@net-mesh/sdk 0.26.0 → 0.27.0-beta.1

package/dist/index.d.ts

@@ -53,6 +53,7 @@ export type { MeshOsDaemon, MeshOsConfig, MeshOsDaemonSdkOptions, DaemonControl,
 export { ReplicaGroup, ForkGroup, StandbyGroup, GroupError } from './groups';
 export type { GroupErrorKind, GroupStrategy, GroupHealth, GroupMemberInfo, GroupHostConfig, ForkRecord, RequestContext, ReplicaGroupConfig, ForkGroupConfig, StandbyGroupConfig, } from './groups';
 export { RedisStreamDedup } from './redis-dedup';
+export { TransferControl, TransferHeader, transferStreamId, isTransferStreamId, nextTransferStreamId, } from './transport';
 export type { NetNodeConfig, Transport, Receipt, PollRequest, PollResponseData, Stats, SubscribeOpts, StoredEvent, } from './types';
 export type { ToolDescriptor, ToolEvent, ToolEventStart, ToolEventProgress, ToolEventDelta, ToolEventResult, ToolEventError, ToolOptions, ToolHandler, ToolServeHandle, StreamingToolHandler, ToolListChange, WatchToolsOptions, ToolMetadataResponse, ToolCallSpec, } from './tool';
 export { isTerminalEvent, descriptorFrom, serveTool, serveToolStreaming, callTool, callToolStreaming, listTools, watchTools, addToolCapabilitiesToAnnounce, fetchToolMetadata, ToolCallParseError, TOOL_METADATA_FETCH_SERVICE, openai, anthropic, mcp, gemini, } from './tool';

package/dist/index.js

@@ -28,8 +28,8 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.standardPlacement = exports.StandardPlacementBuilder = exports.withMetadata = exports.requireAxisValue = exports.requireTag = exports.emptyCapabilities = exports.diffCapabilities = exports.whereHeader = exports.predicateFromRpcHeader = exports.predicateToRpcHeader = exports.predicateFromWire = exports.predicateToWire = exports.p = exports.startsWithReservedPrefix = exports.tagFromUserString = exports.tagFromString = exports.tagToString = exports.tagKey = exports.RPC_WHERE_HEADER = exports.RESERVED_PREFIXES = exports.TAXONOMY_AXES = exports.withSubnetLocalScope = exports.withRegionScope = exports.withTenantScope = exports.SCOPE_SUBNET_LOCAL = exports.SCOPE_REGION_PREFIX = exports.SCOPE_TENANT_PREFIX = exports.delegateToken = exports.channelHash = exports.TokenError = exports.IdentityError = exports.Token = exports.Identity = exports.RedexError = exports.NetDbError = exports.CortexError = exports.MemoriesAdapter = exports.TasksAdapter = exports.NetDb = exports.RedexFile = exports.Redex = exports.ChannelAuthError = exports.ChannelError = exports.NotConnectedError = exports.BackpressureError = exports.MeshNode = exports.TypedChannel = exports.TypedEventStream = exports.EventStream = exports.NetNode = void 0;
-exports.anthropic = exports.openai = exports.TOOL_METADATA_FETCH_SERVICE = exports.ToolCallParseError = exports.fetchToolMetadata = exports.addToolCapabilitiesToAnnounce = exports.watchTools = exports.listTools = exports.callToolStreaming = exports.callTool = exports.serveToolStreaming = exports.serveTool = exports.descriptorFrom = exports.isTerminalEvent = exports.RedisStreamDedup = exports.GroupError = exports.StandbyGroup = exports.ForkGroup = exports.ReplicaGroup = exports.MeshOsSdkError = exports.MeshOsDaemonHandle = exports.MeshOsDaemonSdk = exports.parseMeshDbErrorKind = exports.QueryBuilder = exports.MeshQueryStream = exports.MeshQueryRunner = exports.MeshQuery = exports.InMemoryChainReader = exports.DisposableMeshQueryRunner = exports.MigrationError = exports.MigrationHandle = exports.DaemonError = exports.DaemonHandle = exports.DaemonRuntime = exports.GLOBAL_SUBNET = exports.subnetId = exports.validateCapabilities = exports.isReportValid = exports.isReportClean = exports.METADATA_SOFT_CAP_BYTES = exports.METADATA_RESERVED_PREFIXES = exports.METADATA_RESERVED_KEYS = exports.AXIS_SCHEMA = exports.renderDebugReport = exports.redactMetadataKeys = exports.predicateDebugReportFromWire = exports.predicateDebugReport = exports.evaluatePredicateWithTrace = exports.evaluatePredicate = exports.placementFilterFromFn = void 0;
-exports.gemini = exports.mcp = void 0;
+exports.addToolCapabilitiesToAnnounce = exports.watchTools = exports.listTools = exports.callToolStreaming = exports.callTool = exports.serveToolStreaming = exports.serveTool = exports.descriptorFrom = exports.isTerminalEvent = exports.nextTransferStreamId = exports.isTransferStreamId = exports.transferStreamId = exports.TransferHeader = exports.TransferControl = exports.RedisStreamDedup = exports.GroupError = exports.StandbyGroup = exports.ForkGroup = exports.ReplicaGroup = exports.MeshOsSdkError = exports.MeshOsDaemonHandle = exports.MeshOsDaemonSdk = exports.parseMeshDbErrorKind = exports.QueryBuilder = exports.MeshQueryStream = exports.MeshQueryRunner = exports.MeshQuery = exports.InMemoryChainReader = exports.DisposableMeshQueryRunner = exports.MigrationError = exports.MigrationHandle = exports.DaemonError = exports.DaemonHandle = exports.DaemonRuntime = exports.GLOBAL_SUBNET = exports.subnetId = exports.validateCapabilities = exports.isReportValid = exports.isReportClean = exports.METADATA_SOFT_CAP_BYTES = exports.METADATA_RESERVED_PREFIXES = exports.METADATA_RESERVED_KEYS = exports.AXIS_SCHEMA = exports.renderDebugReport = exports.redactMetadataKeys = exports.predicateDebugReportFromWire = exports.predicateDebugReport = exports.evaluatePredicateWithTrace = exports.evaluatePredicate = exports.placementFilterFromFn = void 0;
+exports.gemini = exports.mcp = exports.anthropic = exports.openai = exports.TOOL_METADATA_FETCH_SERVICE = exports.ToolCallParseError = exports.fetchToolMetadata = void 0;
 // Main handle.
 var node_1 = require("./node");
 Object.defineProperty(exports, "NetNode", { enumerable: true, get: function () { return node_1.NetNode; } });
@@ -146,6 +146,15 @@ Object.defineProperty(exports, "GroupError", { enumerable: true, get: function (
 // module directly.
 var redis_dedup_1 = require("./redis-dedup");
 Object.defineProperty(exports, "RedisStreamDedup", { enumerable: true, get: function () { return redis_dedup_1.RedisStreamDedup; } });
+// Transport surface (blob + directory transfer over the fairscheduler
+// stream transport). Wire types + stream-id helpers; node-driven ops
+// follow with the Node behavioural tests (T-H).
+var transport_1 = require("./transport");
+Object.defineProperty(exports, "TransferControl", { enumerable: true, get: function () { return transport_1.TransferControl; } });
+Object.defineProperty(exports, "TransferHeader", { enumerable: true, get: function () { return transport_1.TransferHeader; } });
+Object.defineProperty(exports, "transferStreamId", { enumerable: true, get: function () { return transport_1.transferStreamId; } });
+Object.defineProperty(exports, "isTransferStreamId", { enumerable: true, get: function () { return transport_1.isTransferStreamId; } });
+Object.defineProperty(exports, "nextTransferStreamId", { enumerable: true, get: function () { return transport_1.nextTransferStreamId; } });
 var tool_1 = require("./tool");
 Object.defineProperty(exports, "isTerminalEvent", { enumerable: true, get: function () { return tool_1.isTerminalEvent; } });
 Object.defineProperty(exports, "descriptorFrom", { enumerable: true, get: function () { return tool_1.descriptorFrom; } });

package/dist/mesh.d.ts

@@ -249,11 +249,14 @@ export declare class MeshNode {
      *
      * Pass `opts.token` to present a
      * {@link Token PermissionToken} issued by the publisher — required
-     * when the channel was registered with `requireToken: true` or
-     * when your caps alone don't satisfy `subscribeCaps`. The
-     * publisher verifies the signature, checks `subject ===
-     * thisNode.entityId`, installs it in its local cache, then runs
-     * the ACL check.
+     * when the channel was registered with `tokenRoots` (token
+     * enforcement) or when your caps alone don't satisfy
+     * `subscribeCaps`. The publisher verifies the presented token chain
+     * — it must root at one of the channel's `tokenRoots`, bind at its
+     * leaf to this node's entity id, and authorize `subscribe` — before
+     * admitting the subscribe. The credential must be presented on every
+     * subscribe; a previously-accepted one is not reused for a later
+     * bare subscribe.
      *
      * Throws a {@link ChannelAuthError} or {@link ChannelError} on
      * rejection; network-level failures propagate as plain `Error`.
@@ -374,8 +377,18 @@ export interface ChannelConfig {
     /**
      * When true, subscribers must present a valid
      * `PermissionToken` whose subject matches their entity id.
+     * On its own (no `tokenRoots`) this fails every authorization
+     * closed — pass `tokenRoots` to anchor a root of trust.
      */
     requireToken?: boolean;
+    /**
+     * Root(s) of trust for token authorization: 32-byte entity ids
+     * whose signature may root a presented token chain. Setting this
+     * turns on token enforcement and anchors the channel — a chain is
+     * only honored if its root link was issued by one of these
+     * entities (e.g. the publisher that issues subscribe tokens).
+     */
+    tokenRoots?: Buffer[];
     /** Priority (0 = lowest). */
     priority?: number;
     /** Rate cap in packets per second. */

