@net-mesh/core 0.31.0 → 0.33.0

package/index.d.ts

@@ -1,5 +1,16 @@
 /* auto-generated by NAPI-RS */
 /* eslint-disable */
+/**
+ * Keeps the served A2A services alive (returned by `NetMesh.serveA2a`).
+ * Dropping it or calling [`stop`](Self::stop) unregisters them.
+ */
+export declare class A2aServeHandle {
+  /** Stop accepting A2A tasks (unregister the services). Idempotent. */
+  stop(): void
+  /** Whether the services are still registered. */
+  get serving(): boolean
+}
+
 /**
  * Typed admin-event surface — one method per `AdminEvent`
  * variant. Each commits via the substrate's admin chain + returns
@@ -772,6 +783,138 @@ export declare class DeckClient {
   subscribeFailures(sinceSeq?: bigint | undefined | null): Promise<FailureStream>
 }
 
+/**
+ * A `root → … → leaf` delegation chain that attributes a capability
+ * invocation to the terminal agent identity.
+ *
+ * Built with [`Self::derive_gateway`] and extended per-task with
+ * [`Self::extend_to_subagent`]. Verify it against a
+ * [`RevocationRegistry`] with [`Self::verify`]; serialize with
+ * [`Self::to_bytes`] to carry it.
+ */
+export declare class DelegationChain {
+  /**
+   * Build a `root → machine → gateway` chain from opaque `Identity`
+   * handles. `root` and `machine` sign their own delegations; only
+   * `gateway`'s public entity-id is used (its keypair stays with the
+   * gateway). `ttlSeconds` is the grant lifetime; the whole chain
+   * expires together. `maxDepth` (default 4) leaves room for subagent
+   * hops.
+   */
+  static deriveGateway(root: Identity, machine: Identity, gateway: Identity, ttlSeconds: number, maxDepth?: number | undefined | null): DelegationChain
+  /**
+   * Parse a serialized chain. Throws `token: invalid_format` on an
+   * empty chain, too many links, or trailing garbage.
+   */
+  static fromBytes(data: Buffer): DelegationChain
+  /**
+   * Extend this chain with a `… → subagent` link, signed by the current
+   * leaf's owner (`leafSigner`, whose entity-id must equal the chain's
+   * current leaf subject — e.g. the gateway extending to a subagent).
+   * The subagent link drops the delegate right but keeps invoke
+   * authority, so its own calls verify and are individually
+   * attributable. Returns a new chain; the original is unchanged.
+   */
+  extendToSubagent(leafSigner: Identity, subagent: Buffer): DelegationChain
+  /**
+   * `true` if the chain still authorizes an invocation by `presenter`,
+   * anchored at `root`, honoring `registry`. Returns `false` (never
+   * throws) when the chain is expired, revoked, rooted elsewhere, or
+   * presented by the wrong identity — so a caller can gate a check on
+   * it directly. `skewSeconds` tolerates clock drift (default 0 =
+   * strict).
+   */
+  verify(presenter: Buffer, root: Buffer, registry: RevocationRegistry, skewSeconds?: number | undefined | null): boolean
+  /**
+   * The terminal (leaf) subject entity-id — the agent this chain
+   * attributes to (the gateway, or a subagent after
+   * [`Self::extend_to_subagent`]).
+   */
+  get leaf(): Buffer
+  /** The root issuer entity-id the chain anchors at. */
+  get root(): Buffer
+  /** The subject entity-id of each link, root-to-leaf. */
+  subjects(): Array<Buffer>
+  /**
+   * Serialize to wire bytes (a `TokenChain` blob) for carriage on an
+   * invoke or hand-off to another process.
+   */
+  toBytes(): Buffer
+  /**
+   * Number of delegation links (2 for a bare gateway chain, +1 per
+   * subagent hop).
+   */
+  get length(): number
+}
+
+/**
+ * A device's **persisted** enrollment — its own key + the
+ * `root → device` grant it received — so it survives restarts without
+ * re-pairing. The device seed stays in Rust (H8); [`Self::device`] hands
+ * back an opaque `Identity`.
+ */
+export declare class DeviceEnrollment {
+  /**
+   * Bundle a device `Identity` handle with the `root → device` chain it
+   * received from `join`, the operator's `rendezvous` locator (from the
+   * invite, for renewal), and the unix-seconds it enrolled.
+   */
+  constructor(device: Identity, chain: DelegationChain, rendezvous: string, enrolledAt: bigint)
+  /**
+   * Load a persisted enrollment from `path`. Resolves `null` if none is
+   * saved yet; rejects on a corrupt file.
+   */
+  static load(path: string): Promise<DeviceEnrollment | null>
+  /**
+   * Persist to `path` (`0600`, atomic). Overwrites — e.g. after a
+   * renewal.
+   */
+  save(path: string): Promise<void>
+  /**
+   * The device's opaque `Identity` handle (its private seed stays in
+   * Rust) — use it to extend the grant to a gateway.
+   */
+  get device(): Identity
+  /** The `root → device` delegation chain. */
+  get chain(): DelegationChain
+  /**
+   * The operator's rendezvous locator — where the device dials to
+   * renew.
+   */
+  get rendezvous(): string
+  /** The mesh root the grant anchors at (32 bytes). */
+  get root(): Buffer
+  /** Unix-seconds the device enrolled. */
+  get enrolledAt(): bigint
+  /** Unix-seconds the grant expires. */
+  get expiresAt(): bigint
+  /**
+   * Whether the grant still verifies + is unexpired. Pass a
+   * `RevocationRegistry` (an empty one is fine device-side — the
+   * provider enforces revocation on invoke). `skewSeconds` tolerates
+   * clock drift (default 0 = strict).
+   */
+  isValid(revocation: RevocationRegistry, skewSeconds?: number | undefined | null): boolean
+  /**
+   * Whether the grant is within `windowSeconds` of expiry at `now`
+   * (unix secs) — the trigger for silent renewal.
+   */
+  needsRenewal(windowSeconds: number, now: bigint): boolean
+}
+
+/** One enrolled device in the operator's inventory. */
+export declare class DeviceRecord {
+  /** The device entity-id (32 bytes). */
+  get device(): Buffer
+  get name(): string
+  get tags(): Array<string>
+  /** Unix-seconds the device enrolled. */
+  get enrolledAt(): bigint
+  /** Unix-seconds the device was revoked, or `null` while active. */
+  get revokedAt(): bigint | null
+  get isRevoked(): boolean
+}
+
 /**
  * Open duplex RPC call. Combined send + receive surface. Use
  * `intoSplit()` to get independent `DuplexSink` + `DuplexStream`
@@ -911,6 +1054,18 @@ export declare class Encoding {
   static defaultReedSolomon(): Encoding
 }
 
+/**
+ * Keeps the served enrollment services alive (returned by
+ * `NetMesh.serveEnrollmentAuto`). Dropping it or calling
+ * [`stop`](Self::stop) unregisters them.
+ */
+export declare class EnrollmentServeHandle {
+  /** Stop serving enrollment (unregister the services). Idempotent. */
+  stop(): void
+  /** Whether the services are still registered. */
+  get serving(): boolean
+}
+
 export declare class FailureStream {
   nextRecord(): Promise<FailureRecordJs | null>
   close(): Promise<void>
@@ -1056,6 +1211,87 @@ export declare class InMemoryChainReader {
   latestSeq(originHash: bigint): bigint | null
 }
 
+/**
+ * A pre-authorization to *ask* to join a mesh — not a key. Carries the
+ * mesh `root`, a `rendezvous` locator, a single-use nonce, and a short
+ * TTL.
+ */
+export declare class InviteToken {
+  /**
+   * Parse an invite string (`net-invite:<base64url>`). Throws on a
+   * missing prefix, bad base64, or malformed bytes.
+   */
+  static decode(s: string): InviteToken
+  /** Parse canonical wire bytes. */
+  static fromBytes(data: Buffer): InviteToken
+  /** The copy-paste / QR invite string. */
+  encode(): string
+  /** The mesh root entity-id this invite admits into (32 bytes). */
+  get root(): Buffer
+  /** The rendezvous locator the device dials (opaque transport string). */
+  get rendezvous(): string
+  /** Unix-seconds expiry. */
+  get expiresAt(): bigint
+  /** The displayed fingerprint of the mesh root — show it to the joiner. */
+  rootFingerprint(): string
+  /** Whether the invite has expired at `now` (unix secs). */
+  isExpired(now: bigint): boolean
+  /** Canonical wire bytes. */
+  toBytes(): Buffer
+}
+
+/**
+ * The operator's response to a join request — the payload the enrollment
+ * RPC returns to the device.
+ */
+export declare class JoinOutcome {
+  /** Parse canonical wire bytes. */
+  static fromBytes(data: Buffer): JoinOutcome
+  /** Canonical wire bytes. */
+  toBytes(): Buffer
+  /** `true` if the device was admitted. */
+  get isAdmitted(): boolean
+  /** The stable reject code (`1..=7`) if rejected, else `null`. */
+  get rejectCode(): number | null
+  /** The human reject message if rejected, else `null`. */
+  get rejectMessage(): string | null
+  /**
+   * Device-side: verify the admitted grant anchors at the invited mesh
+   * root (`inviteRoot`) and binds to this `device`, returning the
+   * `DelegationChain`. Throws if the outcome was a rejection, or the
+   * grant is untrusted (wrong root / wrong device) — defending the
+   * joiner against a rogue operator.
+   *
+   * `&self` despite the `into_` name: a `#[napi]` method can't consume
+   * `self` (the object is JS-owned), and the JS-facing name
+   * deliberately mirrors the SDK's `JoinOutcome::into_chain` (pinned by
+   * the Python binding and callers).
+   */
+  intoChain(device: Buffer, inviteRoot: Buffer): DelegationChain
+}
+
+/** A device's request to join, signed by the device's own key. */
+export declare class JoinRequest {
+  /**
+   * Build + sign a request against `invite`. `device` is the opaque
+   * `Identity` handle whose key is being enrolled (H8: seed stays in
+   * Rust).
+   */
+  static create(device: Identity, name: string, tags: Array<string>, invite: InviteToken): JoinRequest
+  /** Parse canonical wire bytes (does not verify the signature). */
+  static fromBytes(data: Buffer): JoinRequest
+  /** `true` if the device's self-signature verifies (it holds its key). */
+  verifySelfSignature(): boolean
+  /** The device entity-id (32 bytes). */
+  get device(): Buffer
+  /** The device-chosen name. */
+  get name(): string
+  /** The device-chosen tags. */
+  get tags(): Array<string>
+  /** Canonical wire bytes. */
+  toBytes(): Buffer
+}
+
 /**
  * Inbound request-stream handle for client-streaming + duplex
  * server handlers. Drain via `await stream.next()` until it
@@ -2038,6 +2274,84 @@ export declare class NetDb {
  * ```
  */
 export declare class NetMesh {
+  /**
+   * **Executor side.** Serve the A2A task lifecycle on this node, backed
+   * by a JS **async** task executor
+   * `(brief: TaskBriefJs) => Promise<string>` returning the result's
+   * artifact ref, with a fresh task registry. Hold the resolved handle
+   * to keep accepting tasks; call `handle.stop()` before `shutdown()`.
