wire-mesh-core 4.1.2 → 4.1.4

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DzmpxxUr.cjs";
-import { t as Connection } from "../transport-gDbSHO-r.cjs";
+import { N as Frame } from "../protocol-Cb3BnuTL.cjs";
+import { t as Connection } from "../transport-DaeS9N-o.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DzmpxxUr.mjs";
-import { t as Connection } from "../transport-bD3p_TO_.mjs";
+import { N as Frame } from "../protocol-Cb3BnuTL.mjs";
+import { t as Connection } from "../transport-CAD419ge.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-Cb3BnuTL.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-Cb3BnuTL.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.cjs

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_ed25519_identity_key = require("../domain/ed25519-identity-key.cjs");
 const require_ports_identity = require("../ports/identity.cjs");
 let node_crypto = require("node:crypto");
 //#region src/adapters/node-identity.ts
@@ -38,6 +39,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = require_domain_ed25519_identity_key.ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new require_ports_identity.IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -54,7 +59,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -75,6 +80,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !require_domain_ed25519_identity_key.ed25519SignatureIsStrict(signature)) return false;
 	return node_crypto.webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-Cb3BnuTL.cjs";
+import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-Cb3BnuTL.mjs";
+import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.mjs

@@ -1,3 +1,4 @@
+import { ed25519KeyFault, ed25519SignatureIsStrict } from "../domain/ed25519-identity-key.mjs";
 import { IdentityKeyError } from "../ports/identity.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.ts
@@ -37,6 +38,10 @@ function importedKeyId(key) {
 }
 async function importPublicKey(key) {
 	if (key["public-key"].length !== publicKeySize(key.alg)) throw new IdentityKeyError("invalid_key", `identity-key public-key is ${String(key["public-key"].length)} bytes, not the ${String(publicKeySize(key.alg))} an alg ${String(key.alg)} key has`);
+	if (key.alg === EDDSA) {
+		const fault = ed25519KeyFault(key["public-key"]);
+		if (fault !== void 0) throw new IdentityKeyError("invalid_key", `identity-key public-key is not a usable Ed25519 key (${fault})`);
+	}
 	const id = importedKeyId(key);
 	const held = importedKeys.get(id);
 	if (held !== void 0) {
@@ -53,7 +58,7 @@ async function importPublicKey(key) {
 	}
 	return pending;
 }
-/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 import does not check that the bytes are a curve point: such a key imports, and every signature under it fails to verify. */
+/** Imports the raw public key, reporting a key the algorithm cannot import (not a point on the curve, for ES256) as an IdentityKeyError rather than the Web Crypto error it arrives as. An Ed25519 key is checked before this by `ed25519KeyFault`, since the import itself accepts keys that are not points. */
 async function importRawPublicKey(key, algorithm) {
 	try {
 		return await webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), algorithm, false, ["verify"]);
@@ -74,6 +79,7 @@ async function deriveDeviceId(publicKey) {
 }
 async function verifyWithPublicKey(key, message, signature) {
 	const cryptoKey = await importPublicKey(key);
+	if (key.alg === EDDSA && !ed25519SignatureIsStrict(signature)) return false;
 	return webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
 }
 /**

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-gDbSHO-r.cjs";
+import { r as Transport } from "../transport-DaeS9N-o.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-bD3p_TO_.mjs";
+import { r as Transport } from "../transport-CAD419ge.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.cjs";
+import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.mjs";
+import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-gDbSHO-r.cjs";
+import { r as Transport } from "../transport-DaeS9N-o.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-bD3p_TO_.mjs";
+import { r as Transport } from "../transport-CAD419ge.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/advert-extension-policy.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
+import { et as PeerAdvert } from "../protocol-Cb3BnuTL.cjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/advert-extension-policy.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
+import { et as PeerAdvert } from "../protocol-Cb3BnuTL.mjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as Connection } from "../transport-gDbSHO-r.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
+import { t as Connection } from "../transport-DaeS9N-o.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as Connection } from "../transport-bD3p_TO_.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
+import { t as Connection } from "../transport-CAD419ge.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/capability-grant.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
+import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/capability-grant.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
+import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/capability-request.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-Cb3BnuTL.cjs";
+import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-lg4TtUxm.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-ooQCcAZm.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/capability-request.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-Cb3BnuTL.mjs";
+import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
-import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CrieP1WI.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CS4DprDE.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**

package/dist/domain/coordinator-election.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.cjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-Cb3BnuTL.cjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/coordinator-election.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.mjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-Cb3BnuTL.mjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-Cb3BnuTL.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
+import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-Cb3BnuTL.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
+import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { D as DeviceId } from "../protocol-Cb3BnuTL.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
+import { r as Transport, t as Connection } from "../transport-DaeS9N-o.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
+import { r as Transport, t as Connection } from "../transport-CAD419ge.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/ed25519-identity-key.cjs

@@ -0,0 +1,152 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+//#region src/domain/ed25519-identity-key.ts
+/**
+* What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+*
+* A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+*/
+const BITS_PER_BYTE = 8;
+const THREE = 3;
+const FOUR = 4;
+const EIGHT = 8;
+const FIELD_BITS = 255;
+const PRIME_OFFSET = 19;
+const ORDER_BITS = 252;
+const PUBLIC_KEY_BYTES = 32;
+const SIGNATURE_BYTES = 64;
+const BYTE_BITS = BigInt(BITS_PER_BYTE);
+const SIGN_BIT_BYTE = 31;
+const SIGN_BIT_MASK = 127;
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const TWO = BigInt(2);
+/** The field prime, 2^255 - 19. */
+const FIELD_PRIME = (ONE << BigInt(FIELD_BITS)) - BigInt(PRIME_OFFSET);
+/** The order of the prime-order subgroup. */
+const GROUP_ORDER = (ONE << BigInt(ORDER_BITS)) + BigInt("27742317777372353535851937790883648493");
+/** The curve constant d = -121665 / 121666, as a field element. */
+const CURVE_D = BigInt("37095705934669439343138083508754565189542113879843219016388785533085940283555");
+/**
+* The y coordinates of the eight small-order points: 0 (two points of order 4), 1 (the identity element), -1 (order 2) and the two pairs of order 8. Both signs of x share each y, so a key is small-order exactly when its y is one of these, whatever its sign bit.
+*/
+const SMALL_ORDER_Y = new Set([
+	"0",
+	"1",
+	"7fffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffec",
+	"5fc536d880238b13933c6d305acdfd5f098eff289f4c345b027b2c28f95e826",
+	"7a03ac9277fdc74ec6cc392cfa53202a0f67100d760b3cba4fd84d3d706a17c7"
+].map((hex) => BigInt(`0x${hex}`)));
+function littleEndian(bytes) {
+	let value = ZERO;
+	for (let index = bytes.length - 1; index >= 0; index -= 1) value = value << BYTE_BITS | BigInt(bytes[index] ?? 0);
+	return value;
+}
+/** The y coordinate an encoding carries: the 255 low bits, with the sign bit of x cleared. */
+function encodedY(encoding) {
+	const bytes = Uint8Array.from(encoding);
+	bytes[SIGN_BIT_BYTE] = (bytes[SIGN_BIT_BYTE] ?? 0) & SIGN_BIT_MASK;
+	return littleEndian(bytes);
+}
+function modPow(base, exponent) {
+	let result = ONE;
+	let factor = base % FIELD_PRIME;
+	let remaining = exponent;
+	while (remaining > ZERO) {
+		if ((remaining & ONE) === ONE) result = result * factor % FIELD_PRIME;
+		factor = factor * factor % FIELD_PRIME;
+		remaining >>= ONE;
+	}
+	return result;
+}
+function mod(value) {
+	const reduced = value % FIELD_PRIME;
+	return reduced >= ZERO ? reduced : reduced + FIELD_PRIME;
+}
+/** sqrt(-1) modulo the prime: 2^((p - 1) / 4). */
+const SQRT_MINUS_ONE = modPow(TWO, (FIELD_PRIME - ONE) / BigInt(FOUR));
+/** A point with the given y, with either sign of x (negating a point preserves its order, so the sign does not matter to a subgroup test), or `undefined` when no point has that y. */
+function pointWithY(y) {
+	const ySquared = mod(y * y);
+	const target = mod(mod(ySquared - ONE) * modPow(mod(CURVE_D * ySquared + ONE), FIELD_PRIME - TWO));
+	const candidate = modPow(target, (FIELD_PRIME + BigInt(THREE)) / BigInt(EIGHT));
+	for (const x of [candidate, mod(candidate * SQRT_MINUS_ONE)]) if (mod(x * x) === target) return {
+		x,
+		y,
+		z: ONE,
+		t: mod(x * y)
+	};
+}
+/** The sum of two points: the unified, complete addition of Hisil, Wong, Carter and Dawson for a = -1, which doubles as the doubling. */
+function addPoints(p, q) {
+	const a = mod((p.y - p.x) * (q.y - q.x));
+	const b = mod((p.y + p.x) * (q.y + q.x));
+	const c = mod(p.t * TWO * CURVE_D * q.t);
+	const d = mod(p.z * TWO * q.z);
+	const e = b - a;
+	const f = d - c;
+	const g = d + c;
+	const h = b + a;
+	return {
+		x: mod(e * f),
+		y: mod(g * h),
+		z: mod(f * g),
+		t: mod(e * h)
+	};
+}
+const IDENTITY_POINT = {
+	x: ZERO,
+	y: ONE,
+	z: ONE,
+	t: ZERO
+};
+/** Whether the point is in the prime-order subgroup: multiplying it by the group order gives the identity element. The point and the order are public, so the double-and-add loop leaks nothing. It costs one doubling per bit of the order below the top (252) and one addition per set bit below the top (72), each a handful of field multiplications, once per distinct key. */
+function isTorsionFree(point) {
+	let result = IDENTITY_POINT;
+	for (let bit = ORDER_BITS; bit >= 0; bit -= 1) {
+		result = addPoints(result, result);
+		if ((GROUP_ORDER >> BigInt(bit) & ONE) === ONE) result = addPoints(result, point);
+	}
+	return result.x === ZERO && result.y === result.z;
+}
+/** How many key verdicts are remembered, so a key that signs many messages is checked for torsion once and a flood of distinct keys cannot grow the memory without bound. */
+const VERDICT_CAPACITY = 1024;
+const verdicts = /* @__PURE__ */ new Map();
+function keyFaultUncached(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const y = encodedY(publicKey);
+	if (y >= FIELD_PRIME) return "non_canonical";
+	const point = pointWithY(y);
+	if (point === void 0) return "not_a_point";
+	if (SMALL_ORDER_Y.has(y)) return "small_order";
+	return isTorsionFree(point) ? void 0 : "mixed_order";
+}
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+function ed25519KeyFault(publicKey) {
+	if (publicKey.length !== PUBLIC_KEY_BYTES) return "wrong_size";
+	const id = require_domain_device_id.bytesToHex(publicKey);
+	if (verdicts.has(id)) {
+		const held = verdicts.get(id);
+		verdicts.delete(id);
+		verdicts.set(id, held);
+		return held;
+	}
+	const fault = keyFaultUncached(publicKey);
+	verdicts.set(id, fault);
+	for (const oldest of verdicts.keys()) {
+		if (verdicts.size <= VERDICT_CAPACITY) break;
+		verdicts.delete(oldest);
+	}
+	return fault;
+}
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+function ed25519SignatureIsStrict(signature) {
+	if (signature.length !== SIGNATURE_BYTES) return false;
+	const r = signature.subarray(0, PUBLIC_KEY_BYTES);
+	const s = signature.subarray(PUBLIC_KEY_BYTES);
+	const rY = encodedY(r);
+	return littleEndian(s) < GROUP_ORDER && rY < FIELD_PRIME && !SMALL_ORDER_Y.has(rY);
+}
+//#endregion
+exports.ed25519KeyFault = ed25519KeyFault;
+exports.ed25519SignatureIsStrict = ed25519SignatureIsStrict;

package/dist/domain/ed25519-identity-key.d.cts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion

package/dist/domain/ed25519-identity-key.d.mts

@@ -0,0 +1,13 @@
+//#region src/domain/ed25519-identity-key.d.ts
+/**
+ * What an Ed25519 identity-key must be, and what an Ed25519 signature under one must look like, decided here and nowhere else, before the platform's crypto library is consulted.
+ *
+ * A key is usable when it is exactly 32 bytes, is the canonical encoding of a point on the curve (its y coordinate is below the field prime, and it decodes), is not a point of small order (the eight points of the torsion subgroup, the identity element among them), and lies in the prime-order subgroup (it has no torsion component). A signature is acceptable to verify when its S is below the group order and its R is a canonical encoding that is not a small-order point. The signature equation itself is the cofactorless one, `[S]B = R + [k]A` compared as encodings, which Web Crypto's Ed25519 verification does on the platforms the conformance vectors are run on: a platform that verifies differently fails the mixed-order vectors there. The Rust crates apply the same rules through ed25519-dalek's `is_weak`, `is_torsion_free` and `verify_strict`.
+ */
+/** Why a key is refused, in the order the checks run. */
+export type Ed25519KeyFault = "wrong_size" | "non_canonical" | "not_a_point" | "small_order" | "mixed_order";
+/** The first reason an Ed25519 identity-key's bytes are refused, or `undefined` for a usable key. The checks are independent of the platform's crypto library, and the verdict for a key is remembered (the least recently used first goes once more than a fixed number are held), so verifying many signatures under one key tests it for torsion once. */
+export declare function ed25519KeyFault(publicKey: Uint8Array): Ed25519KeyFault | undefined;
+/** Whether a 64-byte Ed25519 signature is acceptable to verify: S below the group order, and R a canonical encoding of a point that is not of small order. A signature that fails this does not verify, whatever the platform's library would say. */
+export declare function ed25519SignatureIsStrict(signature: Uint8Array): boolean;
+//#endregion