wire-mesh-core 3.2.0 → 3.3.1

package/dist/adapters/byte-stream-connection.cjs

@@ -67,8 +67,7 @@ function connectionFromByteStream(stream, options = { opened: false }) {
 		},
 		receive: () => frames,
 		close: async () => {
-			await writer.close();
-			await reader.cancel();
+			await Promise.allSettled([writer.close(), reader.cancel()]);
 		}
 	};
 }

package/dist/adapters/byte-stream-connection.mjs

@@ -66,8 +66,7 @@ function connectionFromByteStream(stream, options = { opened: false }) {
 		},
 		receive: () => frames,
 		close: async () => {
-			await writer.close();
-			await reader.cancel();
+			await Promise.allSettled([writer.close(), reader.cancel()]);
 		}
 	};
 }

package/dist/domain/mesh-session.cjs

@@ -19,6 +19,9 @@ function createRelayPairings() {
 		remove: (device) => {
 			established.delete(require_domain_device_id.deviceIdToHex(device));
 		},
+		clear: () => {
+			established.clear();
+		},
 		list: () => [...established.values()]
 	};
 }
@@ -560,6 +563,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	async function wireUpConnection(link, address, localDomains) {
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
+		relayPairings.clear();
 		localHandshakeSent = localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {

package/dist/domain/mesh-session.mjs

@@ -18,6 +18,9 @@ function createRelayPairings() {
 		remove: (device) => {
 			established.delete(deviceIdToHex(device));
 		},
+		clear: () => {
+			established.clear();
+		},
 		list: () => [...established.values()]
 	};
 }
@@ -559,6 +562,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	async function wireUpConnection(link, address, localDomains) {
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
+		relayPairings.clear();
 		localHandshakeSent = localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {

package/dist/domain/pinned-address.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
+const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
@@ -8,29 +9,29 @@ function hexToBytes(hex) {
 	return bytes;
 }
 /**
-* The address a node advertises for WebTransport: `https://host:port#sha256=<hex>`, the address and the hash of the certificate it serves. A client that pins the hash needs nothing else from the network to trust the node, so the pair travels together in one string, which `wire-candidate.address` already permits.
+* The address a node advertises for WebTransport: `https://host:port#sha256=<hex>[,<hex>...]`, the address and the hashes of the certificates it serves now and will serve next. A client that pins the hashes needs nothing else from the network to trust the node, so they travel with the address in one string, which `wire-candidate.address` already permits.
 */
 function formatPinnedAddress(hostPort, sha256Hex) {
-	return `https://${hostPort}${PIN_FRAGMENT}${sha256Hex}`;
+	return `https://${hostPort}${PIN_FRAGMENT}${sha256Hex.join(HASH_SEPARATOR)}`;
 }
 /**
-* Whether an address carries a certificate pin, and so is dialled over WebTransport rather than WebSocket.
+* Whether an address carries certificate pins, and so is dialled over WebTransport rather than WebSocket.
 */
 function isPinnedAddress(address) {
 	return address.startsWith("https://") && address.includes(PIN_FRAGMENT);
 }
 /**
-* Splits an address of the form `https://host:port#sha256=<hex>`.
-* @throws Error when the address is not `https://` or carries no valid 64-digit lowercase hex hash.
+* Splits an address of the form `https://host:port#sha256=<hex>[,<hex>...]`.
+* @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
 */
 function parsePinnedAddress(address) {
 	const url = new URL(address);
-	const hex = url.hash.startsWith(PIN_FRAGMENT) ? url.hash.slice(8) : "";
-	if (url.protocol !== "https:" || !SHA256_HEX_PATTERN.test(hex)) throw new Error(`expected "https://host:port${PIN_FRAGMENT}<64 hex digits>", got "${address}"`);
+	const hashes = url.hash.startsWith(PIN_FRAGMENT) ? url.hash.slice(8).split(HASH_SEPARATOR) : [];
+	if (url.protocol !== "https:" || hashes.length === 0 || !hashes.every((hash) => SHA256_HEX_PATTERN.test(hash))) throw new Error(`expected "https://host:port${PIN_FRAGMENT}<64 hex digits>[${HASH_SEPARATOR}<64 hex digits>...]", got "${address}"`);
 	url.hash = "";
 	return {
 		url: url.toString(),
-		sha256: hexToBytes(hex)
+		sha256: hashes.map(hexToBytes)
 	};
 }
 //#endregion

package/dist/domain/pinned-address.d.cts

@@ -1,22 +1,22 @@
 //#region src/domain/pinned-address.d.ts
-/** A WebTransport address and the SHA-256 hash of the certificate it is expected to serve. */
+/** A WebTransport address and the SHA-256 hashes of the certificates it may serve. */
 export interface PinnedAddress {
   /** `https://host:port/`, the URL to open. */
   readonly url: string;
-  /** The certificate's SHA-256 hash, as bytes. */
-  readonly sha256: Uint8Array<ArrayBuffer>;
+  /** Each acceptable certificate's SHA-256 hash, as bytes. A browser accepts the server's certificate when it matches any of them, so a node can list the certificates it will serve next and an address stays usable across its renewals. */
+  readonly sha256: readonly Uint8Array<ArrayBuffer>[];
 }
 /**
- * The address a node advertises for WebTransport: `https://host:port#sha256=<hex>`, the address and the hash of the certificate it serves. A client that pins the hash needs nothing else from the network to trust the node, so the pair travels together in one string, which `wire-candidate.address` already permits.
+ * The address a node advertises for WebTransport: `https://host:port#sha256=<hex>[,<hex>...]`, the address and the hashes of the certificates it serves now and will serve next. A client that pins the hashes needs nothing else from the network to trust the node, so they travel with the address in one string, which `wire-candidate.address` already permits.
  */
-export declare function formatPinnedAddress(hostPort: string, sha256Hex: string): string;
+export declare function formatPinnedAddress(hostPort: string, sha256Hex: readonly string[]): string;
 /**
- * Whether an address carries a certificate pin, and so is dialled over WebTransport rather than WebSocket.
+ * Whether an address carries certificate pins, and so is dialled over WebTransport rather than WebSocket.
  */
 export declare function isPinnedAddress(address: string): boolean;
 /**
- * Splits an address of the form `https://host:port#sha256=<hex>`.
- * @throws Error when the address is not `https://` or carries no valid 64-digit lowercase hex hash.
+ * Splits an address of the form `https://host:port#sha256=<hex>[,<hex>...]`.
+ * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
 //#endregion

package/dist/domain/pinned-address.d.mts

@@ -1,22 +1,22 @@
 //#region src/domain/pinned-address.d.ts
-/** A WebTransport address and the SHA-256 hash of the certificate it is expected to serve. */
+/** A WebTransport address and the SHA-256 hashes of the certificates it may serve. */
 export interface PinnedAddress {
   /** `https://host:port/`, the URL to open. */
   readonly url: string;
-  /** The certificate's SHA-256 hash, as bytes. */
-  readonly sha256: Uint8Array<ArrayBuffer>;
+  /** Each acceptable certificate's SHA-256 hash, as bytes. A browser accepts the server's certificate when it matches any of them, so a node can list the certificates it will serve next and an address stays usable across its renewals. */
+  readonly sha256: readonly Uint8Array<ArrayBuffer>[];
 }
 /**
- * The address a node advertises for WebTransport: `https://host:port#sha256=<hex>`, the address and the hash of the certificate it serves. A client that pins the hash needs nothing else from the network to trust the node, so the pair travels together in one string, which `wire-candidate.address` already permits.
+ * The address a node advertises for WebTransport: `https://host:port#sha256=<hex>[,<hex>...]`, the address and the hashes of the certificates it serves now and will serve next. A client that pins the hashes needs nothing else from the network to trust the node, so they travel with the address in one string, which `wire-candidate.address` already permits.
  */
-export declare function formatPinnedAddress(hostPort: string, sha256Hex: string): string;
+export declare function formatPinnedAddress(hostPort: string, sha256Hex: readonly string[]): string;
 /**
- * Whether an address carries a certificate pin, and so is dialled over WebTransport rather than WebSocket.
+ * Whether an address carries certificate pins, and so is dialled over WebTransport rather than WebSocket.
  */
 export declare function isPinnedAddress(address: string): boolean;
 /**
- * Splits an address of the form `https://host:port#sha256=<hex>`.
- * @throws Error when the address is not `https://` or carries no valid 64-digit lowercase hex hash.
+ * Splits an address of the form `https://host:port#sha256=<hex>[,<hex>...]`.
+ * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
 //#endregion

package/dist/domain/pinned-address.mjs

@@ -1,5 +1,6 @@
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
+const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
@@ -7,29 +8,29 @@ function hexToBytes(hex) {
 	return bytes;
 }
 /**
-* The address a node advertises for WebTransport: `https://host:port#sha256=<hex>`, the address and the hash of the certificate it serves. A client that pins the hash needs nothing else from the network to trust the node, so the pair travels together in one string, which `wire-candidate.address` already permits.
+* The address a node advertises for WebTransport: `https://host:port#sha256=<hex>[,<hex>...]`, the address and the hashes of the certificates it serves now and will serve next. A client that pins the hashes needs nothing else from the network to trust the node, so they travel with the address in one string, which `wire-candidate.address` already permits.
 */
 function formatPinnedAddress(hostPort, sha256Hex) {
-	return `https://${hostPort}${PIN_FRAGMENT}${sha256Hex}`;
+	return `https://${hostPort}${PIN_FRAGMENT}${sha256Hex.join(HASH_SEPARATOR)}`;
 }
 /**
-* Whether an address carries a certificate pin, and so is dialled over WebTransport rather than WebSocket.
+* Whether an address carries certificate pins, and so is dialled over WebTransport rather than WebSocket.
 */
 function isPinnedAddress(address) {
 	return address.startsWith("https://") && address.includes(PIN_FRAGMENT);
 }
 /**
-* Splits an address of the form `https://host:port#sha256=<hex>`.
-* @throws Error when the address is not `https://` or carries no valid 64-digit lowercase hex hash.
+* Splits an address of the form `https://host:port#sha256=<hex>[,<hex>...]`.
+* @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
 */
 function parsePinnedAddress(address) {
 	const url = new URL(address);
-	const hex = url.hash.startsWith(PIN_FRAGMENT) ? url.hash.slice(8) : "";
-	if (url.protocol !== "https:" || !SHA256_HEX_PATTERN.test(hex)) throw new Error(`expected "https://host:port${PIN_FRAGMENT}<64 hex digits>", got "${address}"`);
+	const hashes = url.hash.startsWith(PIN_FRAGMENT) ? url.hash.slice(8).split(HASH_SEPARATOR) : [];
+	if (url.protocol !== "https:" || hashes.length === 0 || !hashes.every((hash) => SHA256_HEX_PATTERN.test(hash))) throw new Error(`expected "https://host:port${PIN_FRAGMENT}<64 hex digits>[${HASH_SEPARATOR}<64 hex digits>...]", got "${address}"`);
 	url.hash = "";
 	return {
 		url: url.toString(),
-		sha256: hexToBytes(hex)
+		sha256: hashes.map(hexToBytes)
 	};
 }
 //#endregion

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.2.0",
+  "version": "3.3.1",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",