wire-mesh-core 2.0.2 → 3.0.0

package/dist/domain/mesh-session.mjs

@@ -1,11 +1,12 @@
+import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
+import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
-import { a as isVersionGetCommand, i as OWN_VERSION, n as validateGossipExtensions, o as versionGetOutcome, r as CORE_VERSION_GOSSIP_KEY, t as TOPOLOGY_PEERS_GOSSIP_KEY } from "../gossip-extensions-BNiI44sU.mjs";
-import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
-import { tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
+import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -21,6 +22,260 @@ function createRelayPairings() {
 	};
 }
 //#endregion
+//#region src/domain/secure-channel.ts
+/**
+* The end-to-end channel two devices open between themselves inside a relay pairing (spec/secure-channel.cddl). A relay only forwards the bytes of a `relay-data` frame, and without this it could read them, alter them, and say who sent them. Here the two devices authenticate each other's identity keys over a fresh ECDH exchange, derive one AES-256-GCM key per direction, and seal every frame they exchange so the relay sees ciphertext and every receiver learns the sender's identity from the handshake and nothing a relay asserts.
+*
+* Pure crypto and framing, with no connection or session in it: beginHandshake and verifyHello and establishChannel are the three steps of the handshake, and a SecureChannel then seals and opens frames. mesh-session.ts owns when to do each, and where the results travel.
+*/
+const NONCE_BYTE_LENGTH = 16;
+const AES_KEY_BIT_LENGTH = 256;
+const ECDH_SECRET_BIT_LENGTH = 256;
+const GCM_IV_BYTE_LENGTH = 12;
+/** The counter fills the last eight bytes of the IV; the four before it stay zero. */
+const IV_COUNTER_OFFSET = 4;
+const COUNTER_BYTE_LENGTH = 8;
+const encoder = new TextEncoder();
+const HELLO_CONTEXT = encoder.encode("wire-mesh/secure-hello/v1\0");
+const CHANNEL_CONTEXT = encoder.encode("wire-mesh/secure-channel/v1\0");
+const DATA_CONTEXT = encoder.encode("wire-mesh/secure-data/v1\0");
+const LABEL_LOW_TO_HIGH = encoder.encode("lo-to-hi");
+const LABEL_HIGH_TO_LOW = encoder.encode("hi-to-lo");
+const ECDH_PARAMS = {
+	name: "ECDH",
+	namedCurve: "P-256"
+};
+function concat(...parts) {
+	const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+	let offset = 0;
+	for (const part of parts) {
+		out.set(part, offset);
+		offset += part.length;
+	}
+	return out;
+}
+/** Bytewise order of two device-ids: negative when a sorts first. */
+function compareBytes(a, b) {
+	for (let i = 0; i < Math.min(a.length, b.length); i += 1) {
+		const difference = (a[i] ?? 0) - (b[i] ?? 0);
+		if (difference !== 0) return difference;
+	}
+	return a.length - b.length;
+}
+function counterBytes(counter) {
+	const bytes = new Uint8Array(COUNTER_BYTE_LENGTH);
+	new DataView(bytes.buffer).setBigUint64(0, BigInt(counter), false);
+	return bytes;
+}
+/** Exactly what a hello's signature covers: see spec/secure-channel.cddl. */
+function helloSigningInput(ephemeralKey, nonce, sender, recipient) {
+	return concat(HELLO_CONTEXT, ephemeralKey, nonce, sender, recipient);
+}
+/** Generates this side's ephemeral key pair and nonce and signs a hello for peer. */
+async function beginHandshake(identity, peer) {
+	const pair = await crypto.subtle.generateKey(ECDH_PARAMS, false, ["deriveBits"]);
+	const ephemeralKey = new Uint8Array(await crypto.subtle.exportKey("raw", pair.publicKey));
+	const nonce = crypto.getRandomValues(new Uint8Array(NONCE_BYTE_LENGTH));
+	const signature = await identity.sign(helloSigningInput(ephemeralKey, nonce, identity.deviceId, peer));
+	return {
+		peer,
+		privateKey: pair.privateKey,
+		hello: {
+			type: "secure-hello",
+			"ephemeral-key": ephemeralKey,
+			nonce,
+			"identity-key": identity.identityKey,
+			"to-device": peer,
+			signature
+		}
+	};
+}
+/**
+* Checks a received hello: its identity key must hash to a device-id (which is then the peer), it must be addressed to this device, and its signature must verify under that key over the input spec/secure-channel.cddl defines. Never throws: a hostile hello gets a verdict.
+*/
+async function verifyHello(identity, hello) {
+	const key = hello["identity-key"];
+	try {
+		const sender = await identity.deriveDeviceId(key["public-key"]);
+		if (!bytesEqual(hello["to-device"], identity.deviceId)) return {
+			ok: false,
+			reason: "wrong_recipient"
+		};
+		return await identity.verify(key, helloSigningInput(hello["ephemeral-key"], hello.nonce, sender, identity.deviceId), hello.signature) ? {
+			ok: true,
+			peer: {
+				deviceId: sender,
+				identityKey: key
+			}
+		} : {
+			ok: false,
+			reason: "bad_signature"
+		};
+	} catch {
+		return {
+			ok: false,
+			reason: "identity_mismatch"
+		};
+	}
+}
+function ivFor(counter) {
+	const iv = new Uint8Array(GCM_IV_BYTE_LENGTH);
+	iv.set(counterBytes(counter), IV_COUNTER_OFFSET);
+	return iv;
+}
+function associatedData(sender, recipient, counter) {
+	return concat(DATA_CONTEXT, sender, recipient, counterBytes(counter));
+}
+async function deriveDirectionKey(secret, salt, low, high, label) {
+	const material = await crypto.subtle.importKey("raw", Uint8Array.from(secret), "HKDF", false, ["deriveKey"]);
+	return crypto.subtle.deriveKey({
+		name: "HKDF",
+		hash: "SHA-256",
+		salt: Uint8Array.from(salt),
+		info: concat(CHANNEL_CONTEXT, low, high, label)
+	}, material, {
+		name: "AES-GCM",
+		length: AES_KEY_BIT_LENGTH
+	}, false, ["encrypt", "decrypt"]);
+}
+/**
+* Completes a handshake once the peer's hello has verified: derives the two directional keys from the ECDH result of the ephemeral keys and returns the channel. Returns undefined when the peer's ephemeral key is not a valid P-256 point, which only a hostile or broken peer sends.
+*
+* `peer` is the device verifyHello authenticated for `remote`, and `pending` is this side's own half, whether the handshake was begun here or in answer to that hello.
+*/
+async function establishChannel(identity, pending, remote, peer) {
+	let secret;
+	try {
+		const remoteKey = await crypto.subtle.importKey("raw", Uint8Array.from(remote["ephemeral-key"]), ECDH_PARAMS, false, []);
+		secret = new Uint8Array(await crypto.subtle.deriveBits({
+			name: "ECDH",
+			public: remoteKey
+		}, pending.privateKey, ECDH_SECRET_BIT_LENGTH));
+	} catch {
+		return;
+	}
+	const localIsLow = compareBytes(identity.deviceId, peer.deviceId) < 0;
+	const low = localIsLow ? identity.deviceId : peer.deviceId;
+	const high = localIsLow ? peer.deviceId : identity.deviceId;
+	const salt = concat(localIsLow ? pending.hello.nonce : remote.nonce, localIsLow ? remote.nonce : pending.hello.nonce);
+	const lowToHigh = await deriveDirectionKey(secret, salt, low, high, LABEL_LOW_TO_HIGH);
+	const highToLow = await deriveDirectionKey(secret, salt, low, high, LABEL_HIGH_TO_LOW);
+	const sendKey = localIsLow ? lowToHigh : highToLow;
+	const receiveKey = localIsLow ? highToLow : lowToHigh;
+	let nextSendCounter = 0;
+	let highestReceived = -1;
+	let sealing = Promise.resolve();
+	let opening = Promise.resolve();
+	async function sealAt(frame, counter) {
+		return {
+			type: "secure-data",
+			counter,
+			ciphertext: new Uint8Array(await crypto.subtle.encrypt({
+				name: "AES-GCM",
+				iv: ivFor(counter),
+				additionalData: associatedData(identity.deviceId, peer.deviceId, counter)
+			}, sendKey, messageFromFrame(frame)))
+		};
+	}
+	async function openOne(data) {
+		if (data.counter <= highestReceived) return void 0;
+		let plaintext;
+		try {
+			plaintext = new Uint8Array(await crypto.subtle.decrypt({
+				name: "AES-GCM",
+				iv: ivFor(data.counter),
+				additionalData: associatedData(peer.deviceId, identity.deviceId, data.counter)
+			}, receiveKey, Uint8Array.from(data.ciphertext)));
+		} catch {
+			return;
+		}
+		highestReceived = data.counter;
