@anycon/protocol 0.1.0

package/LICENSE

@@ -0,0 +1,176 @@
+                              Apache License
+                        Version 2.0, January 2004
+                     http://www.apache.org/licenses/
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+   "License" shall mean the terms and conditions for use, reproduction,
+   and distribution as defined by Sections 1 through 9 of this document.
+
+   "Licensor" shall mean the copyright owner or entity authorized by
+   the copyright owner that is granting the License.
+
+   "Legal Entity" shall mean the union of the acting entity and all
+   other entities that control, are controlled by, or are under common
+   control with that entity. For the purposes of this definition,
+   "control" means (i) the power, direct or indirect, to cause the
+   direction or management of such entity, whether by contract or
+   otherwise, or (ii) ownership of fifty percent (50%) or more of the
+   outstanding shares, or (iii) beneficial ownership of such entity.
+
+   "You" (or "Your") shall mean an individual or Legal Entity
+   exercising permissions granted by this License.
+
+   "Source" form shall mean the preferred form for making modifications,
+   including but not limited to software source code, documentation
+   source, and configuration files.
+
+   "Object" form shall mean any form resulting from mechanical
+   transformation or translation of a Source form, including but
+   not limited to compiled object code, generated documentation,
+   and conversions to other media types.
+
+   "Work" shall mean the work of authorship, whether in Source or
+   Object form, made available under the License, as indicated by a
+   copyright notice that is included in or attached to the work
+   (an example is provided in the Appendix below).
+
+   "Derivative Works" shall mean any work, whether in Source or Object
+   form, that is based on (or derived from) the Work and for which the
+   editorial revisions, annotations, elaborations, or other modifications
+   represent, as a whole, an original work of authorship. For the purposes
+   of this License, Derivative Works shall not include works that remain
+   separable from, or merely link (or bind by name) to the interfaces of,
+   the Work and Derivative Works thereof.
+
+   "Contribution" shall mean any work of authorship, including
+   the original version of the Work and any modifications or additions
+   to that Work or Derivative Works thereof, that is intentionally
+   submitted to Licensor for inclusion in the Work by the copyright owner
+   or by an individual or Legal Entity authorized to submit on behalf of
+   the copyright owner. For the purposes of this definition, "submitted"
+   means any form of electronic, verbal, or written communication sent
+   to the Licensor or its representatives, including but not limited to
+   communication on electronic mailing lists, source code control systems,
+   and issue tracking systems that are managed by, or on behalf of, the
+   Licensor for the purpose of discussing and improving the Work, but
+   excluding communication that is conspicuously marked or otherwise
+   designated in writing by the copyright owner as "Not a Contribution."
+
+   "Contributor" shall mean Licensor and any individual or Legal Entity
+   on behalf of whom a Contribution has been received by Licensor and
+   subsequently incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   copyright license to reproduce, prepare Derivative Works of,
+   publicly display, publicly perform, sublicense, and distribute the
+   Work and such Derivative Works in Source or Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of
+   this License, each Contributor hereby grants to You a perpetual,
+   worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+   (except as stated in this section) patent license to make, have made,
+   use, offer to sell, sell, import, and otherwise transfer the Work,
+   where such license applies only to those patent claims licensable
+   by such Contributor that are necessarily infringed by their
+   Contribution(s) alone or by combination of their Contribution(s)
+   with the Work to which such Contribution(s) was submitted. If You
+   institute patent litigation against any entity (including a
+   cross-claim or counterclaim in a lawsuit) alleging that the Work
+   or a Contribution incorporated within the Work constitutes direct
+   or contributory patent infringement, then any patent licenses
+   granted to You under this License for that Work shall terminate
+   as of the date such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the
+   Work or Derivative Works thereof in any medium, with or without
+   modifications, and in Source or Object form, provided that You
+   meet the following conditions:
+
+   (a) You must give any other recipients of the Work or
+       Derivative Works a copy of this License; and
+
+   (b) You must cause any modified files to carry prominent notices
+       stating that You changed the files; and
+
+   (c) You must retain, in the Source form of any Derivative Works
+       that You distribute, all copyright, patent, trademark, and
+       attribution notices from the Source form of the Work,
+       excluding those notices that do not pertain to any part of
+       the Derivative Works; and
+
+   (d) If the Work includes a "NOTICE" text file as part of its
+       distribution, then any Derivative Works that You distribute must
+       include a readable copy of the attribution notices contained
+       within such NOTICE file, excluding those notices that do not
+       pertain to any part of the Derivative Works, in at least one
+       of the following places: within a NOTICE text file distributed
+       as part of the Derivative Works; within the Source form or
+       documentation, if provided along with the Derivative Works; or,
+       within a display generated by the Derivative Works, if and
+       wherever such third-party notices normally appear. The contents
+       of the NOTICE file are for informational purposes only and
+       do not modify the License. You may add Your own attribution
+       notices within Derivative Works that You distribute, alongside
+       or as an addendum to the NOTICE text from the Work, provided
+       that such additional attribution notices cannot be construed
+       as modifying the License.
+
+   You may add Your own copyright statement to Your modifications and
+   may provide additional or different license terms and conditions
+   for use, reproduction, or distribution of Your modifications, or
+   for any such Derivative Works as a whole, provided Your use,
+   reproduction, and distribution of the Work otherwise complies with
+   the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise,
+   any Contribution intentionally submitted for inclusion in the Work
+   by You to the Licensor shall be under the terms and conditions of
+   this License, without any additional terms or conditions.
+   Notwithstanding the above, nothing herein shall supersede or modify
+   the terms of any separate license agreement you may have executed
+   with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade
+   names, trademarks, service marks, or product names of the Licensor,
+   except as required for reasonable and customary use in describing the
+   origin of the Work and reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or
+   agreed to in writing, Licensor provides the Work (and each
+   Contributor provides its Contributions) on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied, including, without limitation, any warranties or conditions
+   of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+   PARTICULAR PURPOSE. You are solely responsible for determining the
+   appropriateness of using or redistributing the Work and assume any
+   risks associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory,
+   whether in tort (including negligence), contract, or otherwise,
+   unless required by applicable law (such as deliberate and grossly
+   negligent acts) or agreed to in writing, shall any Contributor be
+   liable to You for damages, including any direct, indirect, special,
+   incidental, or consequential damages of any character arising as a
+   result of this License or out of the use or inability to use the
+   Work (including but not limited to damages for loss of goodwill,
+   work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses), even if such Contributor
+   has been advised of the possibility of such damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing
+   the Work or Derivative Works thereof, You may choose to offer,
+   and charge a fee for, acceptance of support, warranty, indemnity,
+   or other liability obligations and/or rights consistent with this
+   License. However, in accepting such obligations, You may act only
+   on Your own behalf and on Your sole responsibility, not on behalf
+   of any other Contributor, and only if You agree to indemnify,
+   defend, and hold each Contributor harmless for any liability
+   incurred by, or claims asserted against, such Contributor by reason
+   of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,146 @@
+# @anycon/protocol
+
+[简体中文](https://github.com/anycon-ai/anycon/blob/main/packages/protocol/README.zh-CN.md)
+
+The TypeScript side of the [Anycon](https://github.com/anycon-ai/anycon) protocol: the layer with no networking and no state. The Web UI and [`@anycon/sdk`](https://www.npmjs.com/package/@anycon/sdk) both build on it. To pair with a node and drive sessions, use `@anycon/sdk`. This package is for code that works with the wire format directly.
+
+```bash
+npm install @anycon/protocol
+```
+
+The design docs linked below are in Chinese for now.
+
+| Module | Contents |
+|---|---|
+| `src/generated.ts` | **Generated, do not edit.** `just gen-ts` generates it from `schema/protocol.json` (exported by `crates/protocol`): `Control`, `Event`, `SessionEvent`, the params / result types of each method, … |
+| `src/envelope.ts` | msgpack codec for the outer envelope and control messages: `encodeEnvelope` / `decodeEnvelope`, `encodeControl` / `decodeControl`, `controlEnvelope`, `CONTROL_TYPES`. Also the fragmentation framing for `data` envelope bodies: `encodeFrames` / `decodeFrame` / `Reassembler` / `resetBody` (see below) |
+| `src/rpc.ts` | JSON-RPC 2.0: `encodeRpc` / `decodeRpc`, `isRequest` / `isNotification` / `isResponse`, `AnyconRpcError`, and the transport-agnostic `RpcPeer` |
+| `src/method-types.ts` | **Generated, do not edit.** `just gen-ts` runs `tools/gen-method-types.ts` on `schema/methods.json` (the method registry in `crates/protocol`) to produce `RequestMethods` (client → daemon requests: method name → `{ params, result }`) and `NotificationMethods` (daemon → client notifications: method name → `{ params }`). `tests/method-types.test.ts` asserts that it is in sync with the schema |
+| `src/crypto.ts` | `loadCrypto()`: wraps the wasm build of `crates/crypto` (Noise XXpsk3 / IK, a transport that fragments long messages, `derivePairSecrets`, `generatePairCodeLong`, `fingerprint`), with `Uint8Array` in and out. Also pure-JS pairing-code helpers: `normalizePairCode` / `isValidPairCode` / `formatPairCode` / `extractPairCode` |
+| `src/constants.ts` | `PROTOCOL_VERSION`, `ENVELOPE_VERSION`, `METHODS` (method name constants, including `PAIR_ACK`), `CLOSE_CODE`, `PAIR_CODE_ALPHABET`, `PAIR_CODE_LEN` / `PAIR_CODE_LEN_LONG`, `ERROR_CODE_NUMBERS` |
+
+## Usage
+
+```ts
+import {
+  METHODS,
+  Reassembler,
+  RpcPeer,
+  controlEnvelope,
+  decodeEnvelope,
+  decodeFrame,
+  encodeEnvelope,
+  encodeFrames,
+  loadCrypto,
+  type Control,
+  type SessionEvent,
+} from '@anycon/protocol'
+
+// Envelopes: body is a Uint8Array (msgpack bin), kind is a snake_case string
+const frame = encodeEnvelope({ v: 1, from: myId, to: nodeId, kind: 'data', seq: 7, body })
+const env = decodeEnvelope(bytes)
+
+// Control messages: for messages to the hub, from and to are both empty strings.
+// Pairing sends only match_id. The pairing code itself never leaves this device.
+// derivePairSecrets is one Argon2id run (64 MiB × 3 passes; about 0.1–0.3 s in Node and
+// 0.1–1 s in browsers, blocking the thread). It produces match_id and the PSK in one go, so
+// don't call deriveMatchId / derivePsk separately (each is a full KDF run). Zero psk with fill(0) after use.
+const crypto = await loadCrypto()
+const { matchId, psk } = crypto.derivePairSecrets('7K3P-Q2MX')
+ws.send(encodeEnvelope(controlEnvelope('', seq, { type: 'pair_join', match_id: matchId })))
+// …run the XXpsk3 handshake with crypto.pairing('initiator', keypair, psk)…
+psk.fill(0)
+
+// JSON-RPC: one message = one Transport.encrypt = one msg_id. encodeFrames splits the ciphertext
+// into one or more data envelopes (a short message is a single WHOLE frame).
+const rpc = new RpcPeer({
+  send: (bytes) => {
+    for (const body of encodeFrames(transport.encrypt(bytes), msgId++ >>> 0)) sendData(body)
+  },
+})
+// Receiving: const ct = reassembler.push(decodeFrame(env.body)); if (ct) rpc.handle(transport.decrypt(ct))
+rpc.onNotification<SessionEvent>(METHODS.SESSION_EVENT, (e) => {
+  /* … */
+})
+// Errors throw AnyconRpcError; .code is a stable snake_case string
+const info = await rpc.request(METHODS.NODE_INFO, {}, { timeoutMs: 10_000 })
+```
+
+Notes:
+
+- Pass `{}` for requests without parameters (not `undefined` / `null`). The Rust side's `Empty` is `{}`. `RpcPeer.request` already defaults to `{}`.
+- `decodeControl` throws `UnknownControlError` for an unknown `type` (this can happen when the hub and daemon versions don't match). Callers should ignore that frame instead of disconnecting.
+- Envelope key order, control message key order, and the omission of `skip_serializing_if` fields all match Rust's `rmp_serde::to_vec_named`. `tests/vectors` enforces this.
+
+## Fragmenting data envelopes (ADR-30)
+
+The hub limits the size of a single envelope (256 KiB by default), and one RPC (such as a page of history) can be larger, so Noise ciphertext is fragmented at the envelope layer. The first byte of a `data` envelope body is a flags byte. The byte format matches `mod frame` in `crates/protocol/src/envelope.rs` exactly:
+
+| flags | Meaning | Payload |
+|---|---|---|
+| `0x00` WHOLE | The complete output of one `Transport.encrypt` | Ciphertext |
+| `0x01` FRAGMENT | One fragment | `[u32 be msg_id][u16 be index][u16 be count]` + a slice of the ciphertext. Fragments of one `msg_id` are sent in `index` order and are not interleaved with other messages |
+| `0x02` RESET | The sender found its transport out of sync and asks the peer to drop the transport and handshake again | None |
+
+- `encodeFrames(ciphertext, msgId)` → `Uint8Array[]` (each is the body of one `data` envelope, with at most `MAX_FRAGMENT` = 200 KiB of payload per fragment; `msgId` is a u32, one per RPC). `decodeFrame(body)` → `DataFrame` (a malformed body throws `FrameError`, whose `.code` is `empty | unknown_flags | truncated | out_of_order | count_mismatch | too_large`). `new Reassembler()` (one per peer): `push(frame)` returns the whole ciphertext or `undefined`; the total length is capped at `MAX_MESSAGE` = 16 MiB; on error the reassembly in progress is discarded; `clear()` resets it. Also `resetBody()` and `pushBody(reassembler, body)`.
+- `Reassembler` is strictly ordered, the same as in Rust: `index` must equal the next expected fragment; `index >= count` is `out_of_order`; changing `count` midway through a `msg_id` is `count_mismatch`; `count == 0` is `count_mismatch`; a single FRAGMENT with `count == 1` is accepted; after one message completes, another with the same `msg_id` must start again at `index 0`. `index` / `count` are u16, and comparisons don't overflow (`count = 65535` works through the last fragment).
+- Noise nonces are sequential, so **losing or reordering any fragment desynchronizes the transport**. For a paired `(from, to)`, the hub only forwards an envelope or bounces it back with `backpressure { to, seq }`. It never drops one silently, and bounces are "sticky": once a seq is bounced, every later envelope is bounced too, until that seq is resent successfully ([docs/protocol.md](https://github.com/anycon-ai/anycon/blob/main/docs/protocol.md) § 3.1).
+  - Senders keep the raw bytes of recently sent envelopes (capped by size, at least 8 MiB). On `backpressure`, pause that peer, wait `retry_after_ms` (from the latest `rate_limited`, or 100–300 ms plus jitter if there is none), resend every bounced seq **in ascending order, byte for byte** (never re-encrypt), then continue. If a bounced seq is no longer in the buffer, drop the Transport and handshake again.
+  - `rate_limited { retry_after_ms }` is only a hint for how long to pause. It doesn't mean an envelope was dropped.
+  - `dropped { seq, reason }` arrives at most once per connection per second and means something wrong was sent (`too_large` = not fragmented, or still over the limit after fragmenting; `not_paired` = the devices aren't paired as expected). **Don't resend on it.** Treat it as an error and handshake again.
+  - Receivers drop the Transport and handshake again on a decryption failure, a reassembly error, or a RESET.
+
+  The SDK's implementation is in `packages/sdk/src/link.ts`.
+- Vectors: `tests/vectors/frames.json` (generated from Rust by `tools/gen-vectors`). The ciphertext of large messages is the deterministic pattern `(i % 251) as u8`. Only each fragment's header and length are stored; the TS side rebuilds the data and compares its encoding byte for byte. The file also has decode cases (including various bad bodies) and step-by-step `Reassembler` results (including state cleanup after errors).
+
+## wasm (Noise)
+
+```ts
+const crypto = await loadCrypto() // Node / Bun: reads ../wasm/anycon_crypto_bg.wasm automatically
+const crypto = await loadCrypto({ wasm: wasmUrl }) // Browser: let your bundler provide the .wasm URL, e.g. with Vite's `?url` import
+```
+
+The published package ships the wasm build in `wasm/`. In a repository checkout, `just gen-wasm` builds it into `packages/protocol/wasm/` (gitignored). If the build is missing, `loadCrypto()` throws `CryptoUnavailableError`, and the message says to run `just gen-wasm`. The package exports `@anycon/protocol/wasm/*`, so in the browser you can `import url from '@anycon/protocol/wasm/anycon_crypto_bg.wasm?url'` directly.
+
+**Pairing KDF (ADR-29, revised).** `Crypto.derivePairSecrets(code) -> { matchId, psk }` runs `Argon2id(salt = "anycon-pair-v2", m = 64 MiB, t = 3, p = 1, out = 64)` once over the normalized pairing code. The hex of the first 8 bytes is the `matchId` sent to the hub for matching, and the last 32 bytes are the PSK. It takes about 0.1–0.3 s in Node and about 0.1–1 s in browsers, and it **blocks the thread** (a UI should show "Deriving key…" before calling it, so the browser can paint a frame first). The pairing path calls only this function. Don't also call `deriveMatchId` / `derivePsk` separately (each is a full KDF run, so that computes it twice). `psk` is a copy: zero it with `fill(0)` after use. Known vectors: `ABCD2345` → `matchId = 94d67d781538d997`, `psk = 23e8b63d…6012`; `23456789` → `f9f3c6c9940049ac` / `17d04f19…bb20` (`tests/crypto.test.ts`).
+
+Keypairs in the `Crypto` interface are plain data (`{ public, secret }`) and are rebuilt inside wasm only for the duration of a handshake, so there are no wasm-bindgen ownership issues.
+Roles: in pairing (XXpsk3) the joiner is `initiator` and the host (daemon) is `responder`. In reconnection (IK) the client is `initiator`. **The initiator writes first.**
+
+## Consuming from a bundler
+
+`exports` has two development conditions, `source` and `bun`, which point to `src/index.ts`, so inside the workspace you don't need to `build` first:
+
+- tsconfig: `"customConditions": ["source"]` (the root `tsconfig.base.json` already sets it)
+- Vite: `resolve: { conditions: ['source'] }`
+- The published package and plain Node resolution use `dist/`
+
+## Development
+
+```bash
+bun run --cwd packages/protocol test        # bun test (with the wasm build present, also runs real handshakes and the Argon2id vectors)
+bun run --cwd packages/protocol test:node   # the same tests on Node (tsx)
+bun run --cwd packages/protocol typecheck
+bun run --cwd packages/protocol build       # tsc → dist/ (ESM + .d.ts)
+bun run --cwd packages/protocol lint        # oxlint
+```
+
+### Test vectors
+
+`tests/vectors/` holds the output of the real Rust encoder (`<name>.hex`) and the logical values (`manifest.json`). They cover every `Control` variant, envelopes with various `seq` / `body` lengths (empty, bin8, bin16, u64), and the four JSON-RPC shapes. `frames.json` holds the vectors for the data-envelope framing. On the TS side, decoding must yield the logical value, and re-encoding must match byte for byte.
+They are generated by `tools/gen-vectors` (a standalone cargo project, not a workspace member):
+
+```bash
+just gen-vectors      # only needed when the protocol encoding changes; CI's gen-check diffs the result
+```
+
+`tests/constants.test.ts` parses the source of `crates/protocol/src/{methods,lib,control,error,envelope}.rs` (and `crates/crypto/src/lib.rs` for the pairing-code length)
+and asserts that method names (including `pair.ack`), version numbers, pairing-code lengths, frame constants (flags / fragment size / reassembly limit), close codes, error code numbers, `Control` variants (including `pair_registered` and `dropped`), and `Kind` variants match this package (a drift guard).
+
+### Generated method type table
+
+`src/method-types.ts` isn't written by hand. `methods::REGISTRY` in `crates/protocol` is the single source of truth for "method name → params / result type names". `just gen-schema` exports it to `schema/methods.json`, then `just gen-ts` runs `tools/gen-method-types.ts` (`bun packages/protocol/tools/gen-method-types.ts [--check]`) to generate this file. Type names must be names exported by `generated.ts`; an unknown name is an error. After changing the registry, run `just gen` and commit `schema/` together with the two generated files. `serde_json::Value` is already `unknown` in the schema, so there are no hand-written workarounds.
+
+## License
+
+[Apache-2.0](https://github.com/anycon-ai/anycon/blob/main/LICENSE)

package/README.zh-CN.md

@@ -0,0 +1,118 @@
+# @anycon/protocol
+
+[English](https://github.com/anycon-ai/anycon/blob/main/packages/protocol/README.md)
+
+anycon 协议的 TypeScript 侧：无网络、无状态的那一层。Web UI 和 `@anycon/sdk` 共用。
+
+| 模块 | 内容 |
+|---|---|
+| `src/generated.ts` | **生成**，不要手改。`just gen-ts` 从 `schema/protocol.json`（`crates/protocol` 导出）生成：`Control`、`Event`、`SessionEvent`、各方法的 params / result…… |
+| `src/envelope.ts` | 外层信封与控制消息的 msgpack 编解码：`encodeEnvelope` / `decodeEnvelope`、`encodeControl` / `decodeControl`、`controlEnvelope`、`CONTROL_TYPES`；以及 `data` 信封 body 的分片框架 `encodeFrames` / `decodeFrame` / `Reassembler` / `resetBody`（见下） |
+| `src/rpc.ts` | JSON-RPC 2.0：`encodeRpc` / `decodeRpc`、`isRequest` / `isNotification` / `isResponse`、`AnyconRpcError`、与传输无关的 `RpcPeer` |
+| `src/method-types.ts` | **生成**，不要手改。`just gen-ts` 用 `tools/gen-method-types.ts` 从 `schema/methods.json`（`crates/protocol` 的方法注册表）生成：`RequestMethods`（C→D 请求：方法名 → `{ params, result }`）、`NotificationMethods`（D→C 通知：方法名 → `{ params }`）。`tests/method-types.test.ts` 断言它与 schema 同步 |
+| `src/crypto.ts` | `loadCrypto()`：封装 `crates/crypto` 的 wasm 产物（Noise XXpsk3 / IK、分片传输、`derivePairSecrets`、`generatePairCodeLong`、`fingerprint`），`Uint8Array` 进出；纯 JS 的短码辅助 `normalizePairCode` / `isValidPairCode` / `formatPairCode` / `extractPairCode` |
+| `src/constants.ts` | `PROTOCOL_VERSION`、`ENVELOPE_VERSION`、`METHODS`（方法名常量，含 `PAIR_ACK`）、`CLOSE_CODE`、`PAIR_CODE_ALPHABET`、`PAIR_CODE_LEN` / `PAIR_CODE_LEN_LONG`、`ERROR_CODE_NUMBERS` |
+
+## 用法
+
+```ts
+import {
+  METHODS, RpcPeer, Reassembler, encodeEnvelope, decodeEnvelope, controlEnvelope,
+  encodeFrames, decodeFrame, loadCrypto,
+  type Control, type SessionEvent,
+} from '@anycon/protocol'
+
+// 信封：body 是 Uint8Array（msgpack bin），kind 是 snake_case 字符串
+const frame = encodeEnvelope({ v: 1, from: myId, to: nodeId, kind: 'data', seq: 7, body })
+const env = decodeEnvelope(bytes)
+
+// 控制消息：发给 hub 的 from / to 都填空串。配对只发 match_id，短码本身不出本机。
+// derivePairSecrets 是一次 Argon2id（64 MiB × 3 轮，Node 约 0.1–0.3 s、浏览器约 0.1–1 s，同步阻塞）：
+// match_id 和 PSK 一次算出，别分别调 deriveMatchId / derivePsk（各是一次完整 KDF）；psk 用完 fill(0)
+const crypto = await loadCrypto()
+const { matchId, psk } = crypto.derivePairSecrets('7K3P-Q2MX')
+ws.send(encodeEnvelope(controlEnvelope('', seq, { type: 'pair_join', match_id: matchId })))
+// …用 psk 做 crypto.pairing('initiator', keypair, psk) 的 XXpsk3 握手…
+psk.fill(0)
+
+// JSON-RPC：一条消息 = 一次 Transport.encrypt = 一个 msg_id；密文按 frame 切成若干 data 信封（短消息就是一个 WHOLE）
+const rpc = new RpcPeer({
+  send: (bytes) => {
+    for (const body of encodeFrames(transport.encrypt(bytes), msgId++ >>> 0)) sendData(body)
+  },
+})
+// 收：const ct = reassembler.push(decodeFrame(env.body)); if (ct) rpc.handle(transport.decrypt(ct))
+rpc.onNotification<SessionEvent>(METHODS.SESSION_EVENT, (e) => { /* … */ })
+const info = await rpc.request(METHODS.NODE_INFO, {}, { timeoutMs: 10_000 })   // 错误抛 AnyconRpcError，.code 是稳定 snake_case
+```
+
+注意：
+
+- 请求没有参数时传 `{}`（不是 `undefined` / `null`），Rust 侧的 `Empty` 是 `{}`；`RpcPeer.request` 已经默认成 `{}`。
+- `decodeControl` 对未知 `type` 抛 `UnknownControlError`（hub / daemon 版本错位时可能出现），调用方应忽略这一帧而不是断连。
+- 信封键序、控制消息键序、`skip_serializing_if` 字段的省略都与 Rust 的 `rmp_serde::to_vec_named` 一致，由 `tests/vectors` 守着。
+
+## data 信封的分片（ADR-30）
+
+hub 对单个信封有大小上限（默认 256 KiB），一条 RPC（如一页历史）可能更大，所以 Noise 密文在信封层分片。`data` 信封 body 的第一个字节是 flags，字节格式与 `crates/protocol/src/envelope.rs` 的 `mod frame` 逐字节一致：
+
+| flags | 含义 | 载荷 |
+|---|---|---|
+| `0x00` WHOLE | 一整条 `Transport.encrypt` 的输出 | 密文 |
+| `0x01` FRAGMENT | 分片 | `[u32 be msg_id][u16 be index][u16 be count]` + 密文切片。同一 `msg_id` 的分片按 `index` 顺序、不与其他消息交错地发送 |
+| `0x02` RESET | 发送方发现传输失步，请对端丢弃传输并重新握手 | 无 |
+
+- `encodeFrames(ciphertext, msgId)` → `Uint8Array[]`（每个是一个 `data` 信封的 body，每片载荷 ≤ `MAX_FRAGMENT` = 200 KiB；`msgId` 是 u32，每条 RPC 一个）、`decodeFrame(body)` → `DataFrame`（格式错抛 `FrameError`，`.code` 是 `empty | unknown_flags | truncated | out_of_order | count_mismatch | too_large`）、`new Reassembler()`（每个对端一个；`push(frame)` 返回整条密文或 `undefined`；总长上限 `MAX_MESSAGE` = 16 MiB；出错时进行中的重组被丢弃；`clear()`）、`resetBody()`、`pushBody(reassembler, body)`。
+- `Reassembler` 严格按序，与 Rust 一致：`index` 必须等于期望的下一片；`index >= count` 报 `out_of_order`；同一 `msg_id` 中途改 `count` 报 `count_mismatch`；`count == 0` 报 `count_mismatch`；`count == 1` 的单片 FRAGMENT 也能收；一条收完后同一 `msg_id` 再来要从 `index 0` 开始；`index` / `count` 是 u16，比较不会溢出（`count = 65535` 走到最后一片也正常）。
+- Noise 的 nonce 是顺序的，**任何一片丢失或乱序都意味着传输失步**。hub 对已配对的 `(from, to)` 只会转发或退回 `backpressure { to, seq }`，不会静默丢弃，并且「粘住」（一个 seq 被退回后，后续信封一律退回，直到它被重发成功，docs/protocol.md § 3.1）。发送方：保留最近发出的信封原文（按字节封顶，≥ 8 MiB）；收到 `backpressure` 后暂停该对端，等 `retry_after_ms`（最近一条 `rate_limited` 给的，没有就 100–300 ms + 抖动），把所有被退回的 seq **按升序原样重发**（不能重新加密），再继续；被退回的 seq 已不在缓冲里 → 丢 Transport 重新握手。`rate_limited { retry_after_ms }` 只是暂停多久的提示，不再意味着有信封被丢。`dropped { seq, reason }` 每连接每秒至多一条，是「发错东西」的信号（`too_large` = 没分片 / 分片后仍超限，`not_paired` = 配对关系不对），**不要据此重发**，当作错误处理并重新握手。接收方解密失败、重组出错、收到 RESET 都要丢 Transport 并重新握手。SDK 的实现见 `packages/sdk/src/link.ts`。
+- 向量：`tests/vectors/frames.json`（`tools/gen-vectors` 用 Rust 生成）。大消息的密文约定为 `(i % 251) as u8` 的确定性图样，只存各片的头和长度，TS 侧还原后逐字节比对 encode；另有 decode（含各种坏 body）和 Reassembler 的逐步结果（含出错后的状态清理）。
+
+## wasm（Noise）
+
+```ts
+const crypto = await loadCrypto()                    // Node / Bun：自动读 ../wasm/anycon_crypto_bg.wasm
+const crypto = await loadCrypto({ wasm: wasmUrl })   // 浏览器：把 .wasm 的 URL 交给打包器，例如 Vite 的 `?url` 导入
+```
+
+产物由 `just gen-wasm` 生成到 `packages/protocol/wasm/`（已 gitignore）。产物不存在时 `loadCrypto()` 抛 `CryptoUnavailableError`，消息里写明要跑 `just gen-wasm`。
+包导出 `@anycon/protocol/wasm/*`，浏览器侧可以直接 `import url from '@anycon/protocol/wasm/anycon_crypto_bg.wasm?url'`。
+
+**配对 KDF（ADR-29 修订）**：`Crypto.derivePairSecrets(code) -> { matchId, psk }` 对规范化短码做一次 `Argon2id(salt = "anycon-pair-v2", m = 64 MiB, t = 3, p = 1, out = 64)`：前 8 字节的 hex 是发给 hub 撮合的 `matchId`，后 32 字节是 PSK。耗时 Node / 本机 wasm 约 0.1–0.3 s，浏览器约 0.1–1 s，**同步占用线程**（UI 要先显示「正在派生密钥…」再调用，让浏览器先画一帧）。配对路径只调这一个，不要再分别调 `deriveMatchId` / `derivePsk`（各是一次完整 KDF，等于算两遍）；`psk` 是拷贝，用完 `fill(0)`。已知向量：`ABCD2345` → `matchId = 94d67d781538d997`、`psk = 23e8b63d…6012`；`23456789` → `f9f3c6c9940049ac` / `17d04f19…bb20`（`tests/crypto.test.ts`）。
+
+`Crypto` 接口里的密钥对是纯数据（`{ public, secret }`），握手时才在 wasm 里临时重建，没有 wasm-bindgen 的所有权问题。
+角色：配对（XXpsk3）joiner 是 `initiator`、host（daemon）是 `responder`；重连（IK）客户端是 `initiator`。**initiator 先写**。
+
+## 命令
+
+```bash
+bun run --cwd packages/protocol test        # bun test（wasm 存在时多跑真实握手和 Argon2id 向量）
+bun run --cwd packages/protocol test:node   # 同一批用例在 Node 上跑（tsx）
+bun run --cwd packages/protocol typecheck
+bun run --cwd packages/protocol build       # tsc → dist/（ESM + .d.ts）
+bun run --cwd packages/protocol lint        # oxlint
+```
+
+## 测试向量
+
+`tests/vectors/` 里是 Rust 真实编码器的输出（`<name>.hex`）和逻辑值（`manifest.json`），覆盖全部 `Control` 变体、
+信封的各种 `seq` / `body` 长度（空、bin8、bin16、u64）、JSON-RPC 的四种形状；`frames.json` 是 data 信封分片框架的向量。TS 侧解码后必须等于逻辑值，再编码必须逐字节一致。
+由 `tools/gen-vectors`（独立的 cargo 工程，不是 workspace 成员）生成：
+
+```bash
+just gen-vectors      # 协议编码变了才需要；CI 的 gen-check 会 diff
+```
+
+`tests/constants.test.ts` 解析 `crates/protocol/src/{methods,lib,control,error,envelope}.rs` 的源码，
+断言方法名（含 `pair.ack`）、版本号、短码长度、frame 常量（flags / 片大小 / 重组上限）、close code、错误码数值、`Control` 变体（含 `pair_registered`、`dropped`）、`Kind` 变体与这里一致（漂移守卫）。
+
+## 方法类型表（生成）
+
+`src/method-types.ts` 不手写：`crates/protocol` 的 `methods::REGISTRY` 是「方法名 → params / result 类型名」的唯一真源，`just gen-schema` 导出到 `schema/methods.json`，`just gen-ts` 再跑 `tools/gen-method-types.ts`（`bun packages/protocol/tools/gen-method-types.ts [--check]`）生成这个文件。类型名必须是 `generated.ts` 导出的名字，找不到就报错。改了注册表之后 `just gen`，提交 `schema/` 和这两个生成文件。`serde_json::Value` 在 schema 里已经是 `unknown`，没有手写的绕过。
+
+## 在打包器里消费
+
+`exports` 带两个开发条件：`source` 和 `bun`，指向 `src/index.ts`，所以 workspace 内不用先 `build`：
+
+- tsconfig：`"customConditions": ["source"]`（根 `tsconfig.base.json` 已经带）
+- Vite：`resolve: { conditions: ['source'] }`
+- 发布 / 普通 Node 解析走 `dist/`

package/dist/constants.d.ts

@@ -0,0 +1,151 @@
+/**
+ * 常量。全部镜像 `crates/protocol`，`constants.test.ts` 会解析 Rust 源码做漂移检查：
+ * 改了 Rust 侧的方法名 / 版本号 / close code / 错误码数值，这里不同步测试就会红。
+ */
+/** 内层 JSON-RPC 协议版本。相邻 minor 兼容，0.x 阶段可 break。 */
+export declare const PROTOCOL_VERSION = 1;
+/** 外层信封版本。极少改动。 */
+export declare const ENVELOPE_VERSION = 1;
+/** 短码字母表：大写字母数字去掉 0 O 1 I L。 */
+export declare const PAIR_CODE_ALPHABET = "23456789ABCDEFGHJKMNPQRSTUVWXYZ";
+/** 短码长度：8 位（约 40 bit），`anycon pair --short` 生成的；只适合自建 hub，经不信任的 hub 配对不要用。 */
+export declare const PAIR_CODE_LEN = 8;
+/** 长短码长度：16 位（约 79 bit），`anycon pair` 的**默认**长度，链接 / 二维码 / `--json` 都是它。与 `crates/crypto` 的 `PAIR_CODE_LEN_LONG` 一致。 */
+export declare const PAIR_CODE_LEN_LONG = 16;
+/** WebSocket close code（hub → 设备）。 */
+export declare const CLOSE_CODE: {
+    /** 同一设备的新连接顶掉了这条。不要自动重连，否则两条连接会互相踢。 */
+    readonly SUPERSEDED: 4001;
+    /** hub 优雅关停。1–3 秒抖动后重连，而不是指数退避。 */
+    readonly RESTARTING: 4002;
+    /** 接收太慢，发送缓冲持续满。 */
+    readonly SLOW_CONSUMER: 4003;
+    /** 设备已被吊销。 */
+    readonly REVOKED: 4004;
+    /** 第一帧 auth 超时。 */
+    readonly AUTH_TIMEOUT: 4005;
+};
+/** 内层方法名。`域.动作`。键名与 `crates/protocol/src/methods.rs` 的常量名一致。 */
+export declare const METHODS: {
+    /** D→C notification，params = PairAck */
+    readonly PAIR_ACK: "pair.ack";
+    readonly NODE_INFO: "node.info";
+    readonly NODE_DEVICES: "node.devices";
+    readonly NODE_REVOKE_DEVICE: "node.revoke_device";
+    readonly NODE_PAIR_BEGIN: "node.pair_begin";
+    readonly NODE_STATS: "node.stats";
+    readonly NODE_DOCTOR: "node.doctor";
+    readonly NODE_AUDIT: "node.audit";
+    readonly NODE_SET_AGENT_DEFAULTS: "node.set_agent_defaults";
+    /** 进行中的接入会话。 */
+    readonly NODE_ENROLL_LIST: "node.enroll_list";
+    /** 批准一个接入请求：`code` 返回 6 位码，`scan` 带二维码里的密钥。 */
+    readonly NODE_ENROLL_APPROVE: "node.enroll_approve";
+    readonly NODE_ENROLL_DENY: "node.enroll_deny";
+    /** 主动生成 6 位接入码（「添加设备」、`anycon pair --enroll`）。 */
+    readonly NODE_ENROLL_CODE: "node.enroll_code";
+    readonly NODE_ENROLL_STATUS: "node.enroll_status";
+    readonly NODE_SET_ENROLL_PASSWORD: "node.set_enroll_password";
+    readonly NODE_SET_ENROLL_ENABLED: "node.set_enroll_enabled";
+    /** D→C notification，params = EnrollInfo */
+    readonly NODE_ENROLL_REQUESTED: "node.enroll_requested";
+    /** D→C notification，params = NodeEnrollResolved */
+    readonly NODE_ENROLL_RESOLVED: "node.enroll_resolved";
+    /** D→C notification，params = NodeSecurityEvent */
+    readonly NODE_SECURITY_EVENT: "node.security_event";
+    readonly AGENT_LIST: "agent.list";
+    readonly AGENT_DIAGNOSE: "agent.diagnose";
+    /** D→C notification，params = AgentListResult */
+    readonly AGENT_CHANGED: "agent.changed";
+    readonly WORKSPACE_LIST: "workspace.list";
+    readonly WORKSPACE_CREATE: "workspace.create";
+    readonly WORKSPACE_CLONE: "workspace.clone";
+    readonly WORKSPACE_RENAME: "workspace.rename";
+    readonly WORKSPACE_TRASH: "workspace.trash";
+    readonly WORKSPACE_TRASH_LIST: "workspace.trash_list";
+    readonly WORKSPACE_RESTORE: "workspace.restore";
+    readonly WORKSPACE_PURGE: "workspace.purge";
+    /** 把本机已有目录关联为项目（params = WorkspaceLinkParams → Project）。 */
+    readonly WORKSPACE_LINK: "workspace.link";
+    /** 解除关联（不删除目录；params = WorkspaceNameParams）。 */
+    readonly WORKSPACE_UNLINK: "workspace.unlink";
+    /** 列本机目录供选择（params = WorkspaceBrowseParams → WorkspaceBrowseResult）。 */
+    readonly WORKSPACE_BROWSE: "workspace.browse";
+    /** 列项目的分支（params = WorkspaceBranchesParams → WorkspaceBranchesResult，ADR-34）。 */
+    readonly WORKSPACE_BRANCHES: "workspace.branches";
+    /** 列 anycon 建的 worktree（params = WorkspaceWorktreesParams → WorkspaceWorktreesResult）。 */
+    readonly WORKSPACE_WORKTREES: "workspace.worktrees";
+    /** 删掉一个已保留 / 没有会话的 worktree（params = WorkspaceRemoveWorktreeParams）。 */
+    readonly WORKSPACE_REMOVE_WORKTREE: "workspace.remove_worktree";
+    /** D→C notification */
+    readonly WORKSPACE_CHANGED: "workspace.changed";
+    /** D→C notification */
+    readonly JOB_PROGRESS: "job.progress";
+    /** D→C notification */
+    readonly JOB_DONE: "job.done";
+    readonly JOB_CANCEL: "job.cancel";
+    readonly FS_LIST: "fs.list";
+    readonly FS_READ: "fs.read";
+    readonly SESSION_LIST: "session.list";
+    readonly SESSION_GET: "session.get";
+    readonly SESSION_CREATE: "session.create";
+    readonly SESSION_SEND: "session.send";
+    readonly SESSION_CANCEL: "session.cancel";
+    readonly SESSION_SET_SETTINGS: "session.set_settings";
+    readonly SESSION_WATCH: "session.watch";
+    readonly SESSION_UNWATCH: "session.unwatch";
+    readonly SESSION_HISTORY: "session.history";
+    /** D→C notification，params = SessionEvent */
+    readonly SESSION_EVENT: "session.event";
+    /** D→C notification，params = SessionChanged */
+    readonly SESSION_CHANGED: "session.changed";
+    readonly SESSION_RENAME: "session.rename";
+    readonly SESSION_ARCHIVE: "session.archive";
+    readonly SESSION_UNARCHIVE: "session.unarchive";
+    readonly SESSION_DELETE: "session.delete";
+    readonly SESSION_RESTART: "session.restart";
+    readonly SESSION_SEARCH: "session.search";
+    readonly SESSION_PROMOTE: "session.promote";
+    /** params = SessionGitStatusParams → SessionGitStatus（ADR-34） */
+    readonly SESSION_GIT_STATUS: "session.git_status";
+    /** params = SessionDiffParams → SessionDiffResult */
+    readonly SESSION_DIFF: "session.diff";
+    /** params = SessionSyncBaseParams → SessionSyncBaseResult */
+    readonly SESSION_SYNC_BASE: "session.sync_base";
+    /** params = BlobPutBeginParams → BlobPutBeginResult */
+    readonly BLOB_PUT_BEGIN: "blob.put_begin";
+    /** params = BlobPutChunkParams */
+    readonly BLOB_PUT_CHUNK: "blob.put_chunk";
+    /** params = BlobIdParams → AttachmentRef */
+    readonly BLOB_PUT_END: "blob.put_end";
+    /** params = BlobGetParams → BlobGetResult */
+    readonly BLOB_GET: "blob.get";
+    /** params = BlobIdParams */
+    readonly BLOB_DISCARD: "blob.discard";
+    /** D→C notification，params = PermissionRequest */
+    readonly PERMISSION_REQUEST: "permission.request";
+    readonly PERMISSION_RESPOND: "permission.respond";
+    /** D→C notification，params = PermissionResolved */
+    readonly PERMISSION_RESOLVED: "permission.resolved";
+    readonly PERMISSION_LIST: "permission.list";
+};
+export type MethodName = (typeof METHODS)[keyof typeof METHODS];
+/**
+ * `ErrorCode` → JSON-RPC 数字 code（`crates/protocol/src/error.rs` 的 `rpc_code`）。
+ * 客户端只应依赖 `error.data.code`；数字 code 仅在对端没带 `data` 时做兜底。
+ */
+export declare const ERROR_CODE_NUMBERS: {
+    readonly invalid: -32602;
+    readonly invalid_settings: -32001;
+    readonly agent_unavailable: -32002;
+    readonly node_busy: -32003;
+    readonly busy: -32004;
+    readonly already_resolved: -32005;
+    readonly exists: -32006;
+    readonly not_found: -32007;
+    readonly forbidden: -32008;
+    readonly unsupported: -32009;
+    readonly protocol_mismatch: -32010;
+    readonly internal: -32603;
+};
+//# sourceMappingURL=constants.d.ts.map

package/dist/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../src/constants.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,kDAAkD;AAClD,eAAO,MAAM,gBAAgB,IAAI,CAAA;AACjC,mBAAmB;AACnB,eAAO,MAAM,gBAAgB,IAAI,CAAA;AAEjC,gCAAgC;AAChC,eAAO,MAAM,kBAAkB,oCAAoC,CAAA;AACnE,8EAA8E;AAC9E,eAAO,MAAM,aAAa,IAAI,CAAA;AAC9B,wHAAwH;AACxH,eAAO,MAAM,kBAAkB,KAAK,CAAA;AAEpC,sCAAsC;AACtC,eAAO,MAAM,UAAU;IACrB,uCAAuC;;IAEvC,mCAAmC;;IAEnC,oBAAoB;;IAEpB,cAAc;;IAEd,mBAAmB;;CAEX,CAAA;AAEV,gEAAgE;AAChE,eAAO,MAAM,OAAO;IAElB,wCAAwC;;;;;;;;;;IAcxC,gBAAgB;;IAEhB,+CAA+C;;;IAG/C,kDAAkD;;;;;IAKlD,2CAA2C;;IAE3C,mDAAmD;;IAEnD,kDAAkD;;;;IAMlD,gDAAgD;;;;;;;;;;IAYhD,4DAA4D;;IAE5D,gDAAgD;;IAEhD,wEAAwE;;IAExE,iFAAiF;;IAEjF,0FAA0F;;IAE1F,wEAAwE;;IAExE,uBAAuB;;IAEvB,uBAAuB;;IAEvB,uBAAuB;;;;;;;;;;;;;;IAkBvB,6CAA6C;;IAE7C,+CAA+C;;;;;;;;;IAS/C,iEAAiE;;IAEjE,qDAAqD;;IAErD,6DAA6D;;IAI7D,uDAAuD;;IAEvD,kCAAkC;;IAElC,4CAA4C;;IAE5C,6CAA6C;;IAE7C,4BAA4B;;IAI5B,kDAAkD;;;IAGlD,mDAAmD;;;CAG3C,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,OAAO,CAAC,CAAC,MAAM,OAAO,OAAO,CAAC,CAAA;AAE/D;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;CAarB,CAAA"}