wire-mesh-core 4.0.4 → 4.0.6

package/dist/adapters/node-identity.cjs

@@ -3,6 +3,16 @@ let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
 const EDDSA = -8;
+/** An ES256 public key is an uncompressed SEC1 P-256 point: a 0x04 prefix, then the 32-byte X and Y coordinates. */
+const ES256_PUBLIC_KEY_BYTES = 65;
+/** An Ed25519 public key is its 32-byte compressed point. */
+const EDDSA_PUBLIC_KEY_BYTES = 32;
+/** The exact size of a public key for `alg`, throwing for an algorithm no verifier here implements. */
+function publicKeySize(alg) {
+	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
+	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
 function algParams(alg) {
 	if (alg === ES256) return {
 		name: "ECDSA",
@@ -15,7 +25,35 @@ function algParams(alg) {
 function toBufferSource(bytes) {
 	return Uint8Array.from(bytes);
 }
+/**
+* How many imported verification keys are kept. An imported key is a handle to a few dozen bytes of key material (only a key that imported successfully is kept, and a valid ES256 or Ed25519 public key is fixed-size), so the bound is on count: well above the devices of any plausible local mesh, so a mesh gossiping every few seconds finds its keys already imported rather than re-importing one per advert.
+*/
+const IMPORTED_KEY_CAPACITY = 1024;
+/** Least recently used first, by Map insertion order. Holds the pending promise so concurrent verifications of one device import its key once. */
+const importedKeys = /* @__PURE__ */ new Map();
+/** Equal for two identity-keys exactly when algorithm and key bytes are equal. */
+function importedKeyId(key) {
+	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
+}
 async function importPublicKey(key) {
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	const id = importedKeyId(key);
+	const held = importedKeys.get(id);
+	if (held !== void 0) {
+		importedKeys.delete(id);
+		importedKeys.set(id, held);
+		return held;
+	}
+	const pending = importPublicKeyUncached(key);
+	importedKeys.set(id, pending);
+	pending.catch(() => importedKeys.delete(id));
+	for (const oldest of importedKeys.keys()) {
+		if (importedKeys.size <= IMPORTED_KEY_CAPACITY) break;
+		importedKeys.delete(oldest);
+	}
+	return pending;
+}
+async function importPublicKeyUncached(key) {
 	if (key.alg === ES256) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
 		name: "ECDSA",
 		namedCurve: "P-256"

package/dist/adapters/node-identity.mjs

@@ -2,6 +2,16 @@ import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
 const EDDSA = -8;
+/** An ES256 public key is an uncompressed SEC1 P-256 point: a 0x04 prefix, then the 32-byte X and Y coordinates. */
+const ES256_PUBLIC_KEY_BYTES = 65;
+/** An Ed25519 public key is its 32-byte compressed point. */
+const EDDSA_PUBLIC_KEY_BYTES = 32;
+/** The exact size of a public key for `alg`, throwing for an algorithm no verifier here implements. */
+function publicKeySize(alg) {
+	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
+	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
 function algParams(alg) {
 	if (alg === ES256) return {
 		name: "ECDSA",
@@ -14,7 +24,35 @@ function algParams(alg) {
 function toBufferSource(bytes) {
 	return Uint8Array.from(bytes);
 }
+/**
+* How many imported verification keys are kept. An imported key is a handle to a few dozen bytes of key material (only a key that imported successfully is kept, and a valid ES256 or Ed25519 public key is fixed-size), so the bound is on count: well above the devices of any plausible local mesh, so a mesh gossiping every few seconds finds its keys already imported rather than re-importing one per advert.
+*/
+const IMPORTED_KEY_CAPACITY = 1024;
+/** Least recently used first, by Map insertion order. Holds the pending promise so concurrent verifications of one device import its key once. */
+const importedKeys = /* @__PURE__ */ new Map();
+/** Equal for two identity-keys exactly when algorithm and key bytes are equal. */
+function importedKeyId(key) {
+	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
+}
 async function importPublicKey(key) {
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	const id = importedKeyId(key);
+	const held = importedKeys.get(id);
+	if (held !== void 0) {
+		importedKeys.delete(id);
+		importedKeys.set(id, held);
+		return held;
+	}
+	const pending = importPublicKeyUncached(key);
+	importedKeys.set(id, pending);
+	pending.catch(() => importedKeys.delete(id));
+	for (const oldest of importedKeys.keys()) {
+		if (importedKeys.size <= IMPORTED_KEY_CAPACITY) break;
+		importedKeys.delete(oldest);
+	}
+	return pending;
+}
+async function importPublicKeyUncached(key) {
 	if (key.alg === ES256) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
 		name: "ECDSA",
 		namedCurve: "P-256"

package/dist/domain/mesh-session.cjs

@@ -494,7 +494,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "gossip") {
 			const verdicts = await Promise.all(frame.peers.map(async (advert) => require_domain_peer_advert.verifyPeerAdvert(identity, advert)));
 			for (const advert of frame.peers.filter((_, i) => verdicts[i] === true)) {
-				directory.set(require_domain_device_id.deviceIdToHex(advert.device), {
+				const deviceHex = require_domain_device_id.deviceIdToHex(advert.device);
+				const held = directory.get(deviceHex)?.advert["snapshot-seconds"];
+				if (held !== void 0 && advert["snapshot-seconds"] < held) continue;
+				directory.set(deviceHex, {
 					device: advert.device,
 					advert
 				});

package/dist/domain/mesh-session.mjs

@@ -493,7 +493,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		else if (frame.type === "gossip") {
 			const verdicts = await Promise.all(frame.peers.map(async (advert) => verifyPeerAdvert(identity, advert)));
 			for (const advert of frame.peers.filter((_, i) => verdicts[i] === true)) {
-				directory.set(deviceIdToHex(advert.device), {
+				const deviceHex = deviceIdToHex(advert.device);
+				const held = directory.get(deviceHex)?.advert["snapshot-seconds"];
+				if (held !== void 0 && advert["snapshot-seconds"] < held) continue;
+				directory.set(deviceHex, {
 					device: advert.device,
 					advert
 				});

package/dist/domain/peer-advert.cjs

@@ -1,7 +1,26 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_verdict_cache = require("./verdict-cache.cjs");
 let cbor2 = require("cbor2");
 //#region src/domain/peer-advert.ts
+const BYTES_PER_KIBIBYTE = 1024;
+/**
+* The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+*
+* A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+*/
+const PEER_ADVERT_VERDICT_BUDGET_BYTES = 8 * (BYTES_PER_KIBIBYTE * BYTES_PER_KIBIBYTE);
+/**
+* One memo per verifier object, held weakly so it lives exactly as long as the identity it serves. A verdict is a pure function of the advert's own bytes (the key and the signature both travel inside it), so every session and hub sharing one verifier shares the answers, and a fresh verifier (a test's fake, a second node identity) starts cold rather than inheriting another's.
+*/
+const verdictCaches = /* @__PURE__ */ new WeakMap();
+function verdictCacheFor(identity) {
+	const existing = verdictCaches.get(identity);
+	if (existing !== void 0) return existing;
+	const created = require_domain_verdict_cache.createVerdictCache(PEER_ADVERT_VERDICT_BUDGET_BYTES);
+	verdictCaches.set(identity, created);
+	return created;
+}
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -41,21 +60,34 @@ async function signPeerAdvert(identity, advert) {
 * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
 *
 * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+*
+* A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
 */
 async function verifyPeerAdvert(identity, advert) {
+	let signedBytes;
+	try {
+		signedBytes = peerAdvertSigningInput(advert);
+	} catch {
+		return false;
+	}
+	return verdictCacheFor(identity).verdict([advert[PEER_ADVERT_SIGNATURE_KEY], signedBytes], async () => checkPeerAdvert(identity, advert, signedBytes));
+}
+/** The uncached checks: true or false when they reached a verdict, undefined when verifying threw. */
+async function checkPeerAdvert(identity, advert, signedBytes) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
 		if (!require_domain_token_scope.bytesEqual(derived, advert.device)) return false;
-		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
+		return await identity.verify(key, signedBytes, advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
-		return false;
+		return;
 	}
 }
 //#endregion
 exports.PEER_ADVERT_IDENTITY_KEY_KEY = PEER_ADVERT_IDENTITY_KEY_KEY;
 exports.PEER_ADVERT_SIGNATURE_KEY = PEER_ADVERT_SIGNATURE_KEY;
 exports.PEER_ADVERT_SIGNING_CONTEXT = PEER_ADVERT_SIGNING_CONTEXT;
+exports.PEER_ADVERT_VERDICT_BUDGET_BYTES = PEER_ADVERT_VERDICT_BUDGET_BYTES;
 exports.peerAdvertSigningInput = peerAdvertSigningInput;
 exports.signPeerAdvert = signPeerAdvert;
 exports.verifyPeerAdvert = verifyPeerAdvert;

package/dist/domain/peer-advert.d.cts

@@ -1,6 +1,12 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/peer-advert.d.ts
+/**
+ * The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+ *
+ * A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+ */
+export declare const PEER_ADVERT_VERDICT_BUDGET_BYTES: number;
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,6 +46,8 @@ export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, adv
  * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
  *
  * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ *
+ * A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
  */
 export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
 //#endregion

package/dist/domain/peer-advert.d.mts

@@ -1,6 +1,12 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/peer-advert.d.ts
+/**
+ * The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+ *
+ * A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+ */
+export declare const PEER_ADVERT_VERDICT_BUDGET_BYTES: number;
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 export declare const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,6 +46,8 @@ export declare function signPeerAdvert(identity: Readonly<PeerAdvertSigner>, adv
  * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
  *
  * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+ *
+ * A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
  */
 export declare function verifyPeerAdvert(identity: Readonly<PeerAdvertVerifier>, advert: Readonly<PeerAdvert>): Promise<boolean>;
 //#endregion

package/dist/domain/peer-advert.mjs

@@ -1,6 +1,25 @@
 import { bytesEqual } from "./token-scope.mjs";
+import { createVerdictCache } from "./verdict-cache.mjs";
 import { cdeEncodeOptions, encode } from "cbor2";
 //#region src/domain/peer-advert.ts
+const BYTES_PER_KIBIBYTE = 1024;
+/**
+* The most a verifier's verdict memo may charge across all its entries, in bytes of key.
+*
+* A key is a signature plus the signed bytes, so an honest advert (a device id, a few addresses, a handful of gossip extensions) costs on the order of a kilobyte and this budget holds the current advert of every device a large local mesh gossips, plus the several generations a hub's catch-up frames can still replay. It is a budget in bytes rather than a count of entries because the signed bytes are attacker-sized up to the frame limit: a count would let a hostile peer pin that many frames in memory, where a byte budget makes the worst case this figure and refuses to keep any single advert larger than it.
+*/
+const PEER_ADVERT_VERDICT_BUDGET_BYTES = 8 * (BYTES_PER_KIBIBYTE * BYTES_PER_KIBIBYTE);
+/**
+* One memo per verifier object, held weakly so it lives exactly as long as the identity it serves. A verdict is a pure function of the advert's own bytes (the key and the signature both travel inside it), so every session and hub sharing one verifier shares the answers, and a fresh verifier (a test's fake, a second node identity) starts cold rather than inheriting another's.
+*/
+const verdictCaches = /* @__PURE__ */ new WeakMap();
+function verdictCacheFor(identity) {
+	const existing = verdictCaches.get(identity);
+	if (existing !== void 0) return existing;
+	const created = createVerdictCache(PEER_ADVERT_VERDICT_BUDGET_BYTES);
+	verdictCaches.set(identity, created);
+	return created;
+}
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
 const PEER_ADVERT_SIGNATURE_KEY = "signature";
 /** peer-advert's own self-certifying key field. Covered by the signature like every other entry, so an advert cannot be re-keyed after signing. */
@@ -40,16 +59,28 @@ async function signPeerAdvert(identity, advert) {
 * Both validity checks spec/transport.cddl states for a gossiped advert, in the order a verifier must apply them: the embedded identity-key self-certifies (sha256 of its public-key equals the advert's own `device`), and the signature verifies under that same key over peerAdvertSigningInput's bytes.
 *
 * Returns a verdict for every input, including a hostile one, and never throws. An advert's `alg` and `public-key` are attacker-chosen (identity-key constrains them to an int and a bstr, nothing more), so importing the key can legitimately fail for an algorithm no verifier implements or for key bytes of the wrong length. An unverifiable advert is a refused advert, exactly as if its signature had simply been wrong, which is why the import failure is turned into `false` here rather than propagated to a caller iterating a frame's other adverts.
+*
+* A hub re-broadcasts every advert it accepts to every other client and replays the whole directory to each sender, so one advert reaches a receiver several times and a mesh of N devices checks each advert on the order of N times per receiver. The two checks are pure functions of the advert's bytes, so the verdict for a given signature over given signed bytes is remembered (see PEER_ADVERT_VERDICT_BUDGET_BYTES) and a repeat costs one encoding rather than two digests and a public-key import and verification. Only a verdict the checks reached is remembered, a refusal included; a check that threw is not, because the same bytes might verify on a later attempt.
 */
 async function verifyPeerAdvert(identity, advert) {
+	let signedBytes;
+	try {
+		signedBytes = peerAdvertSigningInput(advert);
+	} catch {
+		return false;
+	}
+	return verdictCacheFor(identity).verdict([advert[PEER_ADVERT_SIGNATURE_KEY], signedBytes], async () => checkPeerAdvert(identity, advert, signedBytes));
+}
+/** The uncached checks: true or false when they reached a verdict, undefined when verifying threw. */
+async function checkPeerAdvert(identity, advert, signedBytes) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
 		if (!bytesEqual(derived, advert.device)) return false;
-		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
+		return await identity.verify(key, signedBytes, advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
-		return false;
+		return;
 	}
 }
 //#endregion
-export { PEER_ADVERT_IDENTITY_KEY_KEY, PEER_ADVERT_SIGNATURE_KEY, PEER_ADVERT_SIGNING_CONTEXT, peerAdvertSigningInput, signPeerAdvert, verifyPeerAdvert };
+export { PEER_ADVERT_IDENTITY_KEY_KEY, PEER_ADVERT_SIGNATURE_KEY, PEER_ADVERT_SIGNING_CONTEXT, PEER_ADVERT_VERDICT_BUDGET_BYTES, peerAdvertSigningInput, signPeerAdvert, verifyPeerAdvert };

package/dist/domain/verdict-cache.cjs

@@ -0,0 +1,80 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/verdict-cache.ts
+/** Characters appended to a key's byte length when charging an entry to the budget: the cached promise and the map slot are not free, so an entry of zero key bytes still costs something. Sized as one pointer pair on a 64-bit runtime. */
+const ENTRY_OVERHEAD_BYTES = 16;
+/** The most characters String.fromCharCode may be given as arguments in one call without overflowing an engine's argument limit. */
+const FROM_CHAR_CODE_CHUNK = 4096;
+/**
+* How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+*/
+function bytesKeyLength(parts) {
+	let length = 0;
+	for (const part of parts) length += String(part.length).length + 1 + part.length;
+	return length;
+}
+/**
+* A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+*/
+function bytesKey(...parts) {
+	let key = "";
+	for (const part of parts) {
+		key += `${String(part.length)}:`;
+		for (let start = 0; start < part.length; start += FROM_CHAR_CODE_CHUNK) key += String.fromCharCode(...part.subarray(start, start + FROM_CHAR_CODE_CHUNK));
+	}
+	return key;
+}
+/** An outcome that was not kept: the check's verdict, or false when it did not reach one. */
+async function unsettledAsRefusal(compute) {
+	return await compute() ?? false;
+}
+/**
+* Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+*/
+function createVerdictCache(budgetBytes) {
+	const entries = /* @__PURE__ */ new Map();
+	let used = 0;
+	/** Key bytes charged to verdicts still being computed. An entry evicted while its verdict is pending is gone from `entries`, but the computation still holds its key until it settles, so `used` alone would let many concurrent large inputs each keep a key the budget no longer sees. */
+	let pending = 0;
+	const forget = (key) => {
+		const entry = entries.get(key);
+		if (entry === void 0) return;
+		entries.delete(key);
+		used -= entry.cost;
+	};
+	return { async verdict(parts, compute) {
+		const cost = bytesKeyLength(parts) + ENTRY_OVERHEAD_BYTES;
+		if (cost > budgetBytes) return unsettledAsRefusal(compute);
+		if (pending + cost > budgetBytes) return unsettledAsRefusal(compute);
+		const key = bytesKey(...parts);
+		const held = entries.get(key);
+		if (held !== void 0) {
+			entries.delete(key);
+			entries.set(key, held);
+			return held.settled;
+		}
+		pending += cost;
+		const settled = compute().then((outcome) => {
+			if (outcome === void 0) {
+				forget(key);
+				return false;
+			}
+			return outcome;
+		}).finally(() => {
+			pending -= cost;
+		});
+		entries.set(key, {
+			settled,
+			cost
+		});
+		used += cost;
+		for (const oldest of entries.keys()) {
+			if (used <= budgetBytes) break;
+			forget(oldest);
+		}
+		return settled;
+	} };
+}
+//#endregion
+exports.bytesKey = bytesKey;
+exports.bytesKeyLength = bytesKeyLength;
+exports.createVerdictCache = createVerdictCache;

package/dist/domain/verdict-cache.d.cts

@@ -0,0 +1,25 @@
+//#region src/domain/verdict-cache.d.ts
+/**
+ * How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+ */
+export declare function bytesKeyLength(parts: readonly Uint8Array[]): number;
+/**
+ * A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+ */
+export declare function bytesKey(...parts: readonly Uint8Array[]): string;
+/** A memo of in-flight and settled verdicts keyed by an opaque string. */
+export interface VerdictCache {
+  /**
+   * The verdict for the bytes in `parts`, computing it with `compute` only when no live entry holds one. A concurrent caller for the same bytes shares the first caller's computation rather than starting another.
+   *
+   * The key is built from `parts` only when the entry would fit the budget, counting the keys of verdicts still being computed: an input that would not fit is computed and never keyed, so neither one attacker-sized input nor many concurrent ones cost more than computing their verdicts directly, with no copy of them as strings.
+   *
+   * `compute` resolves to a verdict to remember, or to `undefined` when the outcome was an error that a later attempt might not repeat: that outcome is returned to every waiting caller as `false` (the check did not succeed) but is not kept, so a transient failure is retried instead of being remembered as a refusal.
+   */
+  verdict: (parts: readonly Uint8Array[], compute: () => Promise<boolean | undefined>) => Promise<boolean>;
+}
+/**
+ * Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+ */
+export declare function createVerdictCache(budgetBytes: number): VerdictCache;
+//#endregion

package/dist/domain/verdict-cache.d.mts

@@ -0,0 +1,25 @@
+//#region src/domain/verdict-cache.d.ts
+/**
+ * How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+ */
+export declare function bytesKeyLength(parts: readonly Uint8Array[]): number;
+/**
+ * A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+ */
+export declare function bytesKey(...parts: readonly Uint8Array[]): string;
+/** A memo of in-flight and settled verdicts keyed by an opaque string. */
+export interface VerdictCache {
+  /**
+   * The verdict for the bytes in `parts`, computing it with `compute` only when no live entry holds one. A concurrent caller for the same bytes shares the first caller's computation rather than starting another.
+   *
+   * The key is built from `parts` only when the entry would fit the budget, counting the keys of verdicts still being computed: an input that would not fit is computed and never keyed, so neither one attacker-sized input nor many concurrent ones cost more than computing their verdicts directly, with no copy of them as strings.
+   *
+   * `compute` resolves to a verdict to remember, or to `undefined` when the outcome was an error that a later attempt might not repeat: that outcome is returned to every waiting caller as `false` (the check did not succeed) but is not kept, so a transient failure is retried instead of being remembered as a refusal.
+   */
+  verdict: (parts: readonly Uint8Array[], compute: () => Promise<boolean | undefined>) => Promise<boolean>;
+}
+/**
+ * Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+ */
+export declare function createVerdictCache(budgetBytes: number): VerdictCache;
+//#endregion

package/dist/domain/verdict-cache.mjs

@@ -0,0 +1,77 @@
+//#region src/domain/verdict-cache.ts
+/** Characters appended to a key's byte length when charging an entry to the budget: the cached promise and the map slot are not free, so an entry of zero key bytes still costs something. Sized as one pointer pair on a 64-bit runtime. */
+const ENTRY_OVERHEAD_BYTES = 16;
+/** The most characters String.fromCharCode may be given as arguments in one call without overflowing an engine's argument limit. */
+const FROM_CHAR_CODE_CHUNK = 4096;
+/**
+* How many characters bytesKey produces for these parts: each part's length in decimal, a colon, then one character per byte. Computed from the lengths alone, so a caller can refuse an oversized input before any character of its key exists.
+*/
+function bytesKeyLength(parts) {
+	let length = 0;
+	for (const part of parts) length += String(part.length).length + 1 + part.length;
+	return length;
+}
+/**
+* A string that is equal for two byte sequences exactly when the sequences are equal: one character per byte, so a Map can key on it without hashing or comparing byte arrays itself.
+*/
+function bytesKey(...parts) {
+	let key = "";
+	for (const part of parts) {
+		key += `${String(part.length)}:`;
+		for (let start = 0; start < part.length; start += FROM_CHAR_CODE_CHUNK) key += String.fromCharCode(...part.subarray(start, start + FROM_CHAR_CODE_CHUNK));
+	}
+	return key;
+}
+/** An outcome that was not kept: the check's verdict, or false when it did not reach one. */
+async function unsettledAsRefusal(compute) {
+	return await compute() ?? false;
+}
+/**
+* Builds a memo whose entries together never charge more than `budgetBytes`. The least recently used entry goes first when a new one would overflow; an input whose key is larger than the whole budget is computed but never kept, so one hostile oversized input cannot flush everything else.
+*/
+function createVerdictCache(budgetBytes) {
+	const entries = /* @__PURE__ */ new Map();
+	let used = 0;
+	/** Key bytes charged to verdicts still being computed. An entry evicted while its verdict is pending is gone from `entries`, but the computation still holds its key until it settles, so `used` alone would let many concurrent large inputs each keep a key the budget no longer sees. */
+	let pending = 0;
+	const forget = (key) => {
+		const entry = entries.get(key);
+		if (entry === void 0) return;
+		entries.delete(key);
+		used -= entry.cost;
+	};
+	return { async verdict(parts, compute) {
+		const cost = bytesKeyLength(parts) + ENTRY_OVERHEAD_BYTES;
+		if (cost > budgetBytes) return unsettledAsRefusal(compute);
+		if (pending + cost > budgetBytes) return unsettledAsRefusal(compute);
+		const key = bytesKey(...parts);
+		const held = entries.get(key);
+		if (held !== void 0) {
+			entries.delete(key);
+			entries.set(key, held);
+			return held.settled;
+		}
+		pending += cost;
+		const settled = compute().then((outcome) => {
+			if (outcome === void 0) {
+				forget(key);
+				return false;
+			}
+			return outcome;
+		}).finally(() => {
+			pending -= cost;
+		});
+		entries.set(key, {
+			settled,
+			cost
+		});
+		used += cost;
+		for (const oldest of entries.keys()) {
+			if (used <= budgetBytes) break;
+			forget(oldest);
+		}
+		return settled;
+	} };
+}
+//#endregion
+export { bytesKey, bytesKeyLength, createVerdictCache };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.0.4",
+  "version": "4.0.6",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -214,6 +214,10 @@
       "import": "./dist/domain/topology-snapshot.mjs",
       "require": "./dist/domain/topology-snapshot.cjs"
     },
+    "./domain/verdict-cache": {
+      "import": "./dist/domain/verdict-cache.mjs",
+      "require": "./dist/domain/verdict-cache.cjs"
+    },
     "./domain/webrtc-signaling": {
       "import": "./dist/domain/webrtc-signaling.mjs",
       "require": "./dist/domain/webrtc-signaling.cjs"