wire-mesh-core 4.0.2 → 4.0.4

package/README.md

@@ -4,8 +4,8 @@ The TypeScript implementation of wire-mesh's protocol, built ports/adapters: dom
 
 ## Ports
 
-- **Transport** (`src/ports/transport.ts`) -- an async contract for sending/receiving `Frame` values over a connection. Adapter: `src/adapters/tcp-transport.ts` (length-prefixed CBOR frames over plain `node:net`, matching Cascade's own transport shape).
-- **Storage** (`src/ports/storage.ts`) -- an async key/value contract. Adapter: `src/adapters/memory-storage.ts` (in-process, for tests and single-process nodes).
+- **Transport** (`src/ports/transport.ts`): an async contract for sending/receiving `Frame` values over a connection. Adapters: `src/adapters/tcp-transport.ts` (length-prefixed CBOR frames over plain `node:net`, matching Cascade's own transport shape) and `src/adapters/tls-transport.ts` (the same framing over `node:tls`).
+- **Storage** (`src/ports/storage.ts`): an async key/value contract. Adapters: `src/adapters/memory-storage.ts` (in-process, for tests and single-process nodes) and `src/adapters/node-fs-storage.ts` (filesystem).
 - **Identity** (`src/ports/identity.ts`) -- device-id derivation and COSE signing/verification. Adapter: `src/adapters/node-identity.ts` (Web Crypto, ECDSA P-256 and Ed25519 -- the two algorithms the spec's own conformance vectors use).
 - **Clock** (`src/ports/clock.ts`) -- injected time, never `Date.now()` pulled directly into domain logic. Adapter: `src/adapters/system-clock.ts`.
 
@@ -15,10 +15,17 @@ The TypeScript implementation of wire-mesh's protocol, built ports/adapters: dom
 - **Capability-token verification** (`src/domain/tokens.ts`) -- the full chain tokens.cddl documents: COSE_Sign1 signature verification, the self-certifying issuer-key check (`sha256(issuer-key.public-key) == issuer`), expiry/not-before, issuer-matched revocation (only a token's own issuer's signed revocation-entry counts, checked across every ancestor in the delegation chain, not just the leaf), and recursive delegation-chain narrowing across all three axes of authority: a delegated token's issuer must be its parent's bearer (the chain is unbroken), its expiry must not exceed its parent's, and its scope must narrow its parent's (identical kind, equal-or-descendant path when the parent carries one) with an identical capability verb (the verb grammar has no sub-verb relation, so a different verb is different authority, not narrower). Also exports `verifyRevocationEntry` for ingesting gossiped revocation-announce frames: each entry is itself a signed, self-certifying COSE_Sign1 over revocation-claims, verified before it may enter the revocation view.
 - **Peer-advert verification** (`src/domain/peer-advert.ts`): the two checks transport.cddl states for a gossiped advert, applied by the relay hub before it registers or forwards one and by every session before one reaches its directory: the embedded identity-key self-certifies (`sha256(identity-key.public-key) == device`), and the signature verifies under that same key over the domain-separated canonical encoding of the advert with its signature removed, which covers the open extension tail as well. Deliberately not tokens.cddl's COSE Sig_structure: an advert's open tail lets an attacker craft one whose encoding also satisfies token-claims, so the prefixed construction keeps the two byte strings disjoint. Reaches a verdict for every input rather than throwing, since an advert's algorithm and key bytes are attacker-chosen.
 - **Secure channel** (`src/domain/secure-channel.ts`, `src/domain/relay-channels.ts`): the end-to-end channel spec/secure-channel.cddl defines between two devices that reach each other through a relay. A session opens one with each peer it addresses through a relay pairing, seals every manage-request, manage-response and core/data frame in it, drops any that arrives as plain relay-data, and attributes a request to the identity the peer's handshake proved rather than to the `from-device` a hub stamps. There is no plaintext fallback, so a peer that does not speak it cannot be reached through a relay.
+- **Relay hub** (`src/domain/relay-hub.ts`, `src/domain/relay-pairing.ts`, `src/domain/hub-mailbox.ts`): the hub's relay role against the Transport port alone. It verifies every gossiped advert before registering, forwarding or replaying it, pairs devices for relayed traffic, and, as a mailbox, replicates the `core/data` logs of devices that are offline.
+- **Bulk transfer** (`src/domain/bulk.ts`): resumable, flow-controlled `core/bulk` transfer, with a byte-credit window that the receiver's acknowledgements move. `src/domain/sharded-delivery.ts` composes it with erasure coding (`src/domain/erasure-coding.ts`) and shard manifests (`src/domain/shard-manifest.ts`) to spread a payload across holder devices.
+- **Data sync** (`src/domain/data-sync.ts`): the have, request and entries primitive over a storage-backed oplog, which never accepts a gap. What to broadcast, whose logs to track and which holder to ask are left to the application.
+- **Coordinator election** (`src/domain/coordinator-election.ts`): the gossiped, term-based election over `coordinator-frame`, where a higher term supersedes a lower one and equal terms are broken by lowest device-id.
+- **Rooms** (`src/domain/room.ts`, `src/domain/room-path.ts`, `src/domain/room-token-verification.ts`, `src/domain/room-rekey.ts`, `src/domain/group-key.ts`, `src/domain/notice-board.ts`): self-certifying room-notice verification, owner-named and direct-message room paths, the room verifier obligations on top of token verification, content-key distribution and rotation, and the encrypted noticeboard that composes them with data sync.
+- **Threshold signing** (`src/domain/threshold-network.ts`, `src/adapters/threshold-*.ts`): the `exadev.io/threshold` manage-commands for FROST(Ed25519) key generation, resharing and two-round signing, with the cryptography supplied by the WebAssembly build of the Rust threshold crate.
+- **Mesh session** (`src/domain/mesh-session.ts`): the connection session that owns the handshake exchange, the gossip-built peer directory, manage-request dispatch and reconnection, and that the hub, LAN node and web console build on.
 
-## Deliberately deferred
+## Not implemented
 
-Every other frame family (management/exec, streaming, data-domain, discovery, coordinator election) is covered by schema validation only -- `conformance-check` proves the generated schemas decode and re-encode every golden vector byte-exactly, including these families, but no domain-level business logic (dispatch, session bookkeeping, PTY/proc lifecycle, oplog replication, coordinator term tracking) exists for them yet. This first pass deliberately scopes domain logic to transport + handshake + tokens (the families with real business rules worth pinning down before the others), because the conformance suite already covers every family's wire shape either way -- nothing here is unverified, only unimplemented. (The federation link protocol no longer exists in the spec at all: cross-scope sharing is ordinary capability-token delegation, and `src/domain/tokens.ts`'s verification chain is exactly the mechanism that governs it.)
+Exec and streaming are schema only: `conformance-check` proves the generated schemas decode and re-encode their golden vectors byte-exactly, but no code spawns a process or PTY (`proc.*`, `pty.*`) or sends, receives or enforces the credit window of a stream (`stream-data` and its acknowledgements). Tracked in [#341](https://github.com/ExaDev/wire-mesh/issues/341). Direct-path NAT traversal is not implemented either, so a connection across a NAT goes through the relay; tracked in [#343](https://github.com/ExaDev/wire-mesh/issues/343). Nothing resolves DNS-anchored handles. The federation link protocol no longer exists in the spec: cross-scope sharing is ordinary capability-token delegation, and the verification chain in `src/domain/tokens.ts` is the mechanism that governs it.
 
