wire-mesh-core 1.54.0 → 1.56.0

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
+let package_json = require("../../package.json");
+package_json = require_rolldown_runtime.__toESM(package_json, 1);
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -49,6 +52,24 @@ function createPingRoundTrips() {
 	};
 }
 //#endregion
+//#region src/domain/own-version.ts
+/** This node's own actual, currently-running wire-mesh-core version -- read once from the installed package's own package.json, never from anything gossiped or cached, so buildSelfAdvert's own self-advert extension and version.get's manage-response both always answer with the truth for this exact running process. */
+const OWN_VERSION = package_json.default.version;
+/** The gossip extension key wire-mesh-core itself injects into every self-advert (mesh-session.ts's own buildSelfAdvert) to report OWN_VERSION -- reserved so a sendGossipUpdate caller can never also supply it, separately from peer-advert's own typed struct fields (RESERVED_PEER_ADVERT_KEYS in mesh-session.ts), since this is just an extension-tail key (transport.cddl), not a struct field. */
+const CORE_VERSION_GOSSIP_KEY = "wire-mesh/version";
+const VERSION_GET_VERB = "version.get";
+/** True when params is the core/version domain's own version-get command (version.cddl) -- a receiver answers this unconditionally, bypassing incomingManageRequests entirely, since it is deliberately ungated: exactly as sensitive as what CORE_VERSION_GOSSIP_KEY already broadcasts unconditionally via gossip. */
+function isVersionGetCommand(params) {
+	return "verb" in params && params.verb === VERSION_GET_VERB;
+}
+/** The manage-ok outcome mesh-session.ts answers a version.get request with -- OWN_VERSION on manage-ok's own open `* tstr => any` tail, the same pattern exec-list's own exec-session-info result already uses. */
+function versionGetOutcome() {
+	return {
+		result: "ok",
+		version: OWN_VERSION
+	};
+}
+//#endregion
 //#region src/domain/gossip-extensions.ts
 /** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
 const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
@@ -58,10 +79,11 @@ const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
 ]);
 /** A gossip extension key must be domain-qualified as `<domain>/<field>` (lowercase kebab-case each side), per `spec/CONVENTIONS.md`'s gossip-extension-namespacing convention -- this is what stops two independent applications sharing one gossip tail from silently colliding on a bare name like "status". */
 const GOSSIP_EXTENSION_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
-/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields or use a bare, non-domain-qualified key -- both are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
+/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields, use the key wire-mesh-core itself reserves for its own self-reported version, or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
 function validateGossipExtensions(extensions) {
 	for (const key of Object.keys(extensions)) {
 		if (RESERVED_PEER_ADVERT_KEYS.has(key)) throw new Error(`sendGossipUpdate extension key "${key}" collides with a mandatory peer-advert field`);
+		if (key === "wire-mesh/version") throw new Error(`sendGossipUpdate extension key "${key}" is reserved for wire-mesh-core's own self-reported version`);
 		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
 	}
 }
@@ -162,12 +184,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			pending.resolve(frame.outcome);
 		}
 	}
-	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. */
+	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. A version.get request (VERSION_GET_VERB) is answered directly, right here, rather than ever reaching incomingManageRequests -- deliberately ungated (version.cddl), so no application needs to remember to register its own handler for it the way every other verb requires. */
 	function applyManageRequest(frame, relayFrame) {
 		const requestId = frame["request-id"];
 		const fromDevice = relayFrame?.["from-device"];
 		const toDevice = relayFrame?.["to-device"];
-		emitIncomingManageRequest({
+		const incoming = {
 			requestId,
 			command: frame.command,
 			scope: frame.scope,
@@ -187,7 +209,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(response, relayFrame !== void 0, fromDevice);
 				emit();
 			}
-		});
+		};
+		if (isVersionGetCommand(frame.command.params)) {
+			incoming.respond(versionGetOutcome());
+			return;
+		}
+		emitIncomingManageRequest(incoming);
 	}
 	function applyFrame(frame) {
 		if (frame.type === "relay-data") {
@@ -301,13 +328,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		onSessionEnd?.(link);
 		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
 	}
-	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions are spread before the three mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects that case loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
+	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions and CORE_VERSION_GOSSIP_KEY are spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects both collisions loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
 	function buildSelfAdvert(extensions) {
 		if (extensions !== void 0) validateGossipExtensions(extensions);
 		return {
 			type: "gossip",
 			peers: [{
 				...extensions,
+				[CORE_VERSION_GOSSIP_KEY]: OWN_VERSION,
 				device: identity.deviceId,
 				addresses: [...addresses],
 				"snapshot-seconds": Math.floor(clock.now() / MS_PER_SECOND)
@@ -530,8 +558,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = []) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), void 0, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */
@@ -543,9 +571,11 @@ async function acceptMeshSession(connection, identity, localDomains, options = {
 	});
 	let peerDeviceIdResolved = false;
 	const { session, wireUpConnection } = createSessionCore(identity, clock, null, null, (advert) => {
-		if (peerDeviceIdResolved) return;
-		peerDeviceIdResolved = true;
-		resolvePeerDeviceId?.(advert.device);
+		if (!peerDeviceIdResolved) {
+			peerDeviceIdResolved = true;
+			resolvePeerDeviceId?.(advert.device);
+		}
+		options.onPeerAdvert?.(advert);
 	}, options.addresses, options.onFrame, options.onSessionEnd);
 	await wireUpConnection(connection, options.label ?? "accepted", localDomains);
 	return {
@@ -553,67 +583,7 @@ async function acceptMeshSession(connection, identity, localDomains, options = {
 		peerDeviceId
 	};
 }
-/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against applyManageRequest/applyFrame above). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
-async function acceptDirectManageRequest(connection) {
-	const result = await connection.receive()[Symbol.asyncIterator]().next();
-	if (result.done === true || result.value.type !== "manage-request") return null;
-	const frame = result.value;
-	return {
-		requestId: frame["request-id"],
-		command: frame.command,
-		scope: frame.scope,
-		...frame.token !== void 0 ? { token: frame.token } : {},
-		respond: async (outcome) => {
-			const response = {
-				type: "manage-response",
-				"request-id": frame["request-id"],
-				outcome
-			};
-			await connection.send(response);
-			await connection.close();
-		}
-	};
-}
-async function waitForDirectManageResponse(link, requestId) {
-	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
-	throw new Error("connection closed before a response arrived");
-}
-/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
-async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
-	const link = await transport.connect(address);
-	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && require_domain_device_id.deviceIdToHex(link.peerDeviceId) !== require_domain_device_id.deviceIdToHex(options.expectedPeerDeviceId)) {
-		await link.close();
-		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
-	}
-	const requestId = 0;
-	const frame = {
-		type: "manage-request",
-		"request-id": requestId,
-		command,
-		scope,
-		...options.token !== void 0 ? { token: options.token } : {}
-	};
-	await link.send(frame);
-	const responsePromise = waitForDirectManageResponse(link, requestId);
-	let outcome;
-	if (options.timeoutMs === void 0) outcome = await responsePromise;
-	else {
-		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve({
-					result: "error",
-					code: "timeout"
-				});
-			}, options.timeoutMs);
-		})]);
-		responsePromise.catch(() => void 0);
-	}
-	await link.close();
-	return outcome;
-}
 //#endregion
 exports.HANDSHAKE_TIMEOUT_MS = HANDSHAKE_TIMEOUT_MS;
-exports.acceptDirectManageRequest = acceptDirectManageRequest;
 exports.acceptMeshSession = acceptMeshSession;
 exports.createMeshSession = createMeshSession;
-exports.sendDirectManageRequest = sendDirectManageRequest;

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-CbXX1Xd-.cjs";
+import { r as Transport, t as Connection } from "../transport-fUY3alfO.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -95,7 +95,9 @@ export interface MeshSession {
 }
 export declare function createMeshSession(transport: Readonly<Transport>, identity: Readonly<IdentityPort>, clock?: Readonly<Clock>, reconnect?: ReconnectPolicy | null,
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
-addresses?: readonly string[]): MeshSession;
+addresses?: readonly string[],
+/** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
+onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */
@@ -111,18 +113,9 @@ export interface AcceptedMeshSessionOptions {
   onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>;
   /** Fired once this session's own connection.receive() stream ends -- the counterpart a RelayHub's own forgetConnection needs, since its registry is keyed by this exact Connection and must be cleaned up when it specifically ends. */
   onSessionEnd?: (connection: Readonly<Connection>) => void;
+  /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- alongside (never instead of) this session's own internal peerDeviceId resolution, which uses this identical hook internally and keeps working unchanged. See createMeshSession's own onPeerAdvert doc comment for why this exists: a gossip-expansion consumer (wire-mesh#187) needs to observe every advert without becoming a second, competing consumer of this session's own single-reader events stream. */
+  onPeerAdvert?: (advert: PeerAdvert) => void;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */
 export declare function acceptMeshSession(connection: Readonly<Connection>, identity: Readonly<IdentityPort>, localDomains: readonly string[], options?: Readonly<AcceptedMeshSessionOptions>): Promise<AcceptedMeshSession>;
-/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against applyManageRequest/applyFrame above). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
-export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
-export interface DirectManageRequestOptions {
-  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
-  expectedPeerDeviceId?: DeviceId;
-  token?: CapabilityToken;
-  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
-  timeoutMs?: number;
-}
-/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
-export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
 //#endregion

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-DG9ouGe-.mjs";
+import { r as Transport, t as Connection } from "../transport-C5wU0UtA.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -95,7 +95,9 @@ export interface MeshSession {
 }
 export declare function createMeshSession(transport: Readonly<Transport>, identity: Readonly<IdentityPort>, clock?: Readonly<Clock>, reconnect?: ReconnectPolicy | null,
 /** This node's own directly-reachable "host:port" candidates (wire-mesh#38), advertised in this session's self-advert so other peers can attempt a direct connection instead of always falling back to a relay. Omit (or pass none) for a caller with nothing to offer, e.g. a browser client. */
-addresses?: readonly string[]): MeshSession;
+addresses?: readonly string[],
+/** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
+onPeerAdvert?: (advert: PeerAdvert) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */
@@ -111,18 +113,9 @@ export interface AcceptedMeshSessionOptions {
   onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>;
   /** Fired once this session's own connection.receive() stream ends -- the counterpart a RelayHub's own forgetConnection needs, since its registry is keyed by this exact Connection and must be cleaned up when it specifically ends. */
   onSessionEnd?: (connection: Readonly<Connection>) => void;
+  /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- alongside (never instead of) this session's own internal peerDeviceId resolution, which uses this identical hook internally and keeps working unchanged. See createMeshSession's own onPeerAdvert doc comment for why this exists: a gossip-expansion consumer (wire-mesh#187) needs to observe every advert without becoming a second, competing consumer of this session's own single-reader events stream. */
+  onPeerAdvert?: (advert: PeerAdvert) => void;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */
 export declare function acceptMeshSession(connection: Readonly<Connection>, identity: Readonly<IdentityPort>, localDomains: readonly string[], options?: Readonly<AcceptedMeshSessionOptions>): Promise<AcceptedMeshSession>;
-/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against applyManageRequest/applyFrame above). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
-export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
-export interface DirectManageRequestOptions {
-  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
-  expectedPeerDeviceId?: DeviceId;
-  token?: CapabilityToken;
-  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
-  timeoutMs?: number;
-}
-/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
-export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
 //#endregion

package/dist/domain/mesh-session.mjs

@@ -1,6 +1,7 @@
 import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
 import { tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
+import packageJson from "../../package.json" with { type: "json" };
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -48,6 +49,24 @@ function createPingRoundTrips() {
 	};
 }
 //#endregion
+//#region src/domain/own-version.ts
+/** This node's own actual, currently-running wire-mesh-core version -- read once from the installed package's own package.json, never from anything gossiped or cached, so buildSelfAdvert's own self-advert extension and version.get's manage-response both always answer with the truth for this exact running process. */
+const OWN_VERSION = packageJson.version;
+/** The gossip extension key wire-mesh-core itself injects into every self-advert (mesh-session.ts's own buildSelfAdvert) to report OWN_VERSION -- reserved so a sendGossipUpdate caller can never also supply it, separately from peer-advert's own typed struct fields (RESERVED_PEER_ADVERT_KEYS in mesh-session.ts), since this is just an extension-tail key (transport.cddl), not a struct field. */
+const CORE_VERSION_GOSSIP_KEY = "wire-mesh/version";
+const VERSION_GET_VERB = "version.get";
+/** True when params is the core/version domain's own version-get command (version.cddl) -- a receiver answers this unconditionally, bypassing incomingManageRequests entirely, since it is deliberately ungated: exactly as sensitive as what CORE_VERSION_GOSSIP_KEY already broadcasts unconditionally via gossip. */
+function isVersionGetCommand(params) {
+	return "verb" in params && params.verb === VERSION_GET_VERB;
+}
+/** The manage-ok outcome mesh-session.ts answers a version.get request with -- OWN_VERSION on manage-ok's own open `* tstr => any` tail, the same pattern exec-list's own exec-session-info result already uses. */
+function versionGetOutcome() {
+	return {
+		result: "ok",
+		version: OWN_VERSION
+	};
+}
+//#endregion
 //#region src/domain/gossip-extensions.ts
 /** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
 const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
@@ -57,10 +76,11 @@ const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
 ]);
 /** A gossip extension key must be domain-qualified as `<domain>/<field>` (lowercase kebab-case each side), per `spec/CONVENTIONS.md`'s gossip-extension-namespacing convention -- this is what stops two independent applications sharing one gossip tail from silently colliding on a bare name like "status". */
 const GOSSIP_EXTENSION_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
-/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields or use a bare, non-domain-qualified key -- both are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
+/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields, use the key wire-mesh-core itself reserves for its own self-reported version, or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
 function validateGossipExtensions(extensions) {
 	for (const key of Object.keys(extensions)) {
 		if (RESERVED_PEER_ADVERT_KEYS.has(key)) throw new Error(`sendGossipUpdate extension key "${key}" collides with a mandatory peer-advert field`);
+		if (key === "wire-mesh/version") throw new Error(`sendGossipUpdate extension key "${key}" is reserved for wire-mesh-core's own self-reported version`);
 		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
 	}
 }
@@ -161,12 +181,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			pending.resolve(frame.outcome);
 		}
 	}
-	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. */
+	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. A version.get request (VERSION_GET_VERB) is answered directly, right here, rather than ever reaching incomingManageRequests -- deliberately ungated (version.cddl), so no application needs to remember to register its own handler for it the way every other verb requires. */
 	function applyManageRequest(frame, relayFrame) {
 		const requestId = frame["request-id"];
 		const fromDevice = relayFrame?.["from-device"];
 		const toDevice = relayFrame?.["to-device"];
-		emitIncomingManageRequest({
+		const incoming = {
 			requestId,
 			command: frame.command,
 			scope: frame.scope,
@@ -186,7 +206,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(response, relayFrame !== void 0, fromDevice);
 				emit();
 			}
-		});
+		};
+		if (isVersionGetCommand(frame.command.params)) {
+			incoming.respond(versionGetOutcome());
+			return;
+		}
+		emitIncomingManageRequest(incoming);
 	}
 	function applyFrame(frame) {
 		if (frame.type === "relay-data") {
@@ -300,13 +325,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		onSessionEnd?.(link);
 		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
 	}
-	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions are spread before the three mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects that case loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
+	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions and CORE_VERSION_GOSSIP_KEY are spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects both collisions loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
 	function buildSelfAdvert(extensions) {
 		if (extensions !== void 0) validateGossipExtensions(extensions);
 		return {
 			type: "gossip",
 			peers: [{
 				...extensions,
+				[CORE_VERSION_GOSSIP_KEY]: OWN_VERSION,
 				device: identity.deviceId,
 				addresses: [...addresses],
 				"snapshot-seconds": Math.floor(clock.now() / MS_PER_SECOND)
@@ -529,8 +555,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = []) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), void 0, addresses);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */
@@ -542,9 +568,11 @@ async function acceptMeshSession(connection, identity, localDomains, options = {
 	});
 	let peerDeviceIdResolved = false;
 	const { session, wireUpConnection } = createSessionCore(identity, clock, null, null, (advert) => {
-		if (peerDeviceIdResolved) return;
-		peerDeviceIdResolved = true;
-		resolvePeerDeviceId?.(advert.device);
+		if (!peerDeviceIdResolved) {
+			peerDeviceIdResolved = true;
+			resolvePeerDeviceId?.(advert.device);
+		}
+		options.onPeerAdvert?.(advert);
 	}, options.addresses, options.onFrame, options.onSessionEnd);
 	await wireUpConnection(connection, options.label ?? "accepted", localDomains);
 	return {
@@ -552,63 +580,5 @@ async function acceptMeshSession(connection, identity, localDomains, options = {
 		peerDeviceId
 	};
 }
-/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against applyManageRequest/applyFrame above). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
-async function acceptDirectManageRequest(connection) {
-	const result = await connection.receive()[Symbol.asyncIterator]().next();
-	if (result.done === true || result.value.type !== "manage-request") return null;
-	const frame = result.value;
-	return {
-		requestId: frame["request-id"],
-		command: frame.command,
-		scope: frame.scope,
-		...frame.token !== void 0 ? { token: frame.token } : {},
-		respond: async (outcome) => {
-			const response = {
-				type: "manage-response",
-				"request-id": frame["request-id"],
-				outcome
-			};
-			await connection.send(response);
-			await connection.close();
-		}
-	};
-}
-async function waitForDirectManageResponse(link, requestId) {
-	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
-	throw new Error("connection closed before a response arrived");
-}
-/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
-async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
-	const link = await transport.connect(address);
-	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && deviceIdToHex(link.peerDeviceId) !== deviceIdToHex(options.expectedPeerDeviceId)) {
-		await link.close();
-		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
-	}
-	const requestId = 0;
-	const frame = {
-		type: "manage-request",
-		"request-id": requestId,
-		command,
-		scope,
-		...options.token !== void 0 ? { token: options.token } : {}
-	};
-	await link.send(frame);
-	const responsePromise = waitForDirectManageResponse(link, requestId);
-	let outcome;
-	if (options.timeoutMs === void 0) outcome = await responsePromise;
-	else {
-		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve({
-					result: "error",
-					code: "timeout"
-				});
-			}, options.timeoutMs);
-		})]);
-		responsePromise.catch(() => void 0);
-	}
-	await link.close();
-	return outcome;
-}
 //#endregion
-export { HANDSHAKE_TIMEOUT_MS, acceptDirectManageRequest, acceptMeshSession, createMeshSession, sendDirectManageRequest };
+export { HANDSHAKE_TIMEOUT_MS, acceptMeshSession, createMeshSession };

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
+import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-BVrgBeqF.mjs";
+import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-PhUVprXA.cjs";
-import { t as Connection } from "../transport-CbXX1Xd-.cjs";
+import { N as Frame } from "../protocol-D2Ue2nd2.cjs";
+import { t as Connection } from "../transport-fUY3alfO.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, forwards relay-data within established pairings, and replies to a bare ping with a bare pong (wire-mesh#181) so a client can time its own sender-to-hub leg independent of anything being relayed. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-PhUVprXA.mjs";
-import { t as Connection } from "../transport-DG9ouGe-.mjs";
+import { N as Frame } from "../protocol-D2Ue2nd2.mjs";
+import { t as Connection } from "../transport-C5wU0UtA.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, forwards relay-data within established pairings, and replies to a bare ping with a bare pong (wire-mesh#181) so a client can time its own sender-to-hub leg independent of anything being relayed. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-PhUVprXA.cjs";
-import { t as Connection } from "../transport-CbXX1Xd-.cjs";
+import { N as Frame } from "../protocol-D2Ue2nd2.cjs";
+import { t as Connection } from "../transport-fUY3alfO.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-PhUVprXA.mjs";
-import { t as Connection } from "../transport-DG9ouGe-.mjs";
+import { N as Frame } from "../protocol-D2Ue2nd2.mjs";
+import { t as Connection } from "../transport-C5wU0UtA.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-PhUVprXA.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DIPzZ9JJ.cjs";
+import { bt as RevocationEntry } from "../protocol-D2Ue2nd2.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BtczHfrc.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-PhUVprXA.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BVrgBeqF.mjs";
+import { bt as RevocationEntry } from "../protocol-D2Ue2nd2.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-Hnq9oURj.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/room-rekey.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
+import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-BVrgBeqF.mjs";
+import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-D8HndWYM.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CNXMjIQd.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-Dv1O6-FV.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-ZHgJhnsu.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };