wire-mesh-core 1.55.0 → 1.57.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-D2Ue2nd2.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-D2Ue2nd2.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CbXX1Xd-.cjs";
+import { r as Transport } from "../transport-fUY3alfO.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DG9ouGe-.mjs";
+import { r as Transport } from "../transport-C5wU0UtA.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CbXX1Xd-.cjs";
+import { r as Transport } from "../transport-fUY3alfO.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DG9ouGe-.mjs";
+import { r as Transport } from "../transport-C5wU0UtA.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-CbXX1Xd-.cjs";
+import { t as Connection } from "../transport-fUY3alfO.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-DG9ouGe-.mjs";
+import { t as Connection } from "../transport-C5wU0UtA.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DIPzZ9JJ.cjs";
+import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-BVrgBeqF.mjs";
+import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D2Ue2nd2.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-PhUVprXA.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D2Ue2nd2.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-CmD4l_Mp.cjs";
+import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-BXrJ6_YM.mjs";
+import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.cjs

@@ -0,0 +1,64 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/direct-manage-request.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+async function acceptDirectManageRequest(connection) {
+	const result = await connection.receive()[Symbol.asyncIterator]().next();
+	if (result.done === true || result.value.type !== "manage-request") return null;
+	const frame = result.value;
+	return {
+		requestId: frame["request-id"],
+		command: frame.command,
+		scope: frame.scope,
+		...frame.token !== void 0 ? { token: frame.token } : {},
+		respond: async (outcome) => {
+			const response = {
+				type: "manage-response",
+				"request-id": frame["request-id"],
+				outcome
+			};
+			await connection.send(response);
+			await connection.close();
+		}
+	};
+}
+async function waitForDirectManageResponse(link, requestId) {
+	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
+	throw new Error("connection closed before a response arrived");
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
+	const link = await transport.connect(address);
+	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && require_domain_device_id.deviceIdToHex(link.peerDeviceId) !== require_domain_device_id.deviceIdToHex(options.expectedPeerDeviceId)) {
+		await link.close();
+		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
+	}
+	const requestId = 0;
+	const frame = {
+		type: "manage-request",
+		"request-id": requestId,
+		command,
+		scope,
+		...options.token !== void 0 ? { token: options.token } : {}
+	};
+	await link.send(frame);
+	const responsePromise = waitForDirectManageResponse(link, requestId);
+	let outcome;
+	if (options.timeoutMs === void 0) outcome = await responsePromise;
+	else {
+		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+			setTimeout(() => {
+				resolve({
+					result: "error",
+					code: "timeout"
+				});
+			}, options.timeoutMs);
+		})]);
+		responsePromise.catch(() => void 0);
+	}
+	await link.close();
+	return outcome;
+}
+//#endregion
+exports.acceptDirectManageRequest = acceptDirectManageRequest;
+exports.sendDirectManageRequest = sendDirectManageRequest;

package/dist/domain/direct-manage-request.d.cts

@@ -0,0 +1,16 @@
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { r as Transport, t as Connection } from "../transport-fUY3alfO.cjs";
+import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
+//#region src/domain/direct-manage-request.d.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
+export interface DirectManageRequestOptions {
+  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
+  expectedPeerDeviceId?: DeviceId;
+  token?: CapabilityToken;
+  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
+  timeoutMs?: number;
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
+//#endregion

package/dist/domain/direct-manage-request.d.mts

@@ -0,0 +1,16 @@
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { r as Transport, t as Connection } from "../transport-C5wU0UtA.mjs";
+import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
+//#region src/domain/direct-manage-request.d.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;
+export interface DirectManageRequestOptions {
+  /** Refuse the connection as a possible spoofing attempt if the transport's own authenticated Connection.peerDeviceId (never a value read off the wire -- see the Transport port's own doc comment) doesn't match this. Left unchecked when the transport gives no authenticated peerDeviceId at all (an unauthenticated transport, or a peer that presented no credential) -- the caller proceeds at its own risk in that case, exactly the same trust boundary Connection.peerDeviceId already documents for every other consumer of it. */
+  expectedPeerDeviceId?: DeviceId;
+  token?: CapabilityToken;
+  /** Omit to wait indefinitely, matching sendManageRequest's own default. */
+  timeoutMs?: number;
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+export declare function sendDirectManageRequest(transport: Readonly<Pick<Transport, "connect">>, address: string, command: ManageCommand, scope: Readonly<CapabilityScope>, options?: Readonly<DirectManageRequestOptions>): Promise<ManageOutcome>;
+//#endregion

package/dist/domain/direct-manage-request.mjs

@@ -0,0 +1,62 @@
+import { deviceIdToHex } from "./device-id.mjs";
+//#region src/domain/direct-manage-request.ts
+/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
+async function acceptDirectManageRequest(connection) {
+	const result = await connection.receive()[Symbol.asyncIterator]().next();
+	if (result.done === true || result.value.type !== "manage-request") return null;
+	const frame = result.value;
+	return {
+		requestId: frame["request-id"],
+		command: frame.command,
+		scope: frame.scope,
+		...frame.token !== void 0 ? { token: frame.token } : {},
+		respond: async (outcome) => {
+			const response = {
+				type: "manage-response",
+				"request-id": frame["request-id"],
+				outcome
+			};
+			await connection.send(response);
+			await connection.close();
+		}
+	};
+}
+async function waitForDirectManageResponse(link, requestId) {
+	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
+	throw new Error("connection closed before a response arrived");
+}
+/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
+async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
+	const link = await transport.connect(address);
+	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && deviceIdToHex(link.peerDeviceId) !== deviceIdToHex(options.expectedPeerDeviceId)) {
+		await link.close();
+		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
+	}
+	const requestId = 0;
+	const frame = {
+		type: "manage-request",
+		"request-id": requestId,
+		command,
+		scope,
+		...options.token !== void 0 ? { token: options.token } : {}
+	};
+	await link.send(frame);
+	const responsePromise = waitForDirectManageResponse(link, requestId);
+	let outcome;
+	if (options.timeoutMs === void 0) outcome = await responsePromise;
+	else {
+		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+			setTimeout(() => {
+				resolve({
+					result: "error",
+					code: "timeout"
+				});
+			}, options.timeoutMs);
+		})]);
+		responsePromise.catch(() => void 0);
+	}
+	await link.close();
+	return outcome;
+}
+//#endregion
+export { acceptDirectManageRequest, sendDirectManageRequest };