+		return tryDecodeFrame(plaintext) ?? void 0;
+	}
+	return {
+		peer,
+		seal: async (frame) => {
+			const counter = nextSendCounter;
+			nextSendCounter += 1;
+			const sealed = sealing.then(async () => sealAt(frame, counter));
+			sealing = sealed.catch(() => void 0);
+			return sealed;
+		},
+		open: async (data) => {
+			const opened = opening.then(async () => openOne(data));
+			opening = opened.catch(() => void 0);
+			return opened;
+		}
+	};
+}
+//#endregion
+//#region src/domain/relay-channels.ts
+function createRelayChannels(identity, sendHello) {
+	const channels = /* @__PURE__ */ new Map();
+	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
+	function start(peer) {
+		const key = deviceIdToHex(peer);
+		const settle = Promise.withResolvers();
+		const pending = beginHandshake(identity, peer);
+		const entry = {
+			status: "awaiting",
+			pending,
+			settle
+		};
+		channels.set(key, entry);
+		pending.then(async ({ hello }) => sendHello(peer, hello)).catch((error) => {
+			settle.reject(error instanceof Error ? error : new Error(String(error)));
+			if (channels.get(key) === entry) channels.delete(key);
+		});
+		return entry;
+	}
+	return {
+		ensure: async (peer) => {
+			const existing = channels.get(deviceIdToHex(peer));
+			if (existing?.status === "established") return existing.channel;
+			return (existing ?? start(peer)).settle.promise;
+		},
+		applyHello: async (hello) => {
+			const verdict = await verifyHello(identity, hello);
+			if (!verdict.ok) return;
+			const key = deviceIdToHex(verdict.peer.deviceId);
+			const current = channels.get(key);
+			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
+			const channel = await establishChannel(identity, await entry.pending, hello, verdict.peer);
+			if (channel === void 0) {
+				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
+				if (channels.get(key) === entry) channels.delete(key);
+				return;
+			}
+			channels.set(key, {
+				status: "established",
+				channel
+			});
+			entry.settle.resolve(channel);
+		},
+		open: async (data, claimedFrom) => {
+			if (claimedFrom === void 0) return;
+			const entry = channels.get(deviceIdToHex(claimedFrom));
+			if (entry?.status !== "established") return;
+			const frame = await entry.channel.open(data);
+			return frame === void 0 ? void 0 : {
+				frame,
+				from: entry.channel.peer.deviceId
+			};
+		},
+		reset: (reason) => {
+			for (const entry of channels.values()) if (entry.status === "awaiting") entry.settle.reject(new Error(reason));
+			channels.clear();
+		},
+		forget: (peer) => {
+			const key = deviceIdToHex(peer);
+			const entry = channels.get(key);
+			if (entry?.status === "awaiting") entry.settle.reject(/* @__PURE__ */ new Error("the relay pairing was lost"));
+			channels.delete(key);
+		}
+	};
+}
+//#endregion
 //#region src/domain/mesh-session.ts
 const MS_PER_SECOND = 1e3;
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -55,6 +310,15 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		getRelayedDevices: () => relayPairings.list()
 	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
+	const relayChannels = createRelayChannels(identity, async (peer, hello) => {
+		if (connection === null) throw new Error("not connected");
+		frameLog.push({
+			direction: "sent",
+			frame: hello
+		});
+		await connection.send(wrapRelayData(hello, peer));
+		emit();
+	});
 	const incomingQueue = createAsyncQueue();
 	const revocationQueue = createAsyncQueue();
 	const pingRoundTrips = createPingRoundTrips();
@@ -89,28 +353,32 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		if (connection === null || state.status !== "connected") throw new Error("not connected");
 		return connection;
