wire-mesh-core 1.56.0 → 1.58.0

package/dist/domain/path-trace.cjs

@@ -0,0 +1,58 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+//#region src/domain/path-trace.ts
+/** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
+const PATH_TRACE_VERB = "path:trace";
+/** No path: there is no filesystem subtree or other resource involved, only the node itself -- carried on the wire but never actually checked, since path.trace verifies no scope or token at all. */
+const PATH_TRACE_SCOPE = { kind: "node" };
+function isPathTrace(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "path.trace";
+}
+function buildPathTraceCommand() {
+	return {
+		verb: PATH_TRACE_VERB,
+		params: { verb: "path.trace" }
+	};
+}
+/** Builds this side's own answer to an incoming path.trace. relayed is exactly whether THIS request arrived wrapped in relay-data -- incoming.fromDevice is only ever set for a relay-wrapped request (see mesh-session.ts's own applyManageRequest) -- and hubAddress, when given and relayed, is the address this receiver itself dialled to reach the hub the request arrived over, ordinarily read straight off this session's own ConnectionState.address (already tracked by every caller consuming session.events, no new bookkeeping needed). Omitted entirely when not relayed, or when the caller has no address to report (e.g. an accepted, never-dialled connection). */
+function buildPathTraceResponse(incoming, hubAddress) {
+	const relayed = incoming.fromDevice !== void 0;
+	return {
+		result: "ok",
+		relayed,
+		...relayed && hubAddress !== void 0 ? { "hub-address": hubAddress } : {}
+	};
+}
+/** Sends path.trace and measures the real end-to-end round trip, combining it with this side's own local relay knowledge (no wire round trip needed for that half -- see PathTraceLocal's own doc comment) and the receiver's reported relay knowledge parsed out of a successful outcome's own extension fields. Throws if the outcome resolves ok but its extension fields don't match path-trace-ok's own shape (relayed missing or the wrong type) -- a receiver that answers path.trace at all is expected to answer it correctly; this is a protocol violation to surface loudly, not a case to silently treat as "remote unknown". */
+async function tracePath(options) {
+	const startedAt = options.clock.now();
+	const outcome = await options.session.sendManageRequest(buildPathTraceCommand(), options.scope ?? PATH_TRACE_SCOPE, options.targetDevice, options.token, options.timeoutMs);
+	const rttMs = options.clock.now() - startedAt;
+	const local = {
+		relayed: options.targetDevice !== void 0,
+		...options.targetDevice !== void 0 && options.localHubAddress !== void 0 ? { hubAddress: options.localHubAddress } : {}
+	};
+	if (outcome.result === "error") return {
+		rttMs,
+		local,
+		outcome
+	};
+	const parsed = require_generated_protocol.pathTraceOkSchema.safeParse(outcome);
+	if (!parsed.success) throw new Error(`path.trace response did not match path-trace-ok's own shape: ${parsed.error.message}`);
+	return {
+		rttMs,
+		local,
+		remote: {
+			relayed: parsed.data.relayed,
+			...parsed.data["hub-address"] !== void 0 ? { hubAddress: parsed.data["hub-address"] } : {}
+		},
+		outcome
+	};
+}
+//#endregion
+exports.PATH_TRACE_SCOPE = PATH_TRACE_SCOPE;
+exports.PATH_TRACE_VERB = PATH_TRACE_VERB;
+exports.buildPathTraceCommand = buildPathTraceCommand;
+exports.buildPathTraceResponse = buildPathTraceResponse;
+exports.isPathTrace = isPathTrace;
+exports.tracePath = tracePath;

package/dist/domain/path-trace.d.cts

@@ -0,0 +1,44 @@
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BnbpCk0Z.cjs";
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+//#region src/domain/path-trace.d.ts
+/** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
+export declare const PATH_TRACE_VERB = "path:trace";
+/** No path: there is no filesystem subtree or other resource involved, only the node itself -- carried on the wire but never actually checked, since path.trace verifies no scope or token at all. */
+export declare const PATH_TRACE_SCOPE: CapabilityScope;
+export declare function isPathTrace(params: ManageCommandParams): params is PathTrace;
+export declare function buildPathTraceCommand(): ManageCommand;
+/** Builds this side's own answer to an incoming path.trace. relayed is exactly whether THIS request arrived wrapped in relay-data -- incoming.fromDevice is only ever set for a relay-wrapped request (see mesh-session.ts's own applyManageRequest) -- and hubAddress, when given and relayed, is the address this receiver itself dialled to reach the hub the request arrived over, ordinarily read straight off this session's own ConnectionState.address (already tracked by every caller consuming session.events, no new bookkeeping needed). Omitted entirely when not relayed, or when the caller has no address to report (e.g. an accepted, never-dialled connection). */
+export declare function buildPathTraceResponse(incoming: Readonly<IncomingManageRequest>, hubAddress?: string): ManageOutcome;
+export interface PathTraceLocal {
+  /** Whether reaching the traced device required an established relay pairing on this session -- true exactly when targetDevice was given, mirroring sendManageRequest's own targetDevice semantics (mesh-session.ts): a session holds at most one connection at a time, so relaying to ANY device on it means every relay pairing rides the identical hub connection. */
+  relayed: boolean;
+  /** The address this session dialled to reach that hub, when relayed and known -- this side's own equivalent of the remote's reported hub-address, needing no wire round trip since it is already local knowledge. */
+  hubAddress?: string;
+}
+export interface PathTraceRemote {
+  relayed: boolean;
+  hubAddress?: string;
+}
+export interface PathTraceResult {
+  /** Real end-to-end round-trip time in milliseconds: the elapsed time between sending path.trace and receiving its manage-response, exactly what the manage-request/manage-response round trip already gives for free. */
+  rttMs: number;
+  local: PathTraceLocal;
+  /** The receiver's own reported relayed/hub-address, parsed from path-trace-ok's own extension fields -- absent when the outcome was a manage-error rather than a malformed/missing pathTraceOkSchema match, since a malformed ok response is a protocol violation this function surfaces by throwing, not by silently reporting "unknown". */
+  remote?: PathTraceRemote;
+  /** The raw manage-response outcome, for a caller that wants to inspect a manage-error's own code/message directly rather than only knowing remote is absent. */
+  outcome: ManageOutcome;
+}
+export interface TracePathOptions {
+  session: Pick<MeshSession, "sendManageRequest">;
+  clock: Pick<Clock, "now">;
+  scope?: CapabilityScope;
+  targetDevice?: DeviceId;
+  token?: CapabilityToken;
+  timeoutMs?: number;
+  /** This session's own currently-dialled address, reported back as local.hubAddress when targetDevice makes this a relayed trace -- omit when unknown (e.g. this session never dialled anything itself). */
+  localHubAddress?: string;
+}
+/** Sends path.trace and measures the real end-to-end round trip, combining it with this side's own local relay knowledge (no wire round trip needed for that half -- see PathTraceLocal's own doc comment) and the receiver's reported relay knowledge parsed out of a successful outcome's own extension fields. Throws if the outcome resolves ok but its extension fields don't match path-trace-ok's own shape (relayed missing or the wrong type) -- a receiver that answers path.trace at all is expected to answer it correctly; this is a protocol violation to surface loudly, not a case to silently treat as "remote unknown". */
+export declare function tracePath(options: Readonly<TracePathOptions>): Promise<PathTraceResult>;
+//#endregion

package/dist/domain/path-trace.d.mts

@@ -0,0 +1,44 @@
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BnbpCk0Z.mjs";
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+//#region src/domain/path-trace.d.ts
+/** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
+export declare const PATH_TRACE_VERB = "path:trace";
+/** No path: there is no filesystem subtree or other resource involved, only the node itself -- carried on the wire but never actually checked, since path.trace verifies no scope or token at all. */
+export declare const PATH_TRACE_SCOPE: CapabilityScope;
+export declare function isPathTrace(params: ManageCommandParams): params is PathTrace;
+export declare function buildPathTraceCommand(): ManageCommand;
+/** Builds this side's own answer to an incoming path.trace. relayed is exactly whether THIS request arrived wrapped in relay-data -- incoming.fromDevice is only ever set for a relay-wrapped request (see mesh-session.ts's own applyManageRequest) -- and hubAddress, when given and relayed, is the address this receiver itself dialled to reach the hub the request arrived over, ordinarily read straight off this session's own ConnectionState.address (already tracked by every caller consuming session.events, no new bookkeeping needed). Omitted entirely when not relayed, or when the caller has no address to report (e.g. an accepted, never-dialled connection). */
+export declare function buildPathTraceResponse(incoming: Readonly<IncomingManageRequest>, hubAddress?: string): ManageOutcome;
+export interface PathTraceLocal {
+  /** Whether reaching the traced device required an established relay pairing on this session -- true exactly when targetDevice was given, mirroring sendManageRequest's own targetDevice semantics (mesh-session.ts): a session holds at most one connection at a time, so relaying to ANY device on it means every relay pairing rides the identical hub connection. */
+  relayed: boolean;
+  /** The address this session dialled to reach that hub, when relayed and known -- this side's own equivalent of the remote's reported hub-address, needing no wire round trip since it is already local knowledge. */
+  hubAddress?: string;
+}
+export interface PathTraceRemote {
+  relayed: boolean;
+  hubAddress?: string;
+}
+export interface PathTraceResult {
+  /** Real end-to-end round-trip time in milliseconds: the elapsed time between sending path.trace and receiving its manage-response, exactly what the manage-request/manage-response round trip already gives for free. */
+  rttMs: number;
+  local: PathTraceLocal;
+  /** The receiver's own reported relayed/hub-address, parsed from path-trace-ok's own extension fields -- absent when the outcome was a manage-error rather than a malformed/missing pathTraceOkSchema match, since a malformed ok response is a protocol violation this function surfaces by throwing, not by silently reporting "unknown". */
+  remote?: PathTraceRemote;
+  /** The raw manage-response outcome, for a caller that wants to inspect a manage-error's own code/message directly rather than only knowing remote is absent. */
+  outcome: ManageOutcome;
+}
+export interface TracePathOptions {
+  session: Pick<MeshSession, "sendManageRequest">;
+  clock: Pick<Clock, "now">;
+  scope?: CapabilityScope;
+  targetDevice?: DeviceId;
+  token?: CapabilityToken;
+  timeoutMs?: number;
+  /** This session's own currently-dialled address, reported back as local.hubAddress when targetDevice makes this a relayed trace -- omit when unknown (e.g. this session never dialled anything itself). */
+  localHubAddress?: string;
+}
+/** Sends path.trace and measures the real end-to-end round trip, combining it with this side's own local relay knowledge (no wire round trip needed for that half -- see PathTraceLocal's own doc comment) and the receiver's reported relay knowledge parsed out of a successful outcome's own extension fields. Throws if the outcome resolves ok but its extension fields don't match path-trace-ok's own shape (relayed missing or the wrong type) -- a receiver that answers path.trace at all is expected to answer it correctly; this is a protocol violation to surface loudly, not a case to silently treat as "remote unknown". */
+export declare function tracePath(options: Readonly<TracePathOptions>): Promise<PathTraceResult>;
+//#endregion

