wire-mesh-core 4.1.5 → 4.2.1

package/dist/domain/mesh-session.cjs

@@ -7,6 +7,7 @@ const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
 const require_domain_channel_exhausted_error = require("./channel-exhausted-error.cjs");
+const require_domain_fault_report = require("./fault-report.cjs");
 const require_domain_handshake = require("./handshake.cjs");
 const require_domain_hub_mailbox = require("./hub-mailbox.cjs");
 const require_domain_ping_round_trips = require("./ping-round-trips.cjs");
@@ -139,6 +140,15 @@ async function verifyHello(identity, hello) {
 		};
 	}
 }
+/** True when `key` is a usable P-256 ECDH public key, so a channel can be built from a hello carrying it. Cheap enough to run before any key of this side's own is generated. */
+async function isUsableEphemeralKey(key) {
+	try {
+		await crypto.subtle.importKey("raw", Uint8Array.from(key), ECDH_PARAMS, false, []);
+		return true;
+	} catch {
+		return false;
+	}
+}
 /** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
 const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
 /** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
@@ -277,148 +287,382 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 }
 //#endregion
 //#region src/domain/relay-channels.ts
+/** How long a peer may take to answer a hello, and the window every other rule here is measured in: a handshake is outstanding for this long, a replaced channel may still open frames that were in flight for this long, and an entry younger than this is never reused. Whoever holds a hello for longer than this gains nothing, since the handshake it belongs to is over. */
+const HANDSHAKE_WINDOW_MS = 3e3;
+/** Everything held for one peer. The fields only change through the methods, so each transition has one place. */
+var PeerChannels = class {
+	peer;
+	chosen = false;
+	lastUsed;
+	/** The current channel: sealing goes through it and only it. */
+	current;
+	/** The channel the current one replaced, which may still open frames that were in flight but never seals. */
+	replaced;
+	hs;
+	/** The candidates of a handshake that ended without confirming either of two, which together serve as the channel until a frame opens under one. */
+	pool = [];
+	waiters;
+	opening = Promise.resolve();
+	constructor(peer, now) {
+		this.peer = peer;
+		this.lastUsed = now;
+	}
+	get key() {
+		return require_domain_device_id.deviceIdToHex(this.peer);
+	}
+	touch(now) {
+		this.lastUsed = now;
+	}
+	choose() {
+		this.chosen = true;
+	}
+	/** True when `key` is the remote ephemeral key of anything held for the peer. */
+	holdsKey(key) {
+		return [
+			this.current?.remoteKey,
+			this.replaced?.remoteKey,
+			...(this.hs?.cands ?? []).map((cand) => cand.remoteKey),
+			...this.pool.map((cand) => cand.remoteKey)
+		].some((held) => held !== void 0 && require_domain_token_scope.bytesEqual(held, key));
+	}
+	/** Whether this side's handshake with the peer is outstanding: sent less than a window ago, and neither confirmed nor ended. */
+	outstanding(now) {
+		return this.hs !== void 0 && !this.hs.expired && now < this.hs.sentAt + 3e3;
+	}
+	/** Applies whatever the passing of time has ended: the replaced channel after its window, and a handshake after its window. Checked on every event, so no timer is needed. */
+	expire(now) {
+		if (this.replaced !== void 0 && now >= this.replaced.until) this.replaced = void 0;
+		const { hs } = this;
+		if (hs === void 0 || hs.expired || now < hs.sentAt + 3e3) return;
+		const [only, ...rest] = hs.cands;
+		if (this.current !== void 0) this.hs = void 0;
+		else if (only === void 0) hs.expired = true;
+		else if (rest.length === 0) {
+			this.current = {
+				...only,
+				confirmed: false
+			};
+			this.hs = void 0;
+		} else {
+			this.pool = hs.cands;
+			this.hs = void 0;
+		}
+	}
+	/** The candidates a received frame is tried against, in order. */
+	candidates() {
+		return [...this.hs?.cands ?? [], ...this.pool];
+	}
+	begin(hs) {
+		this.hs = hs;
+	}
+	/** Ends `hs` if it is still this peer's handshake. */
+	end(hs) {
+		if (this.hs !== hs) return false;
+		this.hs = void 0;
+		return true;
+	}
+	confirmCurrent() {
+		if (this.current !== void 0) this.current.confirmed = true;
+	}
+	/** A frame opened under `cand`: it becomes the current channel, the channel it replaces may open in-flight frames for a window, and every other candidate goes. */
+	confirm(cand, now) {
+		if (this.current !== void 0) this.replaced = {
+			channel: this.current.channel,
+			remoteKey: this.current.remoteKey,
+			until: now + HANDSHAKE_WINDOW_MS
+		};
+		this.current = {
+			...cand,
+			confirmed: true
+		};
+		this.hs = void 0;
+		this.pool = [];
+	}
+	/** Forgets the confirmed channel and the one it replaced, keeping every candidate. */
+	dropConfirmed() {
+		this.current = void 0;
+		this.replaced = void 0;
+	}
+	/** Forgets the current channel when it is the one that is spent. */
+	clearCurrent(channel) {
+		if (this.current?.channel === channel) this.current = void 0;
+	}
+	isEmpty() {
+		return this.current === void 0 && this.replaced === void 0 && this.hs === void 0 && this.pool.length === 0;
+	}
+	/** Resolves once some candidate exists. */
+	async waitForChannel() {
+		this.waiters ??= (() => {
+			const waiting = Promise.withResolvers();
+			waiting.promise.catch(() => void 0);
+			return waiting;
+		})();
+		return this.waiters.promise;
+	}
+	releaseWaiters() {
+		this.waiters?.resolve(void 0);
+		this.waiters = void 0;
+	}
+	rejectWaiters(error) {
+		this.waiters?.reject(error);
+		this.waiters = void 0;
+	}
+	/** Runs `task` after every earlier one for this peer: two frames opening at once must not both be tried before either has settled what it confirms. */
+	async serialise(task) {
+		const run = this.opening.then(task);
+		this.opening = run.catch(() => void 0);
+		return run;
+	}
+};
+function authentic(outcome) {
+	return outcome.ok || outcome.reason === "undecodable";
+}
+async function openFirst(cands, data) {
+	const [first, ...rest] = cands;
+	if (first === void 0) return;
+	const outcome = await first.channel.openOutcome(data);
+	return authentic(outcome) ? {
+		cand: first,
+		outcome
+	} : openFirst(rest, data);
+}
+/** A clock that never goes backwards: milliseconds from an arbitrary origin, as `performance.now()` gives them. What `createMeshSession` gives its channels. */
+const monotonicClock = { now: () => performance.now() };
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
-	const channels = /* @__PURE__ */ new Map();
-	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
-	function reportFault(error) {
-		const report = (faultError) => {
-			console.error("the local fault callback failed", faultError);
-		};
-		try {
-			const result = options.onFault?.(error);
-			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
-		} catch (faultError) {
-			report(faultError);
-		}
+	const newHandshake = options.newHandshake ?? (async (peer) => beginHandshake(identity, peer));
+	let latest = Number.NEGATIVE_INFINITY;
+	const source = options.clock ?? monotonicClock;
+	const clock = { now: () => {
+		latest = Math.max(latest, source.now());
+		return latest;
+	} };
+	const peers = /* @__PURE__ */ new Map();
+	const reporter = require_domain_fault_report.createFaultReporter(() => clock.now());
+	/** Tells the owner of a failure that is local to this side, through the shared fault reporter: at most one report per peer and interval, with the number withheld, and the callback's own failure contained there. */
+	function reportFault(error, peer) {
+		reporter(peer === void 0 ? "" : require_domain_device_id.deviceIdToHex(peer), async (suppressed) => options.onFault?.(error, {
+			peer,
+			suppressed
+		}));
 	}
-	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
-	function abandon(entry, error) {
+	function prune(entry) {
+		if (entry.isEmpty() && !entry.chosen && peers.get(entry.key) === entry) peers.delete(entry.key);
+	}
+	/** Ends this side's handshake `hs` with the peer, leaving every channel as it is, and tells whoever waits for a channel when there is none to wait for. */
+	function dropHandshake(entry, hs, error) {
+		if (!entry.end(hs)) return;
 		const failure = error instanceof Error ? error : new Error(String(error));
-		if (channels.get(entry.key) === entry) channels.delete(entry.key);
-		entry.settle.reject(failure);
-		entry.sent.reject(failure);
-	}
-	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
-	function start(peer, { answering, track } = {
-		answering: false,
-		track: true
-	}) {
-		const key = require_domain_device_id.deviceIdToHex(peer);
-		const pending = beginHandshake(identity, peer);
-		const entry = {
-			status: "awaiting",
-			pending,
-			settle: Promise.withResolvers(),
-			key,
-			sent: Promise.withResolvers()
+		hs.sent.reject(failure);
+		if (entry.current === void 0 && entry.pool.length === 0) entry.rejectWaiters(failure);
+		prune(entry);
+	}
+	/** Drops every handshake that is waiting for its first answer beyond MAX_PENDING_HANDSHAKES, oldest first. */
+	function enforcePendingBound(keep) {
+		const pending = [...peers.values()].filter((entry) => entry.hs?.origin === "initiated" && entry.hs.cands.length === 0 && entry.current === void 0);
+		const excess = pending.filter((entry) => entry !== keep).sort((a, b) => (a.hs?.sentAt ?? 0) - (b.hs?.sentAt ?? 0)).slice(0, Math.max(0, pending.length - 256));
+		for (const entry of excess) if (entry.hs !== void 0) dropHandshake(entry, entry.hs, /* @__PURE__ */ new Error("the handshake was dropped to make room for others"));
+	}
+	/** Begins this side's own hello to the entry's peer and registers it at once, so a hello arriving meanwhile completes it instead of starting another. */
+	function beginOwn(entry, origin) {
+		const mine = newHandshake(entry.peer);
+		const hs = {
+			mine,
+			origin,
+			sentAt: clock.now(),
+			cands: [],
+			sent: Promise.withResolvers(),
+			expired: false
 		};
-		entry.settle.promise.catch(() => void 0);
-		entry.sent.promise.catch(() => void 0);
-		pending.then(async ({ hello }) => {
+		hs.sent.promise.catch(() => void 0);
+		entry.begin(hs);
+		mine.then(async ({ hello }) => {
 			try {
-				await sendHello(peer, hello);
+				await sendHello(entry.peer, hello);
 			} catch (error) {
-				abandon(entry, error);
-				entry.settle.promise.then((channel) => {
-					const held = channels.get(key);
-					if (held?.status === "established" && held.channel === channel) channels.delete(key);
-				}, () => void 0);
-				if (answering && track) reportFault(error);
+				dropHandshake(entry, hs, error);
+				if (origin === "answered") reportFault(error, entry.peer);
 				return;
 			}
-			entry.sent.resolve(void 0);
+			hs.sent.resolve(void 0);
 		}, (error) => {
-			abandon(entry, error);
+			dropHandshake(entry, hs, error);
 		});
-		if (track) channels.set(key, entry);
-		return entry;
-	}
-	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
-	async function complete({ entry, hello, peer, replaces }) {
-		const { key } = entry;
-		const established = await establishChannelFrom(identity, {
-			pending: await entry.pending,
+		return hs;
+	}
+	/** Builds the channel `hello` makes with this side's handshake `hs`, and holds it as a candidate. */
+	async function addCandidate(entry, hs, hello, peer) {
+		const channel = await establishChannelFrom(identity, {
+			pending: await hs.mine,
 			remote: hello,
 			peer,
 			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
 		});
-		if (established === void 0) {
-			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-			return;
-		}
-		if (replaces !== void 0) await entry.sent.promise;
-		if (channels.get(key) !== (replaces ?? entry)) return;
-		const channel = {
-			...established,
-			seal: async (frame) => {
-				try {
-					return await established.seal(frame);
-				} catch (error) {
-					const held = channels.get(key);
-					if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-					throw error;
-				}
-			}
-		};
-		channels.set(key, {
-			status: "established",
+		if (channel === void 0 || entry.hs !== hs || peers.get(entry.key) !== entry || hs.cands.length >= 2 || entry.holdsKey(hello["ephemeral-key"])) return;
+		hs.cands.push({
 			channel,
-			remoteEphemeralKey: hello["ephemeral-key"]
+			remoteKey: hello["ephemeral-key"]
 		});
-		entry.settle.resolve(channel);
+		entry.releaseWaiters();
+	}
+	/** The entry of a peer this side never sent anything to that may be reused now, or undefined when every slot is free or none is old enough, which is told by `slotIsFree`. An entry is reused only once it is older than the window, so answers cannot outpace the turnover of slots. */
+	function reusableEntry(now) {
+		const [victim] = [...peers.values()].filter((entry) => !entry.chosen && now - entry.lastUsed >= 3e3).sort((a, b) => a.lastUsed - b.lastUsed);
+		return victim;
+	}
+	function slotIsFree() {
+		return [...peers.values()].filter((entry) => !entry.chosen).length < 64;
+	}
+	/** Whether a peer this side never sent anything to could be given an entry now, changing nothing. */
+	function slotAvailable(now) {
+		return slotIsFree() || reusableEntry(now) !== void 0;
+	}
+	/** Makes room for a peer this side never sent anything to. */
+	function reserveUnsolicitedSlot(now) {
+		if (slotIsFree()) return true;
+		const victim = reusableEntry(now);
+		if (victim === void 0) return false;
+		discard(victim, /* @__PURE__ */ new Error("the entry was dropped to make room for others"));
+		return true;
+	}
+	function discard(entry, error) {
+		peers.delete(entry.key);
+		entry.hs?.sent.reject(error);
+		entry.rejectWaiters(error);
+	}
+	async function sealUnder(entry, channel, frame) {
+		try {
+			return await channel.seal(frame);
+		} catch (error) {
+			if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError) entry.clearCurrent(channel);
+			throw error;
+		}
+	}
+	async function sealFor(entry, frame) {
+		entry.expire(clock.now());
+		entry.touch(clock.now());
+		const { current, hs } = entry;
+		if (current !== void 0) return [await sealUnder(entry, current.channel, frame)];
+		if (entry.pool.length > 0) return Promise.all(entry.pool.map(async (cand) => sealUnder(entry, cand.channel, frame)));
+		if (hs === void 0) {
+			beginOwn(entry, "initiated");
+			enforcePendingBound(entry);
+			return sealFor(entry, frame);
+		}
+		if (hs.cands.length > 0) {
+			await hs.sent.promise;
+			return Promise.all(hs.cands.map(async (cand) => sealUnder(entry, cand.channel, frame)));
+		}
+		await entry.waitForChannel();
+		return sealFor(entry, frame);
+	}
+	/** Tries a frame against the peer's channels, in order: the current one, then the candidates, then the replaced one while its window lasts. */
+	async function openUnder(entry, data) {
+		entry.expire(clock.now());
+		const { current } = entry;
+		if (current !== void 0) {
+			const outcome = await current.channel.openOutcome(data);
+			if (authentic(outcome)) {
+				entry.confirmCurrent();
+				entry.touch(clock.now());
+				return outcome.ok ? {
+					frame: outcome.frame,
+					from: current.channel.peer.deviceId
+				} : void 0;
+			}
+		}
+		const found = await openFirst(entry.candidates(), data);
+		if (found !== void 0) {
+			if (peers.get(entry.key) !== entry) return;
+			entry.confirm(found.cand, clock.now());
+			entry.touch(clock.now());
+			return found.outcome.ok ? {
+				frame: found.outcome.frame,
+				from: found.cand.channel.peer.deviceId
+			} : void 0;
+		}
+		const { replaced } = entry;
+		if (replaced !== void 0 && clock.now() < replaced.until) {
+			const outcome = await replaced.channel.openOutcome(data);
+			return outcome.ok ? {
+				frame: outcome.frame,
+				from: replaced.channel.peer.deviceId
+			} : void 0;
+		}
+	}
+	async function acceptHello(hello, sender) {
+		const key = require_domain_device_id.deviceIdToHex(sender);
+		const verdict = await verifyHello(identity, hello);
+		if (!verdict.ok || !await isUsableEphemeralKey(hello["ephemeral-key"])) return;
+		const now = clock.now();
+		let entry = peers.get(key);
+		entry?.expire(now);
+		if (entry?.holdsKey(hello["ephemeral-key"]) === true) return;
+		if (entry?.hs !== void 0 && entry.outstanding(now)) {
+			if (entry.hs.cands.length < 2) await addCandidate(entry, entry.hs, hello, verdict.peer);
+			return;
+		}
+		if (entry === void 0) {
+			if (!reserveUnsolicitedSlot(now)) return;
+			entry = new PeerChannels(sender, now);
+			peers.set(key, entry);
+		}
+		const hs = beginOwn(entry, "answered");
+		entry.touch(now);
+		try {
+			await addCandidate(entry, hs, hello, verdict.peer);
+		} catch (error) {
+			dropHandshake(entry, hs, error);
+			throw error;
+		}
 	}
 	return {
-		ensure: async (peer) => {
+		seal: async (peer, frame, purpose) => {
 			const key = require_domain_device_id.deviceIdToHex(peer);
-			const existing = channels.get(key);
-			if (existing?.status === "established") return existing.channel;
-			return (existing ?? start(peer)).settle.promise;
+			const now = clock.now();
+			let entry = peers.get(key);
+			if (entry === void 0) {
+				if (purpose === "reply" && !reserveUnsolicitedSlot(now)) throw new Error("there is no channel with this peer");
+				entry = new PeerChannels(peer, now);
+				peers.set(key, entry);
+			}
+			if (purpose === "request") entry.choose();
+			return sealFor(entry, frame);
 		},
-		applyHello: async (hello) => {
-			let entry;
+		applyHello: async (hello, claimedFrom) => {
+			let sender;
 			try {
-				const verdict = await verifyHello(identity, hello);
-				if (!verdict.ok) return;
-				const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
-				const current = channels.get(key);
-				if (current?.status === "established" && require_domain_token_scope.bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
-				const replaces = current?.status === "established" ? current : void 0;
-				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
-					answering: true,
-					track: replaces === void 0
-				});
-				await complete({
-					entry,
-					hello,
-					peer: verdict.peer,
-					replaces
-				});
+				if (claimedFrom === void 0) return;
+				sender = await identity.deriveDeviceId(hello["identity-key"]["public-key"]);
+				if (!require_domain_token_scope.bytesEqual(sender, claimedFrom)) return;
+				const held = peers.get(require_domain_device_id.deviceIdToHex(sender));
+				const now = clock.now();
+				held?.expire(now);
+				if (held?.holdsKey(hello["ephemeral-key"]) === true) return;
+				if (held?.hs !== void 0 && held.outstanding(now) && held.hs.cands.length >= 2) return;
+				if (held === void 0 && !slotAvailable(now)) return;
+				await acceptHello(hello, sender);
 			} catch (error) {
-				if (entry !== void 0) abandon(entry, error);
-				reportFault(error);
+				reportFault(error, sender);
 			}
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const key = require_domain_device_id.deviceIdToHex(claimedFrom);
-			const entry = channels.get(key);
-			if (entry?.status !== "established") return;
-			const frame = await entry.channel.open(data);
-			return frame === void 0 ? void 0 : {
-				frame,
-				from: entry.channel.peer.deviceId
-			};
+			const entry = peers.get(require_domain_device_id.deviceIdToHex(claimedFrom));
+			if (entry === void 0) return;
+			return entry.serialise(async () => openUnder(entry, data));
 		},
 		reset: (reason) => {
-			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
-			channels.clear();
+			for (const entry of [...peers.values()]) discard(entry, new Error(reason));
 		},
 		forget: (peer) => {
-			const key = require_domain_device_id.deviceIdToHex(peer);
-			const entry = channels.get(key);
-			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
-			channels.delete(key);
+			const entry = peers.get(require_domain_device_id.deviceIdToHex(peer));
+			if (entry === void 0) return;
+			if ((entry.hs?.cands.length ?? 0) + entry.pool.length === 0) {
+				discard(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
+				return;
+			}
+			entry.dropConfirmed();
 		}
 	};
 }
@@ -503,19 +747,19 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 	}
 	/** The "not connected" guard every send* method on the public session needs, deduplicated into one place rather than repeated inline at each call site: throws unless there is a live connection AND the session's own state machine agrees it is "connected" (transmit's own connection===null check alone doesn't cover the latter). Returns the connection itself, narrowed non-null, for a caller that needs to send directly on it (sendPing/sendPingMeasureRtt); a caller that only needs the throwing side effect (sendManageRequest and friends, which go through transmit instead) calls this and discards the result. */
 	function requireConnectedLink() {
-		if (connection === null || state.status !== "connected") throw new Error("not connected");
+		if (feedCancelled || connection === null || state.status !== "connected") throw new Error("not connected");
 		return connection;
 	}
 	/** Sends a frame. Through a relay it is sealed for toDevice on their secure channel first (spec/secure-channel.cddl) and only then wrapped as relay-data, so the hub carries ciphertext. This is the single choke point every outbound manage-request and manage-response passes through, so a consumer of sendManageRequest or respond never needs its own relay logic. */
-	async function transmit(frame, viaRelay, toDevice) {
+	async function transmit(frame, toDevice, purpose = "request") {
 		if (connection === null) throw new Error("not connected");
-		if (!viaRelay) {
+		if (toDevice === void 0) {
 			await connection.send(frame);
 			return;
 		}
-		if (toDevice === void 0) throw new Error("a relayed frame needs the device it is for");
-		const sealed = await (await relayChannels.ensure(toDevice)).seal(frame);
-		await connection.send(require_adapters_frame_codec.wrapRelayData(sealed, toDevice));
+		const link = connection;
+		const sealed = await relayChannels.seal(toDevice, frame, purpose);
+		await Promise.all(sealed.map(async (copy) => link.send(require_adapters_frame_codec.wrapRelayData(copy, toDevice))));
 	}
 	/** `from` is the device whose secure channel the response arrived through, absent for one that arrived directly. A pending request only accepts an answer from where it was sent: a peer must not be able to answer a request meant for another by guessing its request-id. */
 	function applyManageResponse(frame, from) {
@@ -549,7 +793,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame: response
 				});
-				await transmit(response, origin !== void 0, fromDevice);
+				await transmit(response, fromDevice, "reply");
 				emit();
 			}
 		};
@@ -567,7 +811,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "received",
 					frame: inner
 				});
-				await relayChannels.applyHello(inner);
+				await relayChannels.applyHello(inner, frame["from-device"]);
 				return;
 			}
 			if (inner?.type === "secure-data") {
@@ -834,7 +1078,10 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			},
 			async sendManageRequest(command, scope, targetDevice, token, timeoutMs) {
 				requireConnectedLink();
-				if (targetDevice !== void 0) await ensureRelayPairing(targetDevice);
+				if (targetDevice !== void 0) {
+					await ensureRelayPairing(targetDevice);
+					requireConnectedLink();
+				}
 				const frame = buildManageRequest(command, scope, token);
 				const requestId = frame["request-id"];
 				const outcome = new Promise((resolve, reject) => {
@@ -844,16 +1091,16 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 						expectedFrom: targetDevice
 					});
 				});
+				outcome.catch(() => void 0);
 				recordFrame({
 					direction: "sent",
 					frame
 				});
 				const exchange = (async () => {
 					try {
-						await transmit(frame, targetDevice !== void 0, targetDevice);
+						await transmit(frame, targetDevice);
 					} catch (error) {
 						pendingManageRequests.delete(requestId);
-						outcome.catch(() => void 0);
 						throw error;
 					}
 					emit();
@@ -888,7 +1135,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, false);
+				await transmit(frame);
 				emit();
 			},
 			async sendCoordinatorClaim(frame) {
@@ -898,7 +1145,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame: claim
 				});
-				await transmit(claim, false);
+				await transmit(claim);
 				emit();
 			},
 			async sendGossipUpdate(extensions) {
@@ -908,7 +1155,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, false);
+				await transmit(frame);
 				emit();
 			},
 			getTopologyPeers() {
@@ -921,7 +1168,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, targetDevice !== void 0, targetDevice);
+				await transmit(frame, targetDevice);
 				emit();
 			},
 			async close() {