wire-mesh-core 2.0.2 → 3.0.0

package/README.md

@@ -14,6 +14,7 @@ The TypeScript implementation of wire-mesh's protocol, built ports/adapters: dom
 - **Handshake negotiation** (`src/domain/handshake.ts`) -- protocol-version and capability-domain negotiation between two peers, the mechanism agent-comms issue #31 is fixed by.
 - **Capability-token verification** (`src/domain/tokens.ts`) -- the full chain tokens.cddl documents: COSE_Sign1 signature verification, the self-certifying issuer-key check (`sha256(issuer-key.public-key) == issuer`), expiry/not-before, issuer-matched revocation (only a token's own issuer's signed revocation-entry counts, checked across every ancestor in the delegation chain, not just the leaf), and recursive delegation-chain narrowing across all three axes of authority: a delegated token's issuer must be its parent's bearer (the chain is unbroken), its expiry must not exceed its parent's, and its scope must narrow its parent's (identical kind, equal-or-descendant path when the parent carries one) with an identical capability verb (the verb grammar has no sub-verb relation, so a different verb is different authority, not narrower). Also exports `verifyRevocationEntry` for ingesting gossiped revocation-announce frames: each entry is itself a signed, self-certifying COSE_Sign1 over revocation-claims, verified before it may enter the revocation view.
 - **Peer-advert verification** (`src/domain/peer-advert.ts`): the two checks transport.cddl states for a gossiped advert, applied by the relay hub before it registers or forwards one and by every session before one reaches its directory: the embedded identity-key self-certifies (`sha256(identity-key.public-key) == device`), and the signature verifies under that same key over the domain-separated canonical encoding of the advert with its signature removed, which covers the open extension tail as well. Deliberately not tokens.cddl's COSE Sig_structure: an advert's open tail lets an attacker craft one whose encoding also satisfies token-claims, so the prefixed construction keeps the two byte strings disjoint. Reaches a verdict for every input rather than throwing, since an advert's algorithm and key bytes are attacker-chosen.
+- **Secure channel** (`src/domain/secure-channel.ts`, `src/domain/relay-channels.ts`): the end-to-end channel spec/secure-channel.cddl defines between two devices that reach each other through a relay. A session opens one with each peer it addresses through a relay pairing, seals every manage-request and manage-response in it, drops any that arrives as plain relay-data, and attributes a request to the identity the peer's handshake proved rather than to the `from-device` a hub stamps. There is no plaintext fallback, so a peer that does not speak it cannot be reached through a relay.
 
 ## Deliberately deferred
 

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DCDae3z4.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DCDae3z4.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-Bi2fzBCc.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DCDae3z4.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-Bi2fzBCc.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DCDae3z4.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Cq_odHy3.cjs";
+import { r as Transport } from "../transport-CfW7fsGK.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-GcJ4LYVE.mjs";
+import { r as Transport } from "../transport-iLBxIkRS.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Cq_odHy3.cjs";
+import { r as Transport } from "../transport-CfW7fsGK.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-GcJ4LYVE.mjs";
+import { r as Transport } from "../transport-iLBxIkRS.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/advert-extension-policy.cjs

@@ -0,0 +1,20 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
+//#region src/domain/advert-extension-policy.ts
+/** The extension keys wire-mesh-core itself writes on every self-advert, which a policy never has to list. */
+const CORE_EXTENSION_KEYS = /* @__PURE__ */ new Set([require_gossip_extensions.TOPOLOGY_PEERS_GOSSIP_KEY, require_gossip_extensions.CORE_VERSION_GOSSIP_KEY]);
+/**
+* Checks every extension entry of an advert against a policy. Refuses on the first entry that is not allowed and names its key, so the host can say why.
+*/
+function checkAdvertExtensions(advert, policy) {
+	for (const [key, value] of Object.entries(advert)) {
+		if (require_gossip_extensions.RESERVED_PEER_ADVERT_KEYS.has(key) || CORE_EXTENSION_KEYS.has(key)) continue;
+		if ((Object.hasOwn(policy.allowed, key) ? policy.allowed[key] : void 0)?.(value) !== true) return {
+			ok: false,
+			key
+		};
+	}
+	return { ok: true };
+}
+//#endregion
+exports.checkAdvertExtensions = checkAdvertExtensions;