package/dist/domain/path-trace.mjs

@@ -0,0 +1,52 @@
+import { pathTraceOkSchema } from "../generated/protocol.mjs";
+//#region src/domain/path-trace.ts
+/** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
+const PATH_TRACE_VERB = "path:trace";
+/** No path: there is no filesystem subtree or other resource involved, only the node itself -- carried on the wire but never actually checked, since path.trace verifies no scope or token at all. */
+const PATH_TRACE_SCOPE = { kind: "node" };
+function isPathTrace(params) {
+	return typeof params === "object" && "verb" in params && params.verb === "path.trace";
+}
+function buildPathTraceCommand() {
+	return {
+		verb: PATH_TRACE_VERB,
+		params: { verb: "path.trace" }
+	};
+}
+/** Builds this side's own answer to an incoming path.trace. relayed is exactly whether THIS request arrived wrapped in relay-data -- incoming.fromDevice is only ever set for a relay-wrapped request (see mesh-session.ts's own applyManageRequest) -- and hubAddress, when given and relayed, is the address this receiver itself dialled to reach the hub the request arrived over, ordinarily read straight off this session's own ConnectionState.address (already tracked by every caller consuming session.events, no new bookkeeping needed). Omitted entirely when not relayed, or when the caller has no address to report (e.g. an accepted, never-dialled connection). */
+function buildPathTraceResponse(incoming, hubAddress) {
+	const relayed = incoming.fromDevice !== void 0;
+	return {
+		result: "ok",
+		relayed,
+		...relayed && hubAddress !== void 0 ? { "hub-address": hubAddress } : {}
+	};
+}
+/** Sends path.trace and measures the real end-to-end round trip, combining it with this side's own local relay knowledge (no wire round trip needed for that half -- see PathTraceLocal's own doc comment) and the receiver's reported relay knowledge parsed out of a successful outcome's own extension fields. Throws if the outcome resolves ok but its extension fields don't match path-trace-ok's own shape (relayed missing or the wrong type) -- a receiver that answers path.trace at all is expected to answer it correctly; this is a protocol violation to surface loudly, not a case to silently treat as "remote unknown". */
+async function tracePath(options) {
+	const startedAt = options.clock.now();
+	const outcome = await options.session.sendManageRequest(buildPathTraceCommand(), options.scope ?? PATH_TRACE_SCOPE, options.targetDevice, options.token, options.timeoutMs);
+	const rttMs = options.clock.now() - startedAt;
+	const local = {
+		relayed: options.targetDevice !== void 0,
+		...options.targetDevice !== void 0 && options.localHubAddress !== void 0 ? { hubAddress: options.localHubAddress } : {}
+	};
+	if (outcome.result === "error") return {
+		rttMs,
+		local,
+		outcome
+	};
+	const parsed = pathTraceOkSchema.safeParse(outcome);
+	if (!parsed.success) throw new Error(`path.trace response did not match path-trace-ok's own shape: ${parsed.error.message}`);
+	return {
+		rttMs,
+		local,
+		remote: {
+			relayed: parsed.data.relayed,
+			...parsed.data["hub-address"] !== void 0 ? { hubAddress: parsed.data["hub-address"] } : {}
+		},
+		outcome
+	};
+}
+//#endregion
+export { PATH_TRACE_SCOPE, PATH_TRACE_VERB, buildPathTraceCommand, buildPathTraceResponse, isPathTrace, tracePath };

package/dist/domain/ping-round-trips.cjs

@@ -0,0 +1,38 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/ping-round-trips.ts
+function createPingRoundTrips() {
+	const pending = [];
+	function cancel(sentAt) {
+		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
+		if (index === -1) return false;
+		pending.splice(index, 1);
+		return true;
+	}
+	return {
+		resolveOldest(nowMs) {
+			const entry = pending.shift();
+			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
+		},
+		rejectAll(reason) {
+			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
+		},
+		async sendAndAwait(sentAt, sendPing, timeoutMs) {
+			const rtt = new Promise((resolve, reject) => {
+				pending.push({
+					sentAt,
+					resolve,
+					reject
+				});
+			});
+			await sendPing();
+			if (timeoutMs === void 0) return rtt;
+			return Promise.race([rtt, new Promise((_resolve, reject) => {
+				setTimeout(() => {
+					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+				}, timeoutMs);
+			})]);
+		}
+	};
+}
+//#endregion
+exports.createPingRoundTrips = createPingRoundTrips;

package/dist/domain/ping-round-trips.d.cts

@@ -0,0 +1,13 @@
+//#region src/domain/ping-round-trips.d.ts
+export interface PingRoundTrips {
+  /** Resolves the oldest still-pending call with (nowMs - itsOwnSentAt) -- called once per pong-frame received. A no-op if nothing is pending (a stray pong with no outstanding call). */
+  resolveOldest: (nowMs: number) => void;
+  /** Rejects and clears every still-pending call -- called on disconnect. */
+  rejectAll: (reason: string) => void;
+  /**
+   * Registers sentAt, awaits sendPing (the caller's own "build the ping-frame, log it, transmit it, emit" sequence -- mesh-session.ts's own concern, not this module's), then resolves once resolveOldest/rejectAll settles the registration, racing an optional timeoutMs that cancels the registration and rejects instead of leaving it to resolve later against a pong that arrives after giving up.
+   */
+  sendAndAwait: (sentAt: number, sendPing: () => Promise<void>, timeoutMs?: number) => Promise<number>;
+}
+export declare function createPingRoundTrips(): PingRoundTrips;
+//#endregion

