wire-mesh-core 3.8.0 → 3.10.0

package/dist/domain/mesh-session.mjs

@@ -1,6 +1,6 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
-import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/path-trace.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/path-trace.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/peer-advert.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 let cbor2 = require("cbor2");
 //#region src/domain/peer-advert.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
@@ -46,7 +46,7 @@ async function verifyPeerAdvert(identity, advert) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_token_scope.bytesEqual(derived, advert.device)) return false;
+		if (!require_domain_token_scope.bytesEqual(derived, advert.device)) return false;
 		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
 		return false;

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/peer-advert.mjs

@@ -1,4 +1,4 @@
-import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { bytesEqual } from "./token-scope.mjs";
 import { cdeEncodeOptions, encode } from "cbor2";
 //#region src/domain/peer-advert.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */

package/dist/domain/relay-advert.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-advert.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-hub.cjs

@@ -28,6 +28,7 @@ function supersedes(registered, advert, connection) {
 }
 function createRelayHub(options) {
 	const connections = /* @__PURE__ */ new Set();
+	let uplink;
 	const devices = /* @__PURE__ */ new Map();
 	const connectionDevice = /* @__PURE__ */ new Map();
 	const pairings = /* @__PURE__ */ new Map();
@@ -51,14 +52,16 @@ function createRelayHub(options) {
 	function forgetConnection(connection) {
 		connections.delete(connection);
 		for (const [key, registration] of devices) if (registration.connection === connection) devices.delete(key);
-		const ownDevice = connectionDevice.get(connection);
 		connectionDevice.delete(connection);
 		mostRecentPairing.delete(connection);
+		if (connection === uplink) uplink = void 0;
 		const own = pairings.get(connection);
 		if (own) {
 			for (const peer of own.values()) {
 				const peerOwn = pairings.get(peer);
-				if (peerOwn && ownDevice !== void 0) peerOwn.delete(deviceKey(ownDevice));
+				if (peerOwn) {
+					for (const [key, paired] of peerOwn) if (paired === connection) peerOwn.delete(key);
+				}
 				if (mostRecentPairing.get(peer) === connection) mostRecentPairing.delete(peer);
 				stateChanged(peer);
 			}
@@ -98,11 +101,14 @@ function createRelayHub(options) {
 				advert
 			});
 		}
+		for (const { connection, state } of entries) for (const advert of state.adverts) {
+			const key = deviceKey(advert.device);
+			if (!byDevice.has(key)) byDevice.set(key, connection);
+		}
 		for (const { connection, state } of entries) for (const paired of state.pairedDevices) {
 			const peer = byDevice.get(deviceKey(paired));
 			if (peer === void 0) continue;
 			pairingsOf(connection).set(deviceKey(paired), peer);
-			pairingsOf(peer).set(deviceKey(state.device), connection);
 		}
 		for (const { connection, state } of entries) {
 			const recent = state.mostRecentDevice;
@@ -111,6 +117,27 @@ function createRelayHub(options) {
 			if (peer !== void 0) mostRecentPairing.set(connection, peer);
 		}
 	}
+	/** The device a frame from `connection` acts for: the one it names when it fronts that device, otherwise the device the hub attributes to the connection when none is named. Undefined when the connection has no device yet or names one it does not front. */
+	function initiatorOf(connection, claimed) {
+		if (claimed === void 0) return connectionDevice.get(connection);
+		return devices.get(deviceKey(claimed))?.connection === connection ? claimed : void 0;
+	}
+	/** A relay-inbound is only meaningful from the upstream hub, which sends one to say a device it holds was paired with a device fronted through this hub. Both devices must be known here (the upstream one registered to the uplink, the addressed one to a local client) so the pairing can be recorded and the client told. */
+	async function handleUplinkInbound(connection, frame) {
