wire-mesh-core 1.56.0 → 1.58.0

package/dist/domain/mesh-session.cjs

@@ -1,10 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("../rolldown-runtime-VH7oDXx4.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
+const require_domain_async_queue = require("./async-queue.cjs");
+const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
+const require_domain_topology_snapshot = require("./topology-snapshot.cjs");
+const require_gossip_extensions = require("../gossip-extensions-Dr_T7hk_.cjs");
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
-let package_json = require("../../package.json");
-package_json = require_rolldown_runtime.__toESM(package_json, 1);
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -12,82 +13,11 @@ function createRelayPairings() {
 		has: (device) => established.has(require_domain_device_id.deviceIdToHex(device)),
 		add: (device) => {
 			established.set(require_domain_device_id.deviceIdToHex(device), device);
-		}
-	};
-}
-//#endregion
-//#region src/domain/ping-round-trips.ts
-function createPingRoundTrips() {
-	const pending = [];
-	function cancel(sentAt) {
-		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
-		if (index === -1) return false;
-		pending.splice(index, 1);
-		return true;
-	}
-	return {
-		resolveOldest(nowMs) {
-			const entry = pending.shift();
-			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
 		},
-		rejectAll(reason) {
-			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
-		},
-		async sendAndAwait(sentAt, sendPing, timeoutMs) {
-			const rtt = new Promise((resolve, reject) => {
-				pending.push({
-					sentAt,
-					resolve,
-					reject
-				});
-			});
-			await sendPing();
-			if (timeoutMs === void 0) return rtt;
-			return Promise.race([rtt, new Promise((_resolve, reject) => {
-				setTimeout(() => {
-					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
-				}, timeoutMs);
-			})]);
-		}
-	};
-}
-//#endregion
-//#region src/domain/own-version.ts
-/** This node's own actual, currently-running wire-mesh-core version -- read once from the installed package's own package.json, never from anything gossiped or cached, so buildSelfAdvert's own self-advert extension and version.get's manage-response both always answer with the truth for this exact running process. */
-const OWN_VERSION = package_json.default.version;
-/** The gossip extension key wire-mesh-core itself injects into every self-advert (mesh-session.ts's own buildSelfAdvert) to report OWN_VERSION -- reserved so a sendGossipUpdate caller can never also supply it, separately from peer-advert's own typed struct fields (RESERVED_PEER_ADVERT_KEYS in mesh-session.ts), since this is just an extension-tail key (transport.cddl), not a struct field. */
-const CORE_VERSION_GOSSIP_KEY = "wire-mesh/version";
-const VERSION_GET_VERB = "version.get";
-/** True when params is the core/version domain's own version-get command (version.cddl) -- a receiver answers this unconditionally, bypassing incomingManageRequests entirely, since it is deliberately ungated: exactly as sensitive as what CORE_VERSION_GOSSIP_KEY already broadcasts unconditionally via gossip. */
-function isVersionGetCommand(params) {
-	return "verb" in params && params.verb === VERSION_GET_VERB;
-}
-/** The manage-ok outcome mesh-session.ts answers a version.get request with -- OWN_VERSION on manage-ok's own open `* tstr => any` tail, the same pattern exec-list's own exec-session-info result already uses. */
-function versionGetOutcome() {
-	return {
-		result: "ok",
-		version: OWN_VERSION
+		list: () => [...established.values()]
 	};
 }
 //#endregion
-//#region src/domain/gossip-extensions.ts
-/** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
-const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
-	"device",
-	"addresses",
-	"snapshot-seconds"
-]);
-/** A gossip extension key must be domain-qualified as `<domain>/<field>` (lowercase kebab-case each side), per `spec/CONVENTIONS.md`'s gossip-extension-namespacing convention -- this is what stops two independent applications sharing one gossip tail from silently colliding on a bare name like "status". */
-const GOSSIP_EXTENSION_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
-/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields, use the key wire-mesh-core itself reserves for its own self-reported version, or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