 	}
-	/** Sends a frame, wrapping it as relay-data first when viaRelay is set -- the single choke point every outbound manage-request/manage-response passes through, so a consumer of sendManageRequest/respond never needs its own relay-wrapping logic. When relaying, toDevice is stamped onto the outer relay-data-frame's own `to-device` field so the hub addresses it to the correct pairing directly (wire-mesh#30) rather than falling back to whichever pairing it last saw -- the one case this is omitted is a response to a request that itself arrived with no from-device to echo back, which is left to that same hub fallback exactly as an unaddressed relay-data always has been. */
+	/** Sends a frame. Through a relay it is sealed for toDevice on their secure channel first (spec/secure-channel.cddl) and only then wrapped as relay-data, so the hub carries ciphertext. This is the single choke point every outbound manage-request and manage-response passes through, so a consumer of sendManageRequest or respond never needs its own relay logic. */
 	async function transmit(frame, viaRelay, toDevice) {
 		if (connection === null) throw new Error("not connected");
-		if (viaRelay) {
-			await connection.send(wrapRelayData(frame, toDevice));
+		if (!viaRelay) {
+			await connection.send(frame);
 			return;
 		}
-		await connection.send(frame);
+		if (toDevice === void 0) throw new Error("a relayed frame needs the device it is for");
+		const sealed = await (await relayChannels.ensure(toDevice)).seal(frame);
+		await connection.send(wrapRelayData(sealed, toDevice));
 	}
-	function applyManageResponse(frame) {
+	/** `from` is the device whose secure channel the response arrived through, absent for one that arrived directly. A pending request only accepts an answer from where it was sent: a peer must not be able to answer a request meant for another by guessing its request-id. */
+	function applyManageResponse(frame, from) {
 		const requestId = frame["request-id"];
 		const pending = pendingManageRequests.get(requestId);
-		if (pending !== void 0) {
-			pendingManageRequests.delete(requestId);
-			pending.resolve(frame.outcome);
-		}
+		if (pending === void 0) return;
+		const expected = pending.expectedFrom;
+		if (!(expected === void 0 ? from === void 0 : from !== void 0 && deviceIdToHex(from) === deviceIdToHex(expected))) return;
+		pendingManageRequests.delete(requestId);
+		pending.resolve(frame.outcome);
 	}
-	/** relayFrame is present only for a manage-request that arrived wrapped in relay-data, and is that same outer relay-data-frame -- its own to-device/from-device fields carry whatever addressing it received. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. A version.get request (VERSION_GET_VERB) is answered directly, right here, rather than ever reaching incomingManageRequests -- deliberately ungated (version.cddl), so no application needs to remember to register its own handler for it the way every other verb requires. */
-	function applyManageRequest(frame, relayFrame) {
+	/** `origin` is present only for a manage-request that arrived through a relay pairing: who sent it, as their secure channel authenticated them, and the device the relay-data frame was addressed to, if it named one. See IncomingManageRequest's own fromDevice/toDevice doc comments for what each means and why neither is ever guessed from pairing state. */
+	function applyManageRequest(frame, origin) {
 		const requestId = frame["request-id"];
-		const fromDevice = relayFrame?.["from-device"];
-		const toDevice = relayFrame?.["to-device"];
+		const fromDevice = origin?.fromDevice;
+		const toDevice = origin?.toDevice;
 		const incoming = {
 			requestId,
 			command: frame.command,
@@ -128,7 +396,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame: response
 				});
-				await transmit(response, relayFrame !== void 0, fromDevice);
+				await transmit(response, origin !== void 0, fromDevice);
 				emit();
 			}
 		};
@@ -141,13 +409,32 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	async function applyFrame(frame) {
 		if (frame.type === "relay-data") {
 			const inner = tryDecodeFrame(frame.payload);
-			if (inner !== null && (inner.type === "manage-request" || inner.type === "manage-response")) {
+			if (inner?.type === "secure-hello") {
 				frameLog.push({
 					direction: "received",
 					frame: inner
 				});
-				if (inner.type === "manage-response") applyManageResponse(inner);
-				else applyManageRequest(inner, frame);
+				await relayChannels.applyHello(inner);
+				return;
+			}
+			if (inner?.type === "secure-data") {
+				const opened = await relayChannels.open(inner, frame["from-device"]);
+				if (opened?.frame.type === "manage-response") {
+					frameLog.push({
+						direction: "received",
+						frame: opened.frame
+					});
+					applyManageResponse(opened.frame, opened.from);
+				} else if (opened?.frame.type === "manage-request") {
+					frameLog.push({
+						direction: "received",
+						frame: opened.frame
+					});
+					applyManageRequest(opened.frame, {
+						fromDevice: opened.from,
+						...frame["to-device"] !== void 0 ? { toDevice: frame["to-device"] } : {}
+					});
+				}
 				return;
 			}
 			frameLog.push({
@@ -271,6 +558,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	/** Everything a connection needs once it exists, regardless of whether it was dialled (createMeshSession's own doConnect, below) or handed over already established (acceptMeshSession): send this side's handshake and self-advert, arm the handshake timeout, and start consuming frames. The two entry points differ only in how link itself came to exist and what address means for it -- a real dial target for one, a caller-chosen label for the other, since the Connection/Transport ports expose no remote-address concept of their own for an accepted connection. */
 	async function wireUpConnection(link, address, localDomains) {
 		connection = link;
+		relayChannels.reset("the connection changed before the channel was ready");
 		localHandshakeSent = localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {
@@ -368,20 +656,33 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				const outcome = new Promise((resolve, reject) => {
 					pendingManageRequests.set(requestId, {
 						resolve,
-						reject
+						reject,
+						expectedFrom: targetDevice
 					});
 				});
 				frameLog.push({
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, targetDevice !== void 0, targetDevice);
-				emit();
-				if (timeoutMs === void 0) return outcome;
-				return Promise.race([outcome, new Promise((resolve) => {
+				const exchange = (async () => {
+					try {
+						await transmit(frame, targetDevice !== void 0, targetDevice);
+					} catch (error) {
+						pendingManageRequests.delete(requestId);
+						outcome.catch(() => void 0);
+						throw error;
+					}
+					emit();
+					return outcome;
+				})();
+				if (timeoutMs === void 0) return exchange;
+				return Promise.race([exchange, new Promise((resolve) => {
 					setTimeout(() => {
 						if (pendingManageRequests.delete(requestId)) {
-							if (targetDevice !== void 0) relayPairings.remove(targetDevice);
+							if (targetDevice !== void 0) {
+								relayPairings.remove(targetDevice);
+								relayChannels.forget(targetDevice);
+							}
 							resolve({
 								result: "error",
 								code: "timeout"
@@ -436,6 +737,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					reconnectTimer = null;
 				}
 				rejectPendingManageRequests("connection closed before a response arrived");
+				relayChannels.reset("the session closed before the channel was ready");
 				pingRoundTrips.rejectAll("connection closed before a pong arrived");
 				if (connection !== null) await connection.close();
 				if (state.status === "connected" || state.status === "connecting" || state.status === "reconnecting") state = {

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-BDVxEvl2.cjs";
+import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-0r9ipK1r.mjs";
+import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/path-trace.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.cjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/path-trace.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Bi2fzBCc.mjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
-import { t as IdentityPort } from "../identity-DImeXZcq.cjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
-import { t as IdentityPort } from "../identity-Dc4xmwp3.mjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/relay-hub.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_peer_advert = require("./peer-advert.cjs");
+const require_domain_advert_extension_policy = require("./advert-extension-policy.cjs");
 //#region src/domain/relay-hub.ts
 const HEX_RADIX = 16;
 const HEX_DIGITS_PER_BYTE = 2;
@@ -115,6 +116,16 @@ function createRelayHub(options) {
 			const accepted = [];
 			for (const advert of frame.peers) {
 				if (!await require_domain_peer_advert.verifyPeerAdvert(options.identity, advert)) continue;
+				if (options.extensionPolicy !== void 0) {
+					const verdict = require_domain_advert_extension_policy.checkAdvertExtensions(advert, options.extensionPolicy);
+					if (!verdict.ok) {
+						options.onAdvertRefused?.({
+							device: advert.device,
+							key: verdict.key
+						});
+						continue;
+					}
+				}
 				const key = deviceKey(advert.device);
 				const previous = devices.get(key);
 				if (previous !== void 0 && !supersedes(previous, advert, connection)) continue;

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,6 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-Bi2fzBCc.cjs";
-import { t as Connection } from "../transport-Cq_odHy3.cjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { AdvertExtensionPolicy } from "./advert-extension-policy.cjs";
 import { PeerAdvertVerifier } from "./peer-advert.cjs";
 //#region src/domain/relay-hub.d.ts
 /**
@@ -20,9 +21,21 @@ export interface RelayConnectionRestore {
   readonly connection: Readonly<Connection>;
   readonly state: RelayConnectionState;
 }
+/** An advert the hub refused to carry because of what its extension tail holds. */
+export interface AdvertRefusal {
+  readonly device: DeviceId;
+  /** The extension key that was not allowed, or whose value failed its validator. */
+  readonly key: string;
+}
 export interface RelayHubOptions {
   /** The crypto primitives this hub verifies every gossiped advert with (wire-mesh#225). Narrowed to verify/deriveDeviceId rather than a full IdentityPort because an advert is self-certifying: a hub checks one against the key the advert itself carries, and never needs a signing identity of its own to do it. */
   readonly identity: Readonly<PeerAdvertVerifier>;
+  /**
+   * Which extension entries of an advert this hub will carry. Absent, every extension is carried, which is right for a hub whose every client belongs to one mesh. A hub open to anyone should set it: an advert is forwarded whole to every client, so this is the only control the hub has over what an application publishes to strangers.
+   */
+  readonly extensionPolicy?: AdvertExtensionPolicy;
+  /** Called with each advert refused by extensionPolicy, so the host can report it; the advert's sender is given no reply, since the transport spec defines none. */
+  readonly onAdvertRefused?: (refusal: Readonly<AdvertRefusal>) => void;
   /** Called whenever the value exportConnection returns for a connection changes: it gossiped an advert, gained or lost a pairing, or had one of its adverts taken over by another connection. A host whose own instance can be torn down while its connections stay open (the Cloudflare hub's hibernating Durable Object) reads the new value back with exportConnection, persists it against the connection, and hands it to a later instance through restoreConnections. */
   readonly onConnectionStateChanged?: (connection: Readonly<Connection>) => void;
 }

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,6 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-Bi2fzBCc.mjs";
-import { t as Connection } from "../transport-GcJ4LYVE.mjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { AdvertExtensionPolicy } from "./advert-extension-policy.mjs";
 import { PeerAdvertVerifier } from "./peer-advert.mjs";
 //#region src/domain/relay-hub.d.ts
 /**
@@ -20,9 +21,21 @@ export interface RelayConnectionRestore {
   readonly connection: Readonly<Connection>;
   readonly state: RelayConnectionState;
 }
+/** An advert the hub refused to carry because of what its extension tail holds. */
+export interface AdvertRefusal {
+  readonly device: DeviceId;
+  /** The extension key that was not allowed, or whose value failed its validator. */
+  readonly key: string;
+}
 export interface RelayHubOptions {
   /** The crypto primitives this hub verifies every gossiped advert with (wire-mesh#225). Narrowed to verify/deriveDeviceId rather than a full IdentityPort because an advert is self-certifying: a hub checks one against the key the advert itself carries, and never needs a signing identity of its own to do it. */
   readonly identity: Readonly<PeerAdvertVerifier>;
+  /**
+   * Which extension entries of an advert this hub will carry. Absent, every extension is carried, which is right for a hub whose every client belongs to one mesh. A hub open to anyone should set it: an advert is forwarded whole to every client, so this is the only control the hub has over what an application publishes to strangers.
+   */
+  readonly extensionPolicy?: AdvertExtensionPolicy;
+  /** Called with each advert refused by extensionPolicy, so the host can report it; the advert's sender is given no reply, since the transport spec defines none. */
+  readonly onAdvertRefused?: (refusal: Readonly<AdvertRefusal>) => void;
   /** Called whenever the value exportConnection returns for a connection changes: it gossiped an advert, gained or lost a pairing, or had one of its adverts taken over by another connection. A host whose own instance can be torn down while its connections stay open (the Cloudflare hub's hibernating Durable Object) reads the new value back with exportConnection, persists it against the connection, and hands it to a later instance through restoreConnections. */
   readonly onConnectionStateChanged?: (connection: Readonly<Connection>) => void;
 }

package/dist/domain/relay-hub.mjs

@@ -1,4 +1,5 @@
 import { verifyPeerAdvert } from "./peer-advert.mjs";
+import { checkAdvertExtensions } from "./advert-extension-policy.mjs";
 //#region src/domain/relay-hub.ts
 const HEX_RADIX = 16;
 const HEX_DIGITS_PER_BYTE = 2;
@@ -114,6 +115,16 @@ function createRelayHub(options) {
 			const accepted = [];
 			for (const advert of frame.peers) {
 				if (!await verifyPeerAdvert(options.identity, advert)) continue;
+				if (options.extensionPolicy !== void 0) {
+					const verdict = checkAdvertExtensions(advert, options.extensionPolicy);
+					if (!verdict.ok) {
+						options.onAdvertRefused?.({
+							device: advert.device,
+							key: verdict.key
+						});
+						continue;
+					}
+				}
 				const key = deviceKey(advert.device);
 				const previous = devices.get(key);
 				if (previous !== void 0 && !supersedes(previous, advert, connection)) continue;

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-Bi2fzBCc.cjs";
-import { t as Connection } from "../transport-Cq_odHy3.cjs";
+import { N as Frame } from "../protocol-DCDae3z4.cjs";
+import { t as Connection } from "../transport-CfW7fsGK.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-Bi2fzBCc.mjs";
-import { t as Connection } from "../transport-GcJ4LYVE.mjs";
+import { N as Frame } from "../protocol-DCDae3z4.mjs";
+import { t as Connection } from "../transport-iLBxIkRS.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-Bi2fzBCc.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-BDVxEvl2.cjs";
+import { bt as RevocationEntry } from "../protocol-DCDae3z4.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DqFu7iMX.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-Bi2fzBCc.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-0r9ipK1r.mjs";
+import { bt as RevocationEntry } from "../protocol-DCDae3z4.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CBiSYuzp.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.