wire-mesh-core 4.0.8 → 4.1.1

package/dist/adapters/node-identity.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_ports_identity = require("../ports/identity.cjs");
 let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
@@ -11,7 +12,7 @@ const EDDSA_PUBLIC_KEY_BYTES = 32;
 function publicKeySize(alg) {
 	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
 	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 function algParams(alg) {
 	if (alg === ES256) return {
@@ -19,7 +20,7 @@ function algParams(alg) {
 		hash: "SHA-256"
 	};
 	if (alg === EDDSA) return { name: "Ed25519" };
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 /** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
 function toBufferSource(bytes) {
@@ -36,7 +37,7 @@ function importedKeyId(key) {
 	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
 }
 async function importPublicKey(key) {
-	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -53,13 +54,21 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+async function importRawPublicKey(key, algorithm) {
+	try {
+		return await node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
+	} catch (cause) {
+		throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key does not import as an alg ${String(key.alg)} key`, { cause });
+	}
+}
 async function importPublicKeyUncached(key) {
-	if (key.alg === ES256) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+	if (key.alg === ES256) return importRawPublicKey(key, {
 		name: "ECDSA",
 		namedCurve: "P-256"
-	}, false, ["verify"]);
-	if (key.alg === EDDSA) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
-	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+	});
+	if (key.alg === EDDSA) return importRawPublicKey(key, { name: "Ed25519" });
+	throw new require_ports_identity.IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(key.alg)}`);
 }
 async function deriveDeviceId(publicKey) {
 	return new Uint8Array(await node_crypto.webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.mjs

@@ -1,3 +1,4 @@
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
 const ES256 = -7;
@@ -10,7 +11,7 @@ const EDDSA_PUBLIC_KEY_BYTES = 32;
 function publicKeySize(alg) {
 	if (alg === ES256) return ES256_PUBLIC_KEY_BYTES;
 	if (alg === EDDSA) return EDDSA_PUBLIC_KEY_BYTES;
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 function algParams(alg) {
 	if (alg === ES256) return {
@@ -18,7 +19,7 @@ function algParams(alg) {
 		hash: "SHA-256"
 	};
 	if (alg === EDDSA) return { name: "Ed25519" };
-	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(alg)}`);
 }
 /** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
 function toBufferSource(bytes) {
@@ -35,7 +36,7 @@ function importedKeyId(key) {
 	return `${String(key.alg)}:${Buffer.from(key["public-key"]).toString("base64")}`;
 }
 async function importPublicKey(key) {
-	if (key["public-key"].length !== publicKeySize(key.alg)) throw new Error(`identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key["public-key"].length !== publicKeySize(key.alg)) throw new IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -52,13 +53,21 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+async function importRawPublicKey(key, algorithm) {
+	try {
+		return await webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
+	} catch (cause) {
+		throw new IdentityKeyError("invalid_key", `identity-key public-key does not import as an alg ${String(key.alg)} key`, { cause });
+	}
+}
 async function importPublicKeyUncached(key) {
-	if (key.alg === ES256) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+	if (key.alg === ES256) return importRawPublicKey(key, {
 		name: "ECDSA",
 		namedCurve: "P-256"
-	}, false, ["verify"]);
-	if (key.alg === EDDSA) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
-	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+	});
+	if (key.alg === EDDSA) return importRawPublicKey(key, { name: "Ed25519" });
+	throw new IdentityKeyError("unsupported_alg", `unsupported identity-key alg ${String(key.alg)}`);
 }
 async function deriveDeviceId(publicKey) {
 	return new Uint8Array(await webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";

package/dist/domain/channel-exhausted-error.cjs

@@ -0,0 +1,11 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/channel-exhausted-error.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+var ChannelExhaustedError = class extends Error {
+	constructor() {
+		super("the channel's send counter is exhausted");
+		this.name = "ChannelExhaustedError";
+	}
+};
+//#endregion
+exports.ChannelExhaustedError = ChannelExhaustedError;