package/dist/domain/advert-extension-policy.d.cts

@@ -0,0 +1,21 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+//#region src/domain/advert-extension-policy.d.ts
+/** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
+export type ExtensionValidator = (value: unknown) => boolean;
+export interface AdvertExtensionPolicy {
+  /**
+   * The application extensions the hub carries, each with the validator its value must pass. An advert holding any extension key not listed here, or a listed key whose value fails its validator, is refused whole. wire-mesh-core's own extensions (topology and version) are always carried and need no entry.
+   */
+  readonly allowed: Readonly<Record<string, ExtensionValidator>>;
+}
+export type AdvertExtensionVerdict = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly key: string;
+};
+/**
+ * Checks every extension entry of an advert against a policy. Refuses on the first entry that is not allowed and names its key, so the host can say why.
+ */
+export declare function checkAdvertExtensions(advert: Readonly<PeerAdvert>, policy: Readonly<AdvertExtensionPolicy>): AdvertExtensionVerdict;
+//#endregion

package/dist/domain/advert-extension-policy.d.mts

@@ -0,0 +1,21 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+//#region src/domain/advert-extension-policy.d.ts
+/** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
+export type ExtensionValidator = (value: unknown) => boolean;
+export interface AdvertExtensionPolicy {
+  /**
+   * The application extensions the hub carries, each with the validator its value must pass. An advert holding any extension key not listed here, or a listed key whose value fails its validator, is refused whole. wire-mesh-core's own extensions (topology and version) are always carried and need no entry.
+   */
+  readonly allowed: Readonly<Record<string, ExtensionValidator>>;
+}
+export type AdvertExtensionVerdict = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly key: string;
+};
+/**
+ * Checks every extension entry of an advert against a policy. Refuses on the first entry that is not allowed and names its key, so the host can say why.
+ */
+export declare function checkAdvertExtensions(advert: Readonly<PeerAdvert>, policy: Readonly<AdvertExtensionPolicy>): AdvertExtensionVerdict;
+//#endregion

package/dist/domain/advert-extension-policy.mjs

@@ -0,0 +1,19 @@
+import { i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, t as RESERVED_PEER_ADVERT_KEYS } from "../gossip-extensions-B6WJjkAr.mjs";
+//#region src/domain/advert-extension-policy.ts
+/** The extension keys wire-mesh-core itself writes on every self-advert, which a policy never has to list. */
+const CORE_EXTENSION_KEYS = /* @__PURE__ */ new Set([TOPOLOGY_PEERS_GOSSIP_KEY, CORE_VERSION_GOSSIP_KEY]);
+/**
+* Checks every extension entry of an advert against a policy. Refuses on the first entry that is not allowed and names its key, so the host can say why.
+*/
+function checkAdvertExtensions(advert, policy) {
+	for (const [key, value] of Object.entries(advert)) {
+		if (RESERVED_PEER_ADVERT_KEYS.has(key) || CORE_EXTENSION_KEYS.has(key)) continue;
+		if ((Object.hasOwn(policy.allowed, key) ? policy.allowed[key] : void 0)?.(value) !== true) return {
+			ok: false,
+			key
+		};
+	}
+	return { ok: true };
+}
+//#endregion
+export { checkAdvertExtensions };

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-Cq_odHy3.cjs";
+import { t as Connection } from "../transport-CfW7fsGK.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-GcJ4LYVE.mjs";
+import { t as Connection } from "../transport-iLBxIkRS.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-BDVxEvl2.cjs";
+import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-0r9ipK1r.mjs";
+import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-Bi2fzBCc.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-DCDae3z4.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-Bi2fzBCc.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-DCDae3z4.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
-import { r as Transport, t as Connection } from "../transport-Cq_odHy3.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
+import { r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
-import { r as Transport, t as Connection } from "../transport-GcJ4LYVE.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
+import { r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/gossip-expansion.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
 import { MeshSession } from "./mesh-session.cjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/gossip-expansion.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
 import { MeshSession } from "./mesh-session.mjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/gossip-extensions.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_gossip_extensions = require("../gossip-extensions-DRVTHKnR.cjs");
+const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
+exports.RESERVED_PEER_ADVERT_KEYS = require_gossip_extensions.RESERVED_PEER_ADVERT_KEYS;
 exports.TOPOLOGY_PEERS_GOSSIP_KEY = require_gossip_extensions.TOPOLOGY_PEERS_GOSSIP_KEY;
 exports.validateGossipExtensions = require_gossip_extensions.validateGossipExtensions;

package/dist/domain/gossip-extensions.d.cts

@@ -1,4 +1,6 @@
 //#region src/domain/gossip-extensions.d.ts
+/** peer-advert's own typed fields, reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, freshness timestamp, self-certifying key, or signature by supplying an extension of the same name. The last two matter most: an extension able to shadow them would let a caller replace the very fields wire-mesh#225's authentication rests on. */
+export declare const RESERVED_PEER_ADVERT_KEYS: ReadonlySet<string>;
 /** The gossip extension key topology self-advertisement (wire-mesh#180) is carried under -- session-managed, computed fresh from this session's own connection/relayPairings state on every self-advert, never a caller-supplied fact. */
 export declare const TOPOLOGY_PEERS_GOSSIP_KEY = "topology/peers";
 /** Rejects a `sendGossipUpdate` extension bag that would shadow one of peer-advert's own mandatory fields, shadow topology/peers (a field the session itself already computes and injects automatically, wire-mesh#180), use the key wire-mesh-core itself reserves for its own self-reported version (wire-mesh#179), or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */

package/dist/domain/gossip-extensions.d.mts

@@ -1,4 +1,6 @@
 //#region src/domain/gossip-extensions.d.ts
+/** peer-advert's own typed fields, reserved so a `sendGossipUpdate` caller can never override the session's own device-id, address list, freshness timestamp, self-certifying key, or signature by supplying an extension of the same name. The last two matter most: an extension able to shadow them would let a caller replace the very fields wire-mesh#225's authentication rests on. */
+export declare const RESERVED_PEER_ADVERT_KEYS: ReadonlySet<string>;
 /** The gossip extension key topology self-advertisement (wire-mesh#180) is carried under -- session-managed, computed fresh from this session's own connection/relayPairings state on every self-advert, never a caller-supplied fact. */
 export declare const TOPOLOGY_PEERS_GOSSIP_KEY = "topology/peers";
 /** Rejects a `sendGossipUpdate` extension bag that would shadow one of peer-advert's own mandatory fields, shadow topology/peers (a field the session itself already computes and injects automatically, wire-mesh#180), use the key wire-mesh-core itself reserves for its own self-reported version (wire-mesh#179), or use a bare, non-domain-qualified key -- all are caller bugs that must fail loudly at the call site, not silently corrupt or ambiguously merge into the wire frame. */

package/dist/domain/gossip-extensions.mjs

@@ -1,2 +1,2 @@
-import { n as validateGossipExtensions, t as TOPOLOGY_PEERS_GOSSIP_KEY } from "../gossip-extensions-BNiI44sU.mjs";
-export { TOPOLOGY_PEERS_GOSSIP_KEY, validateGossipExtensions };
+import { n as TOPOLOGY_PEERS_GOSSIP_KEY, r as validateGossipExtensions, t as RESERVED_PEER_ADVERT_KEYS } from "../gossip-extensions-B6WJjkAr.mjs";
+export { RESERVED_PEER_ADVERT_KEYS, TOPOLOGY_PEERS_GOSSIP_KEY, validateGossipExtensions };

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DCDae3z4.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DCDae3z4.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-Bi2fzBCc.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DCDae3z4.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-Bi2fzBCc.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DCDae3z4.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;