package/dist/domain/ping-round-trips.d.mts

@@ -0,0 +1,13 @@
+//#region src/domain/ping-round-trips.d.ts
+export interface PingRoundTrips {
+  /** Resolves the oldest still-pending call with (nowMs - itsOwnSentAt) -- called once per pong-frame received. A no-op if nothing is pending (a stray pong with no outstanding call). */
+  resolveOldest: (nowMs: number) => void;
+  /** Rejects and clears every still-pending call -- called on disconnect. */
+  rejectAll: (reason: string) => void;
+  /**
+   * Registers sentAt, awaits sendPing (the caller's own "build the ping-frame, log it, transmit it, emit" sequence -- mesh-session.ts's own concern, not this module's), then resolves once resolveOldest/rejectAll settles the registration, racing an optional timeoutMs that cancels the registration and rejects instead of leaving it to resolve later against a pong that arrives after giving up.
+   */
+  sendAndAwait: (sentAt: number, sendPing: () => Promise<void>, timeoutMs?: number) => Promise<number>;
+}
+export declare function createPingRoundTrips(): PingRoundTrips;
+//#endregion

package/dist/domain/ping-round-trips.mjs

@@ -0,0 +1,37 @@
+//#region src/domain/ping-round-trips.ts
+function createPingRoundTrips() {
+	const pending = [];
+	function cancel(sentAt) {
+		const index = pending.findIndex((entry) => entry.sentAt === sentAt);
+		if (index === -1) return false;
+		pending.splice(index, 1);
+		return true;
+	}
+	return {
+		resolveOldest(nowMs) {
+			const entry = pending.shift();
+			if (entry !== void 0) entry.resolve(nowMs - entry.sentAt);
+		},
+		rejectAll(reason) {
+			for (const entry of pending.splice(0)) entry.reject(new Error(reason));
+		},
+		async sendAndAwait(sentAt, sendPing, timeoutMs) {
+			const rtt = new Promise((resolve, reject) => {
+				pending.push({
+					sentAt,
+					resolve,
+					reject
+				});
+			});
+			await sendPing();
+			if (timeoutMs === void 0) return rtt;
+			return Promise.race([rtt, new Promise((_resolve, reject) => {
+				setTimeout(() => {
+					if (cancel(sentAt)) reject(/* @__PURE__ */ new Error("timed out waiting for pong"));
+				}, timeoutMs);
+			})]);
+		}
+	};
+}
+//#endregion
+export { createPingRoundTrips };

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D2Ue2nd2.cjs";
-import { t as Connection } from "../transport-fUY3alfO.cjs";
+import { N as Frame } from "../protocol-BnbpCk0Z.cjs";
+import { t as Connection } from "../transport-Ca_ZyyZe.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, forwards relay-data within established pairings, and replies to a bare ping with a bare pong (wire-mesh#181) so a client can time its own sender-to-hub leg independent of anything being relayed. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D2Ue2nd2.mjs";
-import { t as Connection } from "../transport-C5wU0UtA.mjs";
+import { N as Frame } from "../protocol-BnbpCk0Z.mjs";
+import { t as Connection } from "../transport-BH8kGWXt.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, forwards relay-data within established pairings, and replies to a bare ping with a bare pong (wire-mesh#181) so a client can time its own sender-to-hub leg independent of anything being relayed. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D2Ue2nd2.cjs";
-import { t as Connection } from "../transport-fUY3alfO.cjs";
+import { N as Frame } from "../protocol-BnbpCk0Z.cjs";
+import { t as Connection } from "../transport-Ca_ZyyZe.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D2Ue2nd2.mjs";
-import { t as Connection } from "../transport-C5wU0UtA.mjs";
+import { N as Frame } from "../protocol-BnbpCk0Z.mjs";
+import { t as Connection } from "../transport-BH8kGWXt.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-D2Ue2nd2.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BtczHfrc.cjs";
+import { bt as RevocationEntry } from "../protocol-BnbpCk0Z.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BL2BzOmN.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-D2Ue2nd2.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-Hnq9oURj.mjs";
+import { bt as RevocationEntry } from "../protocol-BnbpCk0Z.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DtjdYS_a.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/room-rekey.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-D2Ue2nd2.cjs";
-import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BnbpCk0Z.cjs";
+import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
+import { a as RevocationCheck } from "../tokens-BL2BzOmN.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-D2Ue2nd2.mjs";
-import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BnbpCk0Z.mjs";
+import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
+import { a as RevocationCheck } from "../tokens-DtjdYS_a.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CNXMjIQd.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-D9ogJTO3.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-ZHgJhnsu.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-NjaqYY4k.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-D2Ue2nd2.cjs";
-import { t as IdentityPort } from "../identity-pOt5KxJB.cjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BnbpCk0Z.cjs";
+import { t as IdentityPort } from "../identity-BRlM-Krs.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-BtczHfrc.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-CNXMjIQd.cjs";
+import { a as RevocationCheck } from "../tokens-BL2BzOmN.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-D9ogJTO3.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-D2Ue2nd2.mjs";
-import { t as IdentityPort } from "../identity-Br6e0Rx5.mjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BnbpCk0Z.mjs";
+import { t as IdentityPort } from "../identity-DiuayfEd.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-Hnq9oURj.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-ZHgJhnsu.mjs";
+import { a as RevocationCheck } from "../tokens-DtjdYS_a.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-NjaqYY4k.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/shard-manifest.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-D2Ue2nd2.cjs";
+import { D as DeviceId } from "../protocol-BnbpCk0Z.cjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.cjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/shard-manifest.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-D2Ue2nd2.mjs";
+import { D as DeviceId } from "../protocol-BnbpCk0Z.mjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.mjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-BtczHfrc.cjs";
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-BL2BzOmN.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-Hnq9oURj.mjs";
+import { _ as verifyRevocationEntry, a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyCapabilityToken, h as sig1ToBeSigned, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DtjdYS_a.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/topology-snapshot.cjs