+		const target = frame["target-device"];
+		if (connection !== uplink || target === void 0) return;
+		const local = devices.get(deviceKey(target));
+		const source = devices.get(deviceKey(frame["source-device"]));
+		if (local === void 0 || local.connection === connection || source?.connection !== connection) return;
+		addPairing(local.connection, target, connection, frame["source-device"]);
+		stateChanged(local.connection);
+		stateChanged(connection);
+		await local.connection.send({
+			type: "relay-inbound",
+			"source-device": frame["source-device"],
+			"target-device": target
+		});
+	}
 	async function handleFrame(connection, frame) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
@@ -156,7 +183,7 @@ function createRelayHub(options) {
 			}
 			const catchUp = [];
 			for (const registration of devices.values()) if (registration.connection !== connection) catchUp.push(registration.advert);
-			if (catchUp.length > 0) try {
+			if (catchUp.length > 0 && connection !== uplink) try {
 				await connection.send({
 					type: "gossip",
 					peers: catchUp
@@ -167,24 +194,39 @@ function createRelayHub(options) {
 		if (frame.type === "relay-connect") {
 			const registration = devices.get(deviceKey(frame["target-device"]));
 			if (!registration || registration.connection === connection) return;
-			const initiatorDevice = connectionDevice.get(connection);
-			if (initiatorDevice === void 0) return;
+			const initiatorDevice = initiatorOf(connection, frame["source-device"]);
+			if (initiatorDevice === void 0 || connection === uplink) return;
 			addPairing(connection, initiatorDevice, registration.connection, registration.advert.device);
 			stateChanged(connection);
 			stateChanged(registration.connection);
+			if (registration.connection === uplink) {
+				await registration.connection.send({
+					type: "relay-connect",
+					"target-device": registration.advert.device,
+					"source-device": initiatorDevice
+				});
+				return;
+			}
 			await registration.connection.send({
 				type: "relay-inbound",
-				"source-device": initiatorDevice
+				"source-device": initiatorDevice,
+				"target-device": registration.advert.device
 			});
 			return;
 		}
+		if (frame.type === "relay-inbound") {
+			await handleUplinkInbound(connection, frame);
+			return;
+		}
 		if (frame.type === "relay-data") {
 			const own = pairings.get(connection);
 			const toDevice = frame["to-device"];
 			const peer = toDevice !== void 0 ? own?.get(deviceKey(toDevice)) : mostRecentPairing.get(connection);
 			if (!peer) return;
-			const senderDevice = connectionDevice.get(connection);
+			const claimedFrom = frame["from-device"];
+			const senderDevice = initiatorOf(connection, claimedFrom);
 			if (senderDevice === void 0) return;
+			if (claimedFrom !== void 0 && pairings.get(peer)?.get(deviceKey(claimedFrom)) !== connection) return;
 			await peer.send({
 				type: "relay-data",
 				payload: frame.payload,
@@ -213,14 +255,28 @@ function createRelayHub(options) {
 			return;
 		}
 	}
+	async function serve(connection) {
+		connections.add(connection);
+		try {
+			for await (const frame of connection.receive()) await handleFrame(connection, frame);
+		} catch {} finally {
+			forgetConnection(connection);
+		}
+	}
 	return {
-		async handleConnection(connection) {
-			connections.add(connection);
-			try {
-				for await (const frame of connection.receive()) await handleFrame(connection, frame);
-			} catch {} finally {
-				forgetConnection(connection);
-			}
+		handleConnection: serve,
+		async handleUplink(connection) {
+			if (uplink !== void 0) throw new Error("this relay hub already has an uplink");
+			uplink = connection;
+			const local = [];
+			for (const registration of devices.values()) local.push(registration.advert);
+			if (local.length > 0) try {
+				await connection.send({
+					type: "gossip",
+					peers: local
+				});
+			} catch {}
+			await serve(connection);
 		},
 		registerConnection(connection) {
 			connections.add(connection);
@@ -235,6 +291,7 @@ function createRelayHub(options) {
 			connectionDevice.clear();
 			pairings.clear();
 			mostRecentPairing.clear();
+			uplink = void 0;
 		}
 	};
 }

