@vibecook/truffle 0.4.8 → 0.5.0

package/dist/quic.d.ts

@@ -0,0 +1,88 @@
+import { Duplex } from 'node:stream';
+import type { NapiNode, NapiQuicConnection, NapiQuicListener, NapiQuicStream } from '@vibecook/truffle-native';
+/**
+ * A bidirectional byte stream on a QUIC connection, as a `stream.Duplex`.
+ *
+ * Behaves like an independent TCP connection (ordered, reliable,
+ * flow-controlled) without head-of-line blocking against sibling streams.
+ * `end()` half-closes (the peer sees clean EOF); `destroy()` also stops
+ * the read side.
+ */
+export declare class TruffleQuicStream extends Duplex {
+    #private;
+    constructor(native: NapiQuicStream);
+    _read(size: number): void;
+    _write(chunk: Buffer, _encoding: BufferEncoding, callback: (error?: Error | null) => void): void;
+    _final(callback: (error?: Error | null) => void): void;
+    _destroy(error: Error | null, callback: (error: Error | null) => void): void;
+}
+/**
+ * A QUIC connection to a peer. Open streams with {@link openStream};
+ * iterate peer-opened streams with `for await (const stream of conn)`.
+ *
+ * Streams are lazy: the peer's iterator does not yield a stream until the
+ * opener writes its first bytes. Keep the connection object alive while
+ * its streams are in use — closing it closes all of them.
+ */
+export declare class TruffleQuicConnection implements AsyncIterable<TruffleQuicStream> {
+    #private;
+    /** The peer's tailnet address (`100.x.x.x:port`). */
+    readonly remoteAddress: string;
+    /** The peer's stable device id when known. */
+    readonly remotePeerId?: string;
+    constructor(native: NapiQuicConnection);
+    /** Open a new bidirectional byte stream on this connection. */
+    openStream(): Promise<TruffleQuicStream>;
+    /**
+     * Accept the next stream the peer opens; `null` once the connection has
+     * closed. Prefer iteration: `for await (const stream of conn.streams())`.
+     */
+    acceptStream(): Promise<TruffleQuicStream | null>;
+    /** Async iterator over peer-opened streams, ending when the connection closes. */
+    streams(): AsyncIterableIterator<TruffleQuicStream>;
+    [Symbol.asyncIterator](): AsyncIterableIterator<TruffleQuicStream>;
+    /** Close the connection and all its streams. */
+    close(): void;
+}
+/**
+ * A QUIC server on the mesh. Iterate incoming connections:
+ *
+ * ```ts
+ * const server = await mesh.quic.listen(4433);
+ * for await (const conn of server) {
+ *   for await (const stream of conn.streams()) {
+ *     stream.pipe(stream); // echo
+ *   }
+ * }
+ * ```
+ */
+export declare class TruffleQuicServer implements AsyncIterable<TruffleQuicConnection> {
+    #private;
+    /** The port this server is bound to. */
+    readonly port: number;
+    constructor(native: NapiQuicListener);
+    /** Accept the next incoming connection; `null` once the server is closed. */
+    accept(): Promise<TruffleQuicConnection | null>;
+    /** Alias of async iteration, mirroring the RFC's `sessions()` sketch. */
+    connections(): AsyncIterableIterator<TruffleQuicConnection>;
+    [Symbol.asyncIterator](): AsyncIterableIterator<TruffleQuicConnection>;
+    /** Close the server and every connection accepted from it. */
+    close(): void;
+}
+/** QUIC namespace bound to a mesh node. */
+export interface TruffleQuic {
+    /**
+     * Open a QUIC connection to a peer. `host` accepts a device id (or
+     * unique ≥4-char prefix), device name, Tailscale hostname, or IP. Only
+     * same-app peers can complete the handshake (ALPN scoping).
+     */
+    connect(host: string, port: number): Promise<TruffleQuicConnection>;
+    /**
+     * Listen for QUIC connections. Ports 443/9417 are reserved; port 0 is
+     * not supported over the tsnet relay — choose an explicit port
+     * (suggested default: 9420+).
+     */
+    listen(port: number): Promise<TruffleQuicServer>;
+}
+export declare function createQuicNamespace(node: NapiNode): TruffleQuic;
+//# sourceMappingURL=quic.d.ts.map

package/dist/quic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quic.d.ts","sourceRoot":"","sources":["../src/quic.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,KAAK,EACV,QAAQ,EACR,kBAAkB,EAClB,gBAAgB,EAChB,cAAc,EACf,MAAM,0BAA0B,CAAC;AAElC;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,MAAM;;gBAI/B,MAAM,EAAE,cAAc;IAKzB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAezB,MAAM,CACb,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,cAAc,EACzB,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GACvC,IAAI;IAIE,MAAM,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;IAItD,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,GAAG,IAAI,KAAK,IAAI,GAAG,IAAI;CAItF;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,YAAW,aAAa,CAAC,iBAAiB,CAAC;;IAG5E,qDAAqD;IACrD,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,8CAA8C;IAC9C,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEnB,MAAM,EAAE,kBAAkB;IAMtC,+DAA+D;IACzD,UAAU,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAI9C;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAKvD,kFAAkF;IAClF,OAAO,IAAI,qBAAqB,CAAC,iBAAiB,CAAC;IAI5C,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,iBAAiB,CAAC;IAQzE,gDAAgD;IAChD,KAAK,IAAI,IAAI;CAGd;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,aAAa,CAAC,qBAAqB,CAAC;;IAG5E,wCAAwC;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBAEV,MAAM,EAAE,gBAAgB;IAKpC,6EAA6E;IACvE,MAAM,IAAI,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC;IAKrD,yEAAyE;IACzE,WAAW,IAAI,qBAAqB,CAAC,qBAAqB,CAAC;IAIpD,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,qBAAqB,CAAC,qBAAqB,CAAC;IAQ7E,8DAA8D;IAC9D,KAAK,IAAI,IAAI;CAGd;AAED,2CAA2C;AAC3C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpE;;;;OAIG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClD;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAS/D"}

package/dist/quic.js

@@ -0,0 +1,150 @@
+// mesh.quic — modern QUIC API over the mesh (RFC 021 Phase 3).
+//
+// Shape follows the RFC (and iroh's precedent): connect a peer → a
+// connection carrying many concurrent bidirectional byte streams with no
+// head-of-line blocking between them. Connections and streams are async
+// iterable; each stream is a real `stream.Duplex` (same pull-model
+// backpressure as `mesh.net` sockets).
+import { Duplex } from 'node:stream';
+/**
+ * A bidirectional byte stream on a QUIC connection, as a `stream.Duplex`.
+ *
+ * Behaves like an independent TCP connection (ordered, reliable,
+ * flow-controlled) without head-of-line blocking against sibling streams.
+ * `end()` half-closes (the peer sees clean EOF); `destroy()` also stops
+ * the read side.
+ */
+export class TruffleQuicStream extends Duplex {
+    #native;
+    #reading = false;
+    constructor(native) {
+        super({ allowHalfOpen: true });
+        this.#native = native;
+    }
+    _read(size) {
+        if (this.#reading)
+            return;
+        this.#reading = true;
+        this.#native
+            .read(size > 0 ? size : undefined)
+            .then((chunk) => {
+            this.#reading = false;
+            this.push(chunk);
+        })
+            .catch((err) => {
+            this.#reading = false;
+            this.destroy(err);
+        });
+    }
+    _write(chunk, _encoding, callback) {
+        this.#native.write(chunk).then(() => callback(null), callback);
+    }
+    _final(callback) {
+        this.#native.finish().then(() => callback(null), callback);
+    }
+    _destroy(error, callback) {
+        const finish = () => callback(error);
+        this.#native.close().then(finish, finish);
+    }
+}
+/**
+ * A QUIC connection to a peer. Open streams with {@link openStream};
+ * iterate peer-opened streams with `for await (const stream of conn)`.
+ *
+ * Streams are lazy: the peer's iterator does not yield a stream until the
+ * opener writes its first bytes. Keep the connection object alive while
+ * its streams are in use — closing it closes all of them.
+ */
+export class TruffleQuicConnection {
+    #native;
+    /** The peer's tailnet address (`100.x.x.x:port`). */
+    remoteAddress;
+    /** The peer's stable device id when known. */
+    remotePeerId;
+    constructor(native) {
+        this.#native = native;
+        this.remoteAddress = native.remoteAddress();
+        this.remotePeerId = native.remotePeerId() ?? undefined;
+    }
+    /** Open a new bidirectional byte stream on this connection. */
+    async openStream() {
+        return new TruffleQuicStream(await this.#native.openStream());
+    }
+    /**
+     * Accept the next stream the peer opens; `null` once the connection has
+     * closed. Prefer iteration: `for await (const stream of conn.streams())`.
+     */
+    async acceptStream() {
+        const native = await this.#native.acceptStream();
+        return native === null ? null : new TruffleQuicStream(native);
+    }
+    /** Async iterator over peer-opened streams, ending when the connection closes. */
+    streams() {
+        return this[Symbol.asyncIterator]();
+    }
+    async *[Symbol.asyncIterator]() {
+        for (;;) {
+            const stream = await this.acceptStream();
+            if (stream === null)
+                return;
+            yield stream;
+        }
+    }
+    /** Close the connection and all its streams. */
+    close() {
+        this.#native.close();
+    }
+}
+/**
+ * A QUIC server on the mesh. Iterate incoming connections:
+ *
+ * ```ts
+ * const server = await mesh.quic.listen(4433);
+ * for await (const conn of server) {
+ *   for await (const stream of conn.streams()) {
+ *     stream.pipe(stream); // echo
+ *   }
+ * }
+ * ```
+ */
+export class TruffleQuicServer {
+    #native;
+    /** The port this server is bound to. */
+    port;
+    constructor(native) {
+        this.#native = native;
+        this.port = native.port();
+    }
+    /** Accept the next incoming connection; `null` once the server is closed. */
+    async accept() {
+        const native = await this.#native.accept();
+        return native === null ? null : new TruffleQuicConnection(native);
+    }
+    /** Alias of async iteration, mirroring the RFC's `sessions()` sketch. */
+    connections() {
+        return this[Symbol.asyncIterator]();
+    }
+    async *[Symbol.asyncIterator]() {
+        for (;;) {
+            const conn = await this.accept();
+            if (conn === null)
+                return;
+            yield conn;
+        }
+    }
+    /** Close the server and every connection accepted from it. */
+    close() {
+        this.#native.close();
+    }
+}
+export function createQuicNamespace(node) {
+    return {
+        async connect(host, port) {
+            return new TruffleQuicConnection(await node.connectQuic(host, port));
+        },
+        async listen(port) {
+            return new TruffleQuicServer(await node.listenQuic(port));
+        },
+    };
+}
+//# sourceMappingURL=quic.js.map

package/dist/quic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quic.js","sourceRoot":"","sources":["../src/quic.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,mEAAmE;AACnE,uCAAuC;AAEvC,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAQrC;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAkB,SAAQ,MAAM;IAC3C,OAAO,CAAiB;IACxB,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,MAAsB;QAChC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;IACxB,CAAC;IAEQ,KAAK,CAAC,IAAY;QACzB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,OAAO;aACT,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;aACjC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;YACd,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACb,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,GAAY,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;IACP,CAAC;IAEQ,MAAM,CACb,KAAa,EACb,SAAyB,EACzB,QAAwC;QAExC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IACjE,CAAC;IAEQ,MAAM,CAAC,QAAwC;QACtD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC7D,CAAC;IAEQ,QAAQ,CAAC,KAAmB,EAAE,QAAuC;QAC5E,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC,OAAO,CAAqB;IAE5B,qDAAqD;IAC5C,aAAa,CAAS;IAC/B,8CAA8C;IACrC,YAAY,CAAU;IAE/B,YAAY,MAA0B;QACpC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,EAAE,IAAI,SAAS,CAAC;IACzD,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,UAAU;QACd,OAAO,IAAI,iBAAiB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,YAAY;QAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjD,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAChE,CAAC;IAED,kFAAkF;IAClF,OAAO;QACL,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,SAAS,CAAC;YACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,IAAI;gBAAE,OAAO;YAC5B,MAAM,MAAM,CAAC;QACf,CAAC;IACH,CAAC;IAED,gDAAgD;IAChD,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,iBAAiB;IAC5B,OAAO,CAAmB;IAE1B,wCAAwC;IAC/B,IAAI,CAAS;IAEtB,YAAY,MAAwB;QAClC,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QAC3C,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IAED,yEAAyE;IACzE,WAAW;QACT,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC;QAC3B,SAAS,CAAC;YACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,IAAI;gBAAE,OAAO;YAC1B,MAAM,IAAI,CAAC;QACb,CAAC;IACH,CAAC;IAED,8DAA8D;IAC9D,KAAK;QACH,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;CACF;AAkBD,MAAM,UAAU,mBAAmB,CAAC,IAAc;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAY;YACtC,OAAO,IAAI,qBAAqB,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,IAAY;YACvB,OAAO,IAAI,iBAAiB,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/ws.d.ts

@@ -0,0 +1,72 @@
+import type { TruffleNet } from './net.js';
+import type WebSocket from 'ws';
+import type { WebSocketServer as WsServerInstance, ServerOptions as WsServerOptions, ClientOptions as WsClientOptions } from 'ws';
+/** The subset of the `ws` module mesh.ws uses; see {@link WsLoader}. */
+interface WsExports {
+    /** The `ws` client constructor. */
+    WebSocket: new (address: string, options?: WsClientOptions) => WebSocket;
+    /** The `ws` server constructor. */
+    WebSocketServer: new (options?: WsServerOptions) => WsServerInstance;
+}
+/**
+ * Loads the `ws` module. Defaults to a real `import('ws')`; the seam exists so
+ * tests can inject a loader (including one that rejects, to exercise the
+ * missing-dependency path) without touching the filesystem.
+ */
+export type WsLoader = () => Promise<WsExports>;
+/**
+ * A `ws` {@link WebSocket.Server} bound to a mesh listener.
+ *
+ * Everything about it is the ordinary `ws` server API — most importantly the
+ * `'connection'` event still fires with `(ws, request)` — with two additions:
+ * `port` (resolved, so an ephemeral `0` request surfaces the real port) and a
+ * `close()` that also tears down the underlying mesh listener.
+ */
+export interface TruffleWsServer extends WsServerInstance {
+    /** The mesh port this server is bound to (resolved when `0` was requested). */
+    readonly port: number;
+}
+/** Options for {@link TruffleWs.createServer}. */
+export interface TruffleWsServerOptions {
+    /**
+     * Mesh port to listen on. `0` binds an ephemeral port (read it back from
+     * `server.port`). Ports 443 and 9417 are reserved by the mesh and rejected.
+     */
+    port: number;
+    /**
+     * Optional path filter, like `ws`'s own `path` option: only upgrade requests
+     * whose URL path matches are accepted; others get a `400`-style socket close.
+     */
+    path?: string;
+}
+/** WebSocket-over-mesh namespace bound to a mesh node's `net` namespace. */
+export interface TruffleWs {
+    /**
+     * Open a WebSocket to a peer, returning a connecting `ws` `WebSocket` (await
+     * its `'open'` event as usual). `host` accepts any peer reference — device
+     * id (or ≥4-char prefix), device name, Tailscale hostname, or `100.x` IP —
+     * including names with spaces and case-sensitive ids that aren't valid URL
+     * hostnames (they're pinned past the URL, see the module docs). `path`
+     * defaults to `/`; `options` are forwarded to the `ws` `WebSocket`
+     * constructor (a caller-supplied `agent` is overridden — the mesh agent is
+     * how it reaches the peer).
+     */
+    connect(host: string, port: number, path?: string, options?: WsClientOptions): Promise<WebSocket>;
+    /**
+     * Start a WebSocket server on the mesh. Resolves once it's listening; the
+     * returned server's `'connection'` event delivers `(ws, request)` like any
+     * `ws` server. Close it (and release the mesh port) with `server.close()`.
+     */
+    createServer(options: TruffleWsServerOptions): Promise<TruffleWsServer>;
+}
+/**
+ * Build the `mesh.ws` namespace over a node's `net` namespace.
+ *
+ * @param net   The node's {@link TruffleNet} (mesh TCP), used for the client
+ *              agent and the server's listener.
+ * @param load  How to obtain the `ws` module; defaults to `import('ws')`.
+ *              Injectable for tests.
+ */
+export declare function createWsNamespace(net: TruffleNet, load?: WsLoader): TruffleWs;
+export {};
+//# sourceMappingURL=ws.d.ts.map

package/dist/ws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.d.ts","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAG3C,OAAO,KAAK,SAAS,MAAM,IAAI,CAAC;AAChC,OAAO,KAAK,EACV,eAAe,IAAI,gBAAgB,EACnC,aAAa,IAAI,eAAe,EAChC,aAAa,IAAI,eAAe,EACjC,MAAM,IAAI,CAAC;AAsBZ,wEAAwE;AACxE,UAAU,SAAS;IACjB,mCAAmC;IACnC,SAAS,EAAE,KAAK,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,SAAS,CAAC;IACzE,mCAAmC;IACnC,eAAe,EAAE,KAAK,OAAO,CAAC,EAAE,eAAe,KAAK,gBAAgB,CAAC;CACtE;AAED;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;AAyBhD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAgB,SAAQ,gBAAgB;IACvD,+EAA+E;IAC/E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,IAAI,EAAE,MAAM,CAAC;IACb;;;OAGG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,4EAA4E;AAC5E,MAAM,WAAW,SAAS;IACxB;;;;;;;;;OASG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClG;;;;OAIG;IACH,YAAY,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACzE;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,QAAmB,GAAG,SAAS,CA8FvF"}

package/dist/ws.js

@@ -0,0 +1,152 @@
+// WebSocket over the mesh via the `ws` package (RFC 021 Phase 4, D3).
+//
+// mesh.ws ships zero new Rust: it runs the battle-tested `ws` npm package over
+// mesh TCP. The client drives `ws`'s HTTP upgrade through a MeshAgent (whose
+// `createConnection` returns a mesh `TruffleSocket`); the server feeds mesh
+// connections into a stock `http.Server` and lets a `noServer` WebSocketServer
+// complete the upgrade — exactly the seams `ws` documents for custom
+// transports. `websocket.rs` stays the internal envelope pipe on 9417; this is
+// a separate, user-facing raw-WebSocket surface.
+//
+// `ws` is an OPTIONAL peer dependency: apps that never touch mesh.ws don't need
+// it installed. Nothing here imports `ws` at module load — the namespace holds
+// lazy async functions that `await import('ws')` on first use and throw a
+// clear, actionable error when it's missing.
+import http from 'node:http';
+import { MeshAgent } from './http.js';
+/**
+ * Hostname placed in the `ws://` URL when the caller's peer reference can't be
+ * a URL hostname (device names with spaces, case-sensitive device ids, …).
+ * It only ever sets the HTTP `Host` header — correctness never depends on it,
+ * because the agent dials the real peer reference verbatim (see {@link PIN_KEY}).
+ * `.invalid` is reserved by RFC 2606 and never resolves, so it reads as the
+ * placeholder it is.
+ */
+const PLACEHOLDER_HOST = 'truffle.invalid';
+/**
+ * Request-option key carrying the true peer reference past `ws`'s URL
+ * rewriting. `ws` overwrites `options.host` with the URL's hostname before the
+ * agent sees it, so a non-URL-safe peer reference can't ride `options.host`.
+ * It CAN ride an unknown key: `ws` spreads user options into the request and
+ * `http` forwards unknown keys to the agent's `createConnection` untouched
+ * (verified empirically). {@link MeshWsAgent} reads it back.
+ */
+const PIN_KEY = 'truffleWsPeer';
+const importWs = () => import('ws');
+/**
+ * A {@link MeshAgent} that honours a pinned peer reference ({@link PIN_KEY}).
+ *
+ * For a URL-safe peer reference the pin equals the URL hostname and this is a
+ * no-op; for a non-URL-safe one the URL carries a placeholder and the real
+ * reference arrives only via the pin, so we rewrite `host`/`hostname` before
+ * delegating to MeshAgent — which then dials the exact peer over mesh TCP.
+ */
+class MeshWsAgent extends MeshAgent {
+    createConnection(options, callback) {
+        const pinned = options[PIN_KEY];
+        if (typeof pinned === 'string' && pinned.length > 0) {
+            return super.createConnection({ ...options, host: pinned, hostname: pinned }, callback);
+        }
+        return super.createConnection(options, callback);
+    }
+}
+/**
+ * Build the `mesh.ws` namespace over a node's `net` namespace.
+ *
+ * @param net   The node's {@link TruffleNet} (mesh TCP), used for the client
+ *              agent and the server's listener.
+ * @param load  How to obtain the `ws` module; defaults to `import('ws')`.
+ *              Injectable for tests.
+ */
+export function createWsNamespace(net, load = importWs) {
+    const agent = new MeshWsAgent(net);
+    async function loadWs() {
+        try {
+            return await load();
+        }
+        catch (err) {
+            throw new Error("mesh.ws requires the 'ws' package, which is an optional peer dependency — " +
+                'install it with `npm install ws` (or `pnpm add ws`).', { cause: err });
+        }
+    }
+    async function connect(host, port, path = '/', options = {}) {
+        const { WebSocket: WebSocketImpl } = await loadWs();
+        const requestPath = path.startsWith('/') ? path : `/${path}`;
+        // The URL hostname only sets the HTTP Host header; the agent always dials
+        // the pinned peer. Embed `host` when it round-trips as a URL hostname
+        // unchanged (a plain IP or lowercase device name), so the Host header is
+        // natural; otherwise a placeholder (a name with spaces, or a device id
+        // whose case a URL would fold — either would dial the wrong peer).
+        const urlHost = urlHostnameFor(host, port) ?? PLACEHOLDER_HOST;
+        const url = `ws://${urlHost}:${port}${requestPath}`;
+        // `agent` last: the mesh agent is non-negotiable. PIN_KEY is an unknown key
+        // ws/http pass through to the agent (see PIN_KEY); cast past the typed
+        // ClientOptions to attach it.
+        const wsOptions = { ...options, agent, [PIN_KEY]: host };
+        return new WebSocketImpl(url, wsOptions);
+    }
+    async function createServer(options) {
+        const { WebSocketServer } = await loadWs();
+        // A throwaway http.Server does the HTTP/WebSocket upgrade parsing; a
+        // noServer WebSocketServer completes the handshake. We never `.listen()`
+        // this http server on a host port — mesh connections are fed in by hand.
+        const httpServer = http.createServer();
+        const wss = new WebSocketServer({ noServer: true, path: options.path });
+        httpServer.on('upgrade', (req, socket, head) => {
+            // `ws`'s own path check: true when no `path` was set, else on a match.
+            Promise.resolve(wss.shouldHandle(req)).then((ok) => {
+                if (!ok) {
+                    socket.destroy();
+                    return;
+                }
+                wss.handleUpgrade(req, socket, head, (client, request) => {
+                    wss.emit('connection', client, request);
+                });
+            });
+        });
+        // Each mesh TCP connection becomes an http.Server 'connection' — exactly
+        // what a real listening socket would emit — so http parses it and, on an
+        // Upgrade request, fires the 'upgrade' handler above.
+        const meshServer = net.createServer((sock) => httpServer.emit('connection', sock));
+        await new Promise((resolve, reject) => {
+            const onError = (err) => reject(err);
+            meshServer.once('error', onError);
+            meshServer.listen(options.port, () => {
+                meshServer.removeListener('error', onError);
+                resolve();
+            });
+        });
+        const server = wss;
+        Object.defineProperty(server, 'port', {
+            value: meshServer.port ?? options.port,
+            enumerable: true,
+        });
+        // close() also tears down the mesh listener and any live client sockets;
+        // the http.Server holds no listening socket, so there's nothing to close
+        // there. Keep ws's void-returning signature so the type stays a ws Server.
+        const closeWs = wss.close.bind(wss);
+        server.close = (callback) => {
+            for (const client of wss.clients)
+                client.close();
+            meshServer.close();
+            closeWs(callback);
+        };
+        return server;
+    }
+    return { connect, createServer };
+}
+/**
+ * Returns `host` when it is a URL hostname that round-trips unchanged (so it's
+ * safe to embed in a `ws://` URL and use for the Host header), else `null`.
+ * The equality check rejects anything a WHATWG URL would normalise — notably
+ * uppercase device ids, which URL parsing lowercases.
+ */
+function urlHostnameFor(host, port) {
+    try {
+        return new URL(`ws://${host}:${port}`).hostname === host ? host : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=ws.js.map

package/dist/ws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ws.js","sourceRoot":"","sources":["../src/ws.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,+EAA+E;AAC/E,qEAAqE;AACrE,+EAA+E;AAC/E,iDAAiD;AACjD,EAAE;AACF,gFAAgF;AAChF,+EAA+E;AAC/E,0EAA0E;AAC1E,6CAA6C;AAE7C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAWtC;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,iBAAiB,CAAC;AAE3C;;;;;;;GAOG;AACH,MAAM,OAAO,GAAG,eAAe,CAAC;AAiBhC,MAAM,QAAQ,GAAa,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAuB,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,WAAY,SAAQ,SAAS;IACxB,gBAAgB,CACvB,OAA+B,EAC/B,QAAsD;QAEtD,MAAM,MAAM,GAAI,OAAmC,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,KAAK,CAAC,gBAAgB,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO,KAAK,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;CACF;AAkDD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAe,EAAE,OAAiB,QAAQ;IAC1E,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,GAAG,CAAC,CAAC;IAEnC,KAAK,UAAU,MAAM;QACnB,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4EAA4E;gBAC1E,sDAAsD,EACxD,EAAE,KAAK,EAAE,GAAG,EAAE,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,OAAO,CACpB,IAAY,EACZ,IAAY,EACZ,IAAI,GAAG,GAAG,EACV,UAA2B,EAAE;QAE7B,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACpD,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAE7D,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,mEAAmE;QACnE,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,gBAAgB,CAAC;QAC/D,MAAM,GAAG,GAAG,QAAQ,OAAO,IAAI,IAAI,GAAG,WAAW,EAAE,CAAC;QAEpD,4EAA4E;QAC5E,uEAAuE;QACvE,8BAA8B;QAC9B,MAAM,SAAS,GAA4B,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QAClF,OAAO,IAAI,aAAa,CAAC,GAAG,EAAE,SAA4B,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,OAA+B;QACzD,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QAE3C,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAExE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;YAC7C,uEAAuE;YACvE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE;gBACjD,IAAI,CAAC,EAAE,EAAE,CAAC;oBACR,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjB,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,MAAiB,EAAE,OAA6B,EAAE,EAAE;oBACxF,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1C,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,yEAAyE;QACzE,yEAAyE;QACzE,sDAAsD;QACtD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;QACnF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC1C,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAClC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;gBACnC,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5C,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,GAAsB,CAAC;QACtC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE;YACpC,KAAK,EAAE,UAAU,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;YACtC,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,GAAG,CAAC,QAAgC,EAAQ,EAAE;YACxD,KAAK,MAAM,MAAM,IAAI,GAAG,CAAC,OAAO;gBAAE,MAAM,CAAC,KAAK,EAAE,CAAC;YACjD,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpB,CAAC,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibecook/truffle",
-  "version": "0.4.8",
+  "version": "0.5.0",
   "description": "Mesh networking for local-first apps, built on Tailscale",
   "license": "MIT",
   "author": "James Yong",
@@ -44,22 +44,33 @@
     "sidecar-checksums.json"
   ],
   "dependencies": {
-    "@vibecook/truffle-native": "0.4.8"
+    "@vibecook/truffle-native": "0.5.0"
+  },
+  "peerDependencies": {
+    "ws": ">=8"
+  },
+  "peerDependenciesMeta": {
+    "ws": {
+      "optional": true
+    }
   },
   "optionalDependencies": {
-    "@vibecook/truffle-sidecar-darwin-arm64": "^0.4.6",
-    "@vibecook/truffle-sidecar-darwin-x64": "^0.4.6",
-    "@vibecook/truffle-sidecar-linux-x64": "^0.4.5",
-    "@vibecook/truffle-sidecar-linux-arm64": "^0.4.5",
-    "@vibecook/truffle-sidecar-win32-x64": "^0.4.5"
+    "@vibecook/truffle-sidecar-darwin-arm64": "0.5.0",
+    "@vibecook/truffle-sidecar-darwin-x64": "0.5.0",
+    "@vibecook/truffle-sidecar-linux-x64": "0.5.0",
+    "@vibecook/truffle-sidecar-linux-arm64": "0.5.0",
+    "@vibecook/truffle-sidecar-win32-x64": "0.5.0"
   },
   "devDependencies": {
-    "typescript": "^5.7.0"
+    "@types/ws": "^8.5.13",
+    "typescript": "^5.7.0",
+    "ws": "^8.18.0"
   },
   "scripts": {
     "build": "tsc",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
+    "test": "node --test \"test/**/*.test.cjs\"",
     "postinstall": "node scripts/postinstall.cjs"
   }
 }

package/scripts/postinstall.cjs

@@ -103,6 +103,20 @@ function loadExpectedChecksum(version, asset) {
   }
 }
 
+/** Release tags are `truffle-v{version}` (release-please monorepo tag scheme), NOT `v{version}`. */
+function buildDownloadUrl(version, asset) {
+  return `https://github.com/${GITHUB_REPO}/releases/download/truffle-v${version}/${asset}`;
+}
+
+/** Throw if `actual` does not match `expected` (hex, case-insensitive). */
+function assertChecksum(actual, expected, label) {
+  if (actual.toLowerCase() !== expected.toLowerCase()) {
+    throw new Error(
+      `SECURITY: sidecar checksum mismatch for ${label}. Expected ${expected}, got ${actual}.`,
+    );
+  }
+}
+
 async function main() {
   const key = `${process.platform}-${process.arch}`;
   const pkg = PLATFORM_PACKAGES[key];
@@ -142,7 +156,7 @@ async function main() {
   if (!asset) return;
 
   const version = require('../package.json').version;
-  const url = `https://github.com/${GITHUB_REPO}/releases/download/v${version}/${asset}`;
+  const url = buildDownloadUrl(version, asset);
   const expected = loadExpectedChecksum(version, asset);
 
   console.log(`[truffle] Sidecar not found via npm. Downloading from GitHub Releases...`);
@@ -176,21 +190,21 @@ async function main() {
   // Integrity check.
   if (expected) {
     const actual = await sha256File(dest);
-    if (actual.toLowerCase() !== expected.toLowerCase()) {
+    try {
+      assertChecksum(actual, expected, `truffle-v${version}/${asset}`);
+    } catch (err) {
       try {
         unlinkSync(dest);
       } catch {
         /* ignore */
       }
-      console.error(
-        `[truffle] SECURITY: sidecar checksum mismatch for v${version}/${asset}. ` +
-          `Deleted the download and refusing to install it. Expected ${expected}, got ${actual}.`,
-      );
+      console.error(`[truffle] ${err.message} Deleted the download and refusing to install it.`);
+      process.exitCode = 1;
       return;
     }
   } else {
     console.warn(
-      `[truffle] WARNING: no pinned checksum for v${version}/${asset}; integrity NOT verified. ` +
+      `[truffle] WARNING: no pinned checksum for truffle-v${version}/${asset}; integrity NOT verified. ` +
         `Prefer installing with optionalDependencies enabled.`,
     );
   }
@@ -202,4 +216,11 @@ async function main() {
   console.log(`[truffle] Sidecar downloaded${expected ? ' and verified' : ''}.`);
 }
 
-main();
+module.exports = { buildDownloadUrl, assertChecksum, loadExpectedChecksum };
+
+if (require.main === module) {
+  main().catch((err) => {
+    console.error(`[truffle] postinstall failed: ${err.message}`);
+    process.exitCode = 1;
+  });
+}

package/sidecar-checksums.json

@@ -1,12 +1,24 @@
 {
   "_comment": "SHA-256 of each GitHub Release sidecar asset, keyed by release version then by asset filename. This file ships inside the npm package (which npm integrity-protects), so it is the trust anchor for the postinstall HTTPS download fallback. When an entry for the installing version/asset is present, postinstall FAILS CLOSED on a checksum mismatch; when absent it warns that integrity was not verified. Populate this at release time, e.g. `shasum -a 256 tsnet-sidecar-*` over the built assets. Keys must match GITHUB_ASSETS in scripts/postinstall.cjs.",
-  "_example": {
-    "0.4.7": {
-      "tsnet-sidecar-darwin-arm64": "<sha256-hex>",
-      "tsnet-sidecar-darwin-amd64": "<sha256-hex>",
-      "tsnet-sidecar-linux-amd64": "<sha256-hex>",
-      "tsnet-sidecar-linux-arm64": "<sha256-hex>",
-      "tsnet-sidecar-windows-amd64.exe": "<sha256-hex>"
-    }
+  "0.4.8": {
+    "tsnet-sidecar-darwin-arm64": "acfaed6a2de2cb250adb5d3ce5122f5530005a331ad8eb539af6376fe79fc69a",
+    "tsnet-sidecar-darwin-amd64": "68bcbf7bb6e61de57e357f0940ef4db8dd86ab2bd69d34e48264ff5d945a6e6c",
+    "tsnet-sidecar-linux-amd64": "a4450bbbf72777b9773207b96a9585040cbf27ea98f0c02a6e186a288b5d85c2",
+    "tsnet-sidecar-linux-arm64": "90482a6f6b671873d58c57c466c6bd0390573b6b150a98ec4648d1634a1000b2",
+    "tsnet-sidecar-windows-amd64.exe": "62db3a5d3fea8b917851000107cd3ede08dbc0245429693c6baf2f2e0b87c3e7"
+  },
+  "0.4.9": {
+    "tsnet-sidecar-darwin-arm64": "b9ab84a715aa031e6f0689824cafd54195b8ae30edc4697d083ae18bfd77abe4",
+    "tsnet-sidecar-darwin-amd64": "a6c796117b9811c69a1a1f6bfc101eba3f1059e7d091021ee278ef651e2682cf",
+    "tsnet-sidecar-linux-amd64": "9429bd4b9247292856b3c5d64c6d8aa28d922149199bb679a8c3c123f09f51a3",
+    "tsnet-sidecar-linux-arm64": "8739d9f8f70b17c2385578a91b332f3fefeab91b6fd05b0adaf81a1822b3003c",
+    "tsnet-sidecar-windows-amd64.exe": "0adb921eba8b3cc193fbc56ef35c713a62c6fcf66d4ee75338993c898adc0edc"
+  },
+  "0.5.0": {
+    "tsnet-sidecar-darwin-arm64": "fc272fb3a02d399c99cb14028da9aafab09b1316ab0115ba31b36ccfd2a63467",
+    "tsnet-sidecar-darwin-amd64": "49a9eae78188df8aa16bc602ebc4bd1a5e7f5f36b8075affc4d3a32d2d0ea0b1",
+    "tsnet-sidecar-linux-amd64": "42c6c9be8a8a36b8fd873f22d6edc271633dc4bfbd72916909ff5f799c8c97ea",
+    "tsnet-sidecar-linux-arm64": "6972149aed545f3370d4ae6032ae185c67e4134b9c6afeffc743fcb1037d9467",
+    "tsnet-sidecar-windows-amd64.exe": "914750c30eb2485536d49030b1e317d0b197189d0943817e88f2e55227cfbdc7"
   }
 }