 ## Building from a fresh checkout
 

package/dist/adapters/byte-stream-connection.cjs

@@ -22,16 +22,27 @@ function concat(first, second) {
 	joined.set(second, first.length);
 	return joined;
 }
+/** A reader's chunks as an async iterable, which ends with the stream and leaves releasing or cancelling the reader to its owner. */
+function chunksOf(reader) {
+	return { [Symbol.asyncIterator]: () => ({ next: async () => {
+		const chunk = await reader.read();
+		return chunk.done ? {
+			done: true,
+			value: void 0
+		} : {
+			done: false,
+			value: chunk.value
+		};
+	} }) };
+}
 /**
 * Frames arriving on a byte stream, in order, until it ends. An empty body (STREAM_OPEN_MARKER) is skipped. A body that does not decode as CBOR, or a length prefix above MAX_FRAME_BYTES, rejects the iteration (a connection-level failure); a body that decodes but fails frame validation is dropped and the stream continues, since an unrecognised frame from a newer peer is what version negotiation exists to tolerate.
 */
 async function* readFrames(reader) {
 	let buffered = /* @__PURE__ */ new Uint8Array(0);
 	try {
-		for (;;) {
-			const chunk = await reader.read();
-			if (chunk.done) return;
-			buffered = concat(buffered, chunk.value);
+		for await (const chunk of chunksOf(reader)) {
+			buffered = concat(buffered, chunk);
 			while (buffered.length >= LENGTH_PREFIX_BYTES) {
 				const bodyLength = new DataView(buffered.buffer, buffered.byteOffset).getUint32(0);
 				if (bodyLength > 104857600) throw new Error(`frame of ${String(bodyLength)} bytes exceeds the ${String(MAX_FRAME_BYTES)}-byte limit`);

package/dist/adapters/byte-stream-connection.mjs

@@ -21,16 +21,27 @@ function concat(first, second) {
 	joined.set(second, first.length);
 	return joined;
 }
+/** A reader's chunks as an async iterable, which ends with the stream and leaves releasing or cancelling the reader to its owner. */
+function chunksOf(reader) {
+	return { [Symbol.asyncIterator]: () => ({ next: async () => {
+		const chunk = await reader.read();
+		return chunk.done ? {
+			done: true,
+			value: void 0
+		} : {
+			done: false,
+			value: chunk.value
+		};
+	} }) };
+}
 /**
 * Frames arriving on a byte stream, in order, until it ends. An empty body (STREAM_OPEN_MARKER) is skipped. A body that does not decode as CBOR, or a length prefix above MAX_FRAME_BYTES, rejects the iteration (a connection-level failure); a body that decodes but fails frame validation is dropped and the stream continues, since an unrecognised frame from a newer peer is what version negotiation exists to tolerate.
 */
 async function* readFrames(reader) {
 	let buffered = /* @__PURE__ */ new Uint8Array(0);
 	try {
-		for (;;) {
-			const chunk = await reader.read();
-			if (chunk.done) return;
-			buffered = concat(buffered, chunk.value);
+		for await (const chunk of chunksOf(reader)) {
+			buffered = concat(buffered, chunk);
 			while (buffered.length >= LENGTH_PREFIX_BYTES) {
 				const bodyLength = new DataView(buffered.buffer, buffered.byteOffset).getUint32(0);
 				if (bodyLength > 104857600) throw new Error(`frame of ${String(bodyLength)} bytes exceeds the ${String(MAX_FRAME_BYTES)}-byte limit`);

package/dist/adapters/memory-storage.d.cts

@@ -1,4 +1,4 @@
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 //#region src/adapters/memory-storage.d.ts
 /** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
 export declare function createMemoryStorage(): KeyValueStorage;

package/dist/adapters/memory-storage.d.mts

@@ -1,4 +1,4 @@
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 //#region src/adapters/memory-storage.d.ts
 /** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
 export declare function createMemoryStorage(): KeyValueStorage;

package/dist/adapters/node-fs-storage.cjs

@@ -23,9 +23,10 @@ async function listAllRelativePaths(baseDir) {
 		if (isEnoent(error)) return [];
 		throw error;
 	}
-	const files = [];
-	for (const entry of entries) if ((await node_fs_promises.stat(node_path.join(baseDir, entry)).catch(() => null))?.isFile() === true) files.push(entry.split(node_path.sep).join("/"));
-	return files;
+	return (await Promise.all(entries.map(async (entry) => ({
+		entry,
+		stat: await node_fs_promises.stat(node_path.join(baseDir, entry)).catch(() => null)
+	})))).filter(({ stat }) => stat?.isFile() === true).map(({ entry }) => entry.split(node_path.sep).join("/"));
 }
 function createNodeFsStorage(options) {
 	const baseDir = options.dir;

package/dist/adapters/node-fs-storage.d.cts

@@ -1,4 +1,4 @@
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 //#region src/adapters/node-fs-storage.d.ts
 export interface NodeFsStorageOptions {
   /** Directory to store entries under. Created on first write if it doesn't already exist. */

package/dist/adapters/node-fs-storage.d.mts

@@ -1,4 +1,4 @@
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 //#region src/adapters/node-fs-storage.d.ts
 export interface NodeFsStorageOptions {
   /** Directory to store entries under. Created on first write if it doesn't already exist. */

package/dist/adapters/node-fs-storage.mjs

@@ -19,9 +19,10 @@ async function listAllRelativePaths(baseDir) {
 		if (isEnoent(error)) return [];
 		throw error;
 	}
-	const files = [];
-	for (const entry of entries) if ((await fs.stat(path.join(baseDir, entry)).catch(() => null))?.isFile() === true) files.push(entry.split(path.sep).join("/"));
-	return files;
+	return (await Promise.all(entries.map(async (entry) => ({
+		entry,
+		stat: await fs.stat(path.join(baseDir, entry)).catch(() => null)
+	})))).filter(({ stat }) => stat?.isFile() === true).map(({ entry }) => entry.split(path.sep).join("/"));
 }
 function createNodeFsStorage(options) {
 	const baseDir = options.dir;

package/dist/adapters/system-clock.d.cts

@@ -1,4 +1,4 @@
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/adapters/system-clock.d.ts
 /** Wraps the system wall clock -- the only place Date.now() appears in this package. */
 export declare function createSystemClock(): Clock;

package/dist/adapters/system-clock.d.mts

@@ -1,4 +1,4 @@
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/adapters/system-clock.d.ts
 /** Wraps the system wall clock -- the only place Date.now() appears in this package. */
 export declare function createSystemClock(): Clock;

package/dist/clock-DhUPRfLh.d.cts

@@ -0,0 +1,10 @@
+//#region src/ports/clock.d.ts
+/**
+ * Injected time source, never pulled from global Date.now() directly in domain logic -- lets token-expiry and revocation-timestamp checks be tested deterministically and lets a consumer substitute a synchronised network clock later without touching domain code.
+ */
+interface Clock {
+  /** Current time as Unix milliseconds, matching every uint timestamp field in the protocol (token-claims.expires, revocation-entry.revoked-at, handshake params, etc.). */
+  now: () => number;
+}
+//#endregion
+export { Clock as t };

package/dist/clock-DhUPRfLh.d.mts

@@ -0,0 +1,10 @@
+//#region src/ports/clock.d.ts
+/**
+ * Injected time source, never pulled from global Date.now() directly in domain logic -- lets token-expiry and revocation-timestamp checks be tested deterministically and lets a consumer substitute a synchronised network clock later without touching domain code.
+ */
+interface Clock {
+  /** Current time as Unix milliseconds, matching every uint timestamp field in the protocol (token-claims.expires, revocation-entry.revoked-at, handshake params, etc.). */
+  now: () => number;
+}
+//#endregion
+export { Clock as t };

package/dist/domain/bulk.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_sequential = require("../sequential-CtQVlW8M.cjs");
 //#region src/domain/bulk.ts
 /**
 * core/bulk (wire-mesh#34/#123): resumable, flow-controlled bulk transfer. `bulk.open`/`bulk.resume`/`bulk.cancel` ride manage-request-frame as ordinary manage-command params; `bulk-data`/`bulk-ack`/`bulk-end` are their own frame kind, riding the connection directly rather than a manage-response -- see spec/bulk.cddl's own header comment for the full design, including the three previously-open questions this module resolves in code (chunk-size negotiation is not a wire concept at all; transfer-id/issuer pairing is a verifier obligation, not a wire field; token expiry is checked once per manage-command, never per data frame).
@@ -103,22 +104,30 @@ function createBulkSender(options) {
 		let window = initialWindow;
 		let bytesInFlight = 0;
 		const inFlight = [];
+		/** Takes one ack's credit in: it replaces the window, and every chunk it covers is retired. */
+		const applyAck = (ack) => {
+			ackedCount = ack["ack-seq"];
+			window = ack.window;
+			for (let head = inFlight[0]; head !== void 0 && head.seq < ackedCount; head = inFlight[0]) {
+				inFlight.shift();
+				bytesInFlight -= head.length;
+			}
+		};
+		const exceedsWindow = (length) => bytesInFlight + length > window;
+		/** Takes acks until `length` more bytes fit in the window. */
+		const awaitCredit = async (length) => {
+			applyAck(await waitForAck(id));
+			if (exceedsWindow(length)) await awaitCredit(length);
+		};
 		try {
 			for await (const chunk of options.source(fromSeq)) {
 				if (cancelled.has(id)) return {
 					status: "incomplete",
 					ackedCount
 				};
-				while (bytesInFlight + chunk.length > window) {
-					const ack = await waitForAck(id);
-					ackedCount = ack["ack-seq"];
-					window = ack.window;
-					for (;;) {
-						const head = inFlight[0];
-						if (head === void 0 || head.seq >= ackedCount) break;
-						inFlight.shift();
-						bytesInFlight -= head.length;
-					}
+				if (exceedsWindow(chunk.length)) {
+					applyAck(await waitForAck(id));
+					if (exceedsWindow(chunk.length)) await awaitCredit(chunk.length);
 				}
 				const dataFrame = {
 					type: "bulk-data",
@@ -306,10 +315,10 @@ function createBulkReceiver(options) {
 			}
 			const ackedCount = await readAckSeq(idHex);
 			const chunks = [];
-			for (let seq = 0; seq < ackedCount; seq += 1) {
+			await require_sequential.eachInOrder(Array.from({ length: ackedCount }, (_, seq) => seq), async (seq) => {
 				const chunk = await storage.get(chunkKey(idHex, seq));
 				if (chunk !== void 0) chunks.push(chunk);
-			}
+			});
 			const ok = bytesEqual(await digestOf(concatChunks(chunks)), frame.digest);
 			reg.onComplete?.({
 				ok,

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as Connection } from "../transport-gDbSHO-r.cjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as Connection } from "../transport-bD3p_TO_.mjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.mjs

@@ -1,5 +1,6 @@
 import { bulkCancelSchema, bulkOpenSchema, bulkResumeSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { t as eachInOrder } from "../sequential-D_W3THly.mjs";
 //#region src/domain/bulk.ts
 /**
 * core/bulk (wire-mesh#34/#123): resumable, flow-controlled bulk transfer. `bulk.open`/`bulk.resume`/`bulk.cancel` ride manage-request-frame as ordinary manage-command params; `bulk-data`/`bulk-ack`/`bulk-end` are their own frame kind, riding the connection directly rather than a manage-response -- see spec/bulk.cddl's own header comment for the full design, including the three previously-open questions this module resolves in code (chunk-size negotiation is not a wire concept at all; transfer-id/issuer pairing is a verifier obligation, not a wire field; token expiry is checked once per manage-command, never per data frame).
@@ -102,22 +103,30 @@ function createBulkSender(options) {
 		let window = initialWindow;
 		let bytesInFlight = 0;
 		const inFlight = [];
+		/** Takes one ack's credit in: it replaces the window, and every chunk it covers is retired. */
+		const applyAck = (ack) => {
+			ackedCount = ack["ack-seq"];
+			window = ack.window;
+			for (let head = inFlight[0]; head !== void 0 && head.seq < ackedCount; head = inFlight[0]) {
+				inFlight.shift();
+				bytesInFlight -= head.length;
+			}
+		};
+		const exceedsWindow = (length) => bytesInFlight + length > window;
+		/** Takes acks until `length` more bytes fit in the window. */
+		const awaitCredit = async (length) => {
+			applyAck(await waitForAck(id));
+			if (exceedsWindow(length)) await awaitCredit(length);
+		};
 		try {
 			for await (const chunk of options.source(fromSeq)) {
 				if (cancelled.has(id)) return {
 					status: "incomplete",
 					ackedCount
 				};
-				while (bytesInFlight + chunk.length > window) {
-					const ack = await waitForAck(id);
-					ackedCount = ack["ack-seq"];
-					window = ack.window;
-					for (;;) {
-						const head = inFlight[0];
-						if (head === void 0 || head.seq >= ackedCount) break;
-						inFlight.shift();
-						bytesInFlight -= head.length;
-					}
+				if (exceedsWindow(chunk.length)) {
+					applyAck(await waitForAck(id));
+					if (exceedsWindow(chunk.length)) await awaitCredit(chunk.length);
 				}
 				const dataFrame = {
 					type: "bulk-data",
@@ -305,10 +314,10 @@ function createBulkReceiver(options) {
 			}
 			const ackedCount = await readAckSeq(idHex);
 			const chunks = [];
-			for (let seq = 0; seq < ackedCount; seq += 1) {
+			await eachInOrder(Array.from({ length: ackedCount }, (_, seq) => seq), async (seq) => {
 				const chunk = await storage.get(chunkKey(idHex, seq));
 				if (chunk !== void 0) chunks.push(chunk);
-			}
+			});
 			const ok = bytesEqual(await digestOf(concatChunks(chunks)), frame.digest);
 			reg.onComplete?.({
 				ok,

package/dist/domain/capability-grant.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-grant.d.ts

package/dist/domain/capability-grant.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-grant.d.ts

package/dist/domain/capability-request.d.cts

@@ -1,8 +1,8 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-D4NNPLnp.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/capability-request.d.mts

@@ -1,8 +1,8 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqpG8VZZ.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/data-sync.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
+const require_sequential = require("../sequential-CtQVlW8M.cjs");
 //#region src/domain/data-sync.ts
 function headKey(peer) {
 	return `data/${require_domain_device_id.deviceIdToHex(peer)}/head`;
@@ -50,18 +51,28 @@ async function handleDataHave(storage, frame) {
 	};
 }
 /**
+* The entries stored for `peer` from sequence `first` to `last` inclusive, read one after another and cut at the first hole: a hole is a record missing from a range the head claims is held, which should not happen while entryKey and headKey stay consistent, and stopping there is better than returning a run with a silent gap that a receiver's own check would only catch after the fact. Keys past a hole are never read.
+*/
+async function readRun(storage, peer, first, last) {
+	const run = [];
+	const readFrom = async (seq) => {
+		if (seq > last) return;
+		const entry = await storage.get(entryKey(peer, seq));
+		if (entry === void 0) return;
+		run.push(entry);
+		await readFrom(seq + 1);
+	};
+	await readFrom(first);
+	return run;
+}
+/**
 * Handles an incoming data-request: the entries this store actually holds for `frame.peer` after `frame["from-seq"]`, capped at `limit`, or null if it holds none past that point. The responder need not be `frame.peer` itself -- any peer holding a replica may answer on the original author's behalf, per data-domain.cddl's own fan-out rule; this function makes no distinction.
 */
 async function handleDataRequest(storage, frame, limit) {
 	const ourHead = await readHeadSeq(storage, frame.peer);
 	if (ourHead <= frame["from-seq"]) return null;
 	const lastSeq = Math.min(ourHead, frame["from-seq"] + limit);
-	const entries = [];
-	for (let seq = frame["from-seq"] + 1; seq <= lastSeq; seq += 1) {
-		const entry = await storage.get(entryKey(frame.peer, seq));
-		if (entry === void 0) break;
-		entries.push(entry);
-	}
+	const entries = await readRun(storage, frame.peer, frame["from-seq"] + 1, lastSeq);
 	if (entries.length === 0) return null;
 	return {
 		type: "data-entries",
@@ -79,12 +90,10 @@ async function handleDataEntries(storage, frame) {
 		ok: false,
 		reason: "gap"
 	};
-	let seq = frame["from-seq"];
-	for (const entry of frame.entries) {
-		seq += 1;
-		await storage.set(entryKey(frame.peer, seq), entry);
-	}
-	await writeHeadSeq(storage, frame.peer, seq);
+	await require_sequential.eachInOrder(frame.entries, async (entry, index) => {
+		await storage.set(entryKey(frame.peer, frame["from-seq"] + 1 + index), entry);
+	});
+	await writeHeadSeq(storage, frame.peer, frame["from-seq"] + frame.entries.length);
 	return { ok: true };
 }
 /**
@@ -92,13 +101,7 @@ async function handleDataEntries(storage, frame) {
 */
 async function readEntries(storage, peer, fromSeqExclusive) {
 	const head = await readHeadSeq(storage, peer);
-	const entries = [];
-	for (let seq = fromSeqExclusive + 1; seq <= head; seq += 1) {
-		const entry = await storage.get(entryKey(peer, seq));
-		if (entry === void 0) break;
-		entries.push(entry);
-	}
-	return entries;
+	return readRun(storage, peer, fromSeqExclusive + 1, head);
 }
 //#endregion
 exports.appendOwnEntry = appendOwnEntry;

package/dist/domain/data-sync.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {

package/dist/domain/data-sync.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {

package/dist/domain/data-sync.mjs

@@ -1,4 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
+import { t as eachInOrder } from "../sequential-D_W3THly.mjs";
 //#region src/domain/data-sync.ts
 function headKey(peer) {
 	return `data/${deviceIdToHex(peer)}/head`;
@@ -49,18 +50,28 @@ async function handleDataHave(storage, frame) {
 	};
 }
 /**
+* The entries stored for `peer` from sequence `first` to `last` inclusive, read one after another and cut at the first hole: a hole is a record missing from a range the head claims is held, which should not happen while entryKey and headKey stay consistent, and stopping there is better than returning a run with a silent gap that a receiver's own check would only catch after the fact. Keys past a hole are never read.
+*/
+async function readRun(storage, peer, first, last) {
+	const run = [];
+	const readFrom = async (seq) => {
+		if (seq > last) return;
+		const entry = await storage.get(entryKey(peer, seq));
+		if (entry === void 0) return;
+		run.push(entry);
+		await readFrom(seq + 1);
+	};
+	await readFrom(first);
+	return run;
+}
+/**
 * Handles an incoming data-request: the entries this store actually holds for `frame.peer` after `frame["from-seq"]`, capped at `limit`, or null if it holds none past that point. The responder need not be `frame.peer` itself -- any peer holding a replica may answer on the original author's behalf, per data-domain.cddl's own fan-out rule; this function makes no distinction.
 */
 async function handleDataRequest(storage, frame, limit) {
 	const ourHead = await readHeadSeq(storage, frame.peer);
 	if (ourHead <= frame["from-seq"]) return null;
 	const lastSeq = Math.min(ourHead, frame["from-seq"] + limit);
-	const entries = [];
-	for (let seq = frame["from-seq"] + 1; seq <= lastSeq; seq += 1) {
-		const entry = await storage.get(entryKey(frame.peer, seq));
-		if (entry === void 0) break;
-		entries.push(entry);
-	}
+	const entries = await readRun(storage, frame.peer, frame["from-seq"] + 1, lastSeq);
 	if (entries.length === 0) return null;
 	return {
 		type: "data-entries",
@@ -78,12 +89,10 @@ async function handleDataEntries(storage, frame) {
 		ok: false,
 		reason: "gap"
 	};
-	let seq = frame["from-seq"];
-	for (const entry of frame.entries) {
-		seq += 1;
-		await storage.set(entryKey(frame.peer, seq), entry);
-	}
-	await writeHeadSeq(storage, frame.peer, seq);
+	await eachInOrder(frame.entries, async (entry, index) => {
+		await storage.set(entryKey(frame.peer, frame["from-seq"] + 1 + index), entry);
+	});
+	await writeHeadSeq(storage, frame.peer, frame["from-seq"] + frame.entries.length);
 	return { ok: true };
 }
 /**
@@ -91,13 +100,7 @@ async function handleDataEntries(storage, frame) {
 */
 async function readEntries(storage, peer, fromSeqExclusive) {
 	const head = await readHeadSeq(storage, peer);
-	const entries = [];
-	for (let seq = fromSeqExclusive + 1; seq <= head; seq += 1) {
-		const entry = await storage.get(entryKey(peer, seq));
-		if (entry === void 0) break;
-		entries.push(entry);
-	}
-	return entries;
+	return readRun(storage, peer, fromSeqExclusive + 1, head);
 }
 //#endregion
 export { appendOwnEntry, handleDataEntries, handleDataHave, handleDataRequest, headSeqFor, readEntries };

package/dist/domain/gossip-expansion.cjs

@@ -20,15 +20,21 @@ function createGossipExpansion(options) {
 			options.onExpansionDeclined?.(candidate);
 			return;
 		}
-		const errors = [];
-		for (const address of candidate.addresses) try {
+		await dialInOrder(candidate, candidate.addresses, []);
+	}
+	/** Dials the addresses one at a time, in order, stopping at the first that connects: a later address is only tried once every earlier one has failed, and when none connects the failures, in order, are reported through `onExpansionFailed`. */
+	async function dialInOrder(candidate, addresses, failures) {
+		const [address, ...remaining] = addresses;
+		if (address === void 0) {
+			options.onExpansionFailed?.(candidate, failures);
+			return;
+		}
+		try {
 			const session = await options.dial(address);
 			options.onExpanded(candidate, address, session);
-			return;
 		} catch (error) {
-			errors.push(toError(error));
+			await dialInOrder(candidate, remaining, [...failures, toError(error)]);
 		}
-		options.onExpansionFailed?.(candidate, errors);
 	}
 	return { considerAdvert(advert) {
 		const hex = require_domain_device_id.deviceIdToHex(advert.device);

package/dist/domain/gossip-expansion.mjs

@@ -19,15 +19,21 @@ function createGossipExpansion(options) {
 			options.onExpansionDeclined?.(candidate);
 			return;
 		}
-		const errors = [];
-		for (const address of candidate.addresses) try {
+		await dialInOrder(candidate, candidate.addresses, []);
+	}
+	/** Dials the addresses one at a time, in order, stopping at the first that connects: a later address is only tried once every earlier one has failed, and when none connects the failures, in order, are reported through `onExpansionFailed`. */
+	async function dialInOrder(candidate, addresses, failures) {
+		const [address, ...remaining] = addresses;
+		if (address === void 0) {
+			options.onExpansionFailed?.(candidate, failures);
+			return;
+		}
+		try {
 			const session = await options.dial(address);
 			options.onExpanded(candidate, address, session);
-			return;
 		} catch (error) {
-			errors.push(toError(error));
+			await dialInOrder(candidate, remaining, [...failures, toError(error)]);
 		}
-		options.onExpansionFailed?.(candidate, errors);
 	}
 	return { considerAdvert(advert) {
 		const hex = deviceIdToHex(advert.device);

package/dist/domain/hub-mailbox.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {
   /** How many devices' logs the mailbox will hold at once. */

package/dist/domain/hub-mailbox.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {
   /** How many devices' logs the mailbox will hold at once. */