wire-mesh-core 4.2.0 → 4.2.1

package/README.md

@@ -14,7 +14,7 @@ The TypeScript implementation of wire-mesh's protocol, built ports/adapters: dom
 - **Handshake negotiation** (`src/domain/handshake.ts`) -- protocol-version and capability-domain negotiation between two peers, the mechanism agent-comms issue #31 is fixed by.
 - **Capability-token verification** (`src/domain/tokens.ts`) -- the full chain tokens.cddl documents: COSE_Sign1 signature verification, the self-certifying issuer-key check (`sha256(issuer-key.public-key) == issuer`), expiry/not-before, issuer-matched revocation (only a token's own issuer's signed revocation-entry counts, checked across every ancestor in the delegation chain, not just the leaf), and recursive delegation-chain narrowing across all three axes of authority: a delegated token's issuer must be its parent's bearer (the chain is unbroken), its expiry must not exceed its parent's, and its scope must narrow its parent's (identical kind, equal-or-descendant path when the parent carries one) with an identical capability verb (the verb grammar has no sub-verb relation, so a different verb is different authority, not narrower). Also exports `verifyRevocationEntry` for ingesting gossiped revocation-announce frames: each entry is itself a signed, self-certifying COSE_Sign1 over revocation-claims, verified before it may enter the revocation view.
 - **Peer-advert verification** (`src/domain/peer-advert.ts`): the two checks transport.cddl states for a gossiped advert, applied by the relay hub before it registers or forwards one and by every session before one reaches its directory: the embedded identity-key self-certifies (`sha256(identity-key.public-key) == device`), and the signature verifies under that same key over the domain-separated canonical encoding of the advert with its signature removed, which covers the open extension tail as well. Deliberately not tokens.cddl's COSE Sig_structure: an advert's open tail lets an attacker craft one whose encoding also satisfies token-claims, so the prefixed construction keeps the two byte strings disjoint. Reaches a verdict for every input rather than throwing, since an advert's algorithm and key bytes are attacker-chosen.
-- **Secure channel** (`src/domain/secure-channel.ts`, `src/domain/relay-channels.ts`): the end-to-end channel spec/secure-channel.cddl defines between two devices that reach each other through a relay. A session opens one with each peer it addresses through a relay pairing, seals every manage-request, manage-response and core/data frame in it, drops any that arrives as plain relay-data, and attributes a request to the identity the peer's handshake proved rather than to the `from-device` a hub stamps. There is no plaintext fallback, so a peer that does not speak it cannot be reached through a relay.
+- **Secure channel** (`src/domain/secure-channel.ts`, `src/domain/relay-channels.ts`): the end-to-end channel spec/secure-channel.cddl defines between two devices that reach each other through a relay. A session opens one with each peer it addresses through a relay pairing, seals every manage-request, manage-response and core/data frame in it, drops any that arrives as plain relay-data, and attributes a request to the identity the peer's handshake proved rather than to the `from-device` a hub stamps. A hello never replaces a channel by itself: it builds a candidate beside it, which takes over only once a frame from the peer opens under it, and a side does not answer a hello while its own handshake with that peer is outstanding. There is no plaintext fallback, so a peer that does not speak it cannot be reached through a relay.
 - **Relay hub** (`src/domain/relay-hub.ts`, `src/domain/relay-pairing.ts`, `src/domain/hub-mailbox.ts`): the hub's relay role against the Transport port alone. It verifies every gossiped advert before registering, forwarding or replaying it, pairs devices for relayed traffic, and, as a mailbox, replicates the `core/data` logs of devices that are offline.
 - **Consuming incoming streams** (`src/domain/consume-incoming.ts`, `src/domain/fault-report.ts`): the one way to read a session's incoming streams (`incomingManageRequests`, `incomingDataFrames`, `revocationAnnouncements`, `coordinatorFrames`, `events`). `consumeEach` handles each item in order and contains a failure while handling one, so it never ends the loop or rejects to whoever started it; `serveManageRequests` also answers a request whose handling failed with a fixed `internal-error` refusal that carries no text from the failure. A failure is told to an optional `onFault` callback through a reporter that allows one report per source per interval, with a count of those left out, and that contains a callback that throws or rejects. A loop can be stopped with an `AbortSignal`, which closes the stream's iterator so the stream's next reader takes what the stopped one did not.
 - **Bulk transfer** (`src/domain/bulk.ts`): resumable, flow-controlled `core/bulk` transfer, with a byte-credit window that the receiver's acknowledgements move. `src/domain/sharded-delivery.ts` composes it with erasure coding (`src/domain/erasure-coding.ts`) and shard manifests (`src/domain/shard-manifest.ts`) to spread a payload across holder devices.

package/dist/domain/bulk.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
 import { t as Connection } from "../transport-DaeS9N-o.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */
 export declare const BULK_WRITE_CAPABILITY = "bulk:write";

package/dist/domain/bulk.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
 import { t as Connection } from "../transport-CAD419ge.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */
 export declare const BULK_WRITE_CAPABILITY = "bulk:write";

package/dist/domain/capability-grant.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
 import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-grant.d.ts
 /**

package/dist/domain/capability-grant.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
 import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-grant.d.ts
 /**

package/dist/domain/capability-request.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-Cb3BnuTL.cjs";
 import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
-import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-ooQCcAZm.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-Cb3BnuTL.mjs";
 import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
-import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-CS4DprDE.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/consume-incoming.d.cts

@@ -1,4 +1,4 @@
-import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, f as ManageOutcome } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/consume-incoming.d.ts
 /** What a consumer is told about a failure. `item` is the item whose handling failed, or undefined when the stream itself failed. `suppressed` is how many failures from the same source were not reported before this report, not counting the one it carries (see FAULT_REPORT_INTERVAL_MS); it also counts failures of sources the reporter has stopped tracking. */
 export type ConsumeFault<T> = (error: unknown, item: T | undefined, suppressed: number) => void | Promise<void>;

package/dist/domain/consume-incoming.d.mts

@@ -1,4 +1,4 @@
-import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, f as ManageOutcome } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/consume-incoming.d.ts
 /** What a consumer is told about a failure. `item` is the item whose handling failed, or undefined when the stream itself failed. `suppressed` is how many failures from the same source were not reported before this report, not counting the one it carries (see FAULT_REPORT_INTERVAL_MS); it also counts failures of sources the reporter has stopped tracking. */
 export type ConsumeFault<T> = (error: unknown, item: T | undefined, suppressed: number) => void | Promise<void>;

package/dist/domain/direct-manage-request.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
 import { r as Transport, t as Connection } from "../transport-DaeS9N-o.cjs";
-import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, f as ManageOutcome } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
 export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;

package/dist/domain/direct-manage-request.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
 import { r as Transport, t as Connection } from "../transport-CAD419ge.mjs";
-import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, f as ManageOutcome } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */
 export declare function acceptDirectManageRequest(connection: Readonly<Connection>): Promise<IncomingManageRequest | null>;

package/dist/domain/gossip-expansion.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, et as PeerAdvert } from "../protocol-Cb3BnuTL.cjs";
-import { MeshSession } from "./mesh-session.cjs";
+import { p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */
 export interface GossipExpansionCandidate {

package/dist/domain/gossip-expansion.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, et as PeerAdvert } from "../protocol-Cb3BnuTL.mjs";
-import { MeshSession } from "./mesh-session.mjs";
+import { p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */
 export interface GossipExpansionCandidate {

package/dist/domain/grant-candidates.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, f as CapabilityScope } from "../protocol-Cb3BnuTL.cjs";
-import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
+import { a as DirectoryEntry, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts
 declare const grantCandidateSchema: z.ZodObject<{

package/dist/domain/grant-candidates.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, f as CapabilityScope } from "../protocol-Cb3BnuTL.mjs";
-import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
+import { a as DirectoryEntry, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts
 declare const grantCandidateSchema: z.ZodObject<{