wire-mesh-core 4.1.4 → 4.2.0

package/dist/domain/consume-incoming.d.mts

@@ -0,0 +1,27 @@
+import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
+//#region src/domain/consume-incoming.d.ts
+/** What a consumer is told about a failure. `item` is the item whose handling failed, or undefined when the stream itself failed. `suppressed` is how many failures from the same source were not reported before this report, not counting the one it carries (see FAULT_REPORT_INTERVAL_MS); it also counts failures of sources the reporter has stopped tracking. */
+export type ConsumeFault<T> = (error: unknown, item: T | undefined, suppressed: number) => void | Promise<void>;
+export interface ConsumeOptions<T> {
+  /** Told of a failure, at most once per source per FAULT_REPORT_INTERVAL_MS, so a peer cannot drive one report per failing item. A throw from this callback, or a promise it returns that rejects, is reported once to the console and dropped: reporting a fault never ends the loop either. Omit to drop failures silently. */
+  onFault?: ConsumeFault<T> | undefined;
+  /** Names the source an item's failure is counted against, so that one peer's failures do not hide another's. Items share one source when omitted. */
+  sourceOf?: ((item: T) => string) | undefined;
+  /** Stops the loop: the stream's iterator is closed when the signal aborts, and the loop ends at the next item boundary. See consumeEach for what that does to an item already taken. */
+  signal?: AbortSignal | undefined;
+  /** The clock the report interval is read from. */
+  now?: (() => number) | undefined;
+}
+/**
+ * Handles each item of `source` in order with `handle`. Resolves when the stream ends, fails or is stopped, and never rejects.
+ *
+ * Stopping with `signal` closes the stream's iterator at once and ends the loop at the next item boundary. An item the loop has already taken is handled to completion, never discarded, so a stream whose `return()` withdraws a pending wait (the session's own streams do) loses nothing to a later reader. A source whose `return()` cannot settle a pending `next()` (an async generator) ends the loop when that `next()` settles. A failure of the stream itself, or of closing it, is reported once and at once: it is not coalesced with item failures, because it ends the loop and no later report could carry it.
+ */
+export declare function consumeEach<T>(source: Readonly<AsyncIterable<T>>, handle: (item: T) => void | Promise<void>, options?: Readonly<ConsumeOptions<T>>): Promise<void>;
+/** The refusal sent for a request whose handling failed before it was answered. It is a fixed code with no text from the failure, so a peer learns nothing of this side's internals; the code is this repository's convention for it, beside the codes a handler itself answers with. */
+export declare const HANDLER_FAILED_OUTCOME: ManageOutcome;
+/**
+ * consumeEach for incoming manage-requests. A request whose handling fails before it was answered is answered with `internal-error`, so its sender is not left waiting for a response that will never come; if that answer cannot be sent either (the connection has gone), the request is dropped, and either way the failure is reported once. A request the handler already answered is not answered again.
+ */
+export declare function serveManageRequests(source: Readonly<AsyncIterable<IncomingManageRequest>>, handle: (incoming: IncomingManageRequest) => Promise<void>, options?: Readonly<ConsumeOptions<IncomingManageRequest>>): Promise<void>;
+//#endregion

package/dist/domain/consume-incoming.mjs

@@ -0,0 +1,93 @@
+import { deviceIdToHex } from "./device-id.mjs";
+import { createFaultReporter, deliverContained, describeFault } from "./fault-report.mjs";
+//#region src/domain/consume-incoming.ts
+/**
+* The one way to consume a session's incoming streams (incomingManageRequests, incomingDataFrames, revocationAnnouncements, coordinatorFrames, events, or any other async iterable of items): a failure while handling one item is contained to that item, reported once, and the loop goes on to the next, and no rejection escapes to whoever started the loop. A consumer written as a bare `for await` loop ends for good on the first item whose handling throws, and when it was started with `void` the rejection is unhandled, which ends a Node process by default.
+*
+* A failure of the stream itself (the iterator throws, as it does when the session behind it has gone) ends the loop and is reported once with no item. A stream that simply finishes ends the loop without a report.
+*/
+/**
+* Handles each item of `source` in order with `handle`. Resolves when the stream ends, fails or is stopped, and never rejects.
+*
+* Stopping with `signal` closes the stream's iterator at once and ends the loop at the next item boundary. An item the loop has already taken is handled to completion, never discarded, so a stream whose `return()` withdraws a pending wait (the session's own streams do) loses nothing to a later reader. A source whose `return()` cannot settle a pending `next()` (an async generator) ends the loop when that `next()` settles. A failure of the stream itself, or of closing it, is reported once and at once: it is not coalesced with item failures, because it ends the loop and no later report could carry it.
+*/
+async function consumeEach(source, handle, options = {}) {
+	const { onFault, signal } = options;
+	const reporter = createFaultReporter(options.now);
+	const reportItem = (error, item) => {
+		if (onFault === void 0) return;
+		try {
+			const origin = options.sourceOf?.(item) ?? "";
+			reporter(origin, async (suppressed) => onFault(error, item, suppressed));
+		} catch (failure) {
+			console.error(`could not report a failure: ${describeFault(failure)}`);
+		}
+	};
+	const reportStream = (error) => {
+		if (onFault !== void 0) deliverContained(async (suppressed) => onFault(error, void 0, suppressed), 0);
+	};
+	const iterator = source[Symbol.asyncIterator]();
+	let closing;
+	const close = () => {
+		closing ??= iterator.return?.().catch(reportStream);
+	};
+	signal?.addEventListener("abort", close, { once: true });
+	/** Takes and handles one item. Resolves true when there may be another, false when the stream ended or was stopped; rejects when the stream itself failed. */
+	async function step() {
+		if (signal?.aborted === true) return false;
+		const result = await iterator.next();
+		if (result.done === true) return false;
+		try {
+			await handle(result.value);
+		} catch (error) {
+			reportItem(error, result.value);
+		}
+		return true;
+	}
+	await new Promise((resolve) => {
+		const pump = () => {
+			step().then((more) => {
+				if (more) pump();
+				else resolve();
+			}, (error) => {
+				reportStream(error);
+				resolve();
+			});
+		};
+		pump();
+	});
+	signal?.removeEventListener("abort", close);
+	if (signal?.aborted === true) close();
+	await closing;
+}
+/** The refusal sent for a request whose handling failed before it was answered. It is a fixed code with no text from the failure, so a peer learns nothing of this side's internals; the code is this repository's convention for it, beside the codes a handler itself answers with. */
+const HANDLER_FAILED_OUTCOME = {
+	result: "error",
+	code: "internal-error"
+};
+/**
+* consumeEach for incoming manage-requests. A request whose handling fails before it was answered is answered with `internal-error`, so its sender is not left waiting for a response that will never come; if that answer cannot be sent either (the connection has gone), the request is dropped, and either way the failure is reported once. A request the handler already answered is not answered again.
+*/
+async function serveManageRequests(source, handle, options = {}) {
+	await consumeEach(source, async (incoming) => {
+		const state = { answered: false };
+		const tracked = {
+			...incoming,
+			respond: async (outcome) => {
+				state.answered = true;
+				await incoming.respond(outcome);
+			}
+		};
+		try {
+			await handle(tracked);
+		} catch (error) {
+			if (!state.answered) await incoming.respond(HANDLER_FAILED_OUTCOME).catch(() => void 0);
+			throw error;
+		}
+	}, {
+		...options,
+		sourceOf: options.sourceOf ?? ((incoming) => incoming.fromDevice === void 0 ? "" : deviceIdToHex(incoming.fromDevice))
+	});
+}
+//#endregion
+export { HANDLER_FAILED_OUTCOME, consumeEach, serveManageRequests };

package/dist/domain/direct-manage-request.cjs

@@ -41,20 +41,33 @@ async function sendDirectManageRequest(transport, address, command, scope, optio
 		scope,
 		...options.token !== void 0 ? { token: options.token } : {}
 	};
-	await link.send(frame);
+	try {
+		await link.send(frame);
+	} catch (error) {
+		await link.close().catch(() => void 0);
+		throw error;
+	}
 	const responsePromise = waitForDirectManageResponse(link, requestId);
 	let outcome;
-	if (options.timeoutMs === void 0) outcome = await responsePromise;
-	else {
-		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve({
-					result: "error",
-					code: "timeout"
-				});
-			}, options.timeoutMs);
-		})]);
-		responsePromise.catch(() => void 0);
+	try {
+		if (options.timeoutMs === void 0) outcome = await responsePromise;
+		else {
+			let timer;
+			outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+				timer = setTimeout(() => {
+					resolve({
+						result: "error",
+						code: "timeout"
+					});
+				}, options.timeoutMs);
+			})]).finally(() => {
+				clearTimeout(timer);
+			});
+			responsePromise.catch(() => void 0);
+		}
+	} catch (error) {
+		await link.close().catch(() => void 0);
+		throw error;
 	}
 	await link.close();
 	return outcome;

package/dist/domain/direct-manage-request.mjs

@@ -40,20 +40,33 @@ async function sendDirectManageRequest(transport, address, command, scope, optio
 		scope,
 		...options.token !== void 0 ? { token: options.token } : {}
 	};
-	await link.send(frame);
+	try {
+		await link.send(frame);
+	} catch (error) {
+		await link.close().catch(() => void 0);
+		throw error;
+	}
 	const responsePromise = waitForDirectManageResponse(link, requestId);
 	let outcome;
-	if (options.timeoutMs === void 0) outcome = await responsePromise;
-	else {
-		outcome = await Promise.race([responsePromise, new Promise((resolve) => {
-			setTimeout(() => {
-				resolve({
-					result: "error",
-					code: "timeout"
-				});
-			}, options.timeoutMs);
-		})]);
-		responsePromise.catch(() => void 0);
+	try {
+		if (options.timeoutMs === void 0) outcome = await responsePromise;
+		else {
+			let timer;
+			outcome = await Promise.race([responsePromise, new Promise((resolve) => {
+				timer = setTimeout(() => {
+					resolve({
+						result: "error",
+						code: "timeout"
+					});
+				}, options.timeoutMs);
+			})]).finally(() => {
+				clearTimeout(timer);
+			});
+			responsePromise.catch(() => void 0);
+		}
+	} catch (error) {
+		await link.close().catch(() => void 0);
+		throw error;
 	}
 	await link.close();
 	return outcome;

package/dist/domain/fault-report.cjs

@@ -0,0 +1,136 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_timers = require("../timers-DTJNuBa8.cjs");
+//#region src/domain/fault-report.ts
+/** The shortest time between two reports for one source. */
+const FAULT_REPORT_INTERVAL_MS = 1e3;
+/** The most sources whose report windows are kept at once; past it the oldest window goes, its pending count delivered first if the budget allows. */
+const MAX_TRACKED_FAULT_SOURCES = 1024;
+/** The most reports delivered across all sources in one interval. A source beyond it is counted like one inside its own interval, so the total is bounded however many distinct sources a peer presents. */
+const MAX_FAULT_REPORTS_PER_INTERVAL = 64;
+/** The most characters of a fault's text that a log line or console report carries, since the text can come from what a peer sent. */
+const MAX_FAULT_TEXT_CHARS = 256;
+/** A fault as one bounded, quoted line of text: control characters are escaped, so it cannot start a new line, and it is cut to MAX_FAULT_TEXT_CHARS. */
+function describeFault(error) {
+	return JSON.stringify(String(error).slice(0, 256));
+}
+/** Runs `deliver` so that nothing it does reaches the caller: a throw, or a returned promise that rejects, is reported once to the console and dropped. */
+function deliverContained(deliver, suppressed) {
+	const report = (error) => {
+		console.error(`the fault callback failed: ${describeFault(error)}`);
+	};
+	try {
+		const result = deliver(suppressed);
+		if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+	} catch (error) {
+		report(error);
+	}
+}
+/** A clock that never steps backwards, which the interval arithmetic relies on. */
+function monotonicNow() {
+	return performance.now();
+}
+/**
+* Builds a reporter that delivers a source's first fault at once and then at most one more per FAULT_REPORT_INTERVAL_MS, with at most MAX_FAULT_REPORTS_PER_INTERVAL reports across all sources. A fault inside a source's interval is counted, and the most recent one is delivered when the interval ends, carrying the count of the others; a source that falls quiet is therefore still told. Each report's `suppressed` counts the faults of its source that were not reported before it, not the one it carries.
+*
+* A source forgotten to keep the number of tracked sources bounded loses nothing silently: the faults it still had pending are added to the count the next delivered report carries, from whichever source.
+*
+* `now` is the clock the intervals are read from; it must not step backwards.
+*/
+function createFaultReporter(now = monotonicNow) {
+	const windows = /* @__PURE__ */ new Map();
+	const budget = {
+		since: Number.NEGATIVE_INFINITY,
+		used: 0
+	};
+	const forgotten = { count: 0 };
+	/** Takes one report from the interval's budget, if it has one left. */
+	function admit(at) {
+		if (at - budget.since >= 1e3) {
+			budget.since = at;
+			budget.used = 0;
+		}
+		if (budget.used >= 64) return false;
+		budget.used += 1;
+		return true;
+	}
+	/** What a delivered report adds for faults of sources that were forgotten, which it takes over. */
+	function takeForgotten() {
+		const count = forgotten.count;
+		forgotten.count = 0;
+		return count;
+	}
+	function arm(source) {
+		const window = windows.get(source);
+		if (window === void 0 || window.timer !== void 0) return;
+		const delay = Math.max(0, window.since + FAULT_REPORT_INTERVAL_MS - now());
+		const timer = setTimeout(() => {
+			flush(source);
+		}, delay);
+		require_timers.unrefIfSupported(timer);
+		window.timer = timer;
+	}
+	/** Delivers a window's most recent pending fault at the end of its interval, or waits for the next interval when the budget is spent. */
+	function flush(source) {
+		const window = windows.get(source);
+		if (window === void 0) return;
+		window.timer = void 0;
+		const { latest } = window;
+		if (window.pending === 0 || latest === void 0) return;
+		const at = now();
+		window.since = at;
+		if (!admit(at)) {
+			arm(source);
+			return;
+		}
+		const others = window.pending - 1;
+		window.pending = 0;
+		window.latest = void 0;
+		deliverContained(latest, others + takeForgotten());
+	}
+	function forgetOldest() {
+		const oldest = windows.entries().next();
+		if (oldest.done === true) return;
+		const [source, window] = oldest.value;
+		clearTimeout(window.timer);
+		windows.delete(source);
+		forgotten.count += window.pending;
+	}
+	return (source, deliver) => {
+		const at = now();
+		const window = windows.get(source);
+		if (window !== void 0 && at - window.since < 1e3) {
+			window.pending += 1;
+			window.latest = deliver;
+			arm(source);
+			return;
+		}
+		const carried = window?.pending ?? 0;
+		clearTimeout(window?.timer);
+		windows.delete(source);
+		const next = {
+			since: at,
+			pending: carried,
+			latest: window?.latest,
+			timer: void 0
+		};
+		windows.set(source, next);
+		if (windows.size > 1024) forgetOldest();
+		if (!admit(at)) {
+			next.pending += 1;
+			next.latest = deliver;
+			arm(source);
+			return;
+		}
+		next.pending = 0;
+		next.latest = void 0;
+		deliverContained(deliver, carried + takeForgotten());
+	};
+}
+//#endregion
+exports.FAULT_REPORT_INTERVAL_MS = FAULT_REPORT_INTERVAL_MS;
+exports.MAX_FAULT_REPORTS_PER_INTERVAL = MAX_FAULT_REPORTS_PER_INTERVAL;
+exports.MAX_FAULT_TEXT_CHARS = MAX_FAULT_TEXT_CHARS;
+exports.MAX_TRACKED_FAULT_SOURCES = MAX_TRACKED_FAULT_SOURCES;
+exports.createFaultReporter = createFaultReporter;
+exports.deliverContained = deliverContained;
+exports.describeFault = describeFault;

package/dist/domain/fault-report.d.cts

@@ -0,0 +1,25 @@
+//#region src/domain/fault-report.d.ts
+/** The shortest time between two reports for one source. */
+export declare const FAULT_REPORT_INTERVAL_MS = 1000;
+/** The most sources whose report windows are kept at once; past it the oldest window goes, its pending count delivered first if the budget allows. */
+export declare const MAX_TRACKED_FAULT_SOURCES = 1024;
+/** The most reports delivered across all sources in one interval. A source beyond it is counted like one inside its own interval, so the total is bounded however many distinct sources a peer presents. */
+export declare const MAX_FAULT_REPORTS_PER_INTERVAL = 64;
+/** The most characters of a fault's text that a log line or console report carries, since the text can come from what a peer sent. */
+export declare const MAX_FAULT_TEXT_CHARS = 256;
+/** A fault as one bounded, quoted line of text: control characters are escaped, so it cannot start a new line, and it is cut to MAX_FAULT_TEXT_CHARS. */
+export declare function describeFault(error: unknown): string;
+/** Delivers one report, given how many faults were suppressed since the previous report for its source, not counting the fault this report carries. A report that follows the loss of an evicted source's pending faults also counts those. */
+export type FaultDelivery = (suppressed: number) => void | Promise<void>;
+export type FaultReporter = (source: string, deliver: FaultDelivery) => void;
+/** Runs `deliver` so that nothing it does reaches the caller: a throw, or a returned promise that rejects, is reported once to the console and dropped. */
+export declare function deliverContained(deliver: FaultDelivery, suppressed: number): void;
+/**
+ * Builds a reporter that delivers a source's first fault at once and then at most one more per FAULT_REPORT_INTERVAL_MS, with at most MAX_FAULT_REPORTS_PER_INTERVAL reports across all sources. A fault inside a source's interval is counted, and the most recent one is delivered when the interval ends, carrying the count of the others; a source that falls quiet is therefore still told. Each report's `suppressed` counts the faults of its source that were not reported before it, not the one it carries.
+ *
+ * A source forgotten to keep the number of tracked sources bounded loses nothing silently: the faults it still had pending are added to the count the next delivered report carries, from whichever source.
+ *
+ * `now` is the clock the intervals are read from; it must not step backwards.
+ */
+export declare function createFaultReporter(now?: () => number): FaultReporter;
+//#endregion

package/dist/domain/fault-report.d.mts

@@ -0,0 +1,25 @@
+//#region src/domain/fault-report.d.ts
+/** The shortest time between two reports for one source. */
+export declare const FAULT_REPORT_INTERVAL_MS = 1000;
+/** The most sources whose report windows are kept at once; past it the oldest window goes, its pending count delivered first if the budget allows. */
+export declare const MAX_TRACKED_FAULT_SOURCES = 1024;
+/** The most reports delivered across all sources in one interval. A source beyond it is counted like one inside its own interval, so the total is bounded however many distinct sources a peer presents. */
+export declare const MAX_FAULT_REPORTS_PER_INTERVAL = 64;
+/** The most characters of a fault's text that a log line or console report carries, since the text can come from what a peer sent. */
+export declare const MAX_FAULT_TEXT_CHARS = 256;
+/** A fault as one bounded, quoted line of text: control characters are escaped, so it cannot start a new line, and it is cut to MAX_FAULT_TEXT_CHARS. */
+export declare function describeFault(error: unknown): string;
+/** Delivers one report, given how many faults were suppressed since the previous report for its source, not counting the fault this report carries. A report that follows the loss of an evicted source's pending faults also counts those. */
+export type FaultDelivery = (suppressed: number) => void | Promise<void>;
+export type FaultReporter = (source: string, deliver: FaultDelivery) => void;
+/** Runs `deliver` so that nothing it does reaches the caller: a throw, or a returned promise that rejects, is reported once to the console and dropped. */
+export declare function deliverContained(deliver: FaultDelivery, suppressed: number): void;
+/**
+ * Builds a reporter that delivers a source's first fault at once and then at most one more per FAULT_REPORT_INTERVAL_MS, with at most MAX_FAULT_REPORTS_PER_INTERVAL reports across all sources. A fault inside a source's interval is counted, and the most recent one is delivered when the interval ends, carrying the count of the others; a source that falls quiet is therefore still told. Each report's `suppressed` counts the faults of its source that were not reported before it, not the one it carries.
+ *
+ * A source forgotten to keep the number of tracked sources bounded loses nothing silently: the faults it still had pending are added to the count the next delivered report carries, from whichever source.
+ *
+ * `now` is the clock the intervals are read from; it must not step backwards.
+ */
+export declare function createFaultReporter(now?: () => number): FaultReporter;
+//#endregion

package/dist/domain/fault-report.mjs

@@ -0,0 +1,129 @@
+import { t as unrefIfSupported } from "../timers-Q1_kDTyY.mjs";
+//#region src/domain/fault-report.ts
+/** The shortest time between two reports for one source. */
+const FAULT_REPORT_INTERVAL_MS = 1e3;
+/** The most sources whose report windows are kept at once; past it the oldest window goes, its pending count delivered first if the budget allows. */
+const MAX_TRACKED_FAULT_SOURCES = 1024;
+/** The most reports delivered across all sources in one interval. A source beyond it is counted like one inside its own interval, so the total is bounded however many distinct sources a peer presents. */
+const MAX_FAULT_REPORTS_PER_INTERVAL = 64;
+/** The most characters of a fault's text that a log line or console report carries, since the text can come from what a peer sent. */
+const MAX_FAULT_TEXT_CHARS = 256;
+/** A fault as one bounded, quoted line of text: control characters are escaped, so it cannot start a new line, and it is cut to MAX_FAULT_TEXT_CHARS. */
+function describeFault(error) {
+	return JSON.stringify(String(error).slice(0, 256));
+}
+/** Runs `deliver` so that nothing it does reaches the caller: a throw, or a returned promise that rejects, is reported once to the console and dropped. */
+function deliverContained(deliver, suppressed) {
+	const report = (error) => {
+		console.error(`the fault callback failed: ${describeFault(error)}`);
+	};
+	try {
+		const result = deliver(suppressed);
+		if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+	} catch (error) {
+		report(error);
+	}
+}
+/** A clock that never steps backwards, which the interval arithmetic relies on. */
+function monotonicNow() {
+	return performance.now();
+}
+/**
+* Builds a reporter that delivers a source's first fault at once and then at most one more per FAULT_REPORT_INTERVAL_MS, with at most MAX_FAULT_REPORTS_PER_INTERVAL reports across all sources. A fault inside a source's interval is counted, and the most recent one is delivered when the interval ends, carrying the count of the others; a source that falls quiet is therefore still told. Each report's `suppressed` counts the faults of its source that were not reported before it, not the one it carries.
+*
+* A source forgotten to keep the number of tracked sources bounded loses nothing silently: the faults it still had pending are added to the count the next delivered report carries, from whichever source.
+*
+* `now` is the clock the intervals are read from; it must not step backwards.
+*/
+function createFaultReporter(now = monotonicNow) {
+	const windows = /* @__PURE__ */ new Map();
+	const budget = {
+		since: Number.NEGATIVE_INFINITY,
+		used: 0
+	};
+	const forgotten = { count: 0 };
+	/** Takes one report from the interval's budget, if it has one left. */
+	function admit(at) {
+		if (at - budget.since >= 1e3) {
+			budget.since = at;
+			budget.used = 0;
+		}
+		if (budget.used >= 64) return false;
+		budget.used += 1;
+		return true;
+	}
+	/** What a delivered report adds for faults of sources that were forgotten, which it takes over. */
+	function takeForgotten() {
+		const count = forgotten.count;
+		forgotten.count = 0;
+		return count;
+	}
+	function arm(source) {
+		const window = windows.get(source);
+		if (window === void 0 || window.timer !== void 0) return;
+		const delay = Math.max(0, window.since + FAULT_REPORT_INTERVAL_MS - now());
+		const timer = setTimeout(() => {
+			flush(source);
+		}, delay);
+		unrefIfSupported(timer);
+		window.timer = timer;
+	}
+	/** Delivers a window's most recent pending fault at the end of its interval, or waits for the next interval when the budget is spent. */
+	function flush(source) {
+		const window = windows.get(source);
+		if (window === void 0) return;
+		window.timer = void 0;
+		const { latest } = window;
+		if (window.pending === 0 || latest === void 0) return;
+		const at = now();
+		window.since = at;
+		if (!admit(at)) {
+			arm(source);
+			return;
+		}
+		const others = window.pending - 1;
+		window.pending = 0;
+		window.latest = void 0;
+		deliverContained(latest, others + takeForgotten());
+	}
+	function forgetOldest() {
+		const oldest = windows.entries().next();
+		if (oldest.done === true) return;
+		const [source, window] = oldest.value;
+		clearTimeout(window.timer);
+		windows.delete(source);
+		forgotten.count += window.pending;
+	}
+	return (source, deliver) => {
+		const at = now();
+		const window = windows.get(source);
+		if (window !== void 0 && at - window.since < 1e3) {
+			window.pending += 1;
+			window.latest = deliver;
+			arm(source);
+			return;
+		}
+		const carried = window?.pending ?? 0;
+		clearTimeout(window?.timer);
+		windows.delete(source);
+		const next = {
+			since: at,
+			pending: carried,
+			latest: window?.latest,
+			timer: void 0
+		};
+		windows.set(source, next);
+		if (windows.size > 1024) forgetOldest();
+		if (!admit(at)) {
+			next.pending += 1;
+			next.latest = deliver;
+			arm(source);
+			return;
+		}
+		next.pending = 0;
+		next.latest = void 0;
+		deliverContained(deliver, carried + takeForgotten());
+	};
+}
+//#endregion
+export { FAULT_REPORT_INTERVAL_MS, MAX_FAULT_REPORTS_PER_INTERVAL, MAX_FAULT_TEXT_CHARS, MAX_TRACKED_FAULT_SOURCES, createFaultReporter, deliverContained, describeFault };

package/dist/domain/gossip-expansion.cjs

@@ -43,7 +43,7 @@ function createGossipExpansion(options) {
 		expand({
 			device: advert.device,
 			addresses: advert.addresses
-		});
+		}).catch(() => void 0);
 	} };
 }
 //#endregion

package/dist/domain/gossip-expansion.mjs

@@ -42,7 +42,7 @@ function createGossipExpansion(options) {
 		expand({
 			device: advert.device,
 			addresses: advert.addresses
-		});
+		}).catch(() => void 0);
 	} };
 }
 //#endregion

package/dist/domain/mesh-session.cjs

@@ -7,6 +7,7 @@ const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_channel_exhausted_error = require("./channel-exhausted-error.cjs");
+const require_domain_fault_report = require("./fault-report.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_domain_hub_mailbox = require("./hub-mailbox.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
@@ -280,17 +281,9 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
-	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
+	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it goes through the shared containment in fault-report.ts. */
 	function reportFault(error) {
-		const report = (faultError) => {
-			console.error("the local fault callback failed", faultError);
-		};
-		try {
-			const result = options.onFault?.(error);
-			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
-		} catch (faultError) {
-			report(faultError);
-		}
+		require_domain_fault_report.deliverContained(async () => options.onFault?.(error), 0);
 	}
 	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
 	function abandon(entry, error) {
@@ -503,7 +496,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	}
 	/** The "not connected" guard every send* method on the public session needs, deduplicated into one place rather than repeated inline at each call site: throws unless there is a live connection AND the session's own state machine agrees it is "connected" (transmit's own connection===null check alone doesn't cover the latter). Returns the connection itself, narrowed non-null, for a caller that needs to send directly on it (sendPing/sendPingMeasureRtt); a caller that only needs the throwing side effect (sendManageRequest and friends, which go through transmit instead) calls this and discards the result. */
 	function requireConnectedLink() {
-		if (connection === null || state.status !== "connected") throw new Error("not connected");
+		if (feedCancelled || connection === null || state.status !== "connected") throw new Error("not connected");
 		return connection;
 	}
 	/** Sends a frame. Through a relay it is sealed for toDevice on their secure channel first (spec/secure-channel.cddl) and only then wrapped as relay-data, so the hub carries ciphertext. This is the single choke point every outbound manage-request and manage-response passes through, so a consumer of sendManageRequest or respond never needs its own relay logic. */
@@ -834,7 +827,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			},
 			async sendManageRequest(command, scope, targetDevice, token, timeoutMs) {
 				requireConnectedLink();
-				if (targetDevice !== void 0) await ensureRelayPairing(targetDevice);
+				if (targetDevice !== void 0) {
+					await ensureRelayPairing(targetDevice);
+					requireConnectedLink();
+				}
 				const frame = buildManageRequest(command, scope, token);
 				const requestId = frame["request-id"];
 				const outcome = new Promise((resolve, reject) => {
@@ -844,6 +840,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 						expectedFrom: targetDevice
 					});
 				});
+				outcome.catch(() => void 0);
 				recordFrame({
 					direction: "sent",
 					frame
@@ -853,7 +850,6 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 						await transmit(frame, targetDevice !== void 0, targetDevice);
 					} catch (error) {
 						pendingManageRequests.delete(requestId);
-						outcome.catch(() => void 0);
 						throw error;
 					}
 					emit();