package/dist/domain/gossip-expansion.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-D2Ue2nd2.cjs";
 import { MeshSession } from "./mesh-session.cjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/gossip-expansion.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-D2Ue2nd2.mjs";
 import { MeshSession } from "./mesh-session.mjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-D2Ue2nd2.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-PhUVprXA.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-D2Ue2nd2.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-D2Ue2nd2.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-PhUVprXA.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-D2Ue2nd2.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
+let package_json = require("../../package.json");
+package_json = require_rolldown_runtime.__toESM(package_json, 1);
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -49,6 +52,24 @@ function createPingRoundTrips() {
 	};
 }
 //#endregion
+//#region src/domain/own-version.ts
+/** This node's own actual, currently-running wire-mesh-core version -- read once from the installed package's own package.json, never from anything gossiped or cached, so buildSelfAdvert's own self-advert extension and version.get's manage-response both always answer with the truth for this exact running process. */
+const OWN_VERSION = package_json.default.version;
+/** The gossip extension key wire-mesh-core itself injects into every self-advert (mesh-session.ts's own buildSelfAdvert) to report OWN_VERSION -- reserved so a sendGossipUpdate caller can never also supply it, separately from peer-advert's own typed struct fields (RESERVED_PEER_ADVERT_KEYS in mesh-session.ts), since this is just an extension-tail key (transport.cddl), not a struct field. */
+const CORE_VERSION_GOSSIP_KEY = "wire-mesh/version";
+const VERSION_GET_VERB = "version.get";
+/** True when params is the core/version domain's own version-get command (version.cddl) -- a receiver answers this unconditionally, bypassing incomingManageRequests entirely, since it is deliberately ungated: exactly as sensitive as what CORE_VERSION_GOSSIP_KEY already broadcasts unconditionally via gossip. */
+function isVersionGetCommand(params) {
+	return "verb" in params && params.verb === VERSION_GET_VERB;
+}
+/** The manage-ok outcome mesh-session.ts answers a version.get request with -- OWN_VERSION on manage-ok's own open `* tstr => any` tail, the same pattern exec-list's own exec-session-info result already uses. */
+function versionGetOutcome() {
+	return {
+		result: "ok",
+		version: OWN_VERSION
+	};
+}
+//#endregion
 //#region src/domain/gossip-extensions.ts
 /** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
 const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
@@ -58,10 +79,11 @@ const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
 ]);
 /** A gossip extension key must be domain-qualified as `<domain>/<field>` (lowercase kebab-case each side), per `spec/CONVENTIONS.md`'s gossip-extension-namespacing convention -- this is what stops two independent applications sharing one gossip tail from silently colliding on a bare name like "status". */
 const GOSSIP_EXTENSION_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
-/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields or use a bare, non-domain-qualified key -- both are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
+/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields, use the key wire-mesh-core itself reserves for its own self-reported version, or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
 function validateGossipExtensions(extensions) {
 	for (const key of Object.keys(extensions)) {
 		if (RESERVED_PEER_ADVERT_KEYS.has(key)) throw new Error(`sendGossipUpdate extension key "${key}" collides with a mandatory peer-advert field`);
+		if (key === "wire-mesh/version") throw new Error(`sendGossipUpdate extension key "${key}" is reserved for wire-mesh-core's own self-reported version`);
 		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
 	}
 }
@@ -162,12 +184,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			pending.resolve(frame.outcome);
 		}
 	}
-	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. */
+	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. A version.get request (VERSION_GET_VERB) is answered directly, right here, rather than ever reaching incomingManageRequests -- deliberately ungated (version.cddl), so no application needs to remember to register its own handler for it the way every other verb requires. */
 	function applyManageRequest(frame, relayFrame) {
 		const requestId = frame["request-id"];
 		const fromDevice = relayFrame?.["from-device"];
 		const toDevice = relayFrame?.["to-device"];
-		emitIncomingManageRequest({
+		const incoming = {
 			requestId,
 			command: frame.command,
 			scope: frame.scope,
@@ -187,7 +209,12 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(response, relayFrame !== void 0, fromDevice);
 				emit();
 			}
-		});
+		};
+		if (isVersionGetCommand(frame.command.params)) {
+			incoming.respond(versionGetOutcome());
+			return;
+		}
+		emitIncomingManageRequest(incoming);
 	}
 	function applyFrame(frame) {
 		if (frame.type === "relay-data") {
@@ -301,13 +328,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		onSessionEnd?.(link);
 		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
 	}
-	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions are spread before the three mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects that case loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
+	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions and CORE_VERSION_GOSSIP_KEY are spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects both collisions loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
 	function buildSelfAdvert(extensions) {
 		if (extensions !== void 0) validateGossipExtensions(extensions);
 		return {
 			type: "gossip",
 			peers: [{
 				...extensions,
+				[CORE_VERSION_GOSSIP_KEY]: OWN_VERSION,
 				device: identity.deviceId,
 				addresses: [...addresses],
 				"snapshot-seconds": Math.floor(clock.now() / MS_PER_SECOND)
@@ -555,67 +583,7 @@ async function acceptMeshSession(connection, identity, localDomains, options = {
 		peerDeviceId
 	};
 }
-/** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against applyManageRequest/applyFrame above). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
-async function acceptDirectManageRequest(connection) {
-	const result = await connection.receive()[Symbol.asyncIterator]().next();
-	if (result.done === true || result.value.type !== "manage-request") return null;
-	const frame = result.value;
-	return {
-		requestId: frame["request-id"],
-		command: frame.command,
-		scope: frame.scope,
-		...frame.token !== void 0 ? { token: frame.token } : {},
-		respond: async (outcome) => {
-			const response = {
-				type: "manage-response",
-				"request-id": frame["request-id"],
-				outcome
-			};
-			await connection.send(response);
-			await connection.close();
-		}
-	};
-}
-async function waitForDirectManageResponse(link, requestId) {
-	for await (const frame of link.receive()) if (frame.type === "manage-response" && frame["request-id"] === requestId) return frame.outcome;
-	throw new Error("connection closed before a response arrived");
-}
-/** Sends exactly one manage-request over a fresh, bare connection with no handshake, negotiation, or gossip exchanged, and no session left behind afterwards -- the connection closes once the correlated response arrives, the wait times out, or the peer-device-id check below refuses it. For attempting a direct connection to a peer whose reachable address is already known (wire-mesh#38), as an alternative to routing the same request through a relay via an established MeshSession's own sendManageRequest(targetDevice, ...). Resolves the same ManageOutcome shape sendManageRequest does -- including `{ result: "error", code: "timeout" }` on a timeout, never a rejection -- so a caller can fall back to the relay path uniformly regardless of which kind of failure this returns for the non-spoofing cases; a peer-device-id mismatch is the one case that rejects outright, since it is not an ordinary reachability failure a relay fallback should silently paper over. */
-async function sendDirectManageRequest(transport, address, command, scope, options = {}) {
-	const link = await transport.connect(address);
-	if (options.expectedPeerDeviceId !== void 0 && link.peerDeviceId !== void 0 && require_domain_device_id.deviceIdToHex(link.peerDeviceId) !== require_domain_device_id.deviceIdToHex(options.expectedPeerDeviceId)) {
-		await link.close();
-		throw new Error("direct connection's authenticated peer-device-id does not match the expected target -- refusing as a possible spoofing attempt");
-	}
-	const requestId = 0;
-	const frame = {
-		type: "manage-request",
-		"request-id": requestId,
-		command,
-		scope,
-		...options.token !== void 0 ? { token: options.token } : {}
-	};
-	await link.send(frame);
-	const responsePromise = waitForDirectManageResponse(link, requestId);
-	let outcome;
-	if (options.timeoutMs === void 0) outcome = await responsePromise;
-	else {
-		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve({
-					result: "error",
-					code: "timeout"
-				});
-			}, options.timeoutMs);
-		})]);
-		responsePromise.catch(() => void 0);
-	}
-	await link.close();
-	return outcome;
-}
 //#endregion
 exports.HANDSHAKE_TIMEOUT_MS = HANDSHAKE_TIMEOUT_MS;
-exports.acceptDirectManageRequest = acceptDirectManageRequest;
 exports.acceptMeshSession = acceptMeshSession;
 exports.createMeshSession = createMeshSession;
-exports.sendDirectManageRequest = sendDirectManageRequest;