@@ -0,0 +1,39 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/topology-snapshot.ts
+/** This session's own direct peer, when it can be honestly known -- see TopologyPeersInputs' own field comments for the priority order and why the gossip-derived fallback is gated on isAccepted. */
+function directPeerDevice(inputs) {
+	if (inputs.authenticatedPeer !== void 0) return inputs.authenticatedPeer;
+	return inputs.isAccepted ? inputs.firstAdvertisedPeer ?? void 0 : void 0;
+}
+/** This session's own current topology self-advertisement: the peer this connection is directly with, when known, and every device this connection currently holds a relay pairing with, each named alongside the hub it is reached via -- always this same direct peer, since a session has exactly one connection and a relay pairing on it can only ever have been established through that connection's own remote end. `via` is omitted, not guessed, when the hub itself has no known device-id (an anonymous relay-only hub, e.g. wire-mesh-node/cloudflare-hub's bare RelayHub, never gossips a self-advert of its own to learn one from). */
+function computeTopologyPeers(inputs) {
+	const direct = directPeerDevice(inputs);
+	return {
+		direct: direct !== void 0 ? [direct] : [],
+		relayed: inputs.relayedDevices.map((device) => ({
+			device,
+			...direct !== void 0 ? { via: direct } : {}
+		}))
+	};
+}
+/** Bundles firstAdvertisedPeer's own mutable tracking together with computeTopologyPeers, so mesh-session.ts's createSessionCore holds one small object instead of a bare `let` plus a wrapper function around this module's own computeTopologyPeers -- sources' own closures are captured once here, so compute() itself takes no arguments at either of buildSelfAdvert/getTopologyPeers' own call sites. */
+function createTopologySnapshotTracker(sources) {
+	let firstAdvertisedPeer = null;
+	return {
+		recordAdvert: (device) => {
+			firstAdvertisedPeer ??= device;
+		},
+		compute: () => {
+			const authenticatedPeer = sources.getAuthenticatedPeer();
+			return computeTopologyPeers({
+				...authenticatedPeer !== void 0 ? { authenticatedPeer } : {},
+				firstAdvertisedPeer,
+				isAccepted: sources.isAccepted,
+				relayedDevices: sources.getRelayedDevices()
+			});
+		}
+	};
+}
+//#endregion
+exports.computeTopologyPeers = computeTopologyPeers;
+exports.createTopologySnapshotTracker = createTopologySnapshotTracker;

package/dist/domain/topology-snapshot.d.cts

@@ -0,0 +1,31 @@
+import { D as DeviceId, en as TopologyPeers } from "../protocol-BnbpCk0Z.cjs";
+//#region src/domain/topology-snapshot.d.ts
+export interface TopologyPeersInputs {
+  /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */
+  authenticatedPeer?: DeviceId;
+  /** The device named by this session's own first-ever peer-advert -- only trustworthy when isAccepted is true; see mesh-session.ts's own firstPeerDevice doc comment for why a dial-side session may end up naming a merely-relayed third device instead. */
+  firstAdvertisedPeer: DeviceId | null;
+  /** True for an accepted connection (dial === null in mesh-session.ts), where firstAdvertisedPeer is structurally sound; false for a dial-side session, where it is not. */
+  isAccepted: boolean;
+  /** Every device this session's own connection currently holds a relay pairing with (relayPairings.list()). */
+  relayedDevices: readonly DeviceId[];
+}
+/** This session's own current topology self-advertisement: the peer this connection is directly with, when known, and every device this connection currently holds a relay pairing with, each named alongside the hub it is reached via -- always this same direct peer, since a session has exactly one connection and a relay pairing on it can only ever have been established through that connection's own remote end. `via` is omitted, not guessed, when the hub itself has no known device-id (an anonymous relay-only hub, e.g. wire-mesh-node/cloudflare-hub's bare RelayHub, never gossips a self-advert of its own to learn one from). */
+export declare function computeTopologyPeers(inputs: Readonly<TopologyPeersInputs>): TopologyPeers;
+export interface TopologySnapshotSources {
+  /** Reads connection?.peerDeviceId live at compute() time -- a closure rather than a plain value, since the connection itself can be replaced (reconnect) between one self-advert and the next. */
+  getAuthenticatedPeer: () => DeviceId | undefined;
+  /** dial === null, fixed for a session's entire lifetime (never reconnects, so not read live). */
+  isAccepted: boolean;
+  /** Reads relayPairings.list() live at compute() time. */
+  getRelayedDevices: () => readonly DeviceId[];
+}
+export interface TopologySnapshotTracker {
+  /** Records one peer-advert entry as it is applied to a session's own directory -- see TopologyPeersInputs.firstAdvertisedPeer's own comment for what this is used for and why only the first call matters. */
+  recordAdvert: (device: DeviceId) => void;
+  /** Computes this session's own current TopologyPeers from the live connection/relayPairings state given at createTopologySnapshotTracker's own construction time. */
+  compute: () => TopologyPeers;
+}
+/** Bundles firstAdvertisedPeer's own mutable tracking together with computeTopologyPeers, so mesh-session.ts's createSessionCore holds one small object instead of a bare `let` plus a wrapper function around this module's own computeTopologyPeers -- sources' own closures are captured once here, so compute() itself takes no arguments at either of buildSelfAdvert/getTopologyPeers' own call sites. */
+export declare function createTopologySnapshotTracker(sources: Readonly<TopologySnapshotSources>): TopologySnapshotTracker;
+//#endregion

package/dist/domain/topology-snapshot.d.mts

@@ -0,0 +1,31 @@
+import { D as DeviceId, en as TopologyPeers } from "../protocol-BnbpCk0Z.mjs";
+//#region src/domain/topology-snapshot.d.ts
+export interface TopologyPeersInputs {
+  /** connection?.peerDeviceId -- the transport-authenticated direct peer, when the adapter gives one. Takes priority over firstAdvertisedPeer below. */
+  authenticatedPeer?: DeviceId;
+  /** The device named by this session's own first-ever peer-advert -- only trustworthy when isAccepted is true; see mesh-session.ts's own firstPeerDevice doc comment for why a dial-side session may end up naming a merely-relayed third device instead. */
+  firstAdvertisedPeer: DeviceId | null;
+  /** True for an accepted connection (dial === null in mesh-session.ts), where firstAdvertisedPeer is structurally sound; false for a dial-side session, where it is not. */
+  isAccepted: boolean;
+  /** Every device this session's own connection currently holds a relay pairing with (relayPairings.list()). */
+  relayedDevices: readonly DeviceId[];
+}
+/** This session's own current topology self-advertisement: the peer this connection is directly with, when known, and every device this connection currently holds a relay pairing with, each named alongside the hub it is reached via -- always this same direct peer, since a session has exactly one connection and a relay pairing on it can only ever have been established through that connection's own remote end. `via` is omitted, not guessed, when the hub itself has no known device-id (an anonymous relay-only hub, e.g. wire-mesh-node/cloudflare-hub's bare RelayHub, never gossips a self-advert of its own to learn one from). */
+export declare function computeTopologyPeers(inputs: Readonly<TopologyPeersInputs>): TopologyPeers;
+export interface TopologySnapshotSources {
+  /** Reads connection?.peerDeviceId live at compute() time -- a closure rather than a plain value, since the connection itself can be replaced (reconnect) between one self-advert and the next. */
+  getAuthenticatedPeer: () => DeviceId | undefined;
+  /** dial === null, fixed for a session's entire lifetime (never reconnects, so not read live). */
+  isAccepted: boolean;
+  /** Reads relayPairings.list() live at compute() time. */
+  getRelayedDevices: () => readonly DeviceId[];
+}
+export interface TopologySnapshotTracker {
+  /** Records one peer-advert entry as it is applied to a session's own directory -- see TopologyPeersInputs.firstAdvertisedPeer's own comment for what this is used for and why only the first call matters. */
+  recordAdvert: (device: DeviceId) => void;
+  /** Computes this session's own current TopologyPeers from the live connection/relayPairings state given at createTopologySnapshotTracker's own construction time. */
+  compute: () => TopologyPeers;
+}
+/** Bundles firstAdvertisedPeer's own mutable tracking together with computeTopologyPeers, so mesh-session.ts's createSessionCore holds one small object instead of a bare `let` plus a wrapper function around this module's own computeTopologyPeers -- sources' own closures are captured once here, so compute() itself takes no arguments at either of buildSelfAdvert/getTopologyPeers' own call sites. */
+export declare function createTopologySnapshotTracker(sources: Readonly<TopologySnapshotSources>): TopologySnapshotTracker;
+//#endregion

package/dist/domain/topology-snapshot.mjs

@@ -0,0 +1,37 @@
+//#region src/domain/topology-snapshot.ts
+/** This session's own direct peer, when it can be honestly known -- see TopologyPeersInputs' own field comments for the priority order and why the gossip-derived fallback is gated on isAccepted. */
+function directPeerDevice(inputs) {
+	if (inputs.authenticatedPeer !== void 0) return inputs.authenticatedPeer;
+	return inputs.isAccepted ? inputs.firstAdvertisedPeer ?? void 0 : void 0;
+}
+/** This session's own current topology self-advertisement: the peer this connection is directly with, when known, and every device this connection currently holds a relay pairing with, each named alongside the hub it is reached via -- always this same direct peer, since a session has exactly one connection and a relay pairing on it can only ever have been established through that connection's own remote end. `via` is omitted, not guessed, when the hub itself has no known device-id (an anonymous relay-only hub, e.g. wire-mesh-node/cloudflare-hub's bare RelayHub, never gossips a self-advert of its own to learn one from). */
+function computeTopologyPeers(inputs) {
+	const direct = directPeerDevice(inputs);
+	return {
+		direct: direct !== void 0 ? [direct] : [],
+		relayed: inputs.relayedDevices.map((device) => ({
+			device,
+			...direct !== void 0 ? { via: direct } : {}
+		}))
+	};
+}
+/** Bundles firstAdvertisedPeer's own mutable tracking together with computeTopologyPeers, so mesh-session.ts's createSessionCore holds one small object instead of a bare `let` plus a wrapper function around this module's own computeTopologyPeers -- sources' own closures are captured once here, so compute() itself takes no arguments at either of buildSelfAdvert/getTopologyPeers' own call sites. */
+function createTopologySnapshotTracker(sources) {
+	let firstAdvertisedPeer = null;
+	return {
+		recordAdvert: (device) => {
+			firstAdvertisedPeer ??= device;
+		},
+		compute: () => {
+			const authenticatedPeer = sources.getAuthenticatedPeer();
+			return computeTopologyPeers({
+				...authenticatedPeer !== void 0 ? { authenticatedPeer } : {},
+				firstAdvertisedPeer,
+				isAccepted: sources.isAccepted,
+				relayedDevices: sources.getRelayedDevices()
+			});
+		}
+	};
+}
+//#endregion
+export { computeTopologyPeers, createTopologySnapshotTracker };