wire-mesh-core 3.9.0 → 3.10.0

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { N as Frame } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { N as Frame } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DP3hdehk.cjs";
+import { r as Transport } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Dv_LTCsF.mjs";
+import { r as Transport } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DP3hdehk.cjs";
+import { r as Transport } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Dv_LTCsF.mjs";
+import { r as Transport } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/advert-extension-policy.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/advert-extension-policy.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-C-aIe1DT.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-D4NNPLnp.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/capability-request.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqvyS7Y8.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqpG8VZZ.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/coordinator-election.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/coordinator-election.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/gossip-expansion.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 import { MeshSession } from "./mesh-session.cjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/gossip-expansion.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 import { MeshSession } from "./mesh-session.mjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DzmpxxUr.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DzmpxxUr.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-BgR1e_NI.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-BgR1e_NI.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/hub-mailbox.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/hub-mailbox.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
-import { r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
+import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
-import { r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
+import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/notice-board.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";

package/dist/domain/notice-board.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";

package/dist/domain/path-trace.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/path-trace.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/path-trace.d.ts

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/peer-advert.d.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";

package/dist/domain/relay-advert.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-advert.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/relay-advert.d.ts
 /** The domain-qualified gossip extension key a node's relay offer rides under, the same `wire-mesh` domain the core's own gossiped version fact occupies. */
 export declare const RELAY_OFFER_GOSSIP_KEY = "wire-mesh/relay-offer";

package/dist/domain/relay-hub.cjs

@@ -28,6 +28,7 @@ function supersedes(registered, advert, connection) {
 }
 function createRelayHub(options) {
 	const connections = /* @__PURE__ */ new Set();
+	let uplink;
 	const devices = /* @__PURE__ */ new Map();
 	const connectionDevice = /* @__PURE__ */ new Map();
 	const pairings = /* @__PURE__ */ new Map();
@@ -51,14 +52,16 @@ function createRelayHub(options) {
 	function forgetConnection(connection) {
 		connections.delete(connection);
 		for (const [key, registration] of devices) if (registration.connection === connection) devices.delete(key);
-		const ownDevice = connectionDevice.get(connection);
 		connectionDevice.delete(connection);
 		mostRecentPairing.delete(connection);
+		if (connection === uplink) uplink = void 0;
 		const own = pairings.get(connection);
 		if (own) {
 			for (const peer of own.values()) {
 				const peerOwn = pairings.get(peer);
-				if (peerOwn && ownDevice !== void 0) peerOwn.delete(deviceKey(ownDevice));
+				if (peerOwn) {
+					for (const [key, paired] of peerOwn) if (paired === connection) peerOwn.delete(key);
+				}
 				if (mostRecentPairing.get(peer) === connection) mostRecentPairing.delete(peer);
 				stateChanged(peer);
 			}
@@ -98,11 +101,14 @@ function createRelayHub(options) {
 				advert
 			});
 		}
+		for (const { connection, state } of entries) for (const advert of state.adverts) {
+			const key = deviceKey(advert.device);
+			if (!byDevice.has(key)) byDevice.set(key, connection);
+		}
 		for (const { connection, state } of entries) for (const paired of state.pairedDevices) {
 			const peer = byDevice.get(deviceKey(paired));
 			if (peer === void 0) continue;
 			pairingsOf(connection).set(deviceKey(paired), peer);
-			pairingsOf(peer).set(deviceKey(state.device), connection);
 		}
 		for (const { connection, state } of entries) {
 			const recent = state.mostRecentDevice;
@@ -111,6 +117,27 @@ function createRelayHub(options) {
 			if (peer !== void 0) mostRecentPairing.set(connection, peer);
 		}
 	}
+	/** The device a frame from `connection` acts for: the one it names when it fronts that device, otherwise the device the hub attributes to the connection when none is named. Undefined when the connection has no device yet or names one it does not front. */
+	function initiatorOf(connection, claimed) {
+		if (claimed === void 0) return connectionDevice.get(connection);
+		return devices.get(deviceKey(claimed))?.connection === connection ? claimed : void 0;
+	}
+	/** A relay-inbound is only meaningful from the upstream hub, which sends one to say a device it holds was paired with a device fronted through this hub. Both devices must be known here (the upstream one registered to the uplink, the addressed one to a local client) so the pairing can be recorded and the client told. */
+	async function handleUplinkInbound(connection, frame) {
+		const target = frame["target-device"];
+		if (connection !== uplink || target === void 0) return;
+		const local = devices.get(deviceKey(target));
+		const source = devices.get(deviceKey(frame["source-device"]));
+		if (local === void 0 || local.connection === connection || source?.connection !== connection) return;
+		addPairing(local.connection, target, connection, frame["source-device"]);
+		stateChanged(local.connection);
+		stateChanged(connection);
+		await local.connection.send({
+			type: "relay-inbound",
+			"source-device": frame["source-device"],
+			"target-device": target
+		});
+	}
 	async function handleFrame(connection, frame) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
@@ -156,7 +183,7 @@ function createRelayHub(options) {
 			}
 			const catchUp = [];
 			for (const registration of devices.values()) if (registration.connection !== connection) catchUp.push(registration.advert);
-			if (catchUp.length > 0) try {
+			if (catchUp.length > 0 && connection !== uplink) try {
 				await connection.send({
 					type: "gossip",
 					peers: catchUp
@@ -167,24 +194,39 @@ function createRelayHub(options) {
 		if (frame.type === "relay-connect") {
 			const registration = devices.get(deviceKey(frame["target-device"]));
 			if (!registration || registration.connection === connection) return;
-			const initiatorDevice = connectionDevice.get(connection);
-			if (initiatorDevice === void 0) return;
+			const initiatorDevice = initiatorOf(connection, frame["source-device"]);
+			if (initiatorDevice === void 0 || connection === uplink) return;
 			addPairing(connection, initiatorDevice, registration.connection, registration.advert.device);
 			stateChanged(connection);
 			stateChanged(registration.connection);
+			if (registration.connection === uplink) {
+				await registration.connection.send({
+					type: "relay-connect",
+					"target-device": registration.advert.device,
+					"source-device": initiatorDevice
+				});
+				return;
+			}
 			await registration.connection.send({
 				type: "relay-inbound",
-				"source-device": initiatorDevice
+				"source-device": initiatorDevice,
+				"target-device": registration.advert.device
 			});
 			return;
 		}
+		if (frame.type === "relay-inbound") {
+			await handleUplinkInbound(connection, frame);
+			return;
+		}
 		if (frame.type === "relay-data") {
 			const own = pairings.get(connection);
 			const toDevice = frame["to-device"];
 			const peer = toDevice !== void 0 ? own?.get(deviceKey(toDevice)) : mostRecentPairing.get(connection);
 			if (!peer) return;
-			const senderDevice = connectionDevice.get(connection);
+			const claimedFrom = frame["from-device"];
+			const senderDevice = initiatorOf(connection, claimedFrom);
 			if (senderDevice === void 0) return;
+			if (claimedFrom !== void 0 && pairings.get(peer)?.get(deviceKey(claimedFrom)) !== connection) return;
 			await peer.send({
 				type: "relay-data",
 				payload: frame.payload,
@@ -213,14 +255,28 @@ function createRelayHub(options) {
 			return;
 		}
 	}
+	async function serve(connection) {
+		connections.add(connection);
+		try {
+			for await (const frame of connection.receive()) await handleFrame(connection, frame);
+		} catch {} finally {
+			forgetConnection(connection);
+		}
+	}
 	return {
-		async handleConnection(connection) {
-			connections.add(connection);
-			try {
-				for await (const frame of connection.receive()) await handleFrame(connection, frame);
-			} catch {} finally {
-				forgetConnection(connection);
-			}
+		handleConnection: serve,
+		async handleUplink(connection) {
+			if (uplink !== void 0) throw new Error("this relay hub already has an uplink");
+			uplink = connection;
+			const local = [];
+			for (const registration of devices.values()) local.push(registration.advert);
+			if (local.length > 0) try {
+				await connection.send({
+					type: "gossip",
+					peers: local
+				});
+			} catch {}
+			await serve(connection);
 		},
 		registerConnection(connection) {
 			connections.add(connection);
@@ -235,6 +291,7 @@ function createRelayHub(options) {
 			connectionDevice.clear();
 			pairings.clear();
 			mostRecentPairing.clear();
+			uplink = void 0;
 		}
 	};
 }