-function validateGossipExtensions(extensions) {
-	for (const key of Object.keys(extensions)) {
-		if (RESERVED_PEER_ADVERT_KEYS.has(key)) throw new Error(`sendGossipUpdate extension key "${key}" collides with a mandatory peer-advert field`);
-		if (key === "wire-mesh/version") throw new Error(`sendGossipUpdate extension key "${key}" is reserved for wire-mesh-core's own self-reported version`);
-		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
-	}
-}
-//#endregion
 //#region src/domain/mesh-session.ts
 const MS_PER_SECOND = 1e3;
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -109,20 +39,22 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	const directory = /* @__PURE__ */ new Map();
 	const frameLog = [];
 	let feedCancelled = false;
-	const eventWaiters = [];
-	const eventBacklog = [];
+	const eventQueue = require_domain_async_queue.createAsyncQueue();
 	let handshakeTimer = null;
 	let reconnectTimer = null;
 	let attempt = 0;
 	let currentToken = null;
 	let nextRequestId = 0;
 	const relayPairings = createRelayPairings();
+	const topology = require_domain_topology_snapshot.createTopologySnapshotTracker({
+		getAuthenticatedPeer: () => connection?.peerDeviceId,
+		isAccepted: dial === null,
+		getRelayedDevices: () => relayPairings.list()
+	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const incomingWaiters = [];
-	const incomingBacklog = [];
-	const revocationWaiters = [];
-	const revocationBacklog = [];
-	const pingRoundTrips = createPingRoundTrips();
+	const incomingQueue = require_domain_async_queue.createAsyncQueue();
+	const revocationQueue = require_domain_async_queue.createAsyncQueue();
+	const pingRoundTrips = require_domain_ping_round_trips.createPingRoundTrips();
 	function snapshot() {
 		return {
 			state,
@@ -131,20 +63,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		};
 	}
 	function emit() {
-		const event = snapshot();
-		const waiter = eventWaiters.shift();
-		if (waiter) waiter(event);
-		else eventBacklog.push(event);
-	}
-	function emitIncomingManageRequest(request) {
-		const waiter = incomingWaiters.shift();
-		if (waiter) waiter(request);
-		else incomingBacklog.push(request);
-	}
-	function emitRevocationEntry(entry) {
-		const waiter = revocationWaiters.shift();
-		if (waiter) waiter(entry);
-		else revocationBacklog.push(entry);
+		eventQueue.push(snapshot());
 	}
 	function rejectPendingManageRequests(reason) {
 		for (const pending of pendingManageRequests.values()) pending.reject(new Error(reason));
@@ -210,11 +129,11 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				emit();
 			}
 		};
-		if (isVersionGetCommand(frame.command.params)) {
-			incoming.respond(versionGetOutcome());
+		if (require_gossip_extensions.isVersionGetCommand(frame.command.params)) {
+			incoming.respond(require_gossip_extensions.versionGetOutcome());
 			return;
 		}
-		emitIncomingManageRequest(incoming);
+		incomingQueue.push(incoming);
 	}
 	function applyFrame(frame) {
 		if (frame.type === "relay-data") {
@@ -244,13 +163,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				device: advert.device,
 				advert
 			});
+			topology.recordAdvert(advert.device);
 			onPeerAdvert?.(advert);
 		}
 		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
-		else if (frame.type === "revocation-announce") for (const entry of frame.entries) emitRevocationEntry(entry);
+		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -328,14 +248,15 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		onSessionEnd?.(link);
 		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
 	}
-	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions and CORE_VERSION_GOSSIP_KEY are spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects both collisions loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
+	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	function buildSelfAdvert(extensions) {
-		if (extensions !== void 0) validateGossipExtensions(extensions);
+		if (extensions !== void 0) require_gossip_extensions.validateGossipExtensions(extensions);
 		return {
 			type: "gossip",
 			peers: [{
 				...extensions,
-				[CORE_VERSION_GOSSIP_KEY]: OWN_VERSION,
+				[require_gossip_extensions.CORE_VERSION_GOSSIP_KEY]: require_gossip_extensions.OWN_VERSION,
+				[require_gossip_extensions.TOPOLOGY_PEERS_GOSSIP_KEY]: topology.compute(),
 				device: identity.deviceId,
 				addresses: [...addresses],
 				"snapshot-seconds": Math.floor(clock.now() / MS_PER_SECOND)
@@ -401,51 +322,9 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	return {
 		wireUpConnection,
 		session: {
-			events: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogEvent = eventBacklog.shift();
-					if (backlogEvent) resolve({
-						value: backlogEvent,
-						done: false
-					});
-					else eventWaiters.push((event) => {
-						resolve({
-							value: event,
-							done: false
-						});
-					});
-				}) };
-			} },
-			incomingManageRequests: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogRequest = incomingBacklog.shift();
-					if (backlogRequest) resolve({
-						value: backlogRequest,
-						done: false
-					});
-					else incomingWaiters.push((request) => {
-						resolve({
-							value: request,
-							done: false
-						});
-					});
-				}) };
-			} },
-			revocationAnnouncements: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogEntry = revocationBacklog.shift();
-					if (backlogEntry) resolve({
-						value: backlogEntry,
-						done: false
-					});
-					else revocationWaiters.push((entry) => {
-						resolve({
-							value: entry,
-							done: false
-						});
-					});
-				}) };
-			} },
+			events: eventQueue.stream,
+			incomingManageRequests: incomingQueue.stream,
+			revocationAnnouncements: revocationQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
@@ -526,6 +405,9 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			getTopologyPeers() {
+				return topology.compute();
+			},
 			async sendDataFrame(frame) {
 				requireConnectedLink();
 				frameLog.push({

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.cjs";
-import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, en as TopologyPeers, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BnbpCk0Z.cjs";
+import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-fUY3alfO.cjs";
+import { r as Transport, t as Connection } from "../transport-Ca_ZyyZe.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -87,6 +87,8 @@ export interface MeshSession {
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
+  /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */
+  getTopologyPeers: () => TopologyPeers;
   /** Sends one core/data frame (data-have, data-request, or data-entries) directly over this session's own connection, never relay-wrapped -- the transport half of an application's own noticeboard replication policy (data-sync.ts owns what the frames MEAN; this owns getting one onto the wire), the same layering sendRevocationAnnounce already established for its own frame kind. Rejects when not connected, exactly like every other send method here. */
   sendDataFrame: (frame: DataHaveFrame | DataRequestFrame | DataEntriesFrame) => Promise<void>;
   /** Sends a manage-request and resolves with the matching manage-response's outcome, correlated by request-id. When targetDevice is given, the request is routed to that specific peer via an established relay-connect pairing (wrapped as relay-data) rather than sent directly over this session's own Connection -- relay-hub deliberately drops manage-request/manage-response frames sent to it directly, since routing between two connected peers is not the relay role's business, so a specific peer reachable only through a relay hub can only be addressed this way. Absent, this sends directly over the Connection exactly as before. When token is given, it is attached to this one request instead of whatever setToken last set -- a single session routinely needs a different token per request when its peer shares more than one scope with this side (e.g. several core/room memberships over one connection), and a session-global token can only ever be correct for one of them. Absent, this request carries setToken's own session-global token exactly as before. When timeoutMs is given, the returned promise resolves with `{ result: "error", code: "timeout" }` rather than hanging forever if no manage-response arrives in time -- a held-open request (a human approval, a not-yet-online peer) otherwise has no way for the caller to give up on it. Absent, this request waits exactly as before, with no time limit of its own. */

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D2Ue2nd2.mjs";
-import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, en as TopologyPeers, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BnbpCk0Z.mjs";
+import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-C5wU0UtA.mjs";
+import { r as Transport, t as Connection } from "../transport-BH8kGWXt.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;
@@ -87,6 +87,8 @@ export interface MeshSession {
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
+  /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */
+  getTopologyPeers: () => TopologyPeers;
   /** Sends one core/data frame (data-have, data-request, or data-entries) directly over this session's own connection, never relay-wrapped -- the transport half of an application's own noticeboard replication policy (data-sync.ts owns what the frames MEAN; this owns getting one onto the wire), the same layering sendRevocationAnnounce already established for its own frame kind. Rejects when not connected, exactly like every other send method here. */
   sendDataFrame: (frame: DataHaveFrame | DataRequestFrame | DataEntriesFrame) => Promise<void>;
   /** Sends a manage-request and resolves with the matching manage-response's outcome, correlated by request-id. When targetDevice is given, the request is routed to that specific peer via an established relay-connect pairing (wrapped as relay-data) rather than sent directly over this session's own Connection -- relay-hub deliberately drops manage-request/manage-response frames sent to it directly, since routing between two connected peers is not the relay role's business, so a specific peer reachable only through a relay hub can only be addressed this way. Absent, this sends directly over the Connection exactly as before. When token is given, it is attached to this one request instead of whatever setToken last set -- a single session routinely needs a different token per request when its peer shares more than one scope with this side (e.g. several core/room memberships over one connection), and a session-global token can only ever be correct for one of them. Absent, this request carries setToken's own session-global token exactly as before. When timeoutMs is given, the returned promise resolves with `{ result: "error", code: "timeout" }` rather than hanging forever if no manage-response arrives in time -- a held-open request (a human approval, a not-yet-online peer) otherwise has no way for the caller to give up on it. Absent, this request waits exactly as before, with no time limit of its own. */

package/dist/domain/mesh-session.mjs

@@ -1,7 +1,10 @@
 import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
+import { createAsyncQueue } from "./async-queue.mjs";
+import { createPingRoundTrips } from "./ping-round-trips.mjs";
+import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
+import { a as isVersionGetCommand, i as OWN_VERSION, n as validateGossipExtensions, o as versionGetOutcome, r as CORE_VERSION_GOSSIP_KEY, t as TOPOLOGY_PEERS_GOSSIP_KEY } from "../gossip-extensions-Cdy5mQhY.mjs";
 import { tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
-import packageJson from "../../package.json" with { type: "json" };
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -9,82 +12,11 @@ function createRelayPairings() {
 		has: (device) => established.has(deviceIdToHex(device)),
 		add: (device) => {
 			established.set(deviceIdToHex(device), device);
-		}
-	};
-}
-//#endregion
-//#region src/domain/ping-round-trips.ts
-function createPingRoundTrips() {
-	const pending = [];
-	function cancel(sentAt) {
-		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
-		if (index === -1) return false;
-		pending.splice(index, 1);
-		return true;
-	}
-	return {
-		resolveOldest(nowMs) {
-			const entry = pending.shift();
-			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
 		},
-		rejectAll(reason) {
-			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
-		},
-		async sendAndAwait(sentAt, sendPing, timeoutMs) {
-			const rtt = new Promise((resolve, reject) => {
-				pending.push({
-					sentAt,
-					resolve,
-					reject
-				});
-			});
-			await sendPing();
-			if (timeoutMs === void 0) return rtt;
-			return Promise.race([rtt, new Promise((_resolve, reject) => {
-				setTimeout(() => {
-					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
-				}, timeoutMs);
-			})]);
-		}
-	};
-}
-//#endregion
-//#region src/domain/own-version.ts
-/** This node's own actual, currently-running wire-mesh-core version -- read once from the installed package's own package.json, never from anything gossiped or cached, so buildSelfAdvert's own self-advert extension and version.get's manage-response both always answer with the truth for this exact running process. */
-const OWN_VERSION = packageJson.version;
-/** The gossip extension key wire-mesh-core itself injects into every self-advert (mesh-session.ts's own buildSelfAdvert) to report OWN_VERSION -- reserved so a sendGossipUpdate caller can never also supply it, separately from peer-advert's own typed struct fields (RESERVED_PEER_ADVERT_KEYS in mesh-session.ts), since this is just an extension-tail key (transport.cddl), not a struct field. */
-const CORE_VERSION_GOSSIP_KEY = "wire-mesh/version";
-const VERSION_GET_VERB = "version.get";
-/** True when params is the core/version domain's own version-get command (version.cddl) -- a receiver answers this unconditionally, bypassing incomingManageRequests entirely, since it is deliberately ungated: exactly as sensitive as what CORE_VERSION_GOSSIP_KEY already broadcasts unconditionally via gossip. */
-function isVersionGetCommand(params) {
-	return "verb" in params && params.verb === VERSION_GET_VERB;
-}
-/** The manage-ok outcome mesh-session.ts answers a version.get request with -- OWN_VERSION on manage-ok's own open `* tstr => any` tail, the same pattern exec-list's own exec-session-info result already uses. */
-function versionGetOutcome() {
-	return {
-		result: "ok",
-		version: OWN_VERSION
+		list: () => [...established.values()]
 	};
 }
 //#endregion
-//#region src/domain/gossip-extensions.ts
-/** peer-advert's own three typed fields -- reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, or freshness timestamp by supplying an extension of the same name. */
-const RESERVED_PEER_ADVERT_KEYS = /* @__PURE__ */ new Set([
-	"device",
-	"addresses",
-	"snapshot-seconds"
-]);
-/** A gossip extension key must be domain-qualified as `<domain>/<field>` (lowercase kebab-case each side), per `spec/CONVENTIONS.md`'s gossip-extension-namespacing convention -- this is what stops two independent applications sharing one gossip tail from silently colliding on a bare name like "status". */
-const GOSSIP_EXTENSION_KEY_PATTERN = /^[a-z][a-z0-9-]*\/[a-z][a-z0-9-]*$/;
-/** Rejects a `sendGossipUpdate` extension bag that would either shadow one of peer-advert's own mandatory fields, use the key wire-mesh-core itself reserves for its own self-reported version, or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */
-function validateGossipExtensions(extensions) {
-	for (const key of Object.keys(extensions)) {
-		if (RESERVED_PEER_ADVERT_KEYS.has(key)) throw new Error(`sendGossipUpdate extension key "${key}" collides with a mandatory peer-advert field`);
-		if (key === "wire-mesh/version") throw new Error(`sendGossipUpdate extension key "${key}" is reserved for wire-mesh-core's own self-reported version`);
-		if (!GOSSIP_EXTENSION_KEY_PATTERN.test(key)) throw new Error(`sendGossipUpdate extension key "${key}" must be domain-qualified as "<domain>/<field>" (e.g. "presence/status")`);
-	}
-}
-//#endregion
 //#region src/domain/mesh-session.ts
 const MS_PER_SECOND = 1e3;
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -106,19 +38,21 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	const directory = /* @__PURE__ */ new Map();
 	const frameLog = [];
 	let feedCancelled = false;
-	const eventWaiters = [];
-	const eventBacklog = [];
+	const eventQueue = createAsyncQueue();
 	let handshakeTimer = null;
 	let reconnectTimer = null;
 	let attempt = 0;
 	let currentToken = null;
 	let nextRequestId = 0;
 	const relayPairings = createRelayPairings();
+	const topology = createTopologySnapshotTracker({
+		getAuthenticatedPeer: () => connection?.peerDeviceId,
+		isAccepted: dial === null,
+		getRelayedDevices: () => relayPairings.list()
+	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const incomingWaiters = [];
-	const incomingBacklog = [];
-	const revocationWaiters = [];
-	const revocationBacklog = [];
+	const incomingQueue = createAsyncQueue();
+	const revocationQueue = createAsyncQueue();
 	const pingRoundTrips = createPingRoundTrips();
 	function snapshot() {
 		return {
@@ -128,20 +62,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		};
 	}
 	function emit() {
-		const event = snapshot();
-		const waiter = eventWaiters.shift();
-		if (waiter) waiter(event);
-		else eventBacklog.push(event);
-	}
-	function emitIncomingManageRequest(request) {
-		const waiter = incomingWaiters.shift();
-		if (waiter) waiter(request);
-		else incomingBacklog.push(request);
-	}
-	function emitRevocationEntry(entry) {
-		const waiter = revocationWaiters.shift();
-		if (waiter) waiter(entry);
-		else revocationBacklog.push(entry);
+		eventQueue.push(snapshot());
 	}
 	function rejectPendingManageRequests(reason) {
 		for (const pending of pendingManageRequests.values()) pending.reject(new Error(reason));
@@ -211,7 +132,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			incoming.respond(versionGetOutcome());
 			return;
 		}
-		emitIncomingManageRequest(incoming);
+		incomingQueue.push(incoming);
 	}
 	function applyFrame(frame) {
 		if (frame.type === "relay-data") {
@@ -241,13 +162,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				device: advert.device,
 				advert
 			});
+			topology.recordAdvert(advert.device);
 			onPeerAdvert?.(advert);
 		}
 		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
-		else if (frame.type === "revocation-announce") for (const entry of frame.entries) emitRevocationEntry(entry);
+		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -325,7 +247,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		onSessionEnd?.(link);
 		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
 	}
-	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions and CORE_VERSION_GOSSIP_KEY are spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects both collisions loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. */
+	/** Builds this side's own self-advert: this node's own directly-reachable addresses (wire-mesh#38), or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	function buildSelfAdvert(extensions) {
 		if (extensions !== void 0) validateGossipExtensions(extensions);
 		return {
@@ -333,6 +255,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			peers: [{
 				...extensions,
 				[CORE_VERSION_GOSSIP_KEY]: OWN_VERSION,
+				[TOPOLOGY_PEERS_GOSSIP_KEY]: topology.compute(),
 				device: identity.deviceId,
 				addresses: [...addresses],
 				"snapshot-seconds": Math.floor(clock.now() / MS_PER_SECOND)
@@ -398,51 +321,9 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	return {
 		wireUpConnection,
 		session: {
-			events: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogEvent = eventBacklog.shift();
-					if (backlogEvent) resolve({
-						value: backlogEvent,
-						done: false
-					});
-					else eventWaiters.push((event) => {
-						resolve({
-							value: event,
-							done: false
-						});
-					});
-				}) };
-			} },
-			incomingManageRequests: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogRequest = incomingBacklog.shift();
-					if (backlogRequest) resolve({
-						value: backlogRequest,
-						done: false
-					});
-					else incomingWaiters.push((request) => {
-						resolve({
-							value: request,
-							done: false
-						});
-					});
-				}) };
-			} },
-			revocationAnnouncements: { [Symbol.asyncIterator]() {
-				return { next: async () => new Promise((resolve) => {
-					const backlogEntry = revocationBacklog.shift();
-					if (backlogEntry) resolve({
-						value: backlogEntry,
-						done: false
-					});
-					else revocationWaiters.push((entry) => {
-						resolve({
-							value: entry,
-							done: false
-						});
-					});
-				}) };
-			} },
+			events: eventQueue.stream,
+			incomingManageRequests: incomingQueue.stream,
+			revocationAnnouncements: revocationQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
@@ -523,6 +404,9 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			getTopologyPeers() {
+				return topology.compute();
+			},
 			async sendDataFrame(frame) {
 				requireConnectedLink();
 				frameLog.push({

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BnbpCk0Z.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
+import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
+import { a as RevocationCheck } from "../tokens-BL2BzOmN.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BnbpCk0Z.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
+import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
+import { a as RevocationCheck } from "../tokens-DtjdYS_a.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**