uxnan-bridge 0.0.1-alpha.20260621

package/dist/src/transport/lan-server.d.ts

@@ -0,0 +1,33 @@
+import type { MessageIO } from './message-io.js';
+/** Result of a `/pair/resolve` lookup: an HTTP status + JSON body to return. */
+export interface PairResolveResult {
+    status: number;
+    json: unknown;
+}
+/** Result of an agent-hook approval call: an HTTP status + JSON body. */
+export interface HookApprovalResult {
+    status: number;
+    json: unknown;
+}
+export interface LanServerOptions {
+    port: number;
+    host?: string;
+    onConnection: (io: MessageIO) => void;
+    /**
+     * Optional handler for `GET /pair/resolve?code=…` (manual-code pairing). Given
+     * the submitted code and the client IP, returns the HTTP status + JSON body.
+     * Omitted → the route 404s.
+     */
+    onPairResolve?: (code: string, ip: string) => PairResolveResult;
+    /**
+     * Optional handler for `POST /agent-hook/approval` (the Claude `PreToolUse`
+     * hook round-trip). Given the parsed JSON body and the `x-uxnan-hook-token`
+     * header, resolves once the user answers on the phone. Omitted → 404.
+     */
+    onHookApproval?: (body: unknown, token: string | undefined) => Promise<HookApprovalResult>;
+}
+export interface LanServerHandle {
+    port: number;
+    close(): Promise<void>;
+}
+export declare function startLanServer(options: LanServerOptions): Promise<LanServerHandle>;

package/dist/src/transport/lan-server.js

@@ -0,0 +1,105 @@
+/**
+ * Direct-LAN server. The phone may connect here without the relay
+ * (architecture/02a §5.9.3); the E2EE semantics are identical.
+ *
+ * It is an `http.Server` with a WebSocket server attached: WS upgrades carry the
+ * E2EE session (the primary path), and a single plain-HTTP route —
+ * `GET /pair/resolve?code=<code>` — backs manual-code pairing (the phone trades a
+ * code shown on the PC for the pairing payload; see `pairing/pairing-code-service.ts`).
+ */
+import { createServer } from 'node:http';
+import { WebSocketServer } from 'ws';
+import { wsToMessageIO } from './ws-adapter.js';
+export function startLanServer(options) {
+    return new Promise((resolve, reject) => {
+        const httpServer = createServer((req, res) => handleHttp(req, res, options));
+        const wss = new WebSocketServer({ server: httpServer });
+        wss.on('connection', (ws) => options.onConnection(wsToMessageIO(ws)));
+        const onError = (err) => reject(err);
+        httpServer.once('error', onError);
+        httpServer.listen(options.port, options.host, () => {
+            httpServer.removeListener('error', onError);
+            const address = httpServer.address();
+            const port = typeof address === 'object' && address !== null ? address.port : options.port;
+            resolve({
+                port,
+                close: () => new Promise((res) => {
+                    wss.close(() => httpServer.close(() => res()));
+                }),
+            });
+        });
+    });
+}
+function handleHttp(req, res, options) {
+    const send = (status, json) => {
+        res.writeHead(status, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(json));
+    };
+    let url;
+    try {
+        url = new URL(req.url ?? '/', 'http://localhost');
+    }
+    catch {
+        send(400, { error: 'bad_request' });
+        return;
+    }
+    // POST /agent-hook/approval — the Claude PreToolUse hook asks the user.
+    if (req.method === 'POST' && url.pathname === '/agent-hook/approval') {
+        if (!options.onHookApproval) {
+            send(404, { error: 'hooks_disabled' });
+            return;
+        }
+        const token = req.headers['x-uxnan-hook-token'];
+        readBody(req)
+            .then((raw) => {
+            let body;
+            try {
+                body = JSON.parse(raw || '{}');
+            }
+            catch {
+                send(400, { error: 'bad_json' });
+                return;
+            }
+            void options.onHookApproval(body, typeof token === 'string' ? token : undefined)
+                .then((result) => send(result.status, result.json))
+                .catch(() => send(500, { error: 'hook_error' