wire-mesh-core 4.2.0 → 4.2.1

package/dist/domain/mesh-session.mjs

@@ -6,7 +6,7 @@ import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOS
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";
 import { ChannelExhaustedError } from "./channel-exhausted-error.mjs";
-import { deliverContained } from "./fault-report.mjs";
+import { createFaultReporter } from "./fault-report.mjs";
 import { localHandshake, negotiate } from "./handshake.mjs";
 import { isDataFrame } from "./hub-mailbox.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
@@ -139,6 +139,15 @@ async function verifyHello(identity, hello) {
 		};
 	}
 }
+/** True when `key` is a usable P-256 ECDH public key, so a channel can be built from a hello carrying it. Cheap enough to run before any key of this side's own is generated. */
+async function isUsableEphemeralKey(key) {
+	try {
+		await crypto.subtle.importKey("raw", Uint8Array.from(key), ECDH_PARAMS, false, []);
+		return true;
+	} catch {
+		return false;
+	}
+}
 /** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
 const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
 /** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
@@ -277,140 +286,382 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 }
 //#endregion
 //#region src/domain/relay-channels.ts
+/** How long a peer may take to answer a hello, and the window every other rule here is measured in: a handshake is outstanding for this long, a replaced channel may still open frames that were in flight for this long, and an entry younger than this is never reused. Whoever holds a hello for longer than this gains nothing, since the handshake it belongs to is over. */
+const HANDSHAKE_WINDOW_MS = 3e3;
+/** Everything held for one peer. The fields only change through the methods, so each transition has one place. */
+var PeerChannels = class {
+	peer;
+	chosen = false;
+	lastUsed;
+	/** The current channel: sealing goes through it and only it. */
+	current;
+	/** The channel the current one replaced, which may still open frames that were in flight but never seals. */
+	replaced;
+	hs;
+	/** The candidates of a handshake that ended without confirming either of two, which together serve as the channel until a frame opens under one. */
+	pool = [];
+	waiters;
+	opening = Promise.resolve();
+	constructor(peer, now) {
+		this.peer = peer;
+		this.lastUsed = now;
+	}
+	get key() {
+		return deviceIdToHex(this.peer);
+	}
+	touch(now) {
+		this.lastUsed = now;
+	}
+	choose() {
+		this.chosen = true;
+	}
+	/** True when `key` is the remote ephemeral key of anything held for the peer. */
+	holdsKey(key) {
+		return [
+			this.current?.remoteKey,
+			this.replaced?.remoteKey,
+			...(this.hs?.cands ?? []).map((cand) => cand.remoteKey),
+			...this.pool.map((cand) => cand.remoteKey)
+		].some((held) => held !== void 0 && bytesEqual(held, key));
+	}
+	/** Whether this side's handshake with the peer is outstanding: sent less than a window ago, and neither confirmed nor ended. */
+	outstanding(now) {
+		return this.hs !== void 0 && !this.hs.expired && now < this.hs.sentAt + 3e3;
+	}
+	/** Applies whatever the passing of time has ended: the replaced channel after its window, and a handshake after its window. Checked on every event, so no timer is needed. */
+	expire(now) {
+		if (this.replaced !== void 0 && now >= this.replaced.until) this.replaced = void 0;
+		const { hs } = this;
+		if (hs === void 0 || hs.expired || now < hs.sentAt + 3e3) return;
+		const [only, ...rest] = hs.cands;
+		if (this.current !== void 0) this.hs = void 0;
+		else if (only === void 0) hs.expired = true;
+		else if (rest.length === 0) {
+			this.current = {
+				...only,
+				confirmed: false
+			};
+			this.hs = void 0;
+		} else {
+			this.pool = hs.cands;
+			this.hs = void 0;
+		}
+	}
+	/** The candidates a received frame is tried against, in order. */
+	candidates() {
+		return [...this.hs?.cands ?? [], ...this.pool];
+	}
+	begin(hs) {
+		this.hs = hs;
+	}
+	/** Ends `hs` if it is still this peer's handshake. */
+	end(hs) {
+		if (this.hs !== hs) return false;
+		this.hs = void 0;
+		return true;
+	}
+	confirmCurrent() {
+		if (this.current !== void 0) this.current.confirmed = true;
+	}
+	/** A frame opened under `cand`: it becomes the current channel, the channel it replaces may open in-flight frames for a window, and every other candidate goes. */
+	confirm(cand, now) {
+		if (this.current !== void 0) this.replaced = {
+			channel: this.current.channel,
+			remoteKey: this.current.remoteKey,
+			until: now + HANDSHAKE_WINDOW_MS
+		};
+		this.current = {
+			...cand,
+			confirmed: true
+		};
+		this.hs = void 0;
+		this.pool = [];
+	}
+	/** Forgets the confirmed channel and the one it replaced, keeping every candidate. */
+	dropConfirmed() {
+		this.current = void 0;
+		this.replaced = void 0;
+	}
+	/** Forgets the current channel when it is the one that is spent. */
+	clearCurrent(channel) {
+		if (this.current?.channel === channel) this.current = void 0;
+	}
+	isEmpty() {
+		return this.current === void 0 && this.replaced === void 0 && this.hs === void 0 && this.pool.length === 0;
+	}
+	/** Resolves once some candidate exists. */
+	async waitForChannel() {
+		this.waiters ??= (() => {
+			const waiting = Promise.withResolvers();
+			waiting.promise.catch(() => void 0);
+			return waiting;
+		})();
+		return this.waiters.promise;
+	}
+	releaseWaiters() {
+		this.waiters?.resolve(void 0);
+		this.waiters = void 0;
+	}
+	rejectWaiters(error) {
+		this.waiters?.reject(error);
+		this.waiters = void 0;
+	}
+	/** Runs `task` after every earlier one for this peer: two frames opening at once must not both be tried before either has settled what it confirms. */
+	async serialise(task) {
+		const run = this.opening.then(task);
+		this.opening = run.catch(() => void 0);
+		return run;
+	}
+};
+function authentic(outcome) {
+	return outcome.ok || outcome.reason === "undecodable";
+}
+async function openFirst(cands, data) {
+	const [first, ...rest] = cands;
+	if (first === void 0) return;
+	const outcome = await first.channel.openOutcome(data);
+	return authentic(outcome) ? {
+		cand: first,
+		outcome
+	} : openFirst(rest, data);
+}
+/** A clock that never goes backwards: milliseconds from an arbitrary origin, as `performance.now()` gives them. What `createMeshSession` gives its channels. */
+const monotonicClock = { now: () => performance.now() };
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
-	const channels = /* @__PURE__ */ new Map();
-	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it goes through the shared containment in fault-report.ts. */
-	function reportFault(error) {
-		deliverContained(async () => options.onFault?.(error), 0);
+	const newHandshake = options.newHandshake ?? (async (peer) => beginHandshake(identity, peer));
+	let latest = Number.NEGATIVE_INFINITY;
+	const source = options.clock ?? monotonicClock;
+	const clock = { now: () => {
+		latest = Math.max(latest, source.now());
+		return latest;
+	} };
+	const peers = /* @__PURE__ */ new Map();
+	const reporter = createFaultReporter(() => clock.now());
+	/** Tells the owner of a failure that is local to this side, through the shared fault reporter: at most one report per peer and interval, with the number withheld, and the callback's own failure contained there. */
+	function reportFault(error, peer) {
+		reporter(peer === void 0 ? "" : deviceIdToHex(peer), async (suppressed) => options.onFault?.(error, {
+			peer,
+			suppressed
+		}));
 	}
-	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
-	function abandon(entry, error) {
+	function prune(entry) {
+		if (entry.isEmpty() && !entry.chosen && peers.get(entry.key) === entry) peers.delete(entry.key);
+	}
+	/** Ends this side's handshake `hs` with the peer, leaving every channel as it is, and tells whoever waits for a channel when there is none to wait for. */
+	function dropHandshake(entry, hs, error) {
+		if (!entry.end(hs)) return;
 		const failure = error instanceof Error ? error : new Error(String(error));
-		if (channels.get(entry.key) === entry) channels.delete(entry.key);
-		entry.settle.reject(failure);
-		entry.sent.reject(failure);
-	}
-	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
-	function start(peer, { answering, track } = {
-		answering: false,
-		track: true
-	}) {
-		const key = deviceIdToHex(peer);
-		const pending = beginHandshake(identity, peer);
-		const entry = {
-			status: "awaiting",
-			pending,
-			settle: Promise.withResolvers(),
-			key,
-			sent: Promise.withResolvers()
+		hs.sent.reject(failure);
+		if (entry.current === void 0 && entry.pool.length === 0) entry.rejectWaiters(failure);
+		prune(entry);
+	}
+	/** Drops every handshake that is waiting for its first answer beyond MAX_PENDING_HANDSHAKES, oldest first. */
+	function enforcePendingBound(keep) {
+		const pending = [...peers.values()].filter((entry) => entry.hs?.origin === "initiated" && entry.hs.cands.length === 0 && entry.current === void 0);
+		const excess = pending.filter((entry) => entry !== keep).sort((a, b) => (a.hs?.sentAt ?? 0) - (b.hs?.sentAt ?? 0)).slice(0, Math.max(0, pending.length - 256));
+		for (const entry of excess) if (entry.hs !== void 0) dropHandshake(entry, entry.hs, /* @__PURE__ */ new Error("the handshake was dropped to make room for others"));
+	}
+	/** Begins this side's own hello to the entry's peer and registers it at once, so a hello arriving meanwhile completes it instead of starting another. */
+	function beginOwn(entry, origin) {
+		const mine = newHandshake(entry.peer);
+		const hs = {
+			mine,
+			origin,
+			sentAt: clock.now(),
+			cands: [],
+			sent: Promise.withResolvers(),
+			expired: false
 		};
-		entry.settle.promise.catch(() => void 0);
-		entry.sent.promise.catch(() => void 0);
-		pending.then(async ({ hello }) => {
+		hs.sent.promise.catch(() => void 0);
+		entry.begin(hs);
+		mine.then(async ({ hello }) => {
 			try {
-				await sendHello(peer, hello);
+				await sendHello(entry.peer, hello);
 			} catch (error) {
-				abandon(entry, error);
-				entry.settle.promise.then((channel) => {
-					const held = channels.get(key);
-					if (held?.status === "established" && held.channel === channel) channels.delete(key);
-				}, () => void 0);
-				if (answering && track) reportFault(error);
+				dropHandshake(entry, hs, error);
+				if (origin === "answered") reportFault(error, entry.peer);
 				return;
 			}
-			entry.sent.resolve(void 0);
+			hs.sent.resolve(void 0);
 		}, (error) => {
-			abandon(entry, error);
+			dropHandshake(entry, hs, error);
 		});
-		if (track) channels.set(key, entry);
-		return entry;
-	}
-	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
-	async function complete({ entry, hello, peer, replaces }) {
-		const { key } = entry;
-		const established = await establishChannelFrom(identity, {
-			pending: await entry.pending,
+		return hs;
+	}
+	/** Builds the channel `hello` makes with this side's handshake `hs`, and holds it as a candidate. */
+	async function addCandidate(entry, hs, hello, peer) {
+		const channel = await establishChannelFrom(identity, {
+			pending: await hs.mine,
 			remote: hello,
 			peer,
 			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
 		});
-		if (established === void 0) {
-			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-			return;
-		}
-		if (replaces !== void 0) await entry.sent.promise;
-		if (channels.get(key) !== (replaces ?? entry)) return;
-		const channel = {
-			...established,
-			seal: async (frame) => {
-				try {
-					return await established.seal(frame);
-				} catch (error) {
-					const held = channels.get(key);
-					if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-					throw error;
-				}
-			}
-		};
-		channels.set(key, {
-			status: "established",
+		if (channel === void 0 || entry.hs !== hs || peers.get(entry.key) !== entry || hs.cands.length >= 2 || entry.holdsKey(hello["ephemeral-key"])) return;
+		hs.cands.push({
 			channel,
-			remoteEphemeralKey: hello["ephemeral-key"]
+			remoteKey: hello["ephemeral-key"]
 		});
-		entry.settle.resolve(channel);
+		entry.releaseWaiters();
+	}
+	/** The entry of a peer this side never sent anything to that may be reused now, or undefined when every slot is free or none is old enough, which is told by `slotIsFree`. An entry is reused only once it is older than the window, so answers cannot outpace the turnover of slots. */
+	function reusableEntry(now) {
+		const [victim] = [...peers.values()].filter((entry) => !entry.chosen && now - entry.lastUsed >= 3e3).sort((a, b) => a.lastUsed - b.lastUsed);
+		return victim;
+	}
+	function slotIsFree() {
+		return [...peers.values()].filter((entry) => !entry.chosen).length < 64;
+	}
+	/** Whether a peer this side never sent anything to could be given an entry now, changing nothing. */
+	function slotAvailable(now) {
+		return slotIsFree() || reusableEntry(now) !== void 0;
+	}
+	/** Makes room for a peer this side never sent anything to. */
+	function reserveUnsolicitedSlot(now) {
+		if (slotIsFree()) return true;
+		const victim = reusableEntry(now);
+		if (victim === void 0) return false;
+		discard(victim, /* @__PURE__ */ new Error("the entry was dropped to make room for others"));
+		return true;
+	}
+	function discard(entry, error) {
+		peers.delete(entry.key);
+		entry.hs?.sent.reject(error);
+		entry.rejectWaiters(error);
+	}
+	async function sealUnder(entry, channel, frame) {
+		try {
+			return await channel.seal(frame);
+		} catch (error) {
+			if (error instanceof ChannelExhaustedError) entry.clearCurrent(channel);
+			throw error;
+		}
+	}
+	async function sealFor(entry, frame) {
+		entry.expire(clock.now());
+		entry.touch(clock.now());
+		const { current, hs } = entry;
+		if (current !== void 0) return [await sealUnder(entry, current.channel, frame)];
+		if (entry.pool.length > 0) return Promise.all(entry.pool.map(async (cand) => sealUnder(entry, cand.channel, frame)));
+		if (hs === void 0) {
+			beginOwn(entry, "initiated");
+			enforcePendingBound(entry);
+			return sealFor(entry, frame);
+		}
+		if (hs.cands.length > 0) {
+			await hs.sent.promise;
+			return Promise.all(hs.cands.map(async (cand) => sealUnder(entry, cand.channel, frame)));
+		}
+		await entry.waitForChannel();
+		return sealFor(entry, frame);
+	}
+	/** Tries a frame against the peer's channels, in order: the current one, then the candidates, then the replaced one while its window lasts. */
+	async function openUnder(entry, data) {
+		entry.expire(clock.now());
+		const { current } = entry;
+		if (current !== void 0) {
+			const outcome = await current.channel.openOutcome(data);
+			if (authentic(outcome)) {
+				entry.confirmCurrent();
+				entry.touch(clock.now());
+				return outcome.ok ? {
+					frame: outcome.frame,
+					from: current.channel.peer.deviceId
+				} : void 0;
+			}
+		}
+		const found = await openFirst(entry.candidates(), data);
+		if (found !== void 0) {
+			if (peers.get(entry.key) !== entry) return;
+			entry.confirm(found.cand, clock.now());
+			entry.touch(clock.now());
+			return found.outcome.ok ? {
+				frame: found.outcome.frame,
+				from: found.cand.channel.peer.deviceId
+			} : void 0;
+		}
+		const { replaced } = entry;
+		if (replaced !== void 0 && clock.now() < replaced.until) {
+			const outcome = await replaced.channel.openOutcome(data);
+			return outcome.ok ? {
+				frame: outcome.frame,
+				from: replaced.channel.peer.deviceId
+			} : void 0;
+		}
+	}
+	async function acceptHello(hello, sender) {
+		const key = deviceIdToHex(sender);
+		const verdict = await verifyHello(identity, hello);
+		if (!verdict.ok || !await isUsableEphemeralKey(hello["ephemeral-key"])) return;
+		const now = clock.now();
+		let entry = peers.get(key);
+		entry?.expire(now);
+		if (entry?.holdsKey(hello["ephemeral-key"]) === true) return;
+		if (entry?.hs !== void 0 && entry.outstanding(now)) {
+			if (entry.hs.cands.length < 2) await addCandidate(entry, entry.hs, hello, verdict.peer);
+			return;
+		}
+		if (entry === void 0) {
+			if (!reserveUnsolicitedSlot(now)) return;
+			entry = new PeerChannels(sender, now);
+			peers.set(key, entry);
+		}
+		const hs = beginOwn(entry, "answered");
+		entry.touch(now);
+		try {
+			await addCandidate(entry, hs, hello, verdict.peer);
+		} catch (error) {
+			dropHandshake(entry, hs, error);
+			throw error;
+		}
 	}
 	return {
-		ensure: async (peer) => {
+		seal: async (peer, frame, purpose) => {
 			const key = deviceIdToHex(peer);
-			const existing = channels.get(key);
-			if (existing?.status === "established") return existing.channel;
-			return (existing ?? start(peer)).settle.promise;
+			const now = clock.now();
+			let entry = peers.get(key);
+			if (entry === void 0) {
+				if (purpose === "reply" && !reserveUnsolicitedSlot(now)) throw new Error("there is no channel with this peer");
+				entry = new PeerChannels(peer, now);
+				peers.set(key, entry);
+			}
+			if (purpose === "request") entry.choose();
+			return sealFor(entry, frame);
 		},
-		applyHello: async (hello) => {
-			let entry;
+		applyHello: async (hello, claimedFrom) => {
+			let sender;
 			try {
-				const verdict = await verifyHello(identity, hello);
-				if (!verdict.ok) return;
-				const key = deviceIdToHex(verdict.peer.deviceId);
-				const current = channels.get(key);
-				if (current?.status === "established" && bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
-				const replaces = current?.status === "established" ? current : void 0;
-				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
-					answering: true,
-					track: replaces === void 0
-				});
-				await complete({
-					entry,
-					hello,
-					peer: verdict.peer,
-					replaces
-				});
+				if (claimedFrom === void 0) return;
+				sender = await identity.deriveDeviceId(hello["identity-key"]["public-key"]);
+				if (!bytesEqual(sender, claimedFrom)) return;
+				const held = peers.get(deviceIdToHex(sender));
+				const now = clock.now();
+				held?.expire(now);
+				if (held?.holdsKey(hello["ephemeral-key"]) === true) return;
+				if (held?.hs !== void 0 && held.outstanding(now) && held.hs.cands.length >= 2) return;
+				if (held === void 0 && !slotAvailable(now)) return;
+				await acceptHello(hello, sender);
 			} catch (error) {
-				if (entry !== void 0) abandon(entry, error);
-				reportFault(error);
+				reportFault(error, sender);
 			}
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const key = deviceIdToHex(claimedFrom);
-			const entry = channels.get(key);
-			if (entry?.status !== "established") return;
-			const frame = await entry.channel.open(data);
-			return frame === void 0 ? void 0 : {
-				frame,
-				from: entry.channel.peer.deviceId
-			};
+			const entry = peers.get(deviceIdToHex(claimedFrom));
+			if (entry === void 0) return;
+			return entry.serialise(async () => openUnder(entry, data));
 		},
 		reset: (reason) => {
-			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
-			channels.clear();
+			for (const entry of [...peers.values()]) discard(entry, new Error(reason));
 		},
 		forget: (peer) => {
-			const key = deviceIdToHex(peer);
-			const entry = channels.get(key);
-			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
-			channels.delete(key);
+			const entry = peers.get(deviceIdToHex(peer));
+			if (entry === void 0) return;
+			if ((entry.hs?.cands.length ?? 0) + entry.pool.length === 0) {
+				discard(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
+				return;
+			}
+			entry.dropConfirmed();
 		}
 	};
 }
@@ -499,15 +750,15 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		return connection;
 	}
 	/** Sends a frame. Through a relay it is sealed for toDevice on their secure channel first (spec/secure-channel.cddl) and only then wrapped as relay-data, so the hub carries ciphertext. This is the single choke point every outbound manage-request and manage-response passes through, so a consumer of sendManageRequest or respond never needs its own relay logic. */
-	async function transmit(frame, viaRelay, toDevice) {
+	async function transmit(frame, toDevice, purpose = "request") {
 		if (connection === null) throw new Error("not connected");
-		if (!viaRelay) {
+		if (toDevice === void 0) {
 			await connection.send(frame);
 			return;
 		}
-		if (toDevice === void 0) throw new Error("a relayed frame needs the device it is for");
-		const sealed = await (await relayChannels.ensure(toDevice)).seal(frame);
-		await connection.send(wrapRelayData(sealed, toDevice));
+		const link = connection;
+		const sealed = await relayChannels.seal(toDevice, frame, purpose);
+		await Promise.all(sealed.map(async (copy) => link.send(wrapRelayData(copy, toDevice))));
 	}
 	/** `from` is the device whose secure channel the response arrived through, absent for one that arrived directly. A pending request only accepts an answer from where it was sent: a peer must not be able to answer a request meant for another by guessing its request-id. */
 	function applyManageResponse(frame, from) {
@@ -541,7 +792,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame: response
 				});
-				await transmit(response, origin !== void 0, fromDevice);
+				await transmit(response, fromDevice, "reply");
 				emit();
 			}
 		};
@@ -559,7 +810,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "received",
 					frame: inner
 				});
-				await relayChannels.applyHello(inner);
+				await relayChannels.applyHello(inner, frame["from-device"]);
 				return;
 			}
 			if (inner?.type === "secure-data") {
@@ -846,7 +1097,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 				});
 				const exchange = (async () => {
 					try {
-						await transmit(frame, targetDevice !== void 0, targetDevice);
+						await transmit(frame, targetDevice);
 					} catch (error) {
 						pendingManageRequests.delete(requestId);
 						throw error;
@@ -883,7 +1134,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, false);
+				await transmit(frame);
 				emit();
 			},
 			async sendCoordinatorClaim(frame) {
@@ -893,7 +1144,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame: claim
 				});
-				await transmit(claim, false);
+				await transmit(claim);
 				emit();
 			},
 			async sendGossipUpdate(extensions) {
@@ -903,7 +1154,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, false);
+				await transmit(frame);
 				emit();
 			},
 			getTopologyPeers() {
@@ -916,7 +1167,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 					direction: "sent",
 					frame
 				});
-				await transmit(frame, targetDevice !== void 0, targetDevice);
+				await transmit(frame, targetDevice);
 				emit();
 			},
 			async close() {

package/dist/domain/path-trace.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/path-trace.d.ts
 /** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
 export declare const PATH_TRACE_VERB = "path:trace";

package/dist/domain/path-trace.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/path-trace.d.ts
 /** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */
 export declare const PATH_TRACE_VERB = "path:trace";

package/dist/domain/room-rekey.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-Cb3BnuTL.cjs";
 import { r as IdentityPort } from "../identity-CQof0iEM.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/room-rekey.d.ts
 /** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */

package/dist/domain/room-rekey.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-Cb3BnuTL.mjs";
 import { r as IdentityPort } from "../identity-CUr-jaAB.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
-import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
+import { d as IncomingManageRequest, f as ManageOutcome, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/room-rekey.d.ts
 /** The error code a room.rekey is answered with when it unwrapped but the recipient could not store the keys, so the sender knows the key is not held and sends it again. */

package/dist/domain/topology.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-Cb3BnuTL.cjs";
-import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
+import { a as DirectoryEntry, d as IncomingManageRequest, p as MeshSession } from "../mesh-session-By06Mnu-.cjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";
 /** Builds the topology.get manage-command per management.cddl: the outer verb is the registered `topology:get` capability, matching every other domain-specific (non-generic) manage-command's own "outer verb is a real capability-verb" convention. */

package/dist/domain/topology.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, et as PeerAdvert, nn as TopologyPeers } from "../protocol-Cb3BnuTL.mjs";
-import { DirectoryEntry, IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
+import { a as DirectoryEntry, d as IncomingManageRequest, p as MeshSession } from "../mesh-session-DzcZYdhe.mjs";
 //#region src/domain/topology.d.ts
 export declare const TOPOLOGY_GET_CAPABILITY = "topology:get";
 /** Builds the topology.get manage-command per management.cddl: the outer verb is the registered `topology:get` capability, matching every other domain-specific (non-generic) manage-command's own "outer verb is a real capability-verb" convention. */

package/dist/domain/webrtc-signaling.d.cts

@@ -1,5 +1,5 @@
 import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-Cb3BnuTL.cjs";
-import { IncomingManageRequest } from "./mesh-session.cjs";
+import { d as IncomingManageRequest } from "../mesh-session-By06Mnu-.cjs";
 import { VerifyCapabilityTokenOptions } from "./tokens.cjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */