wire-mesh-core 3.4.0 → 3.5.1

package/dist/adapters/threshold-identity.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_domain_threshold_subject = require("../domain/threshold-subject.cjs");
-const require_adapters_threshold_wasm = require("./threshold-wasm.cjs");
 const require_adapters_node_identity = require("./node-identity.cjs");
+const require_adapters_threshold_wasm = require("./threshold-wasm.cjs");
+const require_domain_threshold_subject = require("../domain/threshold-subject.cjs");
 //#region src/adapters/threshold-identity.ts
 const ALG_ED25519 = -8;
 const FIRST_SESSION_ID = 1n;

package/dist/adapters/threshold-identity.mjs

@@ -1,6 +1,6 @@
-import { toBeSigned } from "../domain/threshold-subject.mjs";
-import { signingAggregate, signingBuildPackage } from "./threshold-wasm.mjs";
 import { deriveDeviceId, verifyWithPublicKey } from "./node-identity.mjs";
+import { signingAggregate, signingBuildPackage } from "./threshold-wasm.mjs";
+import { toBeSigned } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.ts
 const ALG_ED25519 = -8;
 const FIRST_SESSION_ID = 1n;

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
 import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { n as mintCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/coordinator-election.cjs

@@ -0,0 +1,81 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/coordinator-election.ts
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+function compareDeviceIds(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i++) {
+		const left = a[i];
+		const right = b[i];
+		if (left === void 0 || right === void 0) break;
+		if (left !== right) return left < right ? -1 : 1;
+	}
+	return a.length - b.length;
+}
+var CoordinatorElection = class {
+	ownDevice;
+	incumbent;
+	constructor(options) {
+		this.ownDevice = options.ownDevice;
+	}
+	/** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+	current() {
+		return this.incumbent;
+	}
+	/** Whether this side's own device is the incumbent. */
+	isSelf() {
+		return this.incumbent !== void 0 && compareDeviceIds(this.incumbent.coordinator, this.ownDevice) === 0;
+	}
+	/**
+	* Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+	*/
+	claim(capacityHint) {
+		const frame = {
+			type: "coordinator",
+			term: (this.incumbent?.term ?? -1) + 1,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { "capacity-hint": capacityHint } : {}
+		};
+		this.incumbent = {
+			term: frame.term,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { capacityHint } : {}
+		};
+		return frame;
+	}
+	/**
+	* The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+	*/
+	announceCurrent() {
+		if (this.incumbent === void 0) return void 0;
+		return {
+			type: "coordinator",
+			term: this.incumbent.term,
+			coordinator: this.incumbent.coordinator,
+			...this.incumbent.capacityHint !== void 0 ? { "capacity-hint": this.incumbent.capacityHint } : {}
+		};
+	}
+	/**
+	* Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+	*/
+	evaluate(frame) {
+		const previous = this.incumbent;
+		if (previous === void 0 || frame.term > previous.term || frame.term === previous.term && compareDeviceIds(frame.coordinator, previous.coordinator) < 0) {
+			this.incumbent = {
+				term: frame.term,
+				coordinator: frame.coordinator,
+				...frame["capacity-hint"] !== void 0 ? { capacityHint: frame["capacity-hint"] } : {}
+			};
+			return {
+				outcome: "accepted",
+				incumbent: this.incumbent
+			};
+		}
+		return {
+			outcome: "retained",
+			incumbent: previous
+		};
+	}
+};
+//#endregion
+exports.CoordinatorElection = CoordinatorElection;
+exports.compareDeviceIds = compareDeviceIds;

package/dist/domain/coordinator-election.d.cts

@@ -0,0 +1,44 @@
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.cjs";
+//#region src/domain/coordinator-election.d.ts
+/** The claim this side currently accepts: one coordinator, at the term that put it there. */
+export interface CoordinatorClaim {
+  term: number;
+  coordinator: DeviceId;
+  capacityHint?: number | undefined;
+}
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+export declare function compareDeviceIds(a: DeviceId, b: DeviceId): number;
+/** What evaluating an incoming claim concluded, so the caller can react without re-deriving the comparison: "accepted" means this claim is now the incumbent (it superseded a previous one, or there was none), "retained" means the incumbent survived (the incoming claim was stale, or lost the equal-term tiebreak), and the incumbent is returned either way so a caller squashing a stale claim re-announces exactly what it already holds. */
+export type EvaluationOutcome = {
+  outcome: "accepted";
+  incumbent: CoordinatorClaim;
+} | {
+  outcome: "retained";
+  incumbent: CoordinatorClaim;
+};
+export interface CoordinatorElectionOptions {
+  /** This device's own id: the coordinator named by a claim this side mints. */
+  ownDevice: DeviceId;
+}
+export declare class CoordinatorElection {
+  private readonly ownDevice;
+  private incumbent;
+  constructor(options: Readonly<CoordinatorElectionOptions>);
+  /** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+  current(): CoordinatorClaim | undefined;
+  /** Whether this side's own device is the incumbent. */
+  isSelf(): boolean;
+  /**
+   * Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+   */
+  claim(capacityHint?: number): CoordinatorFrame;
+  /**
+   * The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+   */
+  announceCurrent(): CoordinatorFrame | undefined;
+  /**
+   * Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+   */
+  evaluate(frame: Readonly<CoordinatorFrame>): EvaluationOutcome;
+}
+//#endregion

package/dist/domain/coordinator-election.d.mts

@@ -0,0 +1,44 @@
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.mjs";
+//#region src/domain/coordinator-election.d.ts
+/** The claim this side currently accepts: one coordinator, at the term that put it there. */
+export interface CoordinatorClaim {
+  term: number;
+  coordinator: DeviceId;
+  capacityHint?: number | undefined;
+}
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+export declare function compareDeviceIds(a: DeviceId, b: DeviceId): number;
+/** What evaluating an incoming claim concluded, so the caller can react without re-deriving the comparison: "accepted" means this claim is now the incumbent (it superseded a previous one, or there was none), "retained" means the incumbent survived (the incoming claim was stale, or lost the equal-term tiebreak), and the incumbent is returned either way so a caller squashing a stale claim re-announces exactly what it already holds. */
+export type EvaluationOutcome = {
+  outcome: "accepted";
+  incumbent: CoordinatorClaim;
+} | {
+  outcome: "retained";
+  incumbent: CoordinatorClaim;
+};
+export interface CoordinatorElectionOptions {
+  /** This device's own id: the coordinator named by a claim this side mints. */
+  ownDevice: DeviceId;
+}
+export declare class CoordinatorElection {
+  private readonly ownDevice;
+  private incumbent;
+  constructor(options: Readonly<CoordinatorElectionOptions>);
+  /** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+  current(): CoordinatorClaim | undefined;
+  /** Whether this side's own device is the incumbent. */
+  isSelf(): boolean;
+  /**
+   * Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+   */
+  claim(capacityHint?: number): CoordinatorFrame;
+  /**
+   * The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+   */
+  announceCurrent(): CoordinatorFrame | undefined;
+  /**
+   * Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+   */
+  evaluate(frame: Readonly<CoordinatorFrame>): EvaluationOutcome;
+}
+//#endregion

