPingMeasureRtt: (timeoutMs?: number) => Promise<number>;
   /** Attaches this token to every `manage-request` sent from now on. */
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */

package/dist/domain/mesh-session.mjs

@@ -12,8 +12,43 @@ function createRelayPairings() {
 	};
 }
 //#endregion
-//#region src/domain/mesh-session.ts
-const MS_PER_SECOND = 1e3;
+//#region src/domain/ping-round-trips.ts
+function createPingRoundTrips() {
+	const pending = [];
+	function cancel(sentAt) {
+		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
+		if (index === -1) return false;
+		pending.splice(index, 1);
+		return true;
+	}
+	return {
+		resolveOldest(nowMs) {
+			const entry = pending.shift();
+			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
+		},
+		rejectAll(reason) {
+			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
+		},
+		async sendAndAwait(sentAt, sendPing, timeoutMs) {
+			const rtt = new Promise((resolve, reject) => {
+				pending.push({
+					sentAt,
+					resolve,
+					reject
+				});
+			});
+			await sendPing();
+			if (timeoutMs === void 0) return rtt;
+			return Promise.race([rtt, new Promise((_resolve, reject) => {
+				setTimeout(() => {
+					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+				}, timeoutMs);
+			})]);
+		}
+	};
+}
+//#endregion
+//#region src/domain/gossip-extensions.ts
 /** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
 const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
 	"device",
@@ -29,6 +64,9 @@ function validateGossipExtensions(extensions) {
 		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
 	}
 }
+//#endregion
+//#region src/domain/mesh-session.ts
+const MS_PER_SECOND = 1e3;
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 const HANDSHAKE_TIMEOUT_MS = 3e3;
 function localHandshake(domains) {
@@ -61,6 +99,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	const incomingBacklog = [];
 	const revocationWaiters = [];
 	const revocationBacklog = [];
+	const pingRoundTrips = createPingRoundTrips();
 	function snapshot() {
 		return {
 			state,
@@ -100,6 +139,11 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			...token !== null ? { token } : {}
 		};
 	}
+	/** The "not connected" guard every send* method on the public session needs, deduplicated into one place rather than repeated inline at each call site: throws unless there is a live connection AND the session's own state machine agrees it is "connected" (transmit's own connection===null check alone doesn't cover the latter). Returns the connection itself, narrowed non-null, for a caller that needs to send directly on it (sendPing/sendPingMeasureRtt); a caller that only needs the throwing side effect (sendManageRequest and friends, which go through transmit instead) calls this and discards the result. */
+	function requireConnectedLink() {
+		if (connection === null || state.status !== "connected") throw new Error("not connected");
+		return connection;
+	}
 	/** Sends a frame, wrapping it as relay-data first when viaRelay is set -- the single choke point every outbound manage-request/manage-response passes through, so a consumer of sendManageRequest/respond never needs its own relay-wrapping logic. When relaying, toDevice is stamped onto the outer relay-data-frame's own `to-device` field so the hub addresses it to the correct pairing directly (wire-mesh#30) rather than falling back to whichever pairing it last saw -- the one case this is omitted is a response to a request that itself arrived with no from-device to echo back, which is left to that same hub fallback exactly as an unaddressed relay-data always has been. */
 	async function transmit(frame, viaRelay, toDevice) {
 		if (connection === null) throw new Error("not connected");
@@ -177,6 +221,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
+		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) emitRevocationEntry(entry);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
@@ -219,6 +264,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
+		pingRoundTrips.rejectAll("disconnected before a pong arrived");
 		if (reconnect !== null && attempt < reconnect.maxAttempts) {
 			attempt += 1;
 			const currentAttempt = attempt;
@@ -377,20 +423,32 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await doConnect(address, localDomains);
 			},
 			async sendPing() {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				const link = requireConnectedLink();
 				const ping = { type: "ping" };
 				frameLog.push({
 					direction: "sent",
 					frame: ping
 				});
-				await connection.send(ping);
+				await link.send(ping);
 				emit();
 			},
+			async sendPingMeasureRtt(timeoutMs) {
+				const link = requireConnectedLink();
+				return pingRoundTrips.sendAndAwait(clock.now(), async () => {
+					const ping = { type: "ping" };
+					frameLog.push({
+						direction: "sent",
+						frame: ping
+					});
+					await link.send(ping);
+					emit();
+				}, timeoutMs);
+			},
 			setToken(token) {
 				currentToken = token;
 			},
 			async sendManageRequest(command, scope, targetDevice, token, timeoutMs) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				if (targetDevice !== void 0) await ensureRelayPairing(targetDevice);
 				const frame = buildManageRequest(command, scope, token);
 				const requestId = frame["request-id"];
@@ -417,7 +475,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				})]);
 			},
 			async sendRevocationAnnounce(entries) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				const frame = {
 					type: "revocation-announce",
 					entries: [...entries]
@@ -430,7 +488,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				emit();
 			},
 			async sendGossipUpdate(extensions) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				const frame = buildSelfAdvert(extensions);
 				frameLog.push({
 					direction: "sent",
@@ -440,7 +498,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				emit();
 			},
 			async sendDataFrame(frame) {
-				if (connection === null || state.status !== "connected") throw new Error("not connected");
+				requireConnectedLink();
 				frameLog.push({
 					direction: "sent",
 					frame
@@ -459,6 +517,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					reconnectTimer = null;
 				}
 				rejectPendingManageRequests("connection closed before a response arrived");
+				pingRoundTrips.rejectAll("connection closed before a pong arrived");
 				if (connection !== null) await connection.close();
 				if (state.status === "connected" || state.status === "connecting" || state.status === "reconnecting") state = {
 					status: "closed",

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Et as RoomNoticeClaims, T as DataHaveFrame, Tt as RoomNotice, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
+import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-Cl8sQo7o.cjs";
+import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**