wire-mesh-core 3.3.0 → 3.4.0

package/dist/adapters/byte-stream-connection.cjs

@@ -67,8 +67,7 @@ function connectionFromByteStream(stream, options = { opened: false }) {
 		},
 		receive: () => frames,
 		close: async () => {
-			await writer.close();
-			await reader.cancel();
+			await Promise.allSettled([writer.close(), reader.cancel()]);
 		}
 	};
 }

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.mjs

@@ -66,8 +66,7 @@ function connectionFromByteStream(stream, options = { opened: false }) {
 		},
 		receive: () => frames,
 		close: async () => {
-			await writer.close();
-			await reader.cancel();
+			await Promise.allSettled([writer.close(), reader.cancel()]);
 		}
 	};
 }

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CfW7fsGK.cjs";
+import { r as Transport } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-iLBxIkRS.mjs";
+import { r as Transport } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CfW7fsGK.cjs";
+import { r as Transport } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-iLBxIkRS.mjs";
+import { r as Transport } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/mesh-session.cjs

@@ -19,6 +19,9 @@ function createRelayPairings() {
 		remove: (device) => {
 			established.delete(require_domain_device_id.deviceIdToHex(device));
 		},
+		clear: () => {
+			established.clear();
+		},
 		list: () => [...established.values()]
 	};
 }
@@ -501,6 +504,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			handshake
 		};
 	}
+	/** The address to dial after `link` ended: the one the adapter says reaches the same peer now, if it says anything, else the one this session dialled. */
+	function redialAddress(link, dialled) {
+		return link.redialAddress?.() ?? dialled;
+	}
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
@@ -531,14 +538,19 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		emit();
 	}
 	async function consume(link, address, localDomains) {
+		let heardFromPeer = false;
 		for await (const frame of link.receive()) {
 			if (feedCancelled) return;
+			if (!heardFromPeer) {
+				heardFromPeer = true;
+				attempt = 0;
+			}
 			await applyFrame(frame);
 			await onFrame?.(link, frame);
 			emit();
 		}
 		onSessionEnd?.(link);
-		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
+		if (state.status === "connected") handleDisconnect("node closed the connection", redialAddress(link, address), localDomains);
 	}
 	/** Builds this side's own self-advert and signs it with this node's own key (wire-mesh#225), which is what makes it usable by a receiver that learned of it through a hub or a gateway rather than directly from here. this node's own directly-reachable addresses (wire-mesh#38) are advertised, or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime, and every such key is covered by the signature. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	async function buildSelfAdvert(extensions) {
@@ -560,6 +572,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	async function wireUpConnection(link, address, localDomains) {
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
+		relayPairings.clear();
 		localHandshakeSent = localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {
@@ -592,7 +605,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		}, HANDSHAKE_TIMEOUT_MS);
 		consume(connection, address, localDomains).catch((error) => {
-			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), redialAddress(link, address), localDomains);
 		});
 	}
 	async function doConnect(address, localDomains) {

package/dist/domain/mesh-session.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
-import { r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 //#region src/domain/mesh-session.d.ts

package/dist/domain/mesh-session.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
-import { r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 //#region src/domain/mesh-session.d.ts

package/dist/domain/mesh-session.mjs

@@ -18,6 +18,9 @@ function createRelayPairings() {
 		remove: (device) => {
 			established.delete(deviceIdToHex(device));
 		},
+		clear: () => {
+			established.clear();
+		},
 		list: () => [...established.values()]
 	};
 }
@@ -500,6 +503,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			handshake
 		};
 	}
+	/** The address to dial after `link` ended: the one the adapter says reaches the same peer now, if it says anything, else the one this session dialled. */
+	function redialAddress(link, dialled) {
+		return link.redialAddress?.() ?? dialled;
+	}
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
@@ -530,14 +537,19 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		emit();
 	}
 	async function consume(link, address, localDomains) {
+		let heardFromPeer = false;
 		for await (const frame of link.receive()) {
 			if (feedCancelled) return;
+			if (!heardFromPeer) {
+				heardFromPeer = true;
+				attempt = 0;
+			}
 			await applyFrame(frame);
 			await onFrame?.(link, frame);
 			emit();
 		}
 		onSessionEnd?.(link);
-		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
+		if (state.status === "connected") handleDisconnect("node closed the connection", redialAddress(link, address), localDomains);
 	}
 	/** Builds this side's own self-advert and signs it with this node's own key (wire-mesh#225), which is what makes it usable by a receiver that learned of it through a hub or a gateway rather than directly from here. this node's own directly-reachable addresses (wire-mesh#38) are advertised, or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime, and every such key is covered by the signature. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	async function buildSelfAdvert(extensions) {
@@ -559,6 +571,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	async function wireUpConnection(link, address, localDomains) {
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
+		relayPairings.clear();
 		localHandshakeSent = localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {
@@ -591,7 +604,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		}, HANDSHAKE_TIMEOUT_MS);
 		consume(connection, address, localDomains).catch((error) => {
-			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), redialAddress(link, address), localDomains);
 		});
 	}
 	async function doConnect(address, localDomains) {

package/dist/domain/pinned-address.cjs

@@ -1,8 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let cbor2 = require("cbor2");
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
 const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const HEX_RADIX = 16;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
 	for (let index = 0; index < bytes.length; index++) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
@@ -34,7 +36,56 @@ function parsePinnedAddress(address) {
 		sha256: hashes.map(hexToBytes)
 	};
 }
+/** The bytes in a SHA-256 hash. */
+const SHA256_BYTES = 32;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+const MAX_ANNOUNCED_HASHES = 8;
+/**
+* The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+*/
+function encodeCertificateHashes(sha256Hex) {
+	return (0, cbor2.encode)({ sha256: sha256Hex.map(hexToBytes) }, cbor2.cdeEncodeOptions);
+}
+/**
+* Reads a message made by `encodeCertificateHashes`.
+* @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+*/
+function decodeCertificateHashes(bytes) {
+	const decoded = (0, cbor2.decode)(bytes, cbor2.cdeDecodeOptions);
+	if (typeof decoded !== "object" || decoded === null || !("sha256" in decoded) || !Array.isArray(decoded.sha256)) throw new Error("expected a map with a sha256 array");
+	const announced = decoded.sha256;
+	if (announced.length === 0 || announced.length > 8) throw new Error(`expected 1 to ${String(8)} hashes, got ${String(announced.length)}`);
+	const hashes = [];
+	for (const hash of announced) {
+		if (!(hash instanceof Uint8Array) || hash.length !== SHA256_BYTES) throw new Error(`each hash must be ${String(SHA256_BYTES)} bytes`);
+		hashes.push(new Uint8Array(hash));
+	}
+	return hashes;
+}
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+function mergeHashes(hashes, more) {
+	const known = new Set(hashes.map(bytesToHex));
+	const merged = [...hashes];
+	for (const hash of more) if (!known.has(bytesToHex(hash))) {
+		known.add(bytesToHex(hash));
+		merged.push(hash);
+	}
+	return merged;
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(HEX_RADIX).padStart(2, "0")).join("");
+}
+/** `address` with its pinned hashes replaced by `sha256`. */
+function withPinnedHashes(address, sha256) {
+	const { url } = parsePinnedAddress(address);
+	return formatPinnedAddress(new URL(url).host, sha256.map(bytesToHex));
+}
 //#endregion
+exports.MAX_ANNOUNCED_HASHES = MAX_ANNOUNCED_HASHES;
+exports.decodeCertificateHashes = decodeCertificateHashes;
+exports.encodeCertificateHashes = encodeCertificateHashes;
 exports.formatPinnedAddress = formatPinnedAddress;
 exports.isPinnedAddress = isPinnedAddress;
+exports.mergeHashes = mergeHashes;
 exports.parsePinnedAddress = parsePinnedAddress;
+exports.withPinnedHashes = withPinnedHashes;

package/dist/domain/pinned-address.d.cts

@@ -19,4 +19,19 @@ export declare function isPinnedAddress(address: string): boolean;
  * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+export declare const MAX_ANNOUNCED_HASHES = 8;
+/**
+ * The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+ */
+export declare function encodeCertificateHashes(sha256Hex: readonly string[]): Uint8Array;
+/**
+ * Reads a message made by `encodeCertificateHashes`.
+ * @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+ */
+export declare function decodeCertificateHashes(bytes: Readonly<Uint8Array>): Uint8Array<ArrayBuffer>[];
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+export declare function mergeHashes(hashes: readonly Uint8Array<ArrayBuffer>[], more: readonly Uint8Array<ArrayBuffer>[]): Uint8Array<ArrayBuffer>[];
+/** `address` with its pinned hashes replaced by `sha256`. */
+export declare function withPinnedHashes(address: string, sha256: readonly Uint8Array<ArrayBuffer>[]): string;
 //#endregion

package/dist/domain/pinned-address.d.mts

@@ -19,4 +19,19 @@ export declare function isPinnedAddress(address: string): boolean;
  * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+export declare const MAX_ANNOUNCED_HASHES = 8;
+/**
+ * The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+ */
+export declare function encodeCertificateHashes(sha256Hex: readonly string[]): Uint8Array;
+/**
+ * Reads a message made by `encodeCertificateHashes`.
+ * @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+ */
+export declare function decodeCertificateHashes(bytes: Readonly<Uint8Array>): Uint8Array<ArrayBuffer>[];
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+export declare function mergeHashes(hashes: readonly Uint8Array<ArrayBuffer>[], more: readonly Uint8Array<ArrayBuffer>[]): Uint8Array<ArrayBuffer>[];
+/** `address` with its pinned hashes replaced by `sha256`. */
+export declare function withPinnedHashes(address: string, sha256: readonly Uint8Array<ArrayBuffer>[]): string;
 //#endregion

package/dist/domain/pinned-address.mjs

@@ -1,7 +1,9 @@
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
 const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const HEX_RADIX = 16;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
 	for (let index = 0; index < bytes.length; index++) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
@@ -33,5 +35,49 @@ function parsePinnedAddress(address) {
 		sha256: hashes.map(hexToBytes)
 	};
 }
+/** The bytes in a SHA-256 hash. */
+const SHA256_BYTES = 32;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+const MAX_ANNOUNCED_HASHES = 8;
+/**
+* The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+*/
+function encodeCertificateHashes(sha256Hex) {
+	return encode({ sha256: sha256Hex.map(hexToBytes) }, cdeEncodeOptions);
+}
+/**
+* Reads a message made by `encodeCertificateHashes`.
+* @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+*/
+function decodeCertificateHashes(bytes) {
+	const decoded = decode(bytes, cdeDecodeOptions);
+	if (typeof decoded !== "object" || decoded === null || !("sha256" in decoded) || !Array.isArray(decoded.sha256)) throw new Error("expected a map with a sha256 array");
+	const announced = decoded.sha256;
+	if (announced.length === 0 || announced.length > 8) throw new Error(`expected 1 to ${String(8)} hashes, got ${String(announced.length)}`);
+	const hashes = [];
+	for (const hash of announced) {
+		if (!(hash instanceof Uint8Array) || hash.length !== SHA256_BYTES) throw new Error(`each hash must be ${String(SHA256_BYTES)} bytes`);
+		hashes.push(new Uint8Array(hash));
+	}
+	return hashes;
+}
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+function mergeHashes(hashes, more) {
+	const known = new Set(hashes.map(bytesToHex));
+	const merged = [...hashes];
+	for (const hash of more) if (!known.has(bytesToHex(hash))) {
+		known.add(bytesToHex(hash));
+		merged.push(hash);
+	}
+	return merged;
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(HEX_RADIX).padStart(2, "0")).join("");
+}
+/** `address` with its pinned hashes replaced by `sha256`. */
+function withPinnedHashes(address, sha256) {
+	const { url } = parsePinnedAddress(address);
+	return formatPinnedAddress(new URL(url).host, sha256.map(bytesToHex));
+}
 //#endregion
-export { formatPinnedAddress, isPinnedAddress, parsePinnedAddress };
+export { MAX_ANNOUNCED_HASHES, decodeCertificateHashes, encodeCertificateHashes, formatPinnedAddress, isPinnedAddress, mergeHashes, parsePinnedAddress, withPinnedHashes };

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.cjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.cjs";
 import { PeerAdvertVerifier } from "./peer-advert.cjs";

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.mjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.mjs";
 import { PeerAdvertVerifier } from "./peer-advert.mjs";

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 export { Connection, Listener, Transport };

package/dist/{transport-iLBxIkRS.d.mts → transport-B0GywEzG.d.mts}

@@ -10,6 +10,8 @@ interface Connection {
   close: () => Promise<void>;
   /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
   readonly peerDeviceId?: DeviceId;
+  /** The address to dial to reach this same peer again, when the adapter has learned a better one than the address this connection was dialled with: a node that rotates the certificate a browser pins tells each connection the certificates it will serve next, so a dial made after the address the user was given has aged still succeeds. Absent when the adapter learned nothing, in which case the dialled address stands. */
+  readonly redialAddress?: () => string;
   /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
   unref?: () => void;
 }

package/dist/{transport-CfW7fsGK.d.cts → transport-DIXjoQKn.d.cts}

@@ -10,6 +10,8 @@ interface Connection {
   close: () => Promise<void>;
   /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
   readonly peerDeviceId?: DeviceId;
+  /** The address to dial to reach this same peer again, when the adapter has learned a better one than the address this connection was dialled with: a node that rotates the certificate a browser pins tells each connection the certificates it will serve next, so a dial made after the address the user was given has aged still succeeds. Absent when the adapter learned nothing, in which case the dialled address stands. */
+  readonly redialAddress?: () => string;
   /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
   unref?: () => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.3.0",
+  "version": "3.4.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",