package/dist/domain/channel-exhausted-error.d.cts

@@ -0,0 +1,6 @@
+//#region src/domain/channel-exhausted-error.d.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+export declare class ChannelExhaustedError extends Error {
+  constructor();
+}
+//#endregion

package/dist/domain/channel-exhausted-error.d.mts

@@ -0,0 +1,6 @@
+//#region src/domain/channel-exhausted-error.d.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+export declare class ChannelExhaustedError extends Error {
+  constructor();
+}
+//#endregion

package/dist/domain/channel-exhausted-error.mjs

@@ -0,0 +1,10 @@
+//#region src/domain/channel-exhausted-error.ts
+/** Thrown when a secure channel's send counter is spent: nothing more can be sealed on that channel, and a new handshake gives a fresh counter. The session forgets such a channel, so the next send to the peer starts one; a caller that sees this error from a send can retry it. */
+var ChannelExhaustedError = class extends Error {
+	constructor() {
+		super("the channel's send counter is exhausted");
+		this.name = "ChannelExhaustedError";
+	}
+};
+//#endregion
+export { ChannelExhaustedError };

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/handshake.cjs

@@ -2,6 +2,14 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/domain/handshake.ts
 /** The highest protocol version this build of core understands. */
 const SUPPORTED_PROTOCOL_VERSION = 1;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+function localHandshake(domains) {
+	return {
+		type: "handshake",
+		version: 1,
+		domains: [...domains]
+	};
+}
 /**
 * Domain names that must never be negotiated, per handshake.cddl: core/federation is retired (its string stays reserved, never reused) and "a peer must never advertise or negotiate it". Excluded here even if both peers advertise it -- two buggy advertisers must not end up speaking a dead domain.
 */
@@ -20,4 +28,5 @@ function negotiate(local, remote) {
 }
 //#endregion
 exports.SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSION;
+exports.localHandshake = localHandshake;
 exports.negotiate = negotiate;

package/dist/domain/handshake.d.cts

@@ -2,6 +2,8 @@ import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../pr
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+export declare function localHandshake(domains: readonly string[]): HandshakeFrame;
 export interface NegotiationResult {
   ok: boolean;
   /** The version both peers will speak for the rest of the session -- the lower of the two offered versions, so a peer never has to understand a frame shape it didn't advertise. */

package/dist/domain/handshake.d.mts

@@ -2,6 +2,8 @@ import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../pr
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+export declare function localHandshake(domains: readonly string[]): HandshakeFrame;
 export interface NegotiationResult {
   ok: boolean;
   /** The version both peers will speak for the rest of the session -- the lower of the two offered versions, so a peer never has to understand a frame shape it didn't advertise. */

package/dist/domain/handshake.mjs

@@ -1,6 +1,14 @@
 //#region src/domain/handshake.ts
 /** The highest protocol version this build of core understands. */
 const SUPPORTED_PROTOCOL_VERSION = 1;
+/** The handshake this side sends: the version it supports and the domains it offers. */
+function localHandshake(domains) {
+	return {
+		type: "handshake",
+		version: 1,
+		domains: [...domains]
+	};
+}
 /**
 * Domain names that must never be negotiated, per handshake.cddl: core/federation is retired (its string stays reserved, never reused) and "a peer must never advertise or negotiate it". Excluded here even if both peers advertise it -- two buggy advertisers must not end up speaking a dead domain.
 */
@@ -18,4 +26,4 @@ function negotiate(local, remote) {
 	};
 }
 //#endregion
-export { SUPPORTED_PROTOCOL_VERSION, negotiate };
+export { SUPPORTED_PROTOCOL_VERSION, localHandshake, negotiate };

package/dist/domain/mesh-session.cjs

@@ -1,10 +1,12 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
+const require_ports_identity = require("../ports/identity.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
+const require_domain_channel_exhausted_error = require("./channel-exhausted-error.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_domain_hub_mailbox = require("./hub-mailbox.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
@@ -27,6 +29,19 @@ function createRelayPairings() {
 	};
 }
 //#endregion
+//#region src/domain/bounded-log.ts
+/** A log that keeps only its most recent `window` entries: newest at the end, the oldest dropped once the window is full. Pure and closure-free, split out of mesh-session.ts to keep that file under this repo's max-lines lint budget; nothing here is session-shaped. */
+function createBoundedLog(window) {
+	const log = [];
+	return {
+		record: (entry) => {
+			log.push(entry);
+			if (log.length > window) log.splice(0, log.length - window);
+		},
+		entries: () => [...log]
+	};
+}
+//#endregion
 //#region src/domain/secure-channel.ts
 /**
 * The end-to-end channel two devices open between themselves inside a relay pairing (spec/secure-channel.cddl). A relay only forwards the bytes of a `relay-data` frame, and without this it could read them, alter them, and say who sent them. Here the two devices authenticate each other's identity keys over a fresh ECDH exchange, derive one AES-256-GCM key per direction, and seal every frame they exchange so the relay sees ciphertext and every receiver learns the sender's identity from the handshake and nothing a relay asserts.
@@ -96,16 +111,16 @@ async function beginHandshake(identity, peer) {
 	};
 }
 /**
-* Checks a received hello: its identity key must hash to a device-id (which is then the peer), it must be addressed to this device, and its signature must verify under that key over the input spec/secure-channel.cddl defines. Never throws: a hostile hello gets a verdict.
+* Checks a received hello: it must be addressed to this device, its identity key must be a usable key, and its signature must verify under that key over the input spec/secure-channel.cddl defines. A hostile hello gets a verdict. An error from the identity port that is not an IdentityKeyError is a failure of the port, not a verdict about the peer, and propagates.
 */
 async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
+	const sender = await identity.deriveDeviceId(key["public-key"]);
+	if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
+		ok: false,
+		reason: "wrong_recipient"
+	};
 	try {
-		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
-			ok: false,
-			reason: "wrong_recipient"
-		};
 		return await identity.verify(key, helloSigningInput(hello["ephemeral-key"], hello.nonce, sender, identity.deviceId), hello.signature) ? {
 			ok: true,
 			peer: {
@@ -116,13 +131,30 @@ async function verifyHello(identity, hello) {
 			ok: false,
 			reason: "bad_signature"
 		};
-	} catch {
+	} catch (error) {
+		if (!(error instanceof require_ports_identity.IdentityKeyError)) throw error;
 		return {
 			ok: false,
-			reason: "identity_mismatch"
+			reason: error.fault === "unsupported_alg" ? "unsupported_identity_alg" : "invalid_identity_key"
 		};
 	}
 }
+/** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
+const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
+/** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
+function assertFirstSendCounter(counter) {
+	if (!Number.isSafeInteger(counter) || counter < 0) throw new RangeError("firstSendCounter must be a non-negative safe integer");
+}
+/**
+* Takes the next send counter from `next`, the counter the next seal would use: returns it with the counter that follows. Throws once `next` is past MAX_COUNTER, since a counter that cannot be held exactly would repeat an IV under the same key.
+*/
+function claimSendCounter(next) {
+	if (next > MAX_COUNTER) throw new require_domain_channel_exhausted_error.ChannelExhaustedError();
+	return {
+		counter: next,
+		next: next + 1
+	};
+}
 function ivFor(counter) {
 	const iv = new Uint8Array(GCM_IV_BYTE_LENGTH);
 	iv.set(counterBytes(counter), IV_COUNTER_OFFSET);
@@ -144,11 +176,10 @@ async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	}, false, ["encrypt", "decrypt"]);
 }
 /**
-* Completes a handshake once the peer's hello has verified: derives the two directional keys from the ECDH result of the ephemeral keys and returns the channel. Returns undefined when the peer's ephemeral key is not a valid P-256 point, which only a hostile or broken peer sends.
-*
-* `peer` is the device verifyHello authenticated for `remote`, and `pending` is this side's own half, whether the handshake was begun here or in answer to that hello.
+* establishChannel with its inputs in one object, and the one extra that tests need: where this end's send counter starts. This module is not a published entry (it is in tsdown.config.ts's INTERNAL_MODULES) and the session never passes `firstSendCounter`, so every real channel starts at 0; a test passes a counter near MAX_COUNTER to reach the bound without sealing 2^53 frames.
 */
-async function establishChannel(identity, pending, remote, peer) {
+async function establishChannelFrom(identity, { pending, remote, peer, firstSendCounter = 0 }) {
+	assertFirstSendCounter(firstSendCounter);
 	let secret;
 	try {
 		const remoteKey = await crypto.subtle.importKey("raw", Uint8Array.from(remote["ephemeral-key"]), ECDH_PARAMS, false, []);
@@ -179,7 +210,7 @@ async function establishChannel(identity, pending, remote, peer) {
 	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
-	let nextSendCounter = 0;
+	let nextSendCounter = firstSendCounter;
 	let highestReceived = -1;
 	let sealing = Promise.resolve();
 	let opening = Promise.resolve();
@@ -195,7 +226,10 @@ async function establishChannel(identity, pending, remote, peer) {
 		};
 	}
 	async function openOne(data) {
-		if (data.counter <= highestReceived) return void 0;
+		if (data.counter <= highestReceived) return {
+			ok: false,
+			reason: "replayed"
+		};
 		let plaintext;
 		try {
 			plaintext = new Uint8Array(await crypto.subtle.decrypt({
@@ -204,30 +238,47 @@ async function establishChannel(identity, pending, remote, peer) {
 				additionalData: associatedData(peer.deviceId, identity.deviceId, data.counter)
 			}, receiveKey, Uint8Array.from(data.ciphertext)));
 		} catch {
-			return;
+			return {
+				ok: false,
+				reason: "unauthentic"
+			};
 		}
 		highestReceived = Math.max(highestReceived, data.counter);
-		return require_adapters_frame_codec.tryDecodeFrame(plaintext) ?? void 0;
+		const frame = require_adapters_frame_codec.tryDecodeFrame(plaintext);
+		return frame === null ? {
+			ok: false,
+			reason: "undecodable"
+		} : {
+			ok: true,
+			frame
+		};
 	}
+	const openOutcome = async (data) => {
+		const opened = opening.then(async () => openOne(data));
+		opening = opened.catch(() => void 0);
+		return opened;
+	};
 	return {
 		peer,
 		seal: async (frame) => {
-			const counter = nextSendCounter;
-			nextSendCounter += 1;
+			const claimed = claimSendCounter(nextSendCounter);
+			const counter = claimed.counter;
+			nextSendCounter = claimed.next;
 			const sealed = sealing.then(async () => sealAt(frame, counter));
 			sealing = sealed.catch(() => void 0);
 			return sealed;
 		},
 		open: async (data) => {
-			const opened = opening.then(async () => openOne(data));
-			opening = opened.catch(() => void 0);
-			return opened;
-		}
+			const outcome = await openOutcome(data);
+			return outcome.ok ? outcome.frame : void 0;
+		},
+		openOutcome
 	};
 }
 //#endregion
 //#region src/domain/relay-channels.ts
-function createRelayChannels(identity, sendHello) {
+function createRelayChannels(identity, sendHello, options = {}) {
+	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
 	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
 	function start(peer) {
@@ -253,17 +304,40 @@ function createRelayChannels(identity, sendHello) {
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			const verdict = await verifyHello(identity, hello);
+			let verdict;
+			try {
+				verdict = await verifyHello(identity, hello);
+			} catch (error) {
+				options.onFault?.(error);
+				return;
+			}
 			if (!verdict.ok) return;
 			const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
 			const current = channels.get(key);
 			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const channel = await establishChannel(identity, await entry.pending, hello, verdict.peer);
-			if (channel === void 0) {
+			const established = await establishChannelFrom(identity, {
+				pending: await entry.pending,
+				remote: hello,
+				peer: verdict.peer,
+				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+			});
+			if (established === void 0) {
 				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
 				if (channels.get(key) === entry) channels.delete(key);
 				return;
 			}
+			const channel = {
+				...established,
+				seal: async (frame) => {
+					try {
+						return await established.seal(frame);
+					} catch (error) {
+						const held = channels.get(key);
+						if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+						throw error;
+					}
+				}
+			};
 			channels.set(key, {
 				status: "established",
 				channel
@@ -306,27 +380,16 @@ const HANDSHAKE_TIMEOUT_MS = 3e3;
 * always-on node grows without limit.
 */
 const FRAME_LOG_WINDOW = 256;
-function localHandshake(domains) {
-	return {
-		type: "handshake",
-		version: 1,
-		domains: [...domains]
-	};
-}
 /**
 * Builds the connection-agnostic session state machine and its public MeshSession surface. dial is null for a session that can never (re)connect on its own -- acceptMeshSession's case, where the one connection it will ever have already exists by construction and reconnect therefore cannot apply (only the remote redialing, and being accepted again, produces a fresh connection). createMeshSession supplies dial as transport.connect so its own connect()/reconnect behaviour is unchanged from before this was factored out.
 */
-function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd) {
+function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd, onLocalFault) {
 	let connection = null;
 	let state = { status: "idle" };
 	let handshake = { status: "pending" };
 	const directory = /* @__PURE__ */ new Map();
-	const frameLog = [];
-	/** Keeps the frame log at its recent-activity window: newest entries at the end, the oldest dropped once the window is full. */
-	function recordFrame(entry) {
-		frameLog.push(entry);
-		if (frameLog.length > 256) frameLog.splice(0, frameLog.length - 256);
-	}
+	const frameLog = createBoundedLog(256);
+	const recordFrame = frameLog.record;
 	let feedCancelled = false;
 	const eventQueue = require_domain_async_queue.createAsyncQueue();
 	let handshakeTimer = null;
@@ -341,7 +404,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		getRelayedDevices: () => relayPairings.list()
 	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const relayChannels = createRelayChannels(identity, async (peer, hello) => {
+	const sendHello = async (peer, hello) => {
 		if (connection === null) throw new Error("not connected");
 		recordFrame({
 			direction: "sent",
@@ -349,7 +412,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		});
 		await connection.send(require_adapters_frame_codec.wrapRelayData(hello, peer));
 		emit();
-	});
+	};
+	const relayChannels = createRelayChannels(identity, sendHello, { onFault: onLocalFault });
 	const incomingQueue = require_domain_async_queue.createAsyncQueue();
 	const revocationQueue = require_domain_async_queue.createAsyncQueue();
 	const coordinatorQueue = require_domain_async_queue.createAsyncQueue();
@@ -359,7 +423,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		return {
 			state,
 			directory: [...directory.values()],
-			frameLog: [...frameLog]
+			frameLog: frameLog.entries()
 		};
 	}
 	function emit() {
@@ -434,7 +498,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		};
 		if (require_gossip_extensions.isVersionGetCommand(frame.command.params)) {
-			incoming.respond(require_gossip_extensions.versionGetOutcome());
+			incoming.respond(require_gossip_extensions.versionGetOutcome()).catch(() => void 0);
 			return;
 		}
 		incomingQueue.push(incoming);
@@ -528,7 +592,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		relayPairings.add(targetDevice);
 		emit();
 	}
-	let localHandshakeSent = localHandshake([]);
+	let localHandshakeSent = require_domain_handshake.localHandshake([]);
 	function applyRemoteHandshake(remote) {
 		if (handshake.status !== "pending") return;
 		if (handshakeTimer !== null) {
@@ -618,7 +682,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		connection = link;
 		relayChannels.reset("the connection changed before the channel was ready");
 		relayPairings.clear();
-		localHandshakeSent = localHandshake(localDomains);
+		localHandshakeSent = require_domain_handshake.localHandshake(localDomains);
 		handshake = { status: "pending" };
 		state = {
 			status: "connected",
@@ -828,8 +892,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame, onLocalFault) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame, void 0, onLocalFault);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */