agent-comms 1.33.0 → 2.0.0

package/dist/core/tls-transport.js

@@ -1,758 +0,0 @@
-/**
- * TlsTransport — TLS-encrypted transport for the peer mesh, the one
- * production MeshTransport implementation.
- *
- * All connections are wrapped in TLS with certificate fingerprint
- * authentication. Each peer generates an ECDSA P-256 keypair and self-signed
- * X.509 certificate on startup. The peer ID is the certificate fingerprint —
- * verifying a peer's identity is simply checking that the presented
- * certificate's fingerprint matches the known ID.
- *
- * This is the Syncthing trust model: no CA, no PKI, just certificate pinning.
- * Overlay networks (Tailscale, WireGuard) are still recommended for NAT
- * traversal but are not required for security — TLS handles encryption and
- * authentication at the protocol level.
- *
- * Implements the same MeshTransport interface every transport does. Same
- * wire protocol, same event callbacks — MeshStore only ever sees the
- * interface, never a concrete transport.
- */
-import * as tls from "node:tls";
-import { encode, isMeshMessage, MessageBuffer } from "./wire-protocol.js";
-import { attachSocketHandshake } from "./handshake.js";
-import { fingerprintDer } from "./identity.js";
-import { nanoid } from "./nanoid.js";
-// ---------------------------------------------------------------------------
-// Constants
-// ---------------------------------------------------------------------------
-const COORDINATOR_HOST = "127.0.0.1";
-const CONNECT_TIMEOUT_MS = 1000;
-/**
- * Wrap tls.createServer with a retry for intermittent OpenSSL ASN.1 races
- * that occur when parallel test workers create TLS servers simultaneously.
- * Up to 3 attempts before propagating the error.
- */
-function retryCreateTlsServer(options, callback) {
-    let attempts = 0;
-    const maxAttempts = 3;
-    const tryCreate = () => {
-        attempts++;
-        try {
-            return tls.createServer(options, callback);
-        }
-        catch {
-            if (attempts < maxAttempts)
-                return tryCreate();
-            throw new Error(`tls.createServer failed after ${String(attempts)} attempts`);
-        }
-    };
-    return tryCreate();
-}
-// ---------------------------------------------------------------------------
-// Async socket write helper (not exported)
-// ---------------------------------------------------------------------------
-/**
- * Safety valve so a dial that never completes cannot grow its outbound queue
- * unbounded; oldest entries are dropped first (#23).
- */
-const MAX_PENDING_PER_PEER = 100;
-function writeAsync(socket, data) {
-    return new Promise((resolve, reject) => {
-        if (socket.destroyed) {
-            resolve();
-            return;
-        }
-        socket.write(data, "utf-8", (err) => {
-            if (err)
-                reject(err);
-            else
-                resolve();
-        });
-    });
-}
-/**
- * writeAsync(), but a failed write (the peer disconnected, or its own shutdown destroyed the socket mid-write) resolves instead of rejecting -- cleanup is already handled by the socket's own close/error listeners wherever it's registered, exactly the same ordinary-and-expected outcome broadcast() already treats this way. A caller that genuinely needs to know whether the write landed gets that back as a boolean rather than an exception, since a write racing a legitimate connection teardown is not itself a program error and must never surface as an unhandled rejection.
- */
-async function writeBestEffort(socket, data) {
-    return writeAsync(socket, data).then(() => true, () => false);
-}
-// ---------------------------------------------------------------------------
-// TlsTransport
-// ---------------------------------------------------------------------------
-export class TlsTransport {
-    // -- Data server (accepts incoming peer data connections over TLS) --
-    dataServer;
-    _dataPort = 0;
-    // -- Coordinator listeners (multiple adapters) --
-    coordinatorListeners = new Map();
-    /** The default localhost listener ID (set once during becomeCoordinator). */
-    defaultListenerId;
-    _isCoordinator = false;
-    // -- Coordinator client socket (TLS connection to the coordinator) --
-    coordinatorSocket;
-    // -- Messages queued for peers whose dial is still in flight (#23) --
-    pendingOutbound = new Map();
-    // -- Coordinator introduction handshake (resolved on the peer list) --
-    resolveCoordinatorHandshake;
-    coordinatorHandshakeTimer;
-    // -- Peer data connections (peer ID → socket + buffer) --
-    peerConnections = new Map();
-    // -- All sockets accepted by the data server (for shutdown cleanup) --
-    dataServerSockets = new Set();
-    // -- All sockets accepted by the coordinator server (for shutdown cleanup) --
-    coordinatorServerSockets = new Set();
-    // -- Coordinator introduction connections (handle ID → socket) --
-    introConnections = new Map();
-    // -- Pending connections awaiting approval (handle ID → socket + request info) --
-    pendingConnections = new Map();
-    // -- Outbound connectToPeer sockets still mid-dial, not yet in peerConnections or already failed — tracked so shutdown() can destroy an in-flight dial rather than leaving it running in the background indefinitely, long after this transport is gone --
-    pendingConnectSockets = new Set();
-    // -- Peers this side has dialled out to (in flight or established) — deliberately separate from peerConnections, which also holds sockets THIS side merely accepted an inbound dial from and identified via pong. A peer can legitimately be dialling us at the same time we need to dial them (mesh formation establishes one connection in each direction so each side's acceptor can push its own state), so connectToPeer's own "don't dial twice" guard must not be satisfied by an inbound connection that happens to share the same peer ID. --
-    outboundDials = new Set();
-    // -- Shutdown sentinel — prevents callbacks after shutdown() --
-    shutDown = false;
-    // -- This peer's ID (set during connectToCoordinator or becomeCoordinator) --
-    _peerId = "";
-    events;
-    identity;
-    constructor(events, identity) {
-        this.events = events;
-        this.identity = identity;
-    }
-    // -- Public getters for interface properties --
-    get dataPort() {
-        return this._dataPort;
-    }
-    get isCoordinator() {
-        return this._isCoordinator;
-    }
-    get hasCoordinatorConnection() {
-        return (this.coordinatorSocket !== undefined && !this.coordinatorSocket.destroyed);
-    }
-    // -----------------------------------------------------------------------
-    // TLS options
-    // -----------------------------------------------------------------------
-    get tlsOptions() {
-        return {
-            key: this.identity.privateKey,
-            cert: this.identity.certificate,
-            // Do not reject unauthorized — we do our own fingerprint verification after the TLS handshake completes, in verifyClaimedPeerId().
-            rejectUnauthorized: false,
-            requestCert: true,
-        };
-    }
-    get connectOptions() {
-        return {
-            key: this.identity.privateKey,
-            cert: this.identity.certificate,
-            rejectUnauthorized: false,
-            // Don't verify server cert via CA — verify via fingerprint pinning
-        };
-    }
-    // -----------------------------------------------------------------------
-    // Peer identity verification
-    // -----------------------------------------------------------------------
-    /**
-     * Verify a connected socket's presented certificate fingerprint matches the peer ID it claims via `introduce`/`pong` in the wire protocol, destroying the socket and returning false on any mismatch (including no certificate presented at all).
-     *
-     * Peer IDs are minted as the fingerprint of the peer's own certificate (identity.ts's `generateIdentity()`, wired up by every bridge as `store.peerId = identity.fingerprint`), so a claimed peer ID that doesn't match the certificate actually presented on this connection means the socket is not who it says it is — regardless of what it typed into the wire message.
-     */
-    verifyClaimedPeerId(socket, claimedPeerId) {
-        const cert = socket.getPeerCertificate();
-        // Node's types declare every PeerCertificate field non-optional, but the documented runtime behaviour when the peer presents no certificate at all is an empty object — not null/undefined, and not a Buffer-typed `raw`. Detect that real shape rather than trusting the declared type.
-        if (Object.keys(cert).length === 0) {
-            socket.destroy();
-            this.events.onError?.(new Error(`Rejected connection claiming peer ID ${claimedPeerId}: no certificate presented`));
-            return false;
-        }
-        const actualFingerprint = fingerprintDer(cert.raw);
-        if (actualFingerprint !== claimedPeerId) {
-            socket.destroy();
-            this.events.onError?.(new Error(`Rejected connection claiming peer ID ${claimedPeerId}: presented certificate fingerprint is ${actualFingerprint}`));
-            return false;
-        }
-        return true;
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Data server
-    // -----------------------------------------------------------------------
-    async startDataServer() {
-        await new Promise((resolve, reject) => {
-            this.dataServer = retryCreateTlsServer(this.tlsOptions, (socket) => {
-                this.handleIncomingDataConnection(socket);
-            });
-            this.dataServer.listen(0, COORDINATOR_HOST, () => {
-                const addr = this.dataServer?.address();
-                if (typeof addr === "object" && addr !== null) {
-                    this._dataPort = addr.port;
-                }
-                resolve();
-            });
-            this.dataServer.on("error", reject);
-        });
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Coordinator connection (client side)
-    // -----------------------------------------------------------------------
-    async connectToCoordinator(host, port, peerId, localDataPort) {
-        this._peerId = peerId;
-        await new Promise((resolve, reject) => {
-            const socket = tls.connect({ ...this.connectOptions, host, port }, () => {
-                this.coordinatorSocket = socket;
-                // Wire up the protocol handshake first (client role) so the introduction below lands after it on the wire, not before.
-                const buffer = new MessageBuffer();
-                attachSocketHandshake(socket, "client", (data) => {
-                    const items = buffer.append(data.toString());
-                    for (const item of items) {
-                        if (isMeshMessage(item)) {
-                            this.dispatchCoordinatorClientMessage(item);
-                        }
-                    }
-                }, (error) => this.events.onError?.(error));
-                // Send introduction
-                const intro = {
-                    method: "introduce",
-                    peerId,
-                    dataPort: localDataPort,
-                };
-                socket.write(encode(intro));
-                socket.on("error", () => {
-                    /* ignore late errors on coordinator connection */
-                });
-                clearTimeout(timer);
-                // Resolve on the coordinator's peer list rather than on sending the
-                // introduction: MeshStore.init() then returns only after the post-join
-                // peer dials have started, so the first broadcasts are queued for the
-                // dialling peers instead of dropped (#23). A timeout keeps today's
-                // degraded behaviour for a coordinator that never answers.
-                this.resolveCoordinatorHandshake = resolve;
-                this.coordinatorHandshakeTimer = setTimeout(() => {
-                    this.resolveCoordinatorHandshake = undefined;
-                    resolve();
-                }, CONNECT_TIMEOUT_MS);
-            });
-            const timer = setTimeout(() => {
-                socket.destroy();
-                reject(new Error("Coordinator connection timeout"));
-            }, CONNECT_TIMEOUT_MS);
-            socket.on("error", (err) => {
-                clearTimeout(timer);
-                socket.destroy();
-                reject(err);
-            });
-        });
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Connect to remote coordinator with approval
-    // -----------------------------------------------------------------------
-    async connectToRemote(host, port, peerId, localDataPort, name, fingerprint) {
-        this._peerId = peerId;
-        await new Promise((resolve, reject) => {
-            const socket = tls.connect({ ...this.connectOptions, host, port }, () => {
-                this.coordinatorSocket = socket;
-                clearTimeout(timer);
-                // Wire up the protocol handshake first (client role) so connect_request below lands after it on the wire, not before.
-                const buffer = new MessageBuffer();
-                let approved = false;
-                attachSocketHandshake(socket, "client", (data) => {
-                    const items = buffer.append(data.toString());
-                    for (const item of items) {
-                        if (!isMeshMessage(item))
-                            continue;
-                        if (!approved) {
-                            if (item.method === "connect_accepted") {
-                                approved = true;
-                                resolve();
-                            }
-                            else if (item.method === "connect_rejected") {
-                                socket.destroy();
-                                reject(new Error(`Connection rejected: ${item.reason}`));
-                                return;
-                            }
-                        }
-                        else {
-                            this.dispatchCoordinatorClientMessage(item);
-                        }
-                    }
-                }, (error) => this.events.onError?.(error));
-                // Send connect_request instead of introduce
-                const req = {
-                    method: "connect_request",
-                    peerId,
-                    dataPort: localDataPort,
-                    name,
-                    fingerprint,
-                };
-                socket.write(encode(req));
-                socket.on("error", () => {
-                    /* ignore late errors on coordinator connection */
-                });
-            });
-            const timer = setTimeout(() => {
-                socket.destroy();
-                reject(new Error("Remote connection timeout"));
-            }, CONNECT_TIMEOUT_MS);
-            socket.on("error", (err) => {
-                clearTimeout(timer);
-                socket.destroy();
-                reject(err);
-            });
-        });
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Become coordinator (server side)
-    // -----------------------------------------------------------------------
-    async becomeCoordinator(host, port) {
-        const id = nanoid(8);
-        await new Promise((resolve, reject) => {
-            const server = retryCreateTlsServer(this.tlsOptions, (socket) => {
-                this.handleCoordinatorServerConnection(socket, "full");
-            });
-            server.listen(port, host, () => {
-                const addr = server.address();
-                const actualPort = typeof addr === "object" && addr !== null ? addr.port : port;
-                this._isCoordinator = true;
-                this.coordinatorListeners.set(id, {
-                    server,
-                    policy: "full",
-                    host,
-                    port: actualPort,
-                    isDefault: true,
-                });
-                this.defaultListenerId = id;
-                resolve();
-            });
-            server.on("error", (err) => {
-                reject(err instanceof Error ? err : new Error(String(err)));
-            });
-        });
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Multi-listener management
-    // -----------------------------------------------------------------------
-    async addListener(host, port, policy) {
-        if (!this._isCoordinator) {
-            throw new Error("Only the coordinator can add listeners");
-        }
-        const id = nanoid(8);
-        await new Promise((resolve, reject) => {
-            const server = retryCreateTlsServer(this.tlsOptions, (socket) => {
-                this.handleCoordinatorServerConnection(socket, policy);
-            });
-            server.listen(port, host, () => {
-                const addr = server.address();
-                const actualPort = typeof addr === "object" && addr !== null ? addr.port : port;
-                this.coordinatorListeners.set(id, {
-                    server,
-                    policy,
-                    host,
-                    port: actualPort,
-                    isDefault: false,
-                });
-                resolve();
-            });
-            server.on("error", (err) => {
-                reject(err instanceof Error ? err : new Error(String(err)));
-            });
-        });
-        return id;
-    }
-    removeListener(id) {
-        const listener = this.coordinatorListeners.get(id);
-        if (!listener) {
-            throw new Error(`Listener ${id} not found`);
-        }
-        if (listener.isDefault) {
-            throw new Error("Cannot remove the default localhost listener");
-        }
-        listener.server.unref();
-        listener.server.close();
-        this.coordinatorListeners.delete(id);
-        return Promise.resolve();
-    }
-    listListeners() {
-        const result = [];
-        for (const [id, listener] of this.coordinatorListeners) {
-            result.push({
-                id,
-                host: listener.host,
-                port: listener.port,
-                policy: listener.policy,
-                isDefault: listener.isDefault,
-            });
-        }
-        return result;
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Connect to a peer's data server
-    // -----------------------------------------------------------------------
-    async connectToPeer(peer, ownPeerId) {
-        if (this.shutDown || this.outboundDials.has(peer.id))
-            return;
-        this.outboundDials.add(peer.id);
-        // Queue broadcasts until the connection registers: messages sent in the dial window previously had nowhere to go and were silently dropped.
-        this.pendingOutbound.set(peer.id, this.pendingOutbound.get(peer.id) ?? []);
-        await new Promise((resolve) => {
-            const socket = tls.connect({ ...this.connectOptions, host: COORDINATOR_HOST, port: peer.port }, () => {
-                this.pendingConnectSockets.delete(socket);
-                if (this.shutDown) {
-                    this.pendingOutbound.delete(peer.id);
-                    socket.destroy();
-                    resolve();
-                    return;
-                }
-                if (!this.verifyClaimedPeerId(socket, peer.id)) {
-                    this.pendingOutbound.delete(peer.id);
-                    this.outboundDials.delete(peer.id);
-                    resolve();
-                    return;
-                }
-                const buffer = new MessageBuffer();
-                this.peerConnections.set(peer.id, { socket, buffer });
-                // Wire up the protocol handshake first (client role) so everything below lands after it on the wire, not before.
-                attachSocketHandshake(socket, "client", (data) => {
-                    const items = buffer.append(data.toString());
-                    for (const item of items) {
-                        if (isMeshMessage(item)) {
-                            const handle = { id: peer.id };
-                            this.dispatchDataMessage(handle, item);
-                        }
-                    }
-                }, (error) => this.events.onError?.(error));
-                // Identify ourselves
-                const pong = { method: "pong", peerId: ownPeerId };
-                socket.write(encode(pong));
-                void this.flushPending(peer.id, socket);
-                resolve();
-            });
-            // Tracked from the moment tls.connect() returns (before the connect callback above ever fires) so shutdown() can destroy a dial that's still mid-handshake — otherwise it keeps running in the background with nothing to cancel it, eventually erroring out (or not) long after this transport, and the test or process that started it, are gone.
-            this.pendingConnectSockets.add(socket);
-            const handle = { id: peer.id };
-            let disconnected = false;
-            const onDisconnect = () => {
-                if (disconnected)
-                    return;
-                disconnected = true;
-                this.pendingConnectSockets.delete(socket);
-                this.outboundDials.delete(peer.id);
-                // Only remove peerConnections' entry if it still points at THIS socket -- the peer may also have dialled us independently (a second, inbound connection for the same peer ID), and that connection's own close must never delete a live entry this one already replaced, or vice versa.
-                const current = this.peerConnections.get(peer.id);
-                const wasConnected = current?.socket === socket;
-                if (wasConnected)
-                    this.peerConnections.delete(peer.id);
-                if (wasConnected && !this.shutDown) {
-                    this.events.onPeerDisconnected(handle);
-                }
-            };
-            socket.on("close", onDisconnect);
-            socket.on("error", (err) => {
-                if (!this.shutDown) {
-                    this.events.onError?.(new Error(`connectToPeer(${peer.id}, port ${String(peer.port)}) socket error: ${err.message}`));
-                }
-                this.pendingOutbound.delete(peer.id);
-                onDisconnect();
-                socket.destroy();
-                resolve();
-            });
-        });
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Send / broadcast
-    // -----------------------------------------------------------------------
-    async send(handle, message) {
-        // Check data connections first
-        const peerConn = this.peerConnections.get(handle.id);
-        if (peerConn) {
-            await writeBestEffort(peerConn.socket, encode(message));
-            return;
-        }
-        // Check coordinator introduction connections
-        const introSocket = this.introConnections.get(handle.id);
-        if (introSocket) {
-            await writeBestEffort(introSocket, encode(message));
-            return;
-        }
-        throw new Error(`No connection for handle ${handle.id}`);
-    }
-    async acceptConnection(handle) {
-        const pending = this.pendingConnections.get(handle.id);
-        if (!pending) {
-            throw new Error(`No pending connection for handle ${handle.id}`);
-        }
-        this.pendingConnections.delete(handle.id);
-        const { socket, peerId, dataPort, policy } = pending;
-        // Move to introConnections so send() can reach this peer
-        this.introConnections.set(peerId, socket);
-        // Send acceptance to the connecting peer -- best-effort: the peer having already vanished (or this side's own concurrent shutdown destroying the socket mid-write) is an ordinary disconnect, not a program error, and must not surface as an unhandled rejection once onIntroduction's own downstream state-sync work below is already in flight.
-        const accepted = {
-            method: "connect_accepted",
-            peerId: this._peerId,
-            dataPort: this._dataPort,
-        };
-        await writeBestEffort(socket, encode(accepted));
-        // Fire onIntroduction so MeshStore processes the new peer normally
-        const connHandle = { id: peerId, policy };
-        this.events.onIntroduction(connHandle, { peerId, dataPort });
-    }
-    async rejectConnection(handle, reason) {
-        const pending = this.pendingConnections.get(handle.id);
-        if (!pending) {
-            throw new Error(`No pending connection for handle ${handle.id}`);
-        }
-        this.pendingConnections.delete(handle.id);
-        const { socket } = pending;
-        const rejected = {
-            method: "connect_rejected",
-            peerId: handle.id,
-            reason,
-        };
-        await writeBestEffort(socket, encode(rejected));
-        socket.destroy();
-    }
-    async broadcast(message) {
-        const data = encode(message);
-        const writes = [];
-        for (const [, peer] of this.peerConnections) {
-            writes.push(writeBestEffort(peer.socket, data).then(() => undefined));
-        }
-        for (const queue of this.pendingOutbound.values()) {
-            queue.push(message);
-            if (queue.length > MAX_PENDING_PER_PEER)
-                queue.shift();
-        }
-        await Promise.all(writes);
-    }
-    /** Send messages queued while the peer's connection was being dialled. */
-    async flushPending(peerId, socket) {
-        const queue = this.pendingOutbound.get(peerId);
-        this.pendingOutbound.delete(peerId);
-        if (queue === undefined)
-            return;
-        for (const message of queue) {
-            const sent = await writeBestEffort(socket, encode(message));
-            if (!sent)
-                return; // connection is dying; close/error listeners clean up
-        }
-    }
-    // -----------------------------------------------------------------------
-    // MeshTransport — Shutdown / unref
-    // -----------------------------------------------------------------------
-    shutdown() {
-        this.shutDown = true;
-        if (this.coordinatorHandshakeTimer !== undefined) {
-            clearTimeout(this.coordinatorHandshakeTimer);
-            this.coordinatorHandshakeTimer = undefined;
-        }
-        this.resolveCoordinatorHandshake = undefined;
-        // Destroy the coordinator client socket
-        this.coordinatorSocket?.unref();
-        this.coordinatorSocket?.destroy();
-        this.coordinatorSocket = undefined;
-        // Destroy all identified peer connections
-        for (const [, peer] of this.peerConnections) {
-            peer.socket.unref();
-            peer.socket.destroy();
-        }
-        this.peerConnections.clear();
-        // Destroy all data server accepted sockets (including unidentified)
-        for (const socket of this.dataServerSockets) {
-            socket.unref();
-            socket.destroy();
-        }
-        this.dataServerSockets.clear();
-        // Destroy all coordinator server accepted sockets
-        for (const socket of this.coordinatorServerSockets) {
-            socket.unref();
-            socket.destroy();
-        }
-        this.coordinatorServerSockets.clear();
-        // Clear introduction connection tracking
-        this.introConnections.clear();
-        // Clear pending connections
-        for (const [, pending] of this.pendingConnections) {
-            pending.socket.unref();
-            pending.socket.destroy();
-        }
-        this.pendingConnections.clear();
-        // Destroy any outbound connectToPeer dials still mid-flight — without this they keep retrying/erroring out in the background indefinitely, long after this transport (and whatever test or process started it) is gone.
-        for (const socket of this.pendingConnectSockets) {
-            socket.unref();
-            socket.destroy();
-        }
-        this.pendingConnectSockets.clear();
-        // Close data server
-        this.dataServer?.unref();
-        this.dataServer?.close();
-        this.dataServer = undefined;
-        // Close coordinator listener servers
-        for (const [, listener] of this.coordinatorListeners) {
-            listener.server.unref();
-            listener.server.close();
-        }
-        this.coordinatorListeners.clear();
-        this.defaultListenerId = undefined;
-        this._isCoordinator = false;
-        return Promise.resolve();
-    }
-    unref() {
-        this.dataServer?.unref();
-        for (const [, listener] of this.coordinatorListeners) {
-            listener.server.unref();
-        }
-        this.coordinatorSocket?.unref();
-    }
-    // -----------------------------------------------------------------------
-    // Internal — Coordinator client message dispatch
-    // -----------------------------------------------------------------------
-    dispatchCoordinatorClientMessage(msg) {
-        if (this.shutDown)
-            return;
-        if (msg.method === "peer_list") {
-            // Fire onPeerList first: it starts the post-join dials (and their
-            // broadcast queues) before init() resolves.
-            this.events.onPeerList(msg.peers);
-            this.completeCoordinatorHandshake();
-        }
-        else if (msg.method === "peer_joined") {
-            this.events.onPeerJoined(msg.peer);
-        }
-        else if (msg.method === "become_coordinator") {
-            this.events.onBecomeCoordinator(msg.peerList);
-        }
-    }
-    /** Complete connectToCoordinator's handshake after the peer list arrives. */
-    completeCoordinatorHandshake() {
-        if (this.coordinatorHandshakeTimer !== undefined) {
-            clearTimeout(this.coordinatorHandshakeTimer);
-            this.coordinatorHandshakeTimer = undefined;
-        }
-        this.resolveCoordinatorHandshake?.();
-        this.resolveCoordinatorHandshake = undefined;
-    }
-    // -----------------------------------------------------------------------
-    // Internal — Data message dispatch
-    // -----------------------------------------------------------------------
-    dispatchDataMessage(handle, msg) {
-        if (this.shutDown)
-            return;
-        if (msg.method === "become_coordinator") {
-            this.events.onBecomeCoordinator(msg.peerList);
-        }
-        else {
-            this.events.onMessage(handle, msg);
-        }
-    }
-    // -----------------------------------------------------------------------
-    // Internal — Coordinator server connection handling
-    // -----------------------------------------------------------------------
-    /**
-     * Accepts a new connection on a coordinator server. Reads
-     * introduce messages and fires onIntroduction so MeshStore can
-     * respond with the peer list and broadcast the arrival.
-     * The connection is tagged with the listener's policy.
-     */
-    handleCoordinatorServerConnection(socket, policy) {
-        if (this.shutDown) {
-            socket.destroy();
-            return;
-        }
-        this.coordinatorServerSockets.add(socket);
-        socket.on("close", () => this.coordinatorServerSockets.delete(socket));
-        socket.on("error", () => this.coordinatorServerSockets.delete(socket));
-        const buffer = new MessageBuffer();
-        attachSocketHandshake(socket, "server", (data) => {
-            const items = buffer.append(data.toString());
-            for (const item of items) {
-                if (!isMeshMessage(item))
-                    continue;
-                if (item.method === "introduce") {
-                    if (!this.verifyClaimedPeerId(socket, item.peerId))
-                        continue;
-                    const handle = { id: item.peerId, policy };
-                    this.introConnections.set(handle.id, socket);
-                    this.events.onIntroduction(handle, {
-                        peerId: item.peerId,
-                        dataPort: item.dataPort,
-                    });
-                }
-                else if (item.method === "connect_request") {
-                    const handle = { id: item.peerId, policy };
-                    this.pendingConnections.set(handle.id, {
-                        socket,
-                        peerId: item.peerId,
-                        dataPort: item.dataPort,
-                        name: item.name,
-                        fingerprint: item.fingerprint,
-                        policy,
-                    });
-                    this.events.onConnectionRequest(handle, {
-                        peerId: item.peerId,
-                        dataPort: item.dataPort,
-                        name: item.name,
-                        fingerprint: item.fingerprint,
-                    });
-                }
-            }
-        }, (error) => this.events.onError?.(error));
-    }
-    // -----------------------------------------------------------------------
-    // Internal — Incoming data connection handling
-    // -----------------------------------------------------------------------
-    handleIncomingDataConnection(socket) {
-        if (this.shutDown) {
-            socket.destroy();
-            return;
-        }
-        this.dataServerSockets.add(socket);
-        socket.on("close", () => this.dataServerSockets.delete(socket));
-        const buffer = new MessageBuffer();
-        let remotePeerId;
-        let disconnected = false;
-        attachSocketHandshake(socket, "server", (data) => {
-            const items = buffer.append(data.toString());
-            for (const item of items) {
-                if (isMeshMessage(item)) {
-                    if (item.method === "pong") {
-                        const peerId = item.peerId;
-                        if (!this.verifyClaimedPeerId(socket, peerId))
-                            continue;
-                        remotePeerId = peerId;
-                        if (!this.peerConnections.has(peerId)) {
-                            this.peerConnections.set(peerId, { socket, buffer });
-                        }
-                        void this.flushPending(peerId, socket);
-                        const handle = { id: peerId };
-                        const info = {
-                            id: peerId,
-                            port: 0,
-                            startedAt: new Date().toISOString(),
-                        };
-                        this.events.onPeerConnected(handle, info);
-                    }
-                    else if (remotePeerId !== undefined) {
-                        const handle = { id: remotePeerId };
-                        this.dispatchDataMessage(handle, item);
-                    }
-                }
-            }
-        }, (error) => this.events.onError?.(error));
-        const onDisconnect = () => {
-            if (disconnected)
-                return;
-            disconnected = true;
-            if (remotePeerId !== undefined) {
-                // Only remove peerConnections' entry if it still points at THIS socket -- an outbound dial to the same peer ID can register its own, separate connection there, and this accepted socket closing must never delete that live entry.
-                const current = this.peerConnections.get(remotePeerId);
-                if (current?.socket === socket) {
-                    this.peerConnections.delete(remotePeerId);
-                }
-                if (!this.shutDown) {
-                    this.events.onPeerDisconnected({ id: remotePeerId });
-                }
-            }
-        };
-        socket.on("close", onDisconnect);
-        socket.on("error", onDisconnect);
-    }
-}
-//# sourceMappingURL=tls-transport.js.map