wire-mesh-core 3.3.1 → 3.5.0

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CfW7fsGK.cjs";
+import { r as Transport } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-iLBxIkRS.mjs";
+import { r as Transport } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_domain_threshold_subject = require("../domain/threshold-subject.cjs");
-const require_adapters_threshold_wasm = require("./threshold-wasm.cjs");
 const require_adapters_node_identity = require("./node-identity.cjs");
+const require_adapters_threshold_wasm = require("./threshold-wasm.cjs");
+const require_domain_threshold_subject = require("../domain/threshold-subject.cjs");
 //#region src/adapters/threshold-identity.ts
 const ALG_ED25519 = -8;
 const FIRST_SESSION_ID = 1n;

package/dist/adapters/threshold-identity.mjs

@@ -1,6 +1,6 @@
-import { toBeSigned } from "../domain/threshold-subject.mjs";
-import { signingAggregate, signingBuildPackage } from "./threshold-wasm.mjs";
 import { deriveDeviceId, verifyWithPublicKey } from "./node-identity.mjs";
+import { signingAggregate, signingBuildPackage } from "./threshold-wasm.mjs";
+import { toBeSigned } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.ts
 const ALG_ED25519 = -8;
 const FIRST_SESSION_ID = 1n;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-CfW7fsGK.cjs";
+import { r as Transport } from "../transport-DIXjoQKn.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-iLBxIkRS.mjs";
+import { r as Transport } from "../transport-B0GywEzG.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
 import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { n as mintCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/coordinator-election.cjs

@@ -0,0 +1,81 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/coordinator-election.ts
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+function compareDeviceIds(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i++) {
+		const left = a[i];
+		const right = b[i];
+		if (left === void 0 || right === void 0) break;
+		if (left !== right) return left < right ? -1 : 1;
+	}
+	return a.length - b.length;
+}
+var CoordinatorElection = class {
+	ownDevice;
+	incumbent;
+	constructor(options) {
+		this.ownDevice = options.ownDevice;
+	}
+	/** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+	current() {
+		return this.incumbent;
+	}
+	/** Whether this side's own device is the incumbent. */
+	isSelf() {
+		return this.incumbent !== void 0 && compareDeviceIds(this.incumbent.coordinator, this.ownDevice) === 0;
+	}
+	/**
+	* Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+	*/
+	claim(capacityHint) {
+		const frame = {
+			type: "coordinator",
+			term: (this.incumbent?.term ?? -1) + 1,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { "capacity-hint": capacityHint } : {}
+		};
+		this.incumbent = {
+			term: frame.term,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { capacityHint } : {}
+		};
+		return frame;
+	}
+	/**
+	* The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+	*/
+	announceCurrent() {
+		if (this.incumbent === void 0) return void 0;
+		return {
+			type: "coordinator",
+			term: this.incumbent.term,
+			coordinator: this.incumbent.coordinator,
+			...this.incumbent.capacityHint !== void 0 ? { "capacity-hint": this.incumbent.capacityHint } : {}
+		};
+	}
+	/**
+	* Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+	*/
+	evaluate(frame) {
+		const previous = this.incumbent;
+		if (previous === void 0 || frame.term > previous.term || frame.term === previous.term && compareDeviceIds(frame.coordinator, previous.coordinator) < 0) {
+			this.incumbent = {
+				term: frame.term,
+				coordinator: frame.coordinator,
+				...frame["capacity-hint"] !== void 0 ? { capacityHint: frame["capacity-hint"] } : {}
+			};
+			return {
+				outcome: "accepted",
+				incumbent: this.incumbent
+			};
+		}
+		return {
+			outcome: "retained",
+			incumbent: previous
+		};
+	}
+};
+//#endregion
+exports.CoordinatorElection = CoordinatorElection;
+exports.compareDeviceIds = compareDeviceIds;

package/dist/domain/coordinator-election.d.cts

@@ -0,0 +1,44 @@
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.cjs";
+//#region src/domain/coordinator-election.d.ts
+/** The claim this side currently accepts: one coordinator, at the term that put it there. */
+export interface CoordinatorClaim {
+  term: number;
+  coordinator: DeviceId;
+  capacityHint?: number | undefined;
+}
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+export declare function compareDeviceIds(a: DeviceId, b: DeviceId): number;
+/** What evaluating an incoming claim concluded, so the caller can react without re-deriving the comparison: "accepted" means this claim is now the incumbent (it superseded a previous one, or there was none), "retained" means the incumbent survived (the incoming claim was stale, or lost the equal-term tiebreak), and the incumbent is returned either way so a caller squashing a stale claim re-announces exactly what it already holds. */
+export type EvaluationOutcome = {
+  outcome: "accepted";
+  incumbent: CoordinatorClaim;
+} | {
+  outcome: "retained";
+  incumbent: CoordinatorClaim;
+};
+export interface CoordinatorElectionOptions {
+  /** This device's own id: the coordinator named by a claim this side mints. */
+  ownDevice: DeviceId;
+}
+export declare class CoordinatorElection {
+  private readonly ownDevice;
+  private incumbent;
+  constructor(options: Readonly<CoordinatorElectionOptions>);
+  /** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+  current(): CoordinatorClaim | undefined;
+  /** Whether this side's own device is the incumbent. */
+  isSelf(): boolean;
+  /**
+   * Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+   */
+  claim(capacityHint?: number): CoordinatorFrame;
+  /**
+   * The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+   */
+  announceCurrent(): CoordinatorFrame | undefined;
+  /**
+   * Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+   */
+  evaluate(frame: Readonly<CoordinatorFrame>): EvaluationOutcome;
+}
+//#endregion

package/dist/domain/coordinator-election.d.mts

@@ -0,0 +1,44 @@
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.mjs";
+//#region src/domain/coordinator-election.d.ts
+/** The claim this side currently accepts: one coordinator, at the term that put it there. */
+export interface CoordinatorClaim {
+  term: number;
+  coordinator: DeviceId;
+  capacityHint?: number | undefined;
+}
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+export declare function compareDeviceIds(a: DeviceId, b: DeviceId): number;
+/** What evaluating an incoming claim concluded, so the caller can react without re-deriving the comparison: "accepted" means this claim is now the incumbent (it superseded a previous one, or there was none), "retained" means the incumbent survived (the incoming claim was stale, or lost the equal-term tiebreak), and the incumbent is returned either way so a caller squashing a stale claim re-announces exactly what it already holds. */
+export type EvaluationOutcome = {
+  outcome: "accepted";
+  incumbent: CoordinatorClaim;
+} | {
+  outcome: "retained";
+  incumbent: CoordinatorClaim;
+};
+export interface CoordinatorElectionOptions {
+  /** This device's own id: the coordinator named by a claim this side mints. */
+  ownDevice: DeviceId;
+}
+export declare class CoordinatorElection {
+  private readonly ownDevice;
+  private incumbent;
+  constructor(options: Readonly<CoordinatorElectionOptions>);
+  /** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+  current(): CoordinatorClaim | undefined;
+  /** Whether this side's own device is the incumbent. */
+  isSelf(): boolean;
+  /**
+   * Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+   */
+  claim(capacityHint?: number): CoordinatorFrame;
+  /**
+   * The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+   */
+  announceCurrent(): CoordinatorFrame | undefined;
+  /**
+   * Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+   */
+  evaluate(frame: Readonly<CoordinatorFrame>): EvaluationOutcome;
+}
+//#endregion

package/dist/domain/coordinator-election.mjs

@@ -0,0 +1,79 @@
+//#region src/domain/coordinator-election.ts
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+function compareDeviceIds(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i++) {
+		const left = a[i];
+		const right = b[i];
+		if (left === void 0 || right === void 0) break;
+		if (left !== right) return left < right ? -1 : 1;
+	}
+	return a.length - b.length;
+}
+var CoordinatorElection = class {
+	ownDevice;
+	incumbent;
+	constructor(options) {
+		this.ownDevice = options.ownDevice;
+	}
+	/** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+	current() {
+		return this.incumbent;
+	}
+	/** Whether this side's own device is the incumbent. */
+	isSelf() {
+		return this.incumbent !== void 0 && compareDeviceIds(this.incumbent.coordinator, this.ownDevice) === 0;
+	}
+	/**
+	* Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+	*/
+	claim(capacityHint) {
+		const frame = {
+			type: "coordinator",
+			term: (this.incumbent?.term ?? -1) + 1,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { "capacity-hint": capacityHint } : {}
+		};
+		this.incumbent = {
+			term: frame.term,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { capacityHint } : {}
+		};
+		return frame;
+	}
+	/**
+	* The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+	*/
+	announceCurrent() {
+		if (this.incumbent === void 0) return void 0;
+		return {
+			type: "coordinator",
+			term: this.incumbent.term,
+			coordinator: this.incumbent.coordinator,
+			...this.incumbent.capacityHint !== void 0 ? { "capacity-hint": this.incumbent.capacityHint } : {}
+		};
+	}
+	/**
+	* Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+	*/
+	evaluate(frame) {
+		const previous = this.incumbent;
+		if (previous === void 0 || frame.term > previous.term || frame.term === previous.term && compareDeviceIds(frame.coordinator, previous.coordinator) < 0) {
+			this.incumbent = {
+				term: frame.term,
+				coordinator: frame.coordinator,
+				...frame["capacity-hint"] !== void 0 ? { capacityHint: frame["capacity-hint"] } : {}
+			};
+			return {
+				outcome: "accepted",
+				incumbent: this.incumbent
+			};
+		}
+		return {
+			outcome: "retained",
+			incumbent: previous
+		};
+	}
+};
+//#endregion
+export { CoordinatorElection, compareDeviceIds };

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/mesh-session.cjs

@@ -1,13 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
+const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
+const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
-const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
 const require_domain_topology_snapshot = require("./topology-snapshot.cjs");
-const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -325,6 +325,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	});
 	const incomingQueue = require_domain_async_queue.createAsyncQueue();
 	const revocationQueue = require_domain_async_queue.createAsyncQueue();
+	const coordinatorQueue = require_domain_async_queue.createAsyncQueue();
 	const pingRoundTrips = require_domain_ping_round_trips.createPingRoundTrips();
 	function snapshot() {
 		return {
@@ -466,6 +467,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
+		else if (frame.type === "coordinator") coordinatorQueue.push(frame);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -504,6 +506,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			handshake
 		};
 	}
+	/** The address to dial after `link` ended: the one the adapter says reaches the same peer now, if it says anything, else the one this session dialled. */
+	function redialAddress(link, dialled) {
+		return link.redialAddress?.() ?? dialled;
+	}
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
@@ -534,14 +540,19 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		emit();
 	}
 	async function consume(link, address, localDomains) {
+		let heardFromPeer = false;
 		for await (const frame of link.receive()) {
 			if (feedCancelled) return;
+			if (!heardFromPeer) {
+				heardFromPeer = true;
+				attempt = 0;
+			}
 			await applyFrame(frame);
 			await onFrame?.(link, frame);
 			emit();
 		}
 		onSessionEnd?.(link);
-		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
+		if (state.status === "connected") handleDisconnect("node closed the connection", redialAddress(link, address), localDomains);
 	}
 	/** Builds this side's own self-advert and signs it with this node's own key (wire-mesh#225), which is what makes it usable by a receiver that learned of it through a hub or a gateway rather than directly from here. this node's own directly-reachable addresses (wire-mesh#38) are advertised, or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime, and every such key is covered by the signature. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	async function buildSelfAdvert(extensions) {
@@ -596,7 +607,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		}, HANDSHAKE_TIMEOUT_MS);
 		consume(connection, address, localDomains).catch((error) => {
-			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), redialAddress(link, address), localDomains);
 		});
 	}
 	async function doConnect(address, localDomains) {
@@ -623,6 +634,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			events: eventQueue.stream,
 			incomingManageRequests: incomingQueue.stream,
 			revocationAnnouncements: revocationQueue.stream,
+			coordinatorFrames: coordinatorQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
@@ -709,6 +721,16 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			async sendCoordinatorClaim(frame) {
+				requireConnectedLink();
+				const claim = { ...frame };
+				frameLog.push({
+					direction: "sent",
+					frame: claim
+				});
+				await transmit(claim, false);
+				emit();
+			},
 			async sendGossipUpdate(extensions) {
 				requireConnectedLink();
 				const frame = await buildSelfAdvert(extensions);

package/dist/domain/mesh-session.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
-import { r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
+import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 //#region src/domain/mesh-session.d.ts
@@ -77,6 +77,8 @@ export interface MeshSession {
   readonly incomingManageRequests: AsyncIterable<IncomingManageRequest>;
   /** Every `revocation-entry` received from the peer, in arrival order -- a `revocation-announce` frame's own `entries` array is flattened to one item per entry, since each entry is independently verifiable and independently meaningful regardless of which frame carried it. A consumer typically feeds each one into a RevocationView's own `record`. */
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
+  /** Every `coordinator-frame` received from the peer, in arrival order: a gossiped, term-based claim to the rendezvous role (spec/transport.cddl), surfaced raw exactly like revocationAnnouncements because what a claim means is coordinator-election.ts's own business, not the session's. A consumer feeds each one into a CoordinatorElection's evaluate, and sends its own claims with sendCoordinatorClaim. */
+  readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
   /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
@@ -85,6 +87,8 @@ export interface MeshSession {
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
+  /** Sends one coordinator-frame directly over this session's own connection, never relay-wrapped: the claim is a gossiped broadcast like revocation-announce, not a request addressed to a specific peer. The frame itself comes from a CoordinatorElection (claim, or announceCurrent for a refresh), so the session never invents a term on its own. */
+  sendCoordinatorClaim: (frame: Readonly<CoordinatorFrame>) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
   /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */

package/dist/domain/mesh-session.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
-import { r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
+import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 //#region src/domain/mesh-session.d.ts
@@ -77,6 +77,8 @@ export interface MeshSession {
   readonly incomingManageRequests: AsyncIterable<IncomingManageRequest>;
   /** Every `revocation-entry` received from the peer, in arrival order -- a `revocation-announce` frame's own `entries` array is flattened to one item per entry, since each entry is independently verifiable and independently meaningful regardless of which frame carried it. A consumer typically feeds each one into a RevocationView's own `record`. */
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
+  /** Every `coordinator-frame` received from the peer, in arrival order: a gossiped, term-based claim to the rendezvous role (spec/transport.cddl), surfaced raw exactly like revocationAnnouncements because what a claim means is coordinator-election.ts's own business, not the session's. A consumer feeds each one into a CoordinatorElection's evaluate, and sends its own claims with sendCoordinatorClaim. */
+  readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
   /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
@@ -85,6 +87,8 @@ export interface MeshSession {
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
+  /** Sends one coordinator-frame directly over this session's own connection, never relay-wrapped: the claim is a gossiped broadcast like revocation-announce, not a request addressed to a specific peer. The frame itself comes from a CoordinatorElection (claim, or announceCurrent for a refresh), so the session never invents a term on its own. */
+  sendCoordinatorClaim: (frame: Readonly<CoordinatorFrame>) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
   /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */

package/dist/domain/mesh-session.mjs

@@ -1,12 +1,12 @@
-import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
+import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
+import { createAsyncQueue } from "./async-queue.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
-import { createAsyncQueue } from "./async-queue.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
-import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -324,6 +324,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	});
 	const incomingQueue = createAsyncQueue();
 	const revocationQueue = createAsyncQueue();
+	const coordinatorQueue = createAsyncQueue();
 	const pingRoundTrips = createPingRoundTrips();
 	function snapshot() {
 		return {
@@ -465,6 +466,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
+		else if (frame.type === "coordinator") coordinatorQueue.push(frame);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -503,6 +505,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			handshake
 		};
 	}
+	/** The address to dial after `link` ended: the one the adapter says reaches the same peer now, if it says anything, else the one this session dialled. */
+	function redialAddress(link, dialled) {
+		return link.redialAddress?.() ?? dialled;
+	}
 	function handleDisconnect(reason, address, localDomains) {
 		if (feedCancelled) return;
 		rejectPendingManageRequests("disconnected before a response arrived");
@@ -533,14 +539,19 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		emit();
 	}
 	async function consume(link, address, localDomains) {
+		let heardFromPeer = false;
 		for await (const frame of link.receive()) {
 			if (feedCancelled) return;
+			if (!heardFromPeer) {
+				heardFromPeer = true;
+				attempt = 0;
+			}
 			await applyFrame(frame);
 			await onFrame?.(link, frame);
 			emit();
 		}
 		onSessionEnd?.(link);
-		if (state.status === "connected") handleDisconnect("node closed the connection", address, localDomains);
+		if (state.status === "connected") handleDisconnect("node closed the connection", redialAddress(link, address), localDomains);
 	}
 	/** Builds this side's own self-advert and signs it with this node's own key (wire-mesh#225), which is what makes it usable by a receiver that learned of it through a hub or a gateway rather than directly from here. this node's own directly-reachable addresses (wire-mesh#38) are advertised, or none for a caller with nothing to offer (a browser client, which cannot accept inbound connections) -- either is an honest advert, not a stopgap. extensions merge onto peer-advert's own open `* tstr => any` tail -- the mechanism sendGossipUpdate uses to keep a gossiped fact (presence status, an accept/refuse policy, or any future domain's own) live over the connection's lifetime, and every such key is covered by the signature. Extensions, CORE_VERSION_GOSSIP_KEY, and topology/peers are all spread before the mandatory fields (never after) so a caller-supplied key of the same name can never shadow them on the wire -- validateGossipExtensions already rejects every such collision loudly, but the field order is kept safe in its own right rather than relying solely on the guard staying in sync. topology/peers (wire-mesh#180) is recomputed fresh on every call, the same "always current, never cached" treatment snapshot-seconds already gets, since a session's own connection identity and relay pairings can change between one self-advert and the next. */
 	async function buildSelfAdvert(extensions) {
@@ -595,7 +606,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		}, HANDSHAKE_TIMEOUT_MS);
 		consume(connection, address, localDomains).catch((error) => {
-			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+			if (state.status === "connected") handleDisconnect(error instanceof Error ? error.message : String(error), redialAddress(link, address), localDomains);
 		});
 	}
 	async function doConnect(address, localDomains) {
@@ -622,6 +633,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			events: eventQueue.stream,
 			incomingManageRequests: incomingQueue.stream,
 			revocationAnnouncements: revocationQueue.stream,
+			coordinatorFrames: coordinatorQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
@@ -708,6 +720,16 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			async sendCoordinatorClaim(frame) {
+				requireConnectedLink();
+				const claim = { ...frame };
+				frameLog.push({
+					direction: "sent",
+					frame: claim
+				});
+				await transmit(claim, false);
+				emit();
+			},
 			async sendGossipUpdate(extensions) {
 				requireConnectedLink();
 				const frame = await buildSelfAdvert(extensions);

package/dist/domain/pinned-address.cjs

@@ -1,8 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let cbor2 = require("cbor2");
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
 const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const HEX_RADIX = 16;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
 	for (let index = 0; index < bytes.length; index++) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
@@ -34,7 +36,56 @@ function parsePinnedAddress(address) {
 		sha256: hashes.map(hexToBytes)
 	};
 }
+/** The bytes in a SHA-256 hash. */
+const SHA256_BYTES = 32;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+const MAX_ANNOUNCED_HASHES = 8;
+/**
+* The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+*/
+function encodeCertificateHashes(sha256Hex) {
+	return (0, cbor2.encode)({ sha256: sha256Hex.map(hexToBytes) }, cbor2.cdeEncodeOptions);
+}
+/**
+* Reads a message made by `encodeCertificateHashes`.
+* @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+*/
+function decodeCertificateHashes(bytes) {
+	const decoded = (0, cbor2.decode)(bytes, cbor2.cdeDecodeOptions);
+	if (typeof decoded !== "object" || decoded === null || !("sha256" in decoded) || !Array.isArray(decoded.sha256)) throw new Error("expected a map with a sha256 array");
+	const announced = decoded.sha256;
+	if (announced.length === 0 || announced.length > 8) throw new Error(`expected 1 to ${String(8)} hashes, got ${String(announced.length)}`);
+	const hashes = [];
+	for (const hash of announced) {
+		if (!(hash instanceof Uint8Array) || hash.length !== SHA256_BYTES) throw new Error(`each hash must be ${String(SHA256_BYTES)} bytes`);
+		hashes.push(new Uint8Array(hash));
+	}
+	return hashes;
+}
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+function mergeHashes(hashes, more) {
+	const known = new Set(hashes.map(bytesToHex));
+	const merged = [...hashes];
+	for (const hash of more) if (!known.has(bytesToHex(hash))) {
+		known.add(bytesToHex(hash));
+		merged.push(hash);
+	}
+	return merged;
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(HEX_RADIX).padStart(2, "0")).join("");
+}
+/** `address` with its pinned hashes replaced by `sha256`. */
+function withPinnedHashes(address, sha256) {
+	const { url } = parsePinnedAddress(address);
+	return formatPinnedAddress(new URL(url).host, sha256.map(bytesToHex));
+}
 //#endregion
+exports.MAX_ANNOUNCED_HASHES = MAX_ANNOUNCED_HASHES;
+exports.decodeCertificateHashes = decodeCertificateHashes;
+exports.encodeCertificateHashes = encodeCertificateHashes;
 exports.formatPinnedAddress = formatPinnedAddress;
 exports.isPinnedAddress = isPinnedAddress;
+exports.mergeHashes = mergeHashes;
 exports.parsePinnedAddress = parsePinnedAddress;
+exports.withPinnedHashes = withPinnedHashes;

package/dist/domain/pinned-address.d.cts

@@ -19,4 +19,19 @@ export declare function isPinnedAddress(address: string): boolean;
  * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+export declare const MAX_ANNOUNCED_HASHES = 8;
+/**
+ * The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+ */
+export declare function encodeCertificateHashes(sha256Hex: readonly string[]): Uint8Array;
+/**
+ * Reads a message made by `encodeCertificateHashes`.
+ * @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+ */
+export declare function decodeCertificateHashes(bytes: Readonly<Uint8Array>): Uint8Array<ArrayBuffer>[];
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+export declare function mergeHashes(hashes: readonly Uint8Array<ArrayBuffer>[], more: readonly Uint8Array<ArrayBuffer>[]): Uint8Array<ArrayBuffer>[];
+/** `address` with its pinned hashes replaced by `sha256`. */
+export declare function withPinnedHashes(address: string, sha256: readonly Uint8Array<ArrayBuffer>[]): string;
 //#endregion

package/dist/domain/pinned-address.d.mts

@@ -19,4 +19,19 @@ export declare function isPinnedAddress(address: string): boolean;
  * @throws Error when the address is not `https://` or does not carry one or more 64-digit lowercase hex hashes.
  */
 export declare function parsePinnedAddress(address: string): PinnedAddress;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+export declare const MAX_ANNOUNCED_HASHES = 8;
+/**
+ * The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+ */
+export declare function encodeCertificateHashes(sha256Hex: readonly string[]): Uint8Array;
+/**
+ * Reads a message made by `encodeCertificateHashes`.
+ * @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+ */
+export declare function decodeCertificateHashes(bytes: Readonly<Uint8Array>): Uint8Array<ArrayBuffer>[];
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+export declare function mergeHashes(hashes: readonly Uint8Array<ArrayBuffer>[], more: readonly Uint8Array<ArrayBuffer>[]): Uint8Array<ArrayBuffer>[];
+/** `address` with its pinned hashes replaced by `sha256`. */
+export declare function withPinnedHashes(address: string, sha256: readonly Uint8Array<ArrayBuffer>[]): string;
 //#endregion

package/dist/domain/pinned-address.mjs

@@ -1,7 +1,9 @@
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
 //#region src/domain/pinned-address.ts
 const PIN_FRAGMENT = "#sha256=";
 const HASH_SEPARATOR = ",";
 const SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+const HEX_RADIX = 16;
 function hexToBytes(hex) {
 	const bytes = new Uint8Array(hex.length / 2);
 	for (let index = 0; index < bytes.length; index++) bytes[index] = Number.parseInt(hex.slice(index * 2, index * 2 + 2), 16);
@@ -33,5 +35,49 @@ function parsePinnedAddress(address) {
 		sha256: hashes.map(hexToBytes)
 	};
 }
+/** The bytes in a SHA-256 hash. */
+const SHA256_BYTES = 32;
+/** The most hashes a node may announce at once. A browser is asked to accept any of them, and a longer list is a node misbehaving rather than one advertising a schedule. */
+const MAX_ANNOUNCED_HASHES = 8;
+/**
+* The message a node sends a client, on a stream it opens to that client, to say which certificates it serves now and will serve next: a CBOR map with one key, `sha256`, holding an array of 32-byte hashes in the order they take over. It is authentic because it arrives on the session the client pinned, so no signature is needed.
+*/
+function encodeCertificateHashes(sha256Hex) {
+	return encode({ sha256: sha256Hex.map(hexToBytes) }, cdeEncodeOptions);
+}
+/**
+* Reads a message made by `encodeCertificateHashes`.
+* @throws Error when it is not a map with a `sha256` array of one to MAX_ANNOUNCED_HASHES byte strings of 32 bytes each.
+*/
+function decodeCertificateHashes(bytes) {
+	const decoded = decode(bytes, cdeDecodeOptions);
+	if (typeof decoded !== "object" || decoded === null || !("sha256" in decoded) || !Array.isArray(decoded.sha256)) throw new Error("expected a map with a sha256 array");
+	const announced = decoded.sha256;
+	if (announced.length === 0 || announced.length > 8) throw new Error(`expected 1 to ${String(8)} hashes, got ${String(announced.length)}`);
+	const hashes = [];
+	for (const hash of announced) {
+		if (!(hash instanceof Uint8Array) || hash.length !== SHA256_BYTES) throw new Error(`each hash must be ${String(SHA256_BYTES)} bytes`);
+		hashes.push(new Uint8Array(hash));
+	}
+	return hashes;
+}
+/** `hashes` followed by those of `more` that are not already in it, so a client can pin what it was given and what it has learned since. */
+function mergeHashes(hashes, more) {
+	const known = new Set(hashes.map(bytesToHex));
+	const merged = [...hashes];
+	for (const hash of more) if (!known.has(bytesToHex(hash))) {
+		known.add(bytesToHex(hash));
+		merged.push(hash);
+	}
+	return merged;
+}
+function bytesToHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(HEX_RADIX).padStart(2, "0")).join("");
+}
+/** `address` with its pinned hashes replaced by `sha256`. */
+function withPinnedHashes(address, sha256) {
+	const { url } = parsePinnedAddress(address);
+	return formatPinnedAddress(new URL(url).host, sha256.map(bytesToHex));
+}
 //#endregion
-export { formatPinnedAddress, isPinnedAddress, parsePinnedAddress };
+export { MAX_ANNOUNCED_HASHES, decodeCertificateHashes, encodeCertificateHashes, formatPinnedAddress, isPinnedAddress, mergeHashes, parsePinnedAddress, withPinnedHashes };

package/dist/domain/relay-advert.cjs

@@ -0,0 +1,30 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/relay-advert.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+* Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+*/
+function buildRelayOfferExtension(addresses) {
+	if (addresses.length === 0) throw new Error("a relay offer names at least one address");
+	for (const address of addresses) if (typeof address !== "string") throw new Error(`a relay offer address is a string, got ${JSON.stringify(address)}`);
+	return { [RELAY_OFFER_GOSSIP_KEY]: [...addresses] };
+}
+/**
+* Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+*/
+function readRelayOffer(advert) {
+	const value = advert[RELAY_OFFER_GOSSIP_KEY];
+	if (!Array.isArray(value)) return void 0;
+	const addresses = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") return void 0;
+		addresses.push(entry);
+	}
+	if (addresses.length === 0) return void 0;
+	return addresses;
+}
+//#endregion
+exports.RELAY_OFFER_GOSSIP_KEY = RELAY_OFFER_GOSSIP_KEY;
+exports.buildRelayOfferExtension = buildRelayOfferExtension;
+exports.readRelayOffer = readRelayOffer;

package/dist/domain/relay-advert.d.cts

@@ -0,0 +1,13 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+//#region src/domain/relay-advert.d.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+ * Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+ */
+export declare function buildRelayOfferExtension(addresses: readonly string[]): Record<string, unknown>;
+/**
+ * Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+ */
+export declare function readRelayOffer(advert: Readonly<PeerAdvert>): readonly string[] | undefined;
+//#endregion

package/dist/domain/relay-advert.d.mts

@@ -0,0 +1,13 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+//#region src/domain/relay-advert.d.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+ * Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+ */
+export declare function buildRelayOfferExtension(addresses: readonly string[]): Record<string, unknown>;
+/**
+ * Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+ */
+export declare function readRelayOffer(advert: Readonly<PeerAdvert>): readonly string[] | undefined;
+//#endregion

package/dist/domain/relay-advert.mjs

@@ -0,0 +1,27 @@
+//#region src/domain/relay-advert.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+* Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+*/
+function buildRelayOfferExtension(addresses) {
+	if (addresses.length === 0) throw new Error("a relay offer names at least one address");
+	for (const address of addresses) if (typeof address !== "string") throw new Error(`a relay offer address is a string, got ${JSON.stringify(address)}`);
+	return { [RELAY_OFFER_GOSSIP_KEY]: [...addresses] };
+}
+/**
+* Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+*/
+function readRelayOffer(advert) {
+	const value = advert[RELAY_OFFER_GOSSIP_KEY];
+	if (!Array.isArray(value)) return void 0;
+	const addresses = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") return void 0;
+		addresses.push(entry);
+	}
+	if (addresses.length === 0) return void 0;
+	return addresses;
+}
+//#endregion
+export { RELAY_OFFER_GOSSIP_KEY, buildRelayOfferExtension, readRelayOffer };

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.cjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.cjs";
 import { PeerAdvertVerifier } from "./peer-advert.cjs";

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.mjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.mjs";
 import { PeerAdvertVerifier } from "./peer-advert.mjs";

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-CfW7fsGK.cjs";
+import { t as Connection } from "../transport-DIXjoQKn.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
 import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-iLBxIkRS.mjs";
+import { t as Connection } from "../transport-B0GywEzG.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
+import { o as verifyRevocationEntry } from "../tokens-CMdWiRBb.mjs";
 import { bytesToHex } from "./device-id.mjs";
-import { o as verifyRevocationEntry } from "../tokens-B0dpTLhS.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/threshold-subject.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/threshold-subject.mjs

@@ -1,4 +1,4 @@
-import { i as sig1ToBeSigned } from "../tokens-B0dpTLhS.mjs";
+import { i as sig1ToBeSigned } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-CMdWiRBb.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/webrtc-signaling.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.mjs

@@ -1,4 +1,4 @@
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-CfW7fsGK.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-iLBxIkRS.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 export { Connection, Listener, Transport };

package/dist/{transport-iLBxIkRS.d.mts → transport-B0GywEzG.d.mts}

@@ -10,6 +10,8 @@ interface Connection {
   close: () => Promise<void>;
   /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
   readonly peerDeviceId?: DeviceId;
+  /** The address to dial to reach this same peer again, when the adapter has learned a better one than the address this connection was dialled with: a node that rotates the certificate a browser pins tells each connection the certificates it will serve next, so a dial made after the address the user was given has aged still succeeds. Absent when the adapter learned nothing, in which case the dialled address stands. */
+  readonly redialAddress?: () => string;
   /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
   unref?: () => void;
 }

package/dist/{transport-CfW7fsGK.d.cts → transport-DIXjoQKn.d.cts}

@@ -10,6 +10,8 @@ interface Connection {
   close: () => Promise<void>;
   /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
   readonly peerDeviceId?: DeviceId;
+  /** The address to dial to reach this same peer again, when the adapter has learned a better one than the address this connection was dialled with: a node that rotates the certificate a browser pins tells each connection the certificates it will serve next, so a dial made after the address the user was given has aged still succeeds. Absent when the adapter learned nothing, in which case the dialled address stands. */
+  readonly redialAddress?: () => string;
   /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
   unref?: () => void;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.3.1",
+  "version": "3.5.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -86,6 +86,10 @@
       "import": "./dist/domain/capability-request.mjs",
       "require": "./dist/domain/capability-request.cjs"
     },
+    "./domain/coordinator-election": {
+      "import": "./dist/domain/coordinator-election.mjs",
+      "require": "./dist/domain/coordinator-election.cjs"
+    },
     "./domain/data-sync": {
       "import": "./dist/domain/data-sync.mjs",
       "require": "./dist/domain/data-sync.cjs"
@@ -150,6 +154,10 @@
       "import": "./dist/domain/pinned-address.mjs",
       "require": "./dist/domain/pinned-address.cjs"
     },
+    "./domain/relay-advert": {
+      "import": "./dist/domain/relay-advert.mjs",
+      "require": "./dist/domain/relay-advert.cjs"
+    },
     "./domain/relay-hub": {
       "import": "./dist/domain/relay-hub.mjs",
       "require": "./dist/domain/relay-hub.cjs"

package/dist/{tokens-B0dpTLhS.mjs → tokens-CMdWiRBb.mjs}

@@ -1,7 +1,7 @@
 import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "./generated/protocol.mjs";
 import { n as scopeNarrows, t as bytesEqual } from "./token-scope-Z4bmci4M.mjs";
-import { z } from "zod";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+import { z } from "zod";
 import { PredicateNodeSchema, evaluatePredicate } from "trilean";
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */

package/dist/{tokens-Dh6mG6p_.cjs → tokens-DSG3SDr8.cjs}

@@ -1,7 +1,7 @@
 const require_generated_protocol = require("./generated/protocol.cjs");
 const require_token_scope = require("./token-scope-CxHXTT3u.cjs");
-let zod = require("zod");
 let cbor2 = require("cbor2");
+let zod = require("zod");
 let trilean = require("trilean");
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */