wire-mesh-core 1.54.0 → 1.56.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-D2Ue2nd2.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-D2Ue2nd2.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CbXX1Xd-.cjs";
+import { r as Transport } from "../transport-fUY3alfO.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DG9ouGe-.mjs";
+import { r as Transport } from "../transport-C5wU0UtA.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CbXX1Xd-.cjs";
+import { r as Transport } from "../transport-fUY3alfO.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DG9ouGe-.mjs";
+import { r as Transport } from "../transport-C5wU0UtA.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-CbXX1Xd-.cjs";
+import { t as Connection } from "../transport-fUY3alfO.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-DG9ouGe-.mjs";
+import { t as Connection } from "../transport-C5wU0UtA.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
+import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-BVrgBeqF.mjs";
+import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.cjs

@@ -0,0 +1,64 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/direct-manage-request.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+async function acceptDirectManageRequest(connection) {
+	const result = await connection.receive()[Symbol.asyncIterator]().next();
+	if (result.done === true || result.value.type !== "manage-request") return null;
+	const frame = result.value;
+	return {
+		requestId: frame["request-id"],
+		command: frame.command,
+		scope: frame.scope,
+		...frame.token !== void 0 ? { token: frame.token } : {},
+		respond: async (outcome) => {
+			const response = {
+				type: "manage-response",
+				"request-id": frame["request-id"],
+				outcome
+			};
+			await connection.send(response);
+			await connection.close();
+		}
+	};
+}
+async function waitForDirectManageResponse(link, requestId) {
+	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
+	throw new Error("connection closed before a response arrived");
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
+	const link = await transport.connect(address);
+	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && require_domain_device_id.deviceIdToHex(link.peerDeviceId) !== require_domain_device_id.deviceIdToHex(options.expectedPeerDeviceId)) {
+		await link.close();
+		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
+	}
+	const requestId = 0;
+	const frame = {
+		type: "manage-request",
+		"request-id": requestId,
+		command,
+		scope,
+		...options.token !== void 0 ? { token: options.token } : {}
+	};
+	await link.send(frame);
+	const responsePromise = waitForDirectManageResponse(link, requestId);
+	let outcome;
+	if (options.timeoutMs === void 0) outcome = await responsePromise;
+	else {
+		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+			setTimeout(() => {
+				resolve({
+					result: "error",
+					code: "timeout"
+				});
+			}, options.timeoutMs);
+		})]);
+		responsePromise.catch(() => void 0);
+	}
+	await link.close();
+	return outcome;
+}
+//#endregion
+exports.acceptDirectManageRequest = acceptDirectManageRequest;
+exports.sendDirectManageRequest = sendDirectManageRequest;

package/dist/domain/direct-manage-request.d.cts

@@ -0,0 +1,16 @@
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { r as Transport, t as Connection } from "../transport-fUY3alfO.cjs";
+import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
+//#region src/domain/direct-manage-request.d.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
+export interface DirectManageRequestOptions {
+  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
+  expectedPeerDeviceId?: DeviceId;
+  token?: CapabilityToken;
+  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
+  timeoutMs?: number;
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
+//#endregion

package/dist/domain/direct-manage-request.d.mts

@@ -0,0 +1,16 @@
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { r as Transport, t as Connection } from "../transport-C5wU0UtA.mjs";
+import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
+//#region src/domain/direct-manage-request.d.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
+export interface DirectManageRequestOptions {
+  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
+  expectedPeerDeviceId?: DeviceId;
+  token?: CapabilityToken;
+  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
+  timeoutMs?: number;
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
+//#endregion

package/dist/domain/direct-manage-request.mjs

@@ -0,0 +1,62 @@
+import { deviceIdToHex } from "./device-id.mjs";
+//#region src/domain/direct-manage-request.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+async function acceptDirectManageRequest(connection) {
+	const result = await connection.receive()[Symbol.asyncIterator]().next();
+	if (result.done === true || result.value.type !== "manage-request") return null;
+	const frame = result.value;
+	return {
+		requestId: frame["request-id"],
+		command: frame.command,
+		scope: frame.scope,
+		...frame.token !== void 0 ? { token: frame.token } : {},
+		respond: async (outcome) => {
+			const response = {
+				type: "manage-response",
+				"request-id": frame["request-id"],
+				outcome
+			};
+			await connection.send(response);
+			await connection.close();
+		}
+	};
+}
+async function waitForDirectManageResponse(link, requestId) {
+	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
+	throw new Error("connection closed before a response arrived");
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
+	const link = await transport.connect(address);
+	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && deviceIdToHex(link.peerDeviceId) !== deviceIdToHex(options.expectedPeerDeviceId)) {
+		await link.close();
+		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
+	}
+	const requestId = 0;
+	const frame = {
+		type: "manage-request",
+		"request-id": requestId,
+		command,
+		scope,
+		...options.token !== void 0 ? { token: options.token } : {}
+	};
+	await link.send(frame);
+	const responsePromise = waitForDirectManageResponse(link, requestId);
+	let outcome;
+	if (options.timeoutMs === void 0) outcome = await responsePromise;
+	else {
+		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+			setTimeout(() => {
+				resolve({
+					result: "error",
+					code: "timeout"
+				});
+			}, options.timeoutMs);
+		})]);
+		responsePromise.catch(() => void 0);
+	}
+	await link.close();
+	return outcome;
+}
+//#endregion
+export { acceptDirectManageRequest, sendDirectManageRequest };

package/dist/domain/gossip-expansion.cjs

@@ -0,0 +1,44 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/gossip-expansion.ts
+function toError(value) {
+	return value instanceof Error ? value : new Error(String(value));
+}
+/** Builds the per-device expansion state machine: ask once, dial every advertised address in order on approval, report exactly one outcome. */
+function createGossipExpansion(options) {
+	const selfHex = require_domain_device_id.deviceIdToHex(options.selfDeviceId);
+	const considered = /* @__PURE__ */ new Set();
+	async function expand(candidate) {
+		let approved;
+		try {
+			approved = await options.shouldExpand(candidate);
+		} catch (error) {
+			options.onExpansionFailed?.(candidate, [toError(error)]);
+			return;
+		}
+		if (!approved) {
+			options.onExpansionDeclined?.(candidate);
+			return;
+		}
+		const errors = [];
+		for (const address of candidate.addresses) try {
+			const session = await options.dial(address);
+			options.onExpanded(candidate, address, session);
+			return;
+		} catch (error) {
+			errors.push(toError(error));
+		}
+		options.onExpansionFailed?.(candidate, errors);
+	}
+	return { considerAdvert(advert) {
+		const hex = require_domain_device_id.deviceIdToHex(advert.device);
+		if (hex === selfHex || considered.has(hex) || advert.addresses.length === 0) return;
+		considered.add(hex);
+		expand({
+			device: advert.device,
+			addresses: advert.addresses
+		});
+	} };
+}
+//#endregion
+exports.createGossipExpansion = createGossipExpansion;

package/dist/domain/gossip-expansion.d.cts

@@ -0,0 +1,29 @@
+import { D as DeviceId, et as PeerAdvert } from "../protocol-D2Ue2nd2.cjs";
+import { MeshSession } from "./mesh-session.cjs";
+//#region src/domain/gossip-expansion.d.ts
+/** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */
+export interface GossipExpansionCandidate {
+  readonly device: DeviceId;
+  readonly addresses: readonly string[];
+}
+export interface GossipExpansionOptions {
+  /** This session's own device-id, so its own self-advert (looped back through gossip forwarding or a hub's catch-up frame) is never offered to shouldExpand as if it were a distinct peer. */
+  selfDeviceId: DeviceId;
+  /** Decides whether to attempt a direct connection to a newly-discovered device at all -- called at most once per device for this GossipExpansion instance's lifetime, never re-asked if the same device later re-adverts (an address change, a fresher snapshot-seconds). Returning true does not guarantee a connection: dial may still fail for every one of the candidate's addresses, reported via onExpansionFailed. */
+  shouldExpand: (candidate: Readonly<GossipExpansionCandidate>) => Promise<boolean> | boolean;
+  /** Attempts one direct connection to `address`, resolving with a fully connected MeshSession or rejecting if the dial/handshake fails. Typically wraps createMeshSession(transport, identity, ...) followed by session.connect(address, localDomains). Called once per address of an approved candidate, in the order it advertised them, stopping at the first that succeeds -- the caller owns cleanup of any partially-established session behind a rejected dial, since this module never holds a reference to one that didn't resolve. */
+  dial: (address: string) => Promise<MeshSession>;
+  /** Called once a candidate's dial succeeds, with the specific address that connected (one of candidate.addresses, not necessarily the first -- earlier ones may have failed) and the now-connected session, so the caller can wire it into whatever it already does for its own sessions (render it, merge its directory, route messages). */
+  onExpanded: (candidate: Readonly<GossipExpansionCandidate>, address: string, session: MeshSession) => void;
+  /** Called when shouldExpand itself declines a candidate. */
+  onExpansionDeclined?: (candidate: Readonly<GossipExpansionCandidate>) => void;
+  /** Called once every one of an approved candidate's addresses has failed to connect, or shouldExpand itself rejected -- in the latter case, errors holds exactly the one rejection reason, so a caller doesn't need two separate failure channels to observe every way expansion can fail short of success. */
+  onExpansionFailed?: (candidate: Readonly<GossipExpansionCandidate>, errors: readonly Error[]) => void;
+}
+export interface GossipExpansion {
+  /** Feed one just-received peer-advert -- from the session whose peer-adverts this expansion watches, via its own onPeerAdvert hook -- to decide whether it names a newly-discoverable peer worth expanding to, and if so kick off an expansion attempt for it. Never awaits a dial to completion inline: expansion happens in the background, observable only through onExpanded/onExpansionDeclined/onExpansionFailed. */
+  considerAdvert: (advert: Readonly<PeerAdvert>) => void;
+}
+/** Builds the per-device expansion state machine: ask once, dial every advertised address in order on approval, report exactly one outcome. */
+export declare function createGossipExpansion(options: Readonly<GossipExpansionOptions>): GossipExpansion;
+//#endregion

package/dist/domain/gossip-expansion.d.mts

@@ -0,0 +1,29 @@
+import { D as DeviceId, et as PeerAdvert } from "../protocol-D2Ue2nd2.mjs";
+import { MeshSession } from "./mesh-session.mjs";
+//#region src/domain/gossip-expansion.d.ts
+/** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */
+export interface GossipExpansionCandidate {
+  readonly device: DeviceId;
+  readonly addresses: readonly string[];
+}
+export interface GossipExpansionOptions {
+  /** This session's own device-id, so its own self-advert (looped back through gossip forwarding or a hub's catch-up frame) is never offered to shouldExpand as if it were a distinct peer. */
+  selfDeviceId: DeviceId;
+  /** Decides whether to attempt a direct connection to a newly-discovered device at all -- called at most once per device for this GossipExpansion instance's lifetime, never re-asked if the same device later re-adverts (an address change, a fresher snapshot-seconds). Returning true does not guarantee a connection: dial may still fail for every one of the candidate's addresses, reported via onExpansionFailed. */
+  shouldExpand: (candidate: Readonly<GossipExpansionCandidate>) => Promise<boolean> | boolean;
+  /** Attempts one direct connection to `address`, resolving with a fully connected MeshSession or rejecting if the dial/handshake fails. Typically wraps createMeshSession(transport, identity, ...) followed by session.connect(address, localDomains). Called once per address of an approved candidate, in the order it advertised them, stopping at the first that succeeds -- the caller owns cleanup of any partially-established session behind a rejected dial, since this module never holds a reference to one that didn't resolve. */
+  dial: (address: string) => Promise<MeshSession>;
+  /** Called once a candidate's dial succeeds, with the specific address that connected (one of candidate.addresses, not necessarily the first -- earlier ones may have failed) and the now-connected session, so the caller can wire it into whatever it already does for its own sessions (render it, merge its directory, route messages). */
+  onExpanded: (candidate: Readonly<GossipExpansionCandidate>, address: string, session: MeshSession) => void;
+  /** Called when shouldExpand itself declines a candidate. */
+  onExpansionDeclined?: (candidate: Readonly<GossipExpansionCandidate>) => void;
+  /** Called once every one of an approved candidate's addresses has failed to connect, or shouldExpand itself rejected -- in the latter case, errors holds exactly the one rejection reason, so a caller doesn't need two separate failure channels to observe every way expansion can fail short of success. */
+  onExpansionFailed?: (candidate: Readonly<GossipExpansionCandidate>, errors: readonly Error[]) => void;
+}
+export interface GossipExpansion {
+  /** Feed one just-received peer-advert -- from the session whose peer-adverts this expansion watches, via its own onPeerAdvert hook -- to decide whether it names a newly-discoverable peer worth expanding to, and if so kick off an expansion attempt for it. Never awaits a dial to completion inline: expansion happens in the background, observable only through onExpanded/onExpansionDeclined/onExpansionFailed. */
+  considerAdvert: (advert: Readonly<PeerAdvert>) => void;
+}
+/** Builds the per-device expansion state machine: ask once, dial every advertised address in order on approval, report exactly one outcome. */
+export declare function createGossipExpansion(options: Readonly<GossipExpansionOptions>): GossipExpansion;
+//#endregion

package/dist/domain/gossip-expansion.mjs

@@ -0,0 +1,43 @@
+import { deviceIdToHex } from "./device-id.mjs";
+//#region src/domain/gossip-expansion.ts
+function toError(value) {
+	return value instanceof Error ? value : new Error(String(value));
+}
+/** Builds the per-device expansion state machine: ask once, dial every advertised address in order on approval, report exactly one outcome. */
+function createGossipExpansion(options) {
+	const selfHex = deviceIdToHex(options.selfDeviceId);
+	const considered = /* @__PURE__ */ new Set();
+	async function expand(candidate) {
+		let approved;
+		try {
+			approved = await options.shouldExpand(candidate);
+		} catch (error) {
+			options.onExpansionFailed?.(candidate, [toError(error)]);
+			return;
+		}
+		if (!approved) {
+			options.onExpansionDeclined?.(candidate);
+			return;
+		}
+		const errors = [];
+		for (const address of candidate.addresses) try {
+			const session = await options.dial(address);
+			options.onExpanded(candidate, address, session);
+			return;
+		} catch (error) {
+			errors.push(toError(error));
+		}
+		options.onExpansionFailed?.(candidate, errors);
+	}
+	return { considerAdvert(advert) {
+		const hex = deviceIdToHex(advert.device);
+		if (hex === selfHex || considered.has(hex) || advert.addresses.length === 0) return;
+		considered.add(hex);
+		expand({
+			device: advert.device,
+			addresses: advert.addresses
+		});
+	} };
+}
+//#endregion
+export { createGossipExpansion };

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-D2Ue2nd2.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-D2Ue2nd2.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-D2Ue2nd2.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-D2Ue2nd2.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;