+   * This node must be `start()`ed. (Requires the `a2a` feature.)
+   *
+   * `options.handlerTimeoutMs` bounds how long the executor may take to
+   * settle each task's Promise (default 1 hour; `0` disables) — past the
+   * deadline the task records a `Failed` terminal state instead of
+   * staying `Running` forever behind a wedged event loop.
+   *
+   * Sync setup (the `Function` is `!Send`, so the TSFN is built on the
+   * JS thread), then `spawn_future` for the registration — the SDK's
+   * `serve_rpc` spawns a response-drainer task, which needs the tokio
+   * runtime context only the future has (the `publish.rs` shape).
+   */
+  serveA2a(executor: (arg: TaskBriefJs) => Promise<string>, options?: ServeA2aOptions | undefined | null): Promise<A2aServeHandle>
+  /**
+   * **Requester side.** Hand `prompt` (+ optional Datafort `contextRefs`
+   * + routing `tags`) to the executor at `targetNodeId`; resolves the
+   * accepted task id. Rejects if the executor refused the brief. The
+   * node must already be connected to `targetNodeId`. (Requires the
+   * `a2a` feature.)
+   */
+  submitTask(targetNodeId: bigint, prompt: string, contextRefs?: Array<string> | undefined | null, tags?: Array<string> | undefined | null): Promise<string>
+  /**
+   * **Requester side.** The executor's status record for `taskId` as a
+   * JSON string (`{brief, state, updated_at}`), or `null` if the
+   * executor doesn't know it. (Requires the `a2a` feature.)
+   */
+  taskStatus(targetNodeId: bigint, taskId: string): Promise<string | null>
+  /**
+   * **Requester side.** Cancel `taskId` on the executor; resolves
+   * whether it was in flight. The executor's select observes the token
+   * and the task state flips to `cancelled` — the JS handler's eventual
+   * result is discarded (see the module docs on one-sided
+   * cancellation). (Requires the `a2a` feature.)
+   */
+  cancelTask(targetNodeId: bigint, taskId: string): Promise<boolean>
+  /**
+   * The invite `rendezvous` locator for this node (addr + Noise pubkey
+   * + node id), to pass to `OperatorEnrollment.invite`. Devices dial it
+   * via `join`. (Requires the `delegation` feature.)
+   */
+  rendezvousString(): string
+  /**
+   * Device-side enrollment: enroll `device`'s key into the mesh named
+   * by the `invite` string, under `name` + `tags`, returning the
+   * verified `root → device` `DelegationChain`. This node must be
+   * `start()`ed and built with `permissiveChannels: true` (the
+   * enrollment nRPC uses dynamic per-caller reply channels the strict
+   * registry rejects). (Requires the `delegation` feature.)
+   */
+  join(device: Identity, invite: string, name: string, tags?: Array<string> | undefined | null): Promise<DelegationChain>
+  /**
+   * Operator-side: serve the full device lifecycle on this node (auto —
+   * the invite is the authorization): **enroll** (join) + **renew**.
+   * Hold the resolved handle for as long as enrollment should stay
+   * open; call `handle.stop()` before `shutdown()`. This node must be
+   * `start()`ed and built with `permissiveChannels: true`. (Requires
+   * the `delegation` feature.)
+   *
+   * `async` although the registration itself is synchronous: the SDK's
+   * `serve_rpc` spawns a response-drainer task, which needs the tokio
+   * runtime context napi only provides to `async fn`s — a plain sync
+   * method here panics with "no reactor running" (the same reason the
+   * Python binding wraps this in `runtime.enter()`).
+   */
+  serveEnrollmentAuto(operator: OperatorEnrollment, grantTtlSeconds: number, maxDepth?: number | undefined | null): Promise<EnrollmentServeHandle>
+  /**
+   * Device-side renewal: refresh the grant carried by `enrollment` over
+   * the mesh, returning the verified **fresh** `root → device`
+   * `DelegationChain`. This node must be `start()`ed and built with
+   * `permissiveChannels: true`. (Requires the `delegation` feature.)
+   */
+  renew(enrollment: DeviceEnrollment): Promise<DelegationChain>
   /**
    * Publish this node's island-topology record (host forced to self).
    * Self-indexed locally + broadcast to peers; returns the peer
@@ -2118,6 +2432,12 @@ export declare class NetMesh {
    * Declared `async` so napi-rs invokes it with an active
    * tokio runtime — `MeshNode::start()` spawns background
    * tasks via `tokio::spawn` and panics outside a reactor.
+   *
+   * Uses `start_arc` (like the C FFI and the Rust SDK) so
+   * the Arc-scoped lifecycle loops run too: periodic
+   * capability re-announce (with the reflex-diff
+   * re-classify trigger) and — when `autoDirectUpgrade`
+   * is set — the background direct-path upgrade.
    */
   start(): Promise<void>
   /** Send raw bytes to a direct peer. */
@@ -2273,7 +2593,23 @@ export declare class NetMesh {
    * the natural shape for TS; that ships as a follow-up.
    */
   capabilityCapacityRanking(queryJson: string, rttEntries?: Array<RttEntryJs> | undefined | null): Array<CapacityRowJs>
-  /** Shutdown the mesh node. */
+  /**
+   * Shutdown the mesh node.
+   *
+   * Requires sole ownership of the `Arc<MeshNode>` (via
+   * `try_unwrap`). SDK serve handles — nRPC `serve_rpc`, the
+   * `PaymentProvider` quote/pay wire — release their node clone
+   * via ASYNC task teardown: dropping a `ServeHandle` closes its
+   * dispatcher channel, and the bridge / response-drain tasks then
+   * exit and drop their `Arc<MeshNode>` clones on the next
+   * scheduler tick (Drop deliberately never aborts them, so
+   * in-flight responses aren't killed). A `shutdown()` invoked
+   * right after such a handle is dropped (e.g. `provider.close()`
+   * then `mesh.shutdown()`) can momentarily still observe those
+   * clones, so we retry `try_unwrap` across a bounded grace window
+   * to let the teardown drain. A GENUINE outstanding reference
+   * still fails — just after the window, never hanging.
+   */
   shutdown(): Promise<void>
   /**
    * Register a JS placement-filter predicate under `id`.
@@ -2405,11 +2741,16 @@ export declare class NetMesh {
    */
   reclassifyNat(): Promise<void>
   /**
-   * Cumulative NAT-traversal counters for this mesh.
-   * Object shape: `{ punchesAttempted, punchesSucceeded,
-   * relayFallbacks }` — all u64 bigints, monotonic, never
-   * reset. Useful for telemetry on punch success rate and
-   * relay load.
+   * Cumulative NAT-traversal counters for this mesh — the
+   * full stage-5 snapshot: punch attempt/success/derived-
+   * failure counts, the three failure-cause counters
+   * (timeouts / rejections / no-relay), background-upgrade
+   * activity, and port-mapping state. Base counters are
+   * monotonic and never reset (`punchesFailed` is derived
+   * and can decrease while a punch is in flight;
+   * `portMappingRenewals` resets on a fresh install —
+   * difference only the base counters). Useful for
+   * telemetry on punch success rate and relay load.
    */
   traversalStats(): TraversalStats
   /**
@@ -2431,6 +2772,18 @@ export declare class NetMesh {
    * handshake error.
    */
   connectDirect(peerNodeId: bigint, peerPublicKey: Buffer, coordinator: bigint): Promise<void>
+  /**
+   * Like `connectDirect`, but auto-selects the rendezvous
+   * coordinator: the relay currently forwarding to the
+   * peer, then a `relay-capable` mutual peer, then any
+   * mutual peer.
+   *
+   * **Optimization, not correctness.** Punch-needing pairs
+   * with no coordinator candidate reject with
+   * `traversal: rendezvous-no-relay` — the caller simply
+   * stays on the routed path, which is always available.
+   */
+  connectDirectAuto(peerNodeId: bigint, peerPublicKey: Buffer): Promise<void>
   /**
    * Install a runtime reflex override. Forces `natType()`
    * to `"open"` and `reflexAddr()` to `external`
@@ -2471,6 +2824,71 @@ export declare class NetStream {
   get streamId(): bigint
 }
 
+/**
+ * The operator side: mint invites, approve join requests into
+ * `root → device` delegations, and manage the device inventory —
+ * composing the enrollment authority + device registry + revocation
+ * store for one mesh root.
+ */
+export declare class OperatorEnrollment {
+  /**
+   * Build a coordinator for the `root` `Identity` handle, with explicit
+   * device-registry and revocation-store paths.
+   */
+  constructor(root: Identity, registryPath: string, revocationPath: string)
+  /**
+   * Build using the per-user default store paths (the same
+   * machine-shared files the CLI and a `net wrap` provider converge
+   * on). Throws if neither path resolves.
+   */
+  static withDefaultPaths(root: Identity): OperatorEnrollment
+  /** The mesh root entity-id (32 bytes). */
+  get rootId(): Buffer
+  /** The displayed fingerprint of the mesh root. */
+  rootFingerprint(): string
+  /**
+   * Mint an invite for this mesh valid for `ttlSeconds`, tracking it so
+   * a later `approve` can match a request to it. `rendezvous` is the
+   * transport locator devices dial (e.g. `NetMesh.rendezvousString()`).
+   */
+  invite(rendezvous: string, ttlSeconds: number): InviteToken
+  /**
+   * Approve an arriving request (auto — invite-as-authorization),
+   * reading the system clock: run the fail-closed checks, record the
+   * device, retire the single-use invite, and return the
+   * `root → device` `DelegationChain`. Rejects on any refusal
+   * (unknown/expired/wrong invite, bad signature). Runs off the JS
+   * thread (store file IO).
+   */
+  approve(request: JoinRequest, grantTtlSeconds: number, maxDepth?: number | undefined | null): Promise<DelegationChain>
+  /**
+   * The **server-side** handler: turn serialized `JoinRequest` bytes
+   * into serialized `JoinOutcome` bytes (auto — invite-as-
+   * authorization). This is what the enrollment RPC moves; a JS host
+   * can serve enrollment by feeding it received request bytes and
+   * returning the outcome bytes. Never throws — a malformed request or
+   * a rejection is a coded `JoinOutcome`.
+   */
+  handleJoinRequest(requestBytes: Buffer, grantTtlSeconds: number, maxDepth?: number | undefined | null): Promise<Buffer>
+  /**
+   * Revoke a device: raise its revocation floor (kills all current
+   * delegations) and stamp the inventory. Reads the system clock.
+   */
+  revoke(device: Buffer): Promise<void>
+  /** The enrolled devices in the inventory. */
+  devices(): Promise<Array<DeviceRecord>>
+  /**
+   * Prune a device from the inventory entirely (orthogonal to revoking
+   * its floor). Returns whether a record existed.
+   */
+  forget(device: Buffer): Promise<boolean>
+  /**
+   * Outstanding (minted, unredeemed, unexpired at `now` unix-secs)
+   * invites.
+   */
+  pendingInvites(now: bigint): Array<InviteToken>
+}
+
 /**
  * Operator identity. Operator id is the keypair's 64-bit origin
  * hash. Construct via `generate()` (tests) or `fromSeed(buffer)`
@@ -3034,6 +3452,49 @@ export declare class ReplicaGroup {
   get healthyCount(): number
 }
 
+/**
+ * Shared per-issuer revocation floor. Bumping an issuer's floor
+ * invalidates every outstanding delegation from that issuer — including
+ * delegated children — the moment `verify` next runs.
+ *
+ * One registry is shared by a gateway and all its subagents (Arc-backed),
+ * so a revoke is observed by every chain that verifies against it.
+ */
+export declare class RevocationRegistry {
+  /** A fresh registry — every issuer's floor is implicitly 0. */
+  constructor()
+  /**
+   * Set `issuer`'s floor to `generation`. Any token from `issuer` with
+   * `issuer_generation < generation` is rejected on the next verify.
+   * Monotonic: a value <= the current floor is a no-op.
+   */
+  revokeBelow(issuer: Buffer, generation: number): void
+  /**
+   * Convenience: revoke every generation-0 delegation from `issuer`
+   * (bumps the floor to 1). Revoking the *machine* identity kills its
+   * gateway chain and, transitively, that gateway's subagents — while a
+   * different machine's chain is untouched.
+   */
+  revoke(issuer: Buffer): void
+  /** The current revocation floor for `issuer` (0 if never revoked). */
+  floor(issuer: Buffer): number
+  /**
+   * Reload the machine-shared revocation floors at `path` into this
+   * registry (monotonic — floors only ever rise, so re-loading is
+   * idempotent and composes with any in-process `revoke`). A missing
+   * store file is a no-op (nothing revoked yet); an unreadable or
+   * corrupt store rejects.
+   *
+   * This is what lets a *caller's* self-check observe an operator's
+   * `net identity revoke` — written to the same file a
+   * `net wrap --owner-root` provider honors — so a revoked chain fails
+   * [`DelegationChain::verify`] on the caller side too, not only when
+   * the provider re-verifies. Use [`default_revocation_store_path`]
+   * (or the `NET_MESH_REVOCATION_STORE` override) for `path`.
+   */
+  loadFromStore(path: string): Promise<void>
+}
+
 /**
  * Open streaming RPC call. Yields chunks via `next()` until EOF
  * (returns `null`). Drop OR explicit `close()` emits CANCEL to
@@ -4074,6 +4535,16 @@ export declare function decodeJoined(row: ResultRow): JoinedRow | null
  */
 export declare function decodeWindow(row: ResultRow): WindowBoundary | null
 
+/**
+ * The per-user default revocation-store path — the same file a
+ * `net wrap --owner-root` provider honors and `net identity revoke`
+ * writes — or `null` if neither a data-local nor a home directory
+ * resolves. Pass it (or the `NET_MESH_REVOCATION_STORE` override) to
+ * [`RevocationRegistry::load_from_store`] so a caller-side check
+ * observes an operator revocation.
+ */
+export declare function defaultRevocationStorePath(): string | null
+
 /**
  * Delegate a token to a new subject. The `parent_bytes` token must
  * have `delegation_depth > 0` and include the `delegate` scope; the
@@ -4081,6 +4552,18 @@ export declare function decodeWindow(row: ResultRow): WindowBoundary | null
  */
 export declare function delegateToken(signer: Identity, parentBytes: Buffer, newSubject: Buffer, restrictedScope: Array<string>): Buffer
 
+/**
+ * Derive a stable child `Identity` handle from `parent` under `label`.
+ *
+ * Deterministic (blake3 KDF over the parent seed), so a machine / gateway
+ * identity is reproducible across restarts from the root alone — no extra
+ * persistence, and every process that holds the root derives the same
+ * child. The returned handle owns its keypair; the private seed is never
+ * exposed (H8). `label` namespaces siblings, e.g. `"machine:hostA"` vs
+ * `"gateway:hostA:hermes"`.
+ */
+export declare function deriveChildIdentity(parent: Identity, label: string): Identity
+
 /**
  * One env addition passed to the wrapped server — only the KEY drives
  * classification; the value is never inspected beyond presence and never
@@ -4124,6 +4607,13 @@ export interface FailureRecordJs {
   recordedAtMs: bigint
 }
 
+/**
+ * A short, human-comparable fingerprint of an entity-id (the 32-byte
+ * ed25519 public key), shown on both sides of a join so a human can
+ * confirm the mesh identity matches — `A1B2-C3D4-E5F6-0789`.
+ */
+export declare function fingerprint(entity: Buffer): string
+
 export interface ForkGroupConfigJs {
   forkCount: number
   lbStrategy: StrategyJs
@@ -4137,6 +4627,13 @@ export interface ForkRecordJs {
   fromSnapshotSeq?: bigint
 }
 
+/**
+ * The well-known channel every gateway delegation binds to (never
+ * actually published to). Exported so JS callers and tests can
+ * reference the exact string.
+ */
+export const GATEWAY_DELEGATION_CHANNEL: string
+
 /**
  * Generate a new Net keypair for encrypted UDP transport.
  *
@@ -4683,6 +5180,22 @@ export interface MeshOptions {
    * without `--features port-mapping`.
    */
   tryPortMapping?: boolean
+  /**
+   * Enable the background direct-path upgrade: once a
+   * session to a peer is established via a relay, the mesh
+   * opportunistically re-handshakes over a direct path and
+   * migrates the session, cutting relay hops out of the
+   * data plane. The swap is guarded by a migration
+   * contract (lower-id initiator, compare-and-swap
+   * install, busy-session deferral) so in-flight work is
+   * never dropped.
+   *
+   * **Optimization, not correctness** — traffic rides the
+   * relay until (and unless) a direct path lands. Default
+   * `false`. Silently ignored when the binding was built
+   * without `--features nat-traversal`.
+   */
+  autoDirectUpgrade?: boolean
   /**
    * Opt out of channel authorization: when `true`, no
    * `ChannelConfigRegistry` is installed on the node, so
@@ -5518,6 +6031,20 @@ export interface ScopeFilterJs {
   regions?: Array<string>
 }
 
+/** Optional knobs for [`NetMesh::serve_a2a`]. */
+export interface ServeA2aOptions {
+  /**
+   * Per-task budget in milliseconds for the JS executor to settle its
+   * Promise (the handler returning the Promise + that Promise
+   * resolving, one deadline across both). Default `3600000` (1 hour).
+   * Past it the task records a `Failed` terminal state. Pass `0` to
+   * disable the deadline entirely (Python-binding parity, where
+   * cancellation is the only control) — a wedged event loop then leaves
+   * the task `Running` until a requester cancels it.
+   */
+  handlerTimeoutMs?: number
+}
+
 /**
  * Per-service caller- + server-side nRPC counters at a point
  * in time. Element of [`RpcMetricsSnapshotJs::services`].
@@ -5716,6 +6243,21 @@ export interface Task {
   updatedNs: bigint
 }
 
+/** The brief handed to the JS task executor. */
+export interface TaskBriefJs {
+  /** The registry-assigned task id (poll / cancel by this). */
+  taskId: string
+  /** What to do. */
+  prompt: string
+  /**
+   * Datafort refs carrying the task's context (the executor doesn't
+   * share the requester's memory).
+   */
+  contextRefs: Array<string>
+  /** Routing / bookkeeping tags. */
+  tags: Array<string>
+}
+
 /**
  * Filter for [`TasksAdapter::list_tasks`] and
  * [`TasksAdapter::watch_tasks`].
@@ -5858,9 +6400,14 @@ export declare function transferStreamId(nonce: bigint): bigint
 
 /**
  * Cumulative NAT-traversal counters surfaced via
- * `NetMesh.traversalStats()`. All counters are monotonic u64s
- * and never reset — subtract snapshots for deltas. Exposed as
- * BigInt because JavaScript numbers can't round-trip full u64.
+ * `NetMesh.traversalStats()`. Base counters are monotonic u64s
+ * and never reset — subtract snapshots for deltas — with two
+ * exemptions: `punchesFailed` is derived at snapshot time
+ * (`attempted - succeeded`) and can decrease when an in-flight
+ * punch lands, and `portMappingRenewals` resets to zero on each
+ * fresh mapping install. Difference only the base counters for
+ * rates. Exposed as BigInt because JavaScript numbers can't
+ * round-trip full u64.
  *
  * Framing reminder (plan §5): NAT traversal is an optimization,
  * not a connectivity requirement. `relay_fallbacks` isn't a
@@ -5870,8 +6417,8 @@ export declare function transferStreamId(nonce: bigint): bigint
  */
 export interface TraversalStats {
   /**
-   * Number of hole-punch attempts the pair-type matrix
-   * elected to initiate. Bumps once per attempt, whether the
+   * Number of hole-punch attempts whose coordinator mediation
+   * succeeded. Bumps once per mediated attempt, whether the
    * punch eventually succeeds or falls back.
    */
   punchesAttempted: bigint
@@ -5881,6 +6428,12 @@ export interface TraversalStats {
    * punch-failure rate.
    */
   punchesSucceeded: bigint
+  /**
+   * **Derived** at snapshot time: `punchesAttempted -
+   * punchesSucceeded` (a punch in flight counts as failed
+   * until it resolves).
+   */
+  punchesFailed: bigint
   /**
    * Number of `connect_direct` resolutions that stayed on
    * the routed-handshake path — matrix-skipped pairs plus
@@ -5889,6 +6442,51 @@ export interface TraversalStats {
    * this counter.
    */
   relayFallbacks: bigint
+  /**
+   * Punch flows that gave up on a deadline. Failure *cause*
+   * counter — includes pre-mediation introduce-wait timeouts,
+   * so not a partition of `punchesFailed`.
+   */
+  punchTimeouts: bigint
+  /**
+   * Punch flows refused by a typed coordinator reject
+   * (rate-limited / unknown target reflex / no session with
+   * target / reflex mismatch). Cause counter.
+   */
+  punchRejections: bigint
+  /**
+   * Punch-needing pairs skipped because no rendezvous
+   * coordinator candidate existed. Cause counter; the caller
+   * stayed on the routed path.
+   */
+  rendezvousNoRelay: bigint
+  /** Background direct-path upgrades started. */
+  upgradesAttempted: bigint
+  /**
+   * Upgrades that replaced a relay-routed session with a
+   * punched direct session.
+   */
+  upgradesSucceeded: bigint
+  /**
+   * Upgrades deferred because the session was busy (open
+   * streams / unacked data). Retried later; not failures.
+   */
+  upgradesDeferredBusy: bigint
+  /**
+   * `true` while a UPnP / NAT-PMP / PCP port mapping is
+   * installed on the operator's router.
+   */
+  portMappingActive: boolean
+  /**
+   * Mapped external `"ip:port"`, or `null` when no mapping is
+   * active.
+   */
+  portMappingExternal?: string
+  /**
+   * Successful renewal ticks since the current mapping was
+   * installed. Resets on a fresh install.
+   */
+  portMappingRenewals: bigint
 }
 
 /**

package/index.js

@@ -77,8 +77,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-android-arm64')
         const bindingPackageVersion = require('@net-mesh/core-android-arm64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -93,8 +93,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-android-arm-eabi')
         const bindingPackageVersion = require('@net-mesh/core-android-arm-eabi/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -114,8 +114,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-win32-x64-gnu')
         const bindingPackageVersion = require('@net-mesh/core-win32-x64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -130,8 +130,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-win32-x64-msvc')
         const bindingPackageVersion = require('@net-mesh/core-win32-x64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -147,8 +147,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-win32-ia32-msvc')
         const bindingPackageVersion = require('@net-mesh/core-win32-ia32-msvc/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -163,8 +163,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-win32-arm64-msvc')
         const bindingPackageVersion = require('@net-mesh/core-win32-arm64-msvc/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -182,8 +182,8 @@ function requireNative() {
     try {
       const binding = require('@net-mesh/core-darwin-universal')
       const bindingPackageVersion = require('@net-mesh/core-darwin-universal/package.json').version
-      if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-        throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+      if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+        throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
       }
       return binding
     } catch (e) {
@@ -198,8 +198,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-darwin-x64')
         const bindingPackageVersion = require('@net-mesh/core-darwin-x64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -214,8 +214,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-darwin-arm64')
         const bindingPackageVersion = require('@net-mesh/core-darwin-arm64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -234,8 +234,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-freebsd-x64')
         const bindingPackageVersion = require('@net-mesh/core-freebsd-x64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -250,8 +250,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-freebsd-arm64')
         const bindingPackageVersion = require('@net-mesh/core-freebsd-arm64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -271,8 +271,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-x64-musl')
           const bindingPackageVersion = require('@net-mesh/core-linux-x64-musl/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -287,8 +287,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-x64-gnu')
           const bindingPackageVersion = require('@net-mesh/core-linux-x64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -305,8 +305,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-arm64-musl')
           const bindingPackageVersion = require('@net-mesh/core-linux-arm64-musl/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -321,8 +321,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-arm64-gnu')
           const bindingPackageVersion = require('@net-mesh/core-linux-arm64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -339,8 +339,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-arm-musleabihf')
           const bindingPackageVersion = require('@net-mesh/core-linux-arm-musleabihf/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -355,8 +355,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-arm-gnueabihf')
           const bindingPackageVersion = require('@net-mesh/core-linux-arm-gnueabihf/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -373,8 +373,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-loong64-musl')
           const bindingPackageVersion = require('@net-mesh/core-linux-loong64-musl/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -389,8 +389,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-loong64-gnu')
           const bindingPackageVersion = require('@net-mesh/core-linux-loong64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -407,8 +407,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-riscv64-musl')
           const bindingPackageVersion = require('@net-mesh/core-linux-riscv64-musl/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -423,8 +423,8 @@ function requireNative() {
         try {
           const binding = require('@net-mesh/core-linux-riscv64-gnu')
           const bindingPackageVersion = require('@net-mesh/core-linux-riscv64-gnu/package.json').version
-          if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-            throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+          if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+            throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
           }
           return binding
         } catch (e) {
@@ -440,8 +440,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-linux-ppc64-gnu')
         const bindingPackageVersion = require('@net-mesh/core-linux-ppc64-gnu/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -456,8 +456,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-linux-s390x-gnu')
         const bindingPackageVersion = require('@net-mesh/core-linux-s390x-gnu/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -476,8 +476,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-openharmony-arm64')
         const bindingPackageVersion = require('@net-mesh/core-openharmony-arm64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -492,8 +492,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-openharmony-x64')
         const bindingPackageVersion = require('@net-mesh/core-openharmony-x64/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -508,8 +508,8 @@ function requireNative() {
       try {
         const binding = require('@net-mesh/core-openharmony-arm')
         const bindingPackageVersion = require('@net-mesh/core-openharmony-arm/package.json').version
-        if (bindingPackageVersion !== '0.31.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
-          throw new Error(`Native binding package version mismatch, expected 0.31.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
+        if (bindingPackageVersion !== '0.33.0' && process.env.NAPI_RS_ENFORCE_VERSION_CHECK && process.env.NAPI_RS_ENFORCE_VERSION_CHECK !== '0') {
+          throw new Error(`Native binding package version mismatch, expected 0.33.0 but got ${bindingPackageVersion}. You can reinstall dependencies to fix this issue.`)
         }
         return binding
       } catch (e) {
@@ -587,6 +587,7 @@ if (!nativeBinding) {
 }
 
 module.exports = nativeBinding
+module.exports.A2aServeHandle = nativeBinding.A2aServeHandle
 module.exports.AdminCommands = nativeBinding.AdminCommands
 module.exports.AdminVerifier = nativeBinding.AdminVerifier
 module.exports.AuditQuery = nativeBinding.AuditQuery
@@ -601,10 +602,14 @@ module.exports.ConsentPolicy = nativeBinding.ConsentPolicy
 module.exports.DaemonHandle = nativeBinding.DaemonHandle
 module.exports.DaemonRuntime = nativeBinding.DaemonRuntime
 module.exports.DeckClient = nativeBinding.DeckClient
+module.exports.DelegationChain = nativeBinding.DelegationChain
+module.exports.DeviceEnrollment = nativeBinding.DeviceEnrollment
+module.exports.DeviceRecord = nativeBinding.DeviceRecord
 module.exports.DuplexCall = nativeBinding.DuplexCall
 module.exports.DuplexSink = nativeBinding.DuplexSink
 module.exports.DuplexStream = nativeBinding.DuplexStream
 module.exports.Encoding = nativeBinding.Encoding
+module.exports.EnrollmentServeHandle = nativeBinding.EnrollmentServeHandle
 module.exports.FailureStream = nativeBinding.FailureStream
 module.exports.FoldQueryClient = nativeBinding.FoldQueryClient
 module.exports.ForkGroup = nativeBinding.ForkGroup
@@ -612,6 +617,9 @@ module.exports.IceCommands = nativeBinding.IceCommands
 module.exports.IceProposal = nativeBinding.IceProposal
 module.exports.Identity = nativeBinding.Identity
 module.exports.InMemoryChainReader = nativeBinding.InMemoryChainReader
+module.exports.InviteToken = nativeBinding.InviteToken
+module.exports.JoinOutcome = nativeBinding.JoinOutcome
+module.exports.JoinRequest = nativeBinding.JoinRequest
 module.exports.JsRequestStream = nativeBinding.JsRequestStream
 module.exports.JsResponseSink = nativeBinding.JsResponseSink
 module.exports.LocalPublicationHandle = nativeBinding.LocalPublicationHandle
@@ -631,6 +639,7 @@ module.exports.Net = nativeBinding.Net
 module.exports.NetDb = nativeBinding.NetDb
 module.exports.NetMesh = nativeBinding.NetMesh
 module.exports.NetStream = nativeBinding.NetStream
+module.exports.OperatorEnrollment = nativeBinding.OperatorEnrollment
 module.exports.OperatorIdentity = nativeBinding.OperatorIdentity
 module.exports.OperatorRegistry = nativeBinding.OperatorRegistry
 module.exports.PaymentProvider = nativeBinding.PaymentProvider
@@ -642,6 +651,7 @@ module.exports.RedexTailIter = nativeBinding.RedexTailIter
 module.exports.RedisStreamDedup = nativeBinding.RedisStreamDedup
 module.exports.RegistryClient = nativeBinding.RegistryClient
 module.exports.ReplicaGroup = nativeBinding.ReplicaGroup
+module.exports.RevocationRegistry = nativeBinding.RevocationRegistry
 module.exports.RpcStream = nativeBinding.RpcStream
 module.exports.ServeHandle = nativeBinding.ServeHandle
 module.exports.ShardGroup = nativeBinding.ShardGroup
@@ -675,7 +685,11 @@ module.exports.DATAFORTS_BLOB_TREE_SUPPORTED = nativeBinding.DATAFORTS_BLOB_TREE
 module.exports.decodeAggregate = nativeBinding.decodeAggregate
 module.exports.decodeJoined = nativeBinding.decodeJoined
 module.exports.decodeWindow = nativeBinding.decodeWindow
+module.exports.defaultRevocationStorePath = nativeBinding.defaultRevocationStorePath
 module.exports.delegateToken = nativeBinding.delegateToken
+module.exports.deriveChildIdentity = nativeBinding.deriveChildIdentity
+module.exports.fingerprint = nativeBinding.fingerprint
+module.exports.GATEWAY_DELEGATION_CHANNEL = nativeBinding.GATEWAY_DELEGATION_CHANNEL
 module.exports.generateNetKeypair = nativeBinding.generateNetKeypair
 module.exports.isBlobRef = nativeBinding.isBlobRef
 module.exports.isTransferStreamId = nativeBinding.isTransferStreamId

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@net-mesh/core",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "High-performance, schema-agnostic event bus for AI runtime workloads",
   "main": "index.js",
   "types": "index.d.ts",
@@ -80,9 +80,9 @@
   },
   "scripts": {
     "artifacts": "napi artifacts",
-    "build": "napi build --platform --release --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator",
-    "build:debug": "napi build --platform --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator",
-    "build:test": "napi build --platform --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator,test-helpers",
+    "build": "napi build --platform --release --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator,delegation,a2a",
+    "build:debug": "napi build --platform --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator,delegation,a2a",
+    "build:test": "napi build --platform --features redis,net,cortex,compute,groups,meshos,deck,meshdb,aggregator,delegation,a2a,test-helpers",
     "build:ts": "tsc -p tsconfig.build.json",
     "prepublishOnly": "npm run build:ts && napi prepublish -t npm",
     "test": "vitest run",
@@ -97,13 +97,13 @@
     "node": ">=20"
   },
   "optionalDependencies": {
-    "@net-mesh/core-win32-x64-msvc": "0.31.0",
-    "@net-mesh/core-win32-arm64-msvc": "0.31.0",
-    "@net-mesh/core-darwin-x64": "0.31.0",
-    "@net-mesh/core-darwin-arm64": "0.31.0",
-    "@net-mesh/core-linux-x64-gnu": "0.31.0",
-    "@net-mesh/core-linux-x64-musl": "0.31.0",
-    "@net-mesh/core-linux-arm64-gnu": "0.31.0",
-    "@net-mesh/core-linux-arm64-musl": "0.31.0"
+    "@net-mesh/core-win32-x64-msvc": "0.33.0",
+    "@net-mesh/core-win32-arm64-msvc": "0.33.0",
+    "@net-mesh/core-darwin-x64": "0.33.0",
+    "@net-mesh/core-darwin-arm64": "0.33.0",
+    "@net-mesh/core-linux-x64-gnu": "0.33.0",
+    "@net-mesh/core-linux-x64-musl": "0.33.0",
+    "@net-mesh/core-linux-arm64-gnu": "0.33.0",
+    "@net-mesh/core-linux-arm64-musl": "0.33.0"
   }
 }