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.cjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.cjs";
 import { PeerAdvertVerifier } from "./peer-advert.cjs";
@@ -62,6 +62,10 @@ export interface RelayHub {
   exportConnection: (connection: Readonly<Connection>) => RelayConnectionState | undefined;
   /** Rebuilds device-registry and pairing state for connections that outlived the hub instance which established it, so a frame arriving on one of them routes as it did before rather than being dropped as unknown. Each entry's connection is registered as if registerConnection had been called for it. Pairings resolve within the batch: a paired device-id no entry claims belonged to a peer that disconnected while no instance was running, and its pairing is correctly left out. Meant for a freshly created hub, before it handles any frame. */
   restoreConnections: (entries: readonly RelayConnectionRestore[]) => void;
+  /**
+   * Drives a connection to an upstream hub as this hub's uplink (wire-mesh#311), so the clients registered here are reachable through the upstream hub and can reach the devices registered there, each end keeping its own device-id. Behaves as handleConnection for that connection, and in addition announces every advert already registered here to the upstream hub before its first frame is read, since adverts that arrived earlier would otherwise never be forwarded to it. Resolves when the connection's frame stream ends, after which a new uplink may be attached. Rejects at once when an uplink is already attached.
+   */
+  handleUplink: (connection: Readonly<Connection>) => Promise<void>;
   /** Drops all registry and pairing state -- used by tests and by transport teardown. */
   stop: () => void;
 }

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { D as DeviceId, N as Frame, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 import { AdvertExtensionPolicy } from "./advert-extension-policy.mjs";
 import { Mailbox, MailboxRefusalReason } from "./hub-mailbox.mjs";
 import { PeerAdvertVerifier } from "./peer-advert.mjs";
@@ -62,6 +62,10 @@ export interface RelayHub {
   exportConnection: (connection: Readonly<Connection>) => RelayConnectionState | undefined;
   /** Rebuilds device-registry and pairing state for connections that outlived the hub instance which established it, so a frame arriving on one of them routes as it did before rather than being dropped as unknown. Each entry's connection is registered as if registerConnection had been called for it. Pairings resolve within the batch: a paired device-id no entry claims belonged to a peer that disconnected while no instance was running, and its pairing is correctly left out. Meant for a freshly created hub, before it handles any frame. */
   restoreConnections: (entries: readonly RelayConnectionRestore[]) => void;
+  /**
+   * Drives a connection to an upstream hub as this hub's uplink (wire-mesh#311), so the clients registered here are reachable through the upstream hub and can reach the devices registered there, each end keeping its own device-id. Behaves as handleConnection for that connection, and in addition announces every advert already registered here to the upstream hub before its first frame is read, since adverts that arrived earlier would otherwise never be forwarded to it. Resolves when the connection's frame stream ends, after which a new uplink may be attached. Rejects at once when an uplink is already attached.
+   */
+  handleUplink: (connection: Readonly<Connection>) => Promise<void>;
   /** Drops all registry and pairing state -- used by tests and by transport teardown. */
   stop: () => void;
 }

package/dist/domain/relay-hub.mjs

@@ -27,6 +27,7 @@ function supersedes(registered, advert, connection) {
 }
 function createRelayHub(options) {
 	const connections = /* @__PURE__ */ new Set();
+	let uplink;
 	const devices = /* @__PURE__ */ new Map();
 	const connectionDevice = /* @__PURE__ */ new Map();
 	const pairings = /* @__PURE__ */ new Map();
@@ -50,14 +51,16 @@ function createRelayHub(options) {
 	function forgetConnection(connection) {
 		connections.delete(connection);
 		for (const [key, registration] of devices) if (registration.connection === connection) devices.delete(key);
-		const ownDevice = connectionDevice.get(connection);
 		connectionDevice.delete(connection);
 		mostRecentPairing.delete(connection);
+		if (connection === uplink) uplink = void 0;
 		const own = pairings.get(connection);
 		if (own) {
 			for (const peer of own.values()) {
 				const peerOwn = pairings.get(peer);
-				if (peerOwn && ownDevice !== void 0) peerOwn.delete(deviceKey(ownDevice));
+				if (peerOwn) {
+					for (const [key, paired] of peerOwn) if (paired === connection) peerOwn.delete(key);
+				}
 				if (mostRecentPairing.get(peer) === connection) mostRecentPairing.delete(peer);
 				stateChanged(peer);
 			}
@@ -97,11 +100,14 @@ function createRelayHub(options) {
 				advert
 			});
 		}
+		for (const { connection, state } of entries) for (const advert of state.adverts) {
+			const key = deviceKey(advert.device);
+			if (!byDevice.has(key)) byDevice.set(key, connection);
+		}
 		for (const { connection, state } of entries) for (const paired of state.pairedDevices) {
 			const peer = byDevice.get(deviceKey(paired));
 			if (peer === void 0) continue;
 			pairingsOf(connection).set(deviceKey(paired), peer);
-			pairingsOf(peer).set(deviceKey(state.device), connection);
 		}
 		for (const { connection, state } of entries) {
 			const recent = state.mostRecentDevice;
@@ -110,6 +116,27 @@ function createRelayHub(options) {
 			if (peer !== void 0) mostRecentPairing.set(connection, peer);
 		}
 	}
+	/** The device a frame from `connection` acts for: the one it names when it fronts that device, otherwise the device the hub attributes to the connection when none is named. Undefined when the connection has no device yet or names one it does not front. */
+	function initiatorOf(connection, claimed) {
+		if (claimed === void 0) return connectionDevice.get(connection);
+		return devices.get(deviceKey(claimed))?.connection === connection ? claimed : void 0;
+	}
+	/** A relay-inbound is only meaningful from the upstream hub, which sends one to say a device it holds was paired with a device fronted through this hub. Both devices must be known here (the upstream one registered to the uplink, the addressed one to a local client) so the pairing can be recorded and the client told. */
+	async function handleUplinkInbound(connection, frame) {
+		const target = frame["target-device"];
+		if (connection !== uplink || target === void 0) return;
+		const local = devices.get(deviceKey(target));
+		const source = devices.get(deviceKey(frame["source-device"]));
+		if (local === void 0 || local.connection === connection || source?.connection !== connection) return;
+		addPairing(local.connection, target, connection, frame["source-device"]);
+		stateChanged(local.connection);
+		stateChanged(connection);
+		await local.connection.send({
+			type: "relay-inbound",
+			"source-device": frame["source-device"],
+			"target-device": target
+		});
+	}
 	async function handleFrame(connection, frame) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
@@ -155,7 +182,7 @@ function createRelayHub(options) {
 			}
 			const catchUp = [];
 			for (const registration of devices.values()) if (registration.connection !== connection) catchUp.push(registration.advert);
-			if (catchUp.length > 0) try {
+			if (catchUp.length > 0 && connection !== uplink) try {
 				await connection.send({
 					type: "gossip",
 					peers: catchUp
@@ -166,24 +193,39 @@ function createRelayHub(options) {
 		if (frame.type === "relay-connect") {
 			const registration = devices.get(deviceKey(frame["target-device"]));
 			if (!registration || registration.connection === connection) return;
-			const initiatorDevice = connectionDevice.get(connection);
-			if (initiatorDevice === void 0) return;
+			const initiatorDevice = initiatorOf(connection, frame["source-device"]);
+			if (initiatorDevice === void 0 || connection === uplink) return;
 			addPairing(connection, initiatorDevice, registration.connection, registration.advert.device);
 			stateChanged(connection);
 			stateChanged(registration.connection);
+			if (registration.connection === uplink) {
+				await registration.connection.send({
+					type: "relay-connect",
+					"target-device": registration.advert.device,
+					"source-device": initiatorDevice
+				});
+				return;
+			}
 			await registration.connection.send({
 				type: "relay-inbound",
-				"source-device": initiatorDevice
+				"source-device": initiatorDevice,
+				"target-device": registration.advert.device
 			});
 			return;
 		}
+		if (frame.type === "relay-inbound") {
+			await handleUplinkInbound(connection, frame);
+			return;
+		}
 		if (frame.type === "relay-data") {
 			const own = pairings.get(connection);
 			const toDevice = frame["to-device"];
 			const peer = toDevice !== void 0 ? own?.get(deviceKey(toDevice)) : mostRecentPairing.get(connection);
 			if (!peer) return;
-			const senderDevice = connectionDevice.get(connection);
+			const claimedFrom = frame["from-device"];
+			const senderDevice = initiatorOf(connection, claimedFrom);
 			if (senderDevice === void 0) return;
+			if (claimedFrom !== void 0 && pairings.get(peer)?.get(deviceKey(claimedFrom)) !== connection) return;
 			await peer.send({
 				type: "relay-data",
 				payload: frame.payload,
@@ -212,14 +254,28 @@ function createRelayHub(options) {
 			return;
 		}
 	}
+	async function serve(connection) {
+		connections.add(connection);
+		try {
+			for await (const frame of connection.receive()) await handleFrame(connection, frame);
+		} catch {} finally {
+			forgetConnection(connection);
+		}
+	}
 	return {
-		async handleConnection(connection) {
-			connections.add(connection);
-			try {
-				for await (const frame of connection.receive()) await handleFrame(connection, frame);
-			} catch {} finally {
-				forgetConnection(connection);
-			}
+		handleConnection: serve,
+		async handleUplink(connection) {
+			if (uplink !== void 0) throw new Error("this relay hub already has an uplink");
+			uplink = connection;
+			const local = [];
+			for (const registration of devices.values()) local.push(registration.advert);
+			if (local.length > 0) try {
+				await connection.send({
+					type: "gossip",
+					peers: local
+				});
+			} catch {}
+			await serve(connection);
 		},
 		registerConnection(connection) {
 			connections.add(connection);
@@ -234,6 +290,7 @@ function createRelayHub(options) {
 			connectionDevice.clear();
 			pairings.clear();
 			mostRecentPairing.clear();
+			uplink = void 0;
 		}
 	};
 }

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { N as Frame } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { N as Frame } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);
@@ -12,7 +12,7 @@ function createRevocationView() {
 			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
-			const verdict = await require_tokens.verifyRevocationEntry(entry, options);
+			const verdict = await require_domain_tokens.verifyRevocationEntry(entry, options);
 			if (verdict.ok) {
 				const key = revocationKey(verdict.claims["token-id"]);
 				const existing = entriesByTokenId.get(key);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-BgR1e_NI.cjs";
-import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-BMWCnQEF.cjs";
+import { bt as RevocationEntry } from "../protocol-DzmpxxUr.cjs";
+import { RevocationCheck, RevocationEntryVerdict, VerifyRevocationEntryOptions } from "./tokens.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { bt as RevocationEntry } from "../protocol-BgR1e_NI.mjs";
-import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-DRkm_QOR.mjs";
+import { bt as RevocationEntry } from "../protocol-DzmpxxUr.mjs";
+import { RevocationCheck, RevocationEntryVerdict, VerifyRevocationEntryOptions } from "./tokens.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
 import { bytesToHex } from "./device-id.mjs";
-import { c as verifyRevocationEntry } from "../tokens-D8JlTJNA.mjs";
+import { verifyRevocationEntry } from "./tokens.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-rekey.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**
@@ -12,7 +12,7 @@ const ROOM_MEMBER_CAPABILITY = "room:member";
 * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).
 */
 async function verifyRoomToken(token, options) {
-	const verdict = await require_tokens.verifyCapabilityToken(token, {
+	const verdict = await require_domain_tokens.verifyCapabilityToken(token, {
 		identity: options.identity,
 		clock: options.clock,
 		revocation: options.revocation,

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-hFtBDZPO.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-Dh7SGJfK.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-7zD4ib-A.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-Hb1LkpFh.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
-import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-hFtBDZPO.cjs";
+import { RevocationCheck } from "./tokens.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {