wire-mesh-core 4.0.8 → 4.1.0

package/dist/adapters/node-identity.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_ports_identity = require("../ports/identity.cjs");
 let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
@@ -11,7 +12,7 @@ const EDDSA_PUBLIC_KEY_BYTES = 32;
 function publicKeySize(alg) {
 	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
 	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 function algParams(alg) {
 	if (alg === ES256) return {
@@ -19,7 +20,7 @@ function algParams(alg) {
 		hash: "SHA-256"
 	};
 	if (alg === EDDSA) return { name: "Ed25519" };
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 /** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
 function toBufferSource(bytes) {
@@ -36,7 +37,7 @@ function importedKeyId(key) {
 	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
 }
 async function importPublicKey(key) {
-	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -53,13 +54,21 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+async function importRawPublicKey(key, algorithm) {
+	try {
+		return await node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
+	} catch (cause) {
+		throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key does not import as an alg ${String(key.alg)} key`, { cause });
+	}
+}
 async function importPublicKeyUncached(key) {
-	if (key.alg === ES256) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+	if (key.alg === ES256) return importRawPublicKey(key, {
 		name: "ECDSA",
 		namedCurve: "P-256"
-	}, false, ["verify"]);
-	if (key.alg === EDDSA) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
-	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+	});
+	if (key.alg === EDDSA) return importRawPublicKey(key, { name: "Ed25519" });
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(key.alg)}`);
 }
 async function deriveDeviceId(publicKey) {
 	return new Uint8Array(await node_crypto.webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.mjs

@@ -1,3 +1,4 @@
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
@@ -10,7 +11,7 @@ const EDDSA_PUBLIC_KEY_BYTES = 32;
 function publicKeySize(alg) {
 	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
 	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 function algParams(alg) {
 	if (alg === ES256) return {
@@ -18,7 +19,7 @@ function algParams(alg) {
 		hash: "SHA-256"
 	};
 	if (alg === EDDSA) return { name: "Ed25519" };
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 /** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
 function toBufferSource(bytes) {
@@ -35,7 +36,7 @@ function importedKeyId(key) {
 	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
 }
 async function importPublicKey(key) {
-	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -52,13 +53,21 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+async function importRawPublicKey(key, algorithm) {
+	try {
+		return await webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
+	} catch (cause) {
+		throw new IdentityKeyError("invalid_key", `identity-key public-key does not import as an alg ${String(key.alg)} key`, { cause });
+	}
+}
 async function importPublicKeyUncached(key) {
-	if (key.alg === ES256) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+	if (key.alg === ES256) return importRawPublicKey(key, {
 		name: "ECDSA",
 		namedCurve: "P-256"
-	}, false, ["verify"]);
-	if (key.alg === EDDSA) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
-	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+	});
+	if (key.alg === EDDSA) return importRawPublicKey(key, { name: "Ed25519" });
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(key.alg)}`);
 }
 async function deriveDeviceId(publicKey) {
 	return new Uint8Array(await webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";

package/dist/domain/channel-exhausted-error.cjs

@@ -0,0 +1,11 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/channel-exhausted-error.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+var ChannelExhaustedError = class extends Error {
+	constructor() {
+		super("the channel's send counter is exhausted");
+		this.name = "ChannelExhaustedError";
+	}
+};
+//#endregion
+exports.ChannelExhaustedError = ChannelExhaustedError;

package/dist/domain/channel-exhausted-error.d.cts

@@ -0,0 +1,6 @@
+//#region src/domain/channel-exhausted-error.d.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+export declare class ChannelExhaustedError extends Error {
+  constructor();
+}
+//#endregion

package/dist/domain/channel-exhausted-error.d.mts

@@ -0,0 +1,6 @@
+//#region src/domain/channel-exhausted-error.d.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+export declare class ChannelExhaustedError extends Error {
+  constructor();
+}
+//#endregion

package/dist/domain/channel-exhausted-error.mjs

@@ -0,0 +1,10 @@
+//#region src/domain/channel-exhausted-error.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+var ChannelExhaustedError = class extends Error {
+	constructor() {
+		super("the channel's send counter is exhausted");
+		this.name = "ChannelExhaustedError";
+	}
+};
+//#endregion
+export { ChannelExhaustedError };

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/handshake.cjs

@@ -2,6 +2,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/domain/handshake.ts
 /** The highest protocol version this build of core understands. */
 const SUPPORTED_PROTOCOL_VERSION = 1;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+function localHandshake(domains) {
+	return {
+		type: "handshake",
+		version: 1,
+		domains: [...domains]
+	};
+}
 /**
 * Domain names that must never be negotiated, per handshake.cddl: core/federation is retired (its string stays reserved, never reused) and "a peer must never advertise or negotiate it". Excluded here even if both peers advertise it -- two buggy advertisers must not end up speaking a dead domain.
 */
@@ -20,4 +28,5 @@ function negotiate(local, remote) {
 }
 //#endregion
 exports.SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSION;
+exports.localHandshake = localHandshake;
 exports.negotiate = negotiate;

package/dist/domain/handshake.d.cts

@@ -2,6 +2,8 @@ import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../pr
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+export declare function localHandshake(domains: readonly string[]): HandshakeFrame;
 export interface NegotiationResult {
   ok: boolean;
   /** The version both peers will speak for the rest of the session -- the lower of the two offered versions, so a peer never has to understand a frame shape it didn't advertise. */

package/dist/domain/handshake.d.mts

@@ -2,6 +2,8 @@ import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../pr
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+export declare function localHandshake(domains: readonly string[]): HandshakeFrame;
 export interface NegotiationResult {
   ok: boolean;
   /** The version both peers will speak for the rest of the session -- the lower of the two offered versions, so a peer never has to understand a frame shape it didn't advertise. */

package/dist/domain/handshake.mjs

@@ -1,6 +1,14 @@
 //#region src/domain/handshake.ts
 /** The highest protocol version this build of core understands. */
 const SUPPORTED_PROTOCOL_VERSION = 1;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+function localHandshake(domains) {
+	return {
+		type: "handshake",
+		version: 1,
+		domains: [...domains]
+	};
+}
 /**
 * Domain names that must never be negotiated, per handshake.cddl: core/federation is retired (its string stays reserved, never reused) and "a peer must never advertise or negotiate it". Excluded here even if both peers advertise it -- two buggy advertisers must not end up speaking a dead domain.
 */
@@ -18,4 +26,4 @@ function negotiate(local, remote) {
 	};
 }
 //#endregion
-export { SUPPORTED_PROTOCOL_VERSION, negotiate };
+export { SUPPORTED_PROTOCOL_VERSION, localHandshake, negotiate };

package/dist/domain/mesh-session.cjs

@@ -1,10 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
+const require_domain_channel_exhausted_error = require("./channel-exhausted-error.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_domain_hub_mailbox = require("./hub-mailbox.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
@@ -27,6 +29,19 @@ function createRelayPairings() {
 	};
 }
 //#endregion
+//#region src/domain/bounded-log.ts
+/** A log that keeps only its most recent `window` entries: newest at the end, the oldest dropped once the window is full. Pure and closure-free, split out of mesh-session.ts to keep that file under this repo's max-lines lint budget; nothing here is session-shaped. */
+function createBoundedLog(window) {
+	const log = [];
+	return {
+		record: (entry) => {
+			log.push(entry);
+			if (log.length > window) log.splice(0, log.length - window);
+		},
+		entries: () => [...log]
+	};
+}
+//#endregion
 //#region src/domain/secure-channel.ts
 /**
 * The end-to-end channel two devices open between themselves inside a relay pairing (spec/secure-channel.cddl). A relay only forwards the bytes of a `relay-data` frame, and without this it could read them, alter them, and say who sent them. Here the two devices authenticate each other's identity keys over a fresh ECDH exchange, derive one AES-256-GCM key per direction, and seal every frame they exchange so the relay sees ciphertext and every receiver learns the sender's identity from the handshake and nothing a relay asserts.
@@ -96,16 +111,16 @@ async function beginHandshake(identity, peer) {
 	};
 }
 /**
-* Checks a received hello: its identity key must hash to a device-id (which is then the peer), it must be addressed to this device, and its signature must verify under that key over the input spec/secure-channel.cddl defines. Never throws: a hostile hello gets a verdict.
+* Checks a received hello: it must be addressed to this device, its identity key must be a usable key, and its signature must verify under that key over the input spec/secure-channel.cddl defines. A hostile hello gets a verdict. An error from the identity port that is not an IdentityKeyError is a failure of the port, not a verdict about the peer, and propagates.
 */
 async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
+	const sender = await identity.deriveDeviceId(key["public-key"]);
+	if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
+		ok: false,
+		reason: "wrong_recipient"
+	};
 	try {
-		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
-			ok: false,
-			reason: "wrong_recipient"
-		};
 		return await identity.verify(key, helloSigningInput(hello["ephemeral-key"], hello.nonce, sender, identity.deviceId), hello.signature) ? {
 			ok: true,
 			peer: {
@@ -116,13 +131,30 @@ async function verifyHello(identity, hello) {
 			ok: false,
 			reason: "bad_signature"
 		};
-	} catch {
+	} catch (error) {
+		if (!(error instanceof require_ports_identity.IdentityKeyError)) throw error;
 		return {
 			ok: false,
-			reason: "identity_mismatch"
+			reason: error.fault === "unsupported_alg" ? "unsupported_identity_alg" : "invalid_identity_key"
 		};
 	}
 }
+/** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
+const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
+/** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
+function assertFirstSendCounter(counter) {
+	if (!Number.isSafeInteger(counter) || counter < 0) throw new RangeError("firstSendCounter must be a non-negative safe integer");
+}
+/**
+* Takes the next send counter from `next`, the counter the next seal would use: returns it with the counter that follows. Throws once `next` is past MAX_COUNTER, since a counter that cannot be held exactly would repeat an IV under the same key.
+*/
+function claimSendCounter(next) {
+	if (next > MAX_COUNTER) throw new require_domain_channel_exhausted_error.ChannelExhaustedError();
+	return {
+		counter: next,
+		next: next + 1
+	};
+}
 function ivFor(counter) {
 	const iv = new Uint8Array(GCM_IV_BYTE_LENGTH);
 	iv.set(counterBytes(counter), IV_COUNTER_OFFSET);
@@ -144,11 +176,10 @@ async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	}, false, ["encrypt", "decrypt"]);
 }
 /**
-* Completes a handshake once the peer's hello has verified: derives the two directional keys from the ECDH result of the ephemeral keys and returns the channel. Returns undefined when the peer's ephemeral key is not a valid P-256 point, which only a hostile or broken peer sends.
-*
-* `peer` is the device verifyHello authenticated for `remote`, and `pending` is this side's own half, whether the handshake was begun here or in answer to that hello.
+* establishChannel with its inputs in one object, and the one extra that tests need: where this end's send counter starts. This module is not a published entry (it is in tsdown.config.ts's INTERNAL_MODULES) and the session never passes `firstSendCounter`, so every real channel starts at 0; a test passes a counter near MAX_COUNTER to reach the bound without sealing 2^53 frames.
 */
-async function establishChannel(identity, pending, remote, peer) {
+async function establishChannelFrom(identity, { pending, remote, peer, firstSendCounter = 0 }) {
+	assertFirstSendCounter(firstSendCounter);
 	let secret;
 	try {
 		const remoteKey = await crypto.subtle.importKey("raw", Uint8Array.from(remote["ephemeral-key"]), ECDH_PARAMS, false, []);
@@ -179,7 +210,7 @@ async function establishChannel(identity, pending, remote, peer) {
 	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
-	let nextSendCounter = 0;
+	let nextSendCounter = firstSendCounter;
 	let highestReceived = -1;
 	let sealing = Promise.resolve();
 	let opening = Promise.resolve();
@@ -195,7 +226,10 @@ async function establishChannel(identity, pending, remote, peer) {
 		};
 	}
 	async function openOne(data) {
-		if (data.counter <= highestReceived) return void 0;
+		if (data.counter <= highestReceived) return {
+			ok: false,
+			reason: "replayed"
+		};
 		let plaintext;
 		try {
 			plaintext = new Uint8Array(await crypto.subtle.decrypt({
@@ -204,30 +238,47 @@ async function establishChannel(identity, pending, remote, peer) {
 				additionalData: associatedData(peer.deviceId, identity.deviceId, data.counter)
 			}, receiveKey, Uint8Array.from(data.ciphertext)));
 		} catch {
-			return;
+			return {
+				ok: false,
+				reason: "unauthentic"
+			};
 		}
 		highestReceived = Math.max(highestReceived, data.counter);
-		return require_adapters_frame_codec.tryDecodeFrame(plaintext) ?? void 0;
+		const frame = require_adapters_frame_codec.tryDecodeFrame(plaintext);
+		return frame === null ? {
+			ok: false,
+			reason: "undecodable"
+		} : {
+			ok: true,
+			frame
+		};
 	}
+	const openOutcome = async (data) => {
+		const opened = opening.then(async () => openOne(data));
+		opening = opened.catch(() => void 0);
+		return opened;
+	};
 	return {
 		peer,
 		seal: async (frame) => {
-			const counter = nextSendCounter;
-			nextSendCounter += 1;
+			const claimed = claimSendCounter(nextSendCounter);
+			const counter = claimed.counter;
+			nextSendCounter = claimed.next;
 			const sealed = sealing.then(async () => sealAt(frame, counter));
 			sealing = sealed.catch(() => void 0);
 			return sealed;
 		},
 		open: async (data) => {
-			const opened = opening.then(async () => openOne(data));
-			opening = opened.catch(() => void 0);
-			return opened;
-		}
+			const outcome = await openOutcome(data);
+			return outcome.ok ? outcome.frame : void 0;
+		},
+		openOutcome
 	};
 }
 //#endregion
 //#region src/domain/relay-channels.ts
-function createRelayChannels(identity, sendHello) {
+function createRelayChannels(identity, sendHello, options = {}) {
+	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
 	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
 	function start(peer) {
@@ -253,17 +304,40 @@ function createRelayChannels(identity, sendHello) {
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			const verdict = await verifyHello(identity, hello);
+			let verdict;
+			try {
+				verdict = await verifyHello(identity, hello);
+			} catch (error) {
+				options.onFault?.(error);
+				return;
+			}
 			if (!verdict.ok) return;
 			const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
 			const current = channels.get(key);
 			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const channel = await establishChannel(identity, await entry.pending, hello, verdict.peer);
-			if (channel === void 0) {
+			const established = await establishChannelFrom(identity, {
+				pending: await entry.pending,
+				remote: hello,
+				peer: verdict.peer,
+				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+			});
+			if (established === void 0) {
 				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
 				if (channels.get(key) === entry) channels.delete(key);
 				return;
 			}
+			const channel = {
+				...established,
+				seal: async (frame) => {
+					try {
+						return await established.seal(frame);
+					} catch (error) {
+						const held = channels.get(key);
+						if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+						throw error;
+					}
+				}
+			};
 			channels.set(key, {
 				status: "established",
 				channel
@@ -306,27 +380,16 @@ const HANDSHAKE_TIMEOUT_MS = 3e3;
 * always-on node grows without limit.
 */
 const FRAME_LOG_WINDOW = 256;
-function localHandshake(domains) {
-	return {
-		type: "handshake",
-		version: 1,
-		domains: [...domains]
-	};
-}
 /**
 * Builds the connection-agnostic session state machine and its public MeshSession surface. dial is null for a session that can never (re)connect on its own -- acceptMeshSession's case, where the one connection it will ever have already exists by construction and reconnect therefore cannot apply (only the remote redialing, and being accepted again, produces a fresh connection). createMeshSession supplies dial as transport.connect so its own connect()/reconnect behaviour is unchanged from before this was factored out.
 */
-function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd) {
+function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd, onLocalFault) {
 	let connection = null;
 	let state = { status: "idle" };
 	let handshake = { status: "pending" };
 	const directory = /* @__PURE__ */ new Map();
-	const frameLog = [];
-	/** Keeps the frame log at its recent-activity window: newest entries at the end, the oldest dropped once the window is full. */
-	function recordFrame(entry) {
-		frameLog.push(entry);
-		if (frameLog.length > 256) frameLog.splice(0, frameLog.length - 256);
-	}
+	const frameLog = createBoundedLog(256);
+	const recordFrame = frameLog.record;
 	let feedCancelled = false;
 	const eventQueue = require_domain_async_queue.createAsyncQueue();
 	let handshakeTimer = null;
@@ -341,7 +404,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		getRelayedDevices: () => relayPairings.list()
 	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const relayChannels = createRelayChannels(identity, async (peer, hello) => {
+	const sendHello = async (peer, hello) => {
 		if (connection === null) throw new Error("not connected");
 		recordFrame({
 			direction: "sent",
@@ -349,7 +412,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		});
 		await connection.send(require_adapters_frame_codec.wrapRelayData(hello, peer));
 		emit();
-	});
+	};
+	const relayChannels = createRelayChannels(identity, sendHello, { onFault: onLocalFault });
 	const incomingQueue = require_domain_async_queue.createAsyncQueue();
 	const revocationQueue = require_domain_async_queue.createAsyncQueue();
 	const coordinatorQueue = require_domain_async_queue.createAsyncQueue();
@@ -359,7 +423,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		return {
 			state,
 			directory: [...directory.values()],
-			frameLog: [...frameLog]
+			frameLog: frameLog.entries()
 		};
 	}
 	function emit() {
@@ -434,7 +498,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		};
 		if (require_gossip_extensions.isVersionGetCommand(frame.command.params)) {
-			incoming.respond(require_gossip_extensions.versionGetOutcome());
+			incoming.respond(require_gossip_extensions.versionGetOutcome()).catch(() => void 0);
 			return;
 		}
 		incomingQueue.push(incoming);
@@ -528,7 +592,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		relayPairings.add(targetDevice);
 		emit();
 	}
-	let localHandshakeSent = localHandshake([]);
+	let localHandshakeSent = require_domain_handshake.localHandshake([]);
 	function applyRemoteHandshake(remote) {
 		if (handshake.status !== "pending") return;
 		if (handshakeTimer !== null) {
@@ -618,7 +682,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
 		relayPairings.clear();
-		localHandshakeSent = localHandshake(localDomains);
+		localHandshakeSent = require_domain_handshake.localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {
 			status: "connected",
@@ -828,8 +892,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame, onLocalFault) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame, void 0, onLocalFault);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -136,7 +136,9 @@ addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
-onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
+/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
+onLocalFault?: (error: unknown) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -136,7 +136,9 @@ addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
-onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
+/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
+onLocalFault?: (error: unknown) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -1,10 +1,12 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";
-import { negotiate } from "./handshake.mjs";
+import { ChannelExhaustedError } from "./channel-exhausted-error.mjs";
+import { localHandshake, negotiate } from "./handshake.mjs";
 import { isDataFrame } from "./hub-mailbox.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
@@ -26,6 +28,19 @@ function createRelayPairings() {
 	};
 }
 //#endregion
+//#region src/domain/bounded-log.ts
+/** A log that keeps only its most recent `window` entries: newest at the end, the oldest dropped once the window is full. Pure and closure-free, split out of mesh-session.ts to keep that file under this repo's max-lines lint budget; nothing here is session-shaped. */
+function createBoundedLog(window) {
+	const log = [];
+	return {
+		record: (entry) => {
+			log.push(entry);
+			if (log.length > window) log.splice(0, log.length - window);
+		},
+		entries: () => [...log]
+	};
+}
+//#endregion
 //#region src/domain/secure-channel.ts
 /**
 * The end-to-end channel two devices open between themselves inside a relay pairing (spec/secure-channel.cddl). A relay only forwards the bytes of a `relay-data` frame, and without this it could read them, alter them, and say who sent them. Here the two devices authenticate each other's identity keys over a fresh ECDH exchange, derive one AES-256-GCM key per direction, and seal every frame they exchange so the relay sees ciphertext and every receiver learns the sender's identity from the handshake and nothing a relay asserts.
@@ -95,16 +110,16 @@ async function beginHandshake(identity, peer) {
 	};
 }
 /**
-* Checks a received hello: its identity key must hash to a device-id (which is then the peer), it must be addressed to this device, and its signature must verify under that key over the input spec/secure-channel.cddl defines. Never throws: a hostile hello gets a verdict.
+* Checks a received hello: it must be addressed to this device, its identity key must be a usable key, and its signature must verify under that key over the input spec/secure-channel.cddl defines. A hostile hello gets a verdict. An error from the identity port that is not an IdentityKeyError is a failure of the port, not a verdict about the peer, and propagates.
 */
 async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
+	const sender = await identity.deriveDeviceId(key["public-key"]);
+	if (!bytesEqual(hello["to-device"], identity.deviceId)) return {
+		ok: false,
+		reason: "wrong_recipient"
+	};
 	try {
-		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!bytesEqual(hello["to-device"], identity.deviceId)) return {
-			ok: false,
-			reason: "wrong_recipient"
-		};
 		return await identity.verify(key, helloSigningInput(hello["ephemeral-key"], hello.nonce, sender, identity.deviceId), hello.signature) ? {
 			ok: true,
 			peer: {
@@ -115,13 +130,30 @@ async function verifyHello(identity, hello) {
 			ok: false,
 			reason: "bad_signature"
 		};
-	} catch {
+	} catch (error) {
+		if (!(error instanceof IdentityKeyError)) throw error;
 		return {
 			ok: false,
-			reason: "identity_mismatch"
+			reason: error.fault === "unsupported_alg" ? "unsupported_identity_alg" : "invalid_identity_key"
 		};
 	}
 }
+/** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
+const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
+/** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
+function assertFirstSendCounter(counter) {
+	if (!Number.isSafeInteger(counter) || counter < 0) throw new RangeError("firstSendCounter must be a non-negative safe integer");
+}
+/**
+* Takes the next send counter from `next`, the counter the next seal would use: returns it with the counter that follows. Throws once `next` is past MAX_COUNTER, since a counter that cannot be held exactly would repeat an IV under the same key.
+*/
+function claimSendCounter(next) {
+	if (next > MAX_COUNTER) throw new ChannelExhaustedError();
+	return {
+		counter: next,
+		next: next + 1
+	};
+}
 function ivFor(counter) {
 	const iv = new Uint8Array(GCM_IV_BYTE_LENGTH);
 	iv.set(counterBytes(counter), IV_COUNTER_OFFSET);
@@ -143,11 +175,10 @@ async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	}, false, ["encrypt", "decrypt"]);
 }
 /**
-* Completes a handshake once the peer's hello has verified: derives the two directional keys from the ECDH result of the ephemeral keys and returns the channel. Returns undefined when the peer's ephemeral key is not a valid P-256 point, which only a hostile or broken peer sends.
-*
-* `peer` is the device verifyHello authenticated for `remote`, and `pending` is this side's own half, whether the handshake was begun here or in answer to that hello.
+* establishChannel with its inputs in one object, and the one extra that tests need: where this end's send counter starts. This module is not a published entry (it is in tsdown.config.ts's INTERNAL_MODULES) and the session never passes `firstSendCounter`, so every real channel starts at 0; a test passes a counter near MAX_COUNTER to reach the bound without sealing 2^53 frames.
 */
-async function establishChannel(identity, pending, remote, peer) {
+async function establishChannelFrom(identity, { pending, remote, peer, firstSendCounter = 0 }) {
+	assertFirstSendCounter(firstSendCounter);
 	let secret;
 	try {
 		const remoteKey = await crypto.subtle.importKey("raw", Uint8Array.from(remote["ephemeral-key"]), ECDH_PARAMS, false, []);
@@ -178,7 +209,7 @@ async function establishChannel(identity, pending, remote, peer) {
 	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
-	let nextSendCounter = 0;
+	let nextSendCounter = firstSendCounter;
 	let highestReceived = -1;
 	let sealing = Promise.resolve();
 	let opening = Promise.resolve();
@@ -194,7 +225,10 @@ async function establishChannel(identity, pending, remote, peer) {
 		};
 	}
 	async function openOne(data) {
-		if (data.counter <= highestReceived) return void 0;
+		if (data.counter <= highestReceived) return {
+			ok: false,
+			reason: "replayed"
+		};
 		let plaintext;
 		try {
 			plaintext = new Uint8Array(await crypto.subtle.decrypt({
@@ -203,30 +237,47 @@ async function establishChannel(identity, pending, remote, peer) {
 				additionalData: associatedData(peer.deviceId, identity.deviceId, data.counter)
 			}, receiveKey, Uint8Array.from(data.ciphertext)));
 		} catch {
-			return;
+			return {
+				ok: false,
+				reason: "unauthentic"
+			};
 		}
 		highestReceived = Math.max(highestReceived, data.counter);
-		return tryDecodeFrame(plaintext) ?? void 0;
+		const frame = tryDecodeFrame(plaintext);
+		return frame === null ? {
+			ok: false,
+			reason: "undecodable"
+		} : {
+			ok: true,
+			frame
+		};
 	}
+	const openOutcome = async (data) => {
+		const opened = opening.then(async () => openOne(data));
+		opening = opened.catch(() => void 0);
+		return opened;
+	};
 	return {
 		peer,
 		seal: async (frame) => {
-			const counter = nextSendCounter;
-			nextSendCounter += 1;
+			const claimed = claimSendCounter(nextSendCounter);
+			const counter = claimed.counter;
+			nextSendCounter = claimed.next;
 			const sealed = sealing.then(async () => sealAt(frame, counter));
 			sealing = sealed.catch(() => void 0);
 			return sealed;
 		},
 		open: async (data) => {
-			const opened = opening.then(async () => openOne(data));
-			opening = opened.catch(() => void 0);
-			return opened;
-		}
+			const outcome = await openOutcome(data);
+			return outcome.ok ? outcome.frame : void 0;
+		},
+		openOutcome
 	};
 }
 //#endregion
 //#region src/domain/relay-channels.ts
-function createRelayChannels(identity, sendHello) {
+function createRelayChannels(identity, sendHello, options = {}) {
+	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
 	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
 	function start(peer) {
@@ -252,17 +303,40 @@ function createRelayChannels(identity, sendHello) {
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			const verdict = await verifyHello(identity, hello);
+			let verdict;
+			try {
+				verdict = await verifyHello(identity, hello);
+			} catch (error) {
+				options.onFault?.(error);
+				return;
+			}
 			if (!verdict.ok) return;
 			const key = deviceIdToHex(verdict.peer.deviceId);
 			const current = channels.get(key);
 			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const channel = await establishChannel(identity, await entry.pending, hello, verdict.peer);
-			if (channel === void 0) {
+			const established = await establishChannelFrom(identity, {
+				pending: await entry.pending,
+				remote: hello,
+				peer: verdict.peer,
+				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+			});
+			if (established === void 0) {
 				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
 				if (channels.get(key) === entry) channels.delete(key);
 				return;
 			}
+			const channel = {
+				...established,
+				seal: async (frame) => {
+					try {
+						return await established.seal(frame);
+					} catch (error) {
+						const held = channels.get(key);
+						if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+						throw error;
+					}
+				}
+			};
 			channels.set(key, {
 				status: "established",
 				channel
@@ -305,27 +379,16 @@ const HANDSHAKE_TIMEOUT_MS = 3e3;
 * always-on node grows without limit.
 */
 const FRAME_LOG_WINDOW = 256;
-function localHandshake(domains) {
-	return {
-		type: "handshake",
-		version: 1,
-		domains: [...domains]
-	};
-}
 /**
 * Builds the connection-agnostic session state machine and its public MeshSession surface. dial is null for a session that can never (re)connect on its own -- acceptMeshSession's case, where the one connection it will ever have already exists by construction and reconnect therefore cannot apply (only the remote redialing, and being accepted again, produces a fresh connection). createMeshSession supplies dial as transport.connect so its own connect()/reconnect behaviour is unchanged from before this was factored out.
 */
-function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd) {
+function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd, onLocalFault) {
 	let connection = null;
 	let state = { status: "idle" };
 	let handshake = { status: "pending" };
 	const directory = /* @__PURE__ */ new Map();
-	const frameLog = [];
-	/** Keeps the frame log at its recent-activity window: newest entries at the end, the oldest dropped once the window is full. */
-	function recordFrame(entry) {
-		frameLog.push(entry);
-		if (frameLog.length > 256) frameLog.splice(0, frameLog.length - 256);
-	}
+	const frameLog = createBoundedLog(256);
+	const recordFrame = frameLog.record;
 	let feedCancelled = false;
 	const eventQueue = createAsyncQueue();
 	let handshakeTimer = null;
@@ -340,7 +403,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		getRelayedDevices: () => relayPairings.list()
 	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const relayChannels = createRelayChannels(identity, async (peer, hello) => {
+	const sendHello = async (peer, hello) => {
 		if (connection === null) throw new Error("not connected");
 		recordFrame({
 			direction: "sent",
@@ -348,7 +411,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		});
 		await connection.send(wrapRelayData(hello, peer));
 		emit();
-	});
+	};
+	const relayChannels = createRelayChannels(identity, sendHello, { onFault: onLocalFault });
 	const incomingQueue = createAsyncQueue();
 	const revocationQueue = createAsyncQueue();
 	const coordinatorQueue = createAsyncQueue();
@@ -358,7 +422,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		return {
 			state,
 			directory: [...directory.values()],
-			frameLog: [...frameLog]
+			frameLog: frameLog.entries()
 		};
 	}
 	function emit() {
@@ -433,7 +497,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		};
 		if (isVersionGetCommand(frame.command.params)) {
-			incoming.respond(versionGetOutcome());
+			incoming.respond(versionGetOutcome()).catch(() => void 0);
 			return;
 		}
 		incomingQueue.push(incoming);
@@ -827,8 +891,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame, onLocalFault) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame, void 0, onLocalFault);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/notice-board.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";

package/dist/domain/notice-board.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/room-rekey.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/room-rekey.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/room.d.cts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";

package/dist/domain/room.d.mts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";

package/dist/domain/tokens.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-lg4TtUxm.cjs";
 import { PredicateNode } from "trilean";

package/dist/domain/tokens.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-CrieP1WI.mjs";
 import { PredicateNode } from "trilean";

package/dist/{identity-EV-HHv_D.d.mts → identity-BioGOV9M.d.mts}

@@ -1,5 +1,14 @@
 import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.mjs";
 //#region src/ports/identity.d.ts
+/** Why an identity-key could not be used: its algorithm is not one the implementation verifies, or its key bytes are not a valid key for that algorithm. */
+type IdentityKeyFault = "unsupported_alg" | "invalid_key";
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+declare class IdentityKeyError extends Error {
+  readonly fault: IdentityKeyFault;
+  constructor(fault: IdentityKeyFault, message: string, options?: Readonly<{
+    cause: unknown;
+  }>);
+}
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -16,4 +25,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityPort as t };
+export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/{identity-B6nhlSOT.d.cts → identity-C5jq53NV.d.cts}

@@ -1,5 +1,14 @@
 import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.cjs";
 //#region src/ports/identity.d.ts
+/** Why an identity-key could not be used: its algorithm is not one the implementation verifies, or its key bytes are not a valid key for that algorithm. */
+type IdentityKeyFault = "unsupported_alg" | "invalid_key";
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+declare class IdentityKeyError extends Error {
+  readonly fault: IdentityKeyFault;
+  constructor(fault: IdentityKeyFault, message: string, options?: Readonly<{
+    cause: unknown;
+  }>);
+}
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -16,4 +25,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityPort as t };
+export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/ports/identity.cjs

@@ -0,0 +1,13 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/ports/identity.ts
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+var IdentityKeyError = class extends Error {
+	fault;
+	constructor(fault, message, options) {
+		super(message, options);
+		this.name = "IdentityKeyError";
+		this.fault = fault;
+	}
+};
+//#endregion
+exports.IdentityKeyError = IdentityKeyError;

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-export { IdentityPort };
+import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-C5jq53NV.cjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-export { IdentityPort };
+import { n as IdentityKeyFault, r as IdentityPort, t as IdentityKeyError } from "../identity-BioGOV9M.mjs";
+export { IdentityKeyError, IdentityKeyFault, IdentityPort };

package/dist/ports/identity.mjs

@@ -1 +1,12 @@
-export {};
+//#region src/ports/identity.ts
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+var IdentityKeyError = class extends Error {
+	fault;
+	constructor(fault, message, options) {
+		super(message, options);
+		this.name = "IdentityKeyError";
+		this.fault = fault;
+	}
+};
+//#endregion
+export { IdentityKeyError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.0.8",
+  "version": "4.1.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -86,6 +86,10 @@
       "import": "./dist/domain/capability-request.mjs",
       "require": "./dist/domain/capability-request.cjs"
     },
+    "./domain/channel-exhausted-error": {
+      "import": "./dist/domain/channel-exhausted-error.mjs",
+      "require": "./dist/domain/channel-exhausted-error.cjs"
+    },
     "./domain/coordinator-election": {
       "import": "./dist/domain/coordinator-election.mjs",
       "require": "./dist/domain/coordinator-election.cjs"