package/dist/mesh.js

@@ -294,6 +294,7 @@ class MeshNode {
                 visibility: config.visibility,
                 reliable: config.reliable,
                 requireToken: config.requireToken,
+                tokenRoots: config.tokenRoots,
                 priority: config.priority,
                 maxRatePps: config.maxRatePps,
                 publishCaps: config.publishCaps
@@ -315,11 +316,14 @@ class MeshNode {
      *
      * Pass `opts.token` to present a
      * {@link Token PermissionToken} issued by the publisher — required
-     * when the channel was registered with `requireToken: true` or
-     * when your caps alone don't satisfy `subscribeCaps`. The
-     * publisher verifies the signature, checks `subject ===
-     * thisNode.entityId`, installs it in its local cache, then runs
-     * the ACL check.
+     * when the channel was registered with `tokenRoots` (token
+     * enforcement) or when your caps alone don't satisfy
+     * `subscribeCaps`. The publisher verifies the presented token chain
+     * — it must root at one of the channel's `tokenRoots`, bind at its
+     * leaf to this node's entity id, and authorize `subscribe` — before
+     * admitting the subscribe. The credential must be presented on every
+     * subscribe; a previously-accepted one is not reused for a later
+     * bare subscribe.
      *
      * Throws a {@link ChannelAuthError} or {@link ChannelError} on
      * rejection; network-level failures propagate as plain `Error`.

package/dist/transport.d.ts

@@ -0,0 +1 @@
+export { TransferControl, TransferHeader, transferStreamId, isTransferStreamId, nextTransferStreamId, } from '@net-mesh/core';

package/dist/transport.js

@@ -0,0 +1,32 @@
+"use strict";
+// Transport surface — on-demand cross-peer blob + directory transfer
+// over the fairscheduler stream transport (Transport SDK plan, T-E).
+//
+// Moves content-addressed bytes (and whole directory trees) between
+// peers over the substrate's reliable, fair-scheduled streams —
+// distinct from RedEX replication (a push primitive) and nRPC
+// (request/reply). Mirrors the Rust `net_sdk::transport` surface, the
+// C ABI in `include/net_transport.h`, and the Python `net_sdk.transport`
+// module.
+//
+// This module re-exports the cross-language wire contract + the
+// stream-id helpers from the napi binding (`@net-mesh/core`):
+//
+//   - `TransferControl` / `TransferHeader` — the postcard wire types
+//     with `encode()` / `decode()`, byte-identical across every
+//     language tier (locked by the cross-language golden vectors).
+//   - `transferStreamId` / `isTransferStreamId` / `nextTransferStreamId`.
+//
+// The node-driven ops (`serveBlobTransfer`, `fetchBlob`,
+// `fetchBlobDiscovered`, `storeDir`, `fetchDir`) are methods on the
+// napi `NetMesh` class (see `bindings/node/src/transport.rs`); the SDK
+// `MeshNode` wrapper in `mesh.ts` delegates to them. A `napi build` must
+// regenerate `@net-mesh/core`'s typings before tsc sees the new symbols.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nextTransferStreamId = exports.isTransferStreamId = exports.transferStreamId = exports.TransferHeader = exports.TransferControl = void 0;
+var core_1 = require("@net-mesh/core");
+Object.defineProperty(exports, "TransferControl", { enumerable: true, get: function () { return core_1.TransferControl; } });
+Object.defineProperty(exports, "TransferHeader", { enumerable: true, get: function () { return core_1.TransferHeader; } });
+Object.defineProperty(exports, "transferStreamId", { enumerable: true, get: function () { return core_1.transferStreamId; } });
+Object.defineProperty(exports, "isTransferStreamId", { enumerable: true, get: function () { return core_1.isTransferStreamId; } });
+Object.defineProperty(exports, "nextTransferStreamId", { enumerable: true, get: function () { return core_1.nextTransferStreamId; } });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@net-mesh/sdk",
-  "version": "0.26.0",
+  "version": "0.27.0-beta.1",
   "description": "Ergonomic TypeScript SDK for the Net mesh network",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -39,7 +39,7 @@
     "test:watch": "vitest"
   },
   "peerDependencies": {
-    "@net-mesh/core": ">=0.26.0"
+    "@net-mesh/core": ">=0.27.0-0"
   },
   "devDependencies": {
     "@net-mesh/core": "file:../bindings/node",