package/dist/domain/coordinator-election.mjs

@@ -0,0 +1,79 @@
+//#region src/domain/coordinator-election.ts
+/** Bytewise "lowest device-id" comparison, the equal-term tiebreak the spec names: shorter is lower when one id is a prefix of the other, and equal ids compare equal. Device-ids are a fixed 32 bytes today, so the prefix branch is completeness rather than a live case. */
+function compareDeviceIds(a, b) {
+	const length = Math.min(a.length, b.length);
+	for (let i = 0; i < length; i++) {
+		const left = a[i];
+		const right = b[i];
+		if (left === void 0 || right === void 0) break;
+		if (left !== right) return left < right ? -1 : 1;
+	}
+	return a.length - b.length;
+}
+var CoordinatorElection = class {
+	ownDevice;
+	incumbent;
+	constructor(options) {
+		this.ownDevice = options.ownDevice;
+	}
+	/** The claim this side currently accepts, or undefined before any claim has been made or heard. */
+	current() {
+		return this.incumbent;
+	}
+	/** Whether this side's own device is the incumbent. */
+	isSelf() {
+		return this.incumbent !== void 0 && compareDeviceIds(this.incumbent.coordinator, this.ownDevice) === 0;
+	}
+	/**
+	* Claims the role for this side's own device at a term above every term seen so far (lastTerm + 1, so a first-ever claim is term 0), and returns the frame to gossip. Claiming over a claim this side already holds is a deliberate takeover: it raises the term, which is exactly what a peer recovering the role after losing track of the mesh should do, and what a routine refresh should not (announceCurrent exists for that).
+	*/
+	claim(capacityHint) {
+		const frame = {
+			type: "coordinator",
+			term: (this.incumbent?.term ?? -1) + 1,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { "capacity-hint": capacityHint } : {}
+		};
+		this.incumbent = {
+			term: frame.term,
+			coordinator: this.ownDevice,
+			...capacityHint !== void 0 ? { capacityHint } : {}
+		};
+		return frame;
+	}
+	/**
+	* The incumbent claim as a frame to re-gossip, for a holder refreshing what late joiners see (and for answering a stale claim, which costs the incumbent nothing to squash): the term is unchanged, because a refresh is not a takeover. Undefined when no claim has been made or heard yet.
+	*/
+	announceCurrent() {
+		if (this.incumbent === void 0) return void 0;
+		return {
+			type: "coordinator",
+			term: this.incumbent.term,
+			coordinator: this.incumbent.coordinator,
+			...this.incumbent.capacityHint !== void 0 ? { "capacity-hint": this.incumbent.capacityHint } : {}
+		};
+	}
+	/**
+	* Evaluates an incoming claim against the one this side currently accepts: a strictly higher term always wins; an equal term breaks by lowest device-id, so an incoming claim naming a lower device-id than the incumbent's takes the role and one naming a higher device-id loses; a lower term never wins. "accepted" means the incumbent changed (the caller should gossip the new incumbent onward so the supersession propagates); "retained" means it did not (the caller may answer a stale claim by re-gossiping announceCurrent(), and should drop a lost equal-term claim it originated, since the tiebreak has settled it).
+	*/
+	evaluate(frame) {
+		const previous = this.incumbent;
+		if (previous === void 0 || frame.term > previous.term || frame.term === previous.term && compareDeviceIds(frame.coordinator, previous.coordinator) < 0) {
+			this.incumbent = {
+				term: frame.term,
+				coordinator: frame.coordinator,
+				...frame["capacity-hint"] !== void 0 ? { capacityHint: frame["capacity-hint"] } : {}
+			};
+			return {
+				outcome: "accepted",
+				incumbent: this.incumbent
+			};
+		}
+		return {
+			outcome: "retained",
+			incumbent: previous
+		};
+	}
+};
+//#endregion
+export { CoordinatorElection, compareDeviceIds };

package/dist/domain/mesh-session.cjs

@@ -1,13 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
+const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
+const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_handshake = require("./handshake.cjs");
-const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
 const require_domain_topology_snapshot = require("./topology-snapshot.cjs");
-const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -325,6 +325,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	});
 	const incomingQueue = require_domain_async_queue.createAsyncQueue();
 	const revocationQueue = require_domain_async_queue.createAsyncQueue();
+	const coordinatorQueue = require_domain_async_queue.createAsyncQueue();
 	const pingRoundTrips = require_domain_ping_round_trips.createPingRoundTrips();
 	function snapshot() {
 		return {
@@ -466,6 +467,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
+		else if (frame.type === "coordinator") coordinatorQueue.push(frame);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -632,10 +634,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			events: eventQueue.stream,
 			incomingManageRequests: incomingQueue.stream,
 			revocationAnnouncements: revocationQueue.stream,
+			coordinatorFrames: coordinatorQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
-				await doConnect(address, localDomains);
+				await doConnect(address, localDomains).catch((error) => {
+					handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+					throw error;
+				});
 			},
 			async sendPing() {
 				const link = requireConnectedLink();
@@ -718,6 +724,16 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			async sendCoordinatorClaim(frame) {
+				requireConnectedLink();
+				const claim = { ...frame };
+				frameLog.push({
+					direction: "sent",
+					frame: claim
+				});
+				await transmit(claim, false);
+				emit();
+			},
 			async sendGossipUpdate(extensions) {
 				requireConnectedLink();
 				const frame = await buildSelfAdvert(extensions);

package/dist/domain/mesh-session.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
 import { r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
 import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
@@ -77,6 +77,8 @@ export interface MeshSession {
   readonly incomingManageRequests: AsyncIterable<IncomingManageRequest>;
   /** Every `revocation-entry` received from the peer, in arrival order -- a `revocation-announce` frame's own `entries` array is flattened to one item per entry, since each entry is independently verifiable and independently meaningful regardless of which frame carried it. A consumer typically feeds each one into a RevocationView's own `record`. */
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
+  /** Every `coordinator-frame` received from the peer, in arrival order: a gossiped, term-based claim to the rendezvous role (spec/transport.cddl), surfaced raw exactly like revocationAnnouncements because what a claim means is coordinator-election.ts's own business, not the session's. A consumer feeds each one into a CoordinatorElection's evaluate, and sends its own claims with sendCoordinatorClaim. */
+  readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
   /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
@@ -85,6 +87,8 @@ export interface MeshSession {
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
+  /** Sends one coordinator-frame directly over this session's own connection, never relay-wrapped: the claim is a gossiped broadcast like revocation-announce, not a request addressed to a specific peer. The frame itself comes from a CoordinatorElection (claim, or announceCurrent for a refresh), so the session never invents a term on its own. */
+  sendCoordinatorClaim: (frame: Readonly<CoordinatorFrame>) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
   /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */

package/dist/domain/mesh-session.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
 import { r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
 import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
@@ -77,6 +77,8 @@ export interface MeshSession {
   readonly incomingManageRequests: AsyncIterable<IncomingManageRequest>;
   /** Every `revocation-entry` received from the peer, in arrival order -- a `revocation-announce` frame's own `entries` array is flattened to one item per entry, since each entry is independently verifiable and independently meaningful regardless of which frame carried it. A consumer typically feeds each one into a RevocationView's own `record`. */
   readonly revocationAnnouncements: AsyncIterable<RevocationEntry>;
+  /** Every `coordinator-frame` received from the peer, in arrival order: a gossiped, term-based claim to the rendezvous role (spec/transport.cddl), surfaced raw exactly like revocationAnnouncements because what a claim means is coordinator-election.ts's own business, not the session's. A consumer feeds each one into a CoordinatorElection's evaluate, and sends its own claims with sendCoordinatorClaim. */
+  readonly coordinatorFrames: AsyncIterable<CoordinatorFrame>;
   connect: (address: string, localDomains: readonly string[]) => Promise<void>;
   sendPing: () => Promise<void>;
   /** Sends a ping-frame and resolves with the round-trip time in milliseconds once the correlated pong-frame arrives -- FIFO-paired against this call's own ping, since ping-frame carries no correlation id of its own (spec/transport.cddl): the Nth call's own promise resolves against the Nth pong received after it, never matched by any other means. Rejects if the connection closes, or (when timeoutMs is given) if no pong arrives within timeoutMs, rather than resolving a sentinel value the way sendManageRequest's own timeout does -- there is no natural "no answer" value for a bare millisecond count to double as. Unlike sendPing (fire-and-forget, answered by nothing on an ordinary peer connection), this is answered only by a peer that replies to ping with pong -- today, relay-hub's own frame handling (wire-mesh#181) -- so calling this against a connection to a plain peer that never sends pong hangs until timeoutMs (if given) or forever. Exists to isolate the sender-to-hub leg of a relayed path.trace round trip: time this over the same connection a relayed manage-request travelled, then subtract it from path.trace's own end-to-end RTT to recover the hub-to-target leg. */
@@ -85,6 +87,8 @@ export interface MeshSession {
   setToken: (token: CapabilityToken) => void;
   /** Announces one or more already-minted revocation-entries to the peer. Sent directly over the connection, never relay-wrapped -- revocation-announce is a gossiped broadcast, not a request addressed to a specific peer, so it has no targetDevice/token parameters the way sendManageRequest does. */
   sendRevocationAnnounce: (entries: readonly RevocationEntry[]) => Promise<void>;
+  /** Sends one coordinator-frame directly over this session's own connection, never relay-wrapped: the claim is a gossiped broadcast like revocation-announce, not a request addressed to a specific peer. The frame itself comes from a CoordinatorElection (claim, or announceCurrent for a refresh), so the session never invents a term on its own. */
+  sendCoordinatorClaim: (frame: Readonly<CoordinatorFrame>) => Promise<void>;
   /** Re-sends this side's own self-advert with a fresh snapshot-seconds and, when given, extensions merged onto peer-advert's own open `* tstr => any` tail -- the mechanism a caller uses to keep gossiped presence status (or any other advertised fact) live over a connection's lifetime, since the initial self-advert wireUpConnection sends at connect time is otherwise never repeated. Callers own their own re-advertisement cadence (there is no timer inside MeshSession itself, matching its own DOM-free, fully unit-testable design); a caller not calling this again after connecting is exactly today's existing gossip-once-on-connect behaviour. */
   sendGossipUpdate: (extensions?: Record<string, unknown>) => Promise<void>;
   /** This session's own current topology snapshot -- the identical `topology/peers` value buildSelfAdvert merges into every gossiped self-advert (wire-mesh#180), read back directly rather than only from a possibly-stale gossiped copy elsewhere in the mesh. The live, cache-bust half of the cached-vs-live split `topology.get` itself establishes: a caller answering an incoming topology.get manage-request (see topology.ts's createTopologyGetHandler) calls this to build the response. Synchronous and side-effect-free -- unlike every other method here, it sends nothing and works even before this session has ever connected (an unconnected session simply has no direct peer and no relay pairings yet, both honestly empty). */

package/dist/domain/mesh-session.mjs

@@ -1,12 +1,12 @@
-import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
+import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
+import { createAsyncQueue } from "./async-queue.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { negotiate } from "./handshake.mjs";
-import { createAsyncQueue } from "./async-queue.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
-import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 //#region src/domain/relay-pairing.ts
 function createRelayPairings() {
 	const established = /* @__PURE__ */ new Map();
@@ -324,6 +324,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	});
 	const incomingQueue = createAsyncQueue();
 	const revocationQueue = createAsyncQueue();
+	const coordinatorQueue = createAsyncQueue();
 	const pingRoundTrips = createPingRoundTrips();
 	function snapshot() {
 		return {
@@ -465,6 +466,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());
 		else if (frame.type === "revocation-announce") for (const entry of frame.entries) revocationQueue.push(entry);
+		else if (frame.type === "coordinator") coordinatorQueue.push(frame);
 	}
 	/** Establishes a relay-connect pairing to targetDevice if this session isn't already paired with it -- a no-op when it already is, whether that pairing was established by this session's own prior relay-connect (initiator role) or learned from an incoming relay-inbound (target role, replying back to whoever dialed it). Pairing with a new target never tears down an existing pairing with a different one: this connection can hold several simultaneously (wire-mesh#30's own multiplexed adjacency map), so a later request back to an already-paired target must not re-send relay-connect for it. relay-connect has no ack frame: the initiator proceeds to relay-data right after sending it. */
 	async function ensureRelayPairing(targetDevice) {
@@ -631,10 +633,14 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			events: eventQueue.stream,
 			incomingManageRequests: incomingQueue.stream,
 			revocationAnnouncements: revocationQueue.stream,
+			coordinatorFrames: coordinatorQueue.stream,
 			async connect(address, localDomains) {
 				if (connection !== null) throw new Error("a session connects once; create a new one to reconnect");
 				attempt = 0;
-				await doConnect(address, localDomains);
+				await doConnect(address, localDomains).catch((error) => {
+					handleDisconnect(error instanceof Error ? error.message : String(error), address, localDomains);
+					throw error;
+				});
 			},
 			async sendPing() {
 				const link = requireConnectedLink();
@@ -717,6 +723,16 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				await transmit(frame, false);
 				emit();
 			},
+			async sendCoordinatorClaim(frame) {
+				requireConnectedLink();
+				const claim = { ...frame };
+				frameLog.push({
+					direction: "sent",
+					frame: claim
+				});
+				await transmit(claim, false);
+				emit();
+			},
 			async sendGossipUpdate(extensions) {
 				requireConnectedLink();
 				const frame = await buildSelfAdvert(extensions);

package/dist/domain/relay-advert.cjs

@@ -0,0 +1,30 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/relay-advert.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+* Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+*/
+function buildRelayOfferExtension(addresses) {
+	if (addresses.length === 0) throw new Error("a relay offer names at least one address");
+	for (const address of addresses) if (typeof address !== "string") throw new Error(`a relay offer address is a string, got ${JSON.stringify(address)}`);
+	return { [RELAY_OFFER_GOSSIP_KEY]: [...addresses] };
+}
+/**
+* Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+*/
+function readRelayOffer(advert) {
+	const value = advert[RELAY_OFFER_GOSSIP_KEY];
+	if (!Array.isArray(value)) return void 0;
+	const addresses = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") return void 0;
+		addresses.push(entry);
+	}
+	if (addresses.length === 0) return void 0;
+	return addresses;
+}
+//#endregion
+exports.RELAY_OFFER_GOSSIP_KEY = RELAY_OFFER_GOSSIP_KEY;
+exports.buildRelayOfferExtension = buildRelayOfferExtension;
+exports.readRelayOffer = readRelayOffer;

package/dist/domain/relay-advert.d.cts

@@ -0,0 +1,13 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+//#region src/domain/relay-advert.d.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+ * Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+ */
+export declare function buildRelayOfferExtension(addresses: readonly string[]): Record<string, unknown>;
+/**
+ * Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+ */
+export declare function readRelayOffer(advert: Readonly<PeerAdvert>): readonly string[] | undefined;
+//#endregion

package/dist/domain/relay-advert.d.mts

@@ -0,0 +1,13 @@
+import { et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+//#region src/domain/relay-advert.d.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+ * Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+ */
+export declare function buildRelayOfferExtension(addresses: readonly string[]): Record<string, unknown>;
+/**
+ * Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+ */
+export declare function readRelayOffer(advert: Readonly<PeerAdvert>): readonly string[] | undefined;
+//#endregion

package/dist/domain/relay-advert.mjs

@@ -0,0 +1,27 @@
+//#region src/domain/relay-advert.ts
+/** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
+const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";
+/**
+* Builds the relay-offer extension bag for `sendGossipUpdate`, carrying exactly the address list `relay-offer-frame` itself would name. Throws on an empty list or a non-string entry: an empty offer is not an offer (the caller should simply not advertise), and a malformed address on the wire would be every reader's problem rather than one caller's bug caught at the call site.
+*/
+function buildRelayOfferExtension(addresses) {
+	if (addresses.length === 0) throw new Error("a relay offer names at least one address");
+	for (const address of addresses) if (typeof address !== "string") throw new Error(`a relay offer address is a string, got ${JSON.stringify(address)}`);
+	return { [RELAY_OFFER_GOSSIP_KEY]: [...addresses] };
+}
+/**
+* Reads a peer's relay offer from its advert: the addresses it offers relay service at, or undefined when the peer advertises no offer (or the extension is malformed, which reads as no offer rather than an error). A receiver still decides for itself whether to use any offered address, exactly as it would an in-band relay-offer-frame.
+*/
+function readRelayOffer(advert) {
+	const value = advert[RELAY_OFFER_GOSSIP_KEY];
+	if (!Array.isArray(value)) return void 0;
+	const addresses = [];
+	for (const entry of value) {
+		if (typeof entry !== "string") return void 0;
+		addresses.push(entry);
+	}
+	if (addresses.length === 0) return void 0;
+	return addresses;
+}
+//#endregion
+export { RELAY_OFFER_GOSSIP_KEY, buildRelayOfferExtension, readRelayOffer };

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
+import { o as verifyRevocationEntry } from "../tokens-CMdWiRBb.mjs";
 import { bytesToHex } from "./device-id.mjs";
-import { o as verifyRevocationEntry } from "../tokens-B0dpTLhS.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/threshold-subject.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/threshold-subject.mjs

@@ -1,4 +1,4 @@
-import { i as sig1ToBeSigned } from "../tokens-B0dpTLhS.mjs";
+import { i as sig1ToBeSigned } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken, i as sig1ToBeSigned, n as mintCapabilityToken, o as verifyRevocationEntry, r as mintRevocationEntry, t as canGrant } from "../tokens-CMdWiRBb.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, sig1ToBeSigned, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/webrtc-signaling.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-Dh6mG6p_.cjs");
+const require_tokens = require("../tokens-DSG3SDr8.cjs");
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.mjs

@@ -1,4 +1,4 @@
-import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
+import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.4.0",
+  "version": "3.5.1",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -86,6 +86,10 @@
       "import": "./dist/domain/capability-request.mjs",
       "require": "./dist/domain/capability-request.cjs"
     },
+    "./domain/coordinator-election": {
+      "import": "./dist/domain/coordinator-election.mjs",
+      "require": "./dist/domain/coordinator-election.cjs"
+    },
     "./domain/data-sync": {
       "import": "./dist/domain/data-sync.mjs",
       "require": "./dist/domain/data-sync.cjs"
@@ -150,6 +154,10 @@
       "import": "./dist/domain/pinned-address.mjs",
       "require": "./dist/domain/pinned-address.cjs"
     },
+    "./domain/relay-advert": {
+      "import": "./dist/domain/relay-advert.mjs",
+      "require": "./dist/domain/relay-advert.cjs"
+    },
     "./domain/relay-hub": {
       "import": "./dist/domain/relay-hub.mjs",
       "require": "./dist/domain/relay-hub.cjs"

package/dist/{tokens-B0dpTLhS.mjs → tokens-CMdWiRBb.mjs}

@@ -1,7 +1,7 @@
 import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "./generated/protocol.mjs";
 import { n as scopeNarrows, t as bytesEqual } from "./token-scope-Z4bmci4M.mjs";
-import { z } from "zod";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+import { z } from "zod";
 import { PredicateNodeSchema, evaluatePredicate } from "trilean";
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */

package/dist/{tokens-Dh6mG6p_.cjs → tokens-DSG3SDr8.cjs}

@@ -1,7 +1,7 @@
 const require_generated_protocol = require("./generated/protocol.cjs");
 const require_token_scope = require("./token-scope-CxHXTT3u.cjs");
-let zod = require("zod");
 let cbor2 = require("cbor2");
+let zod = require("zod");
 let trilean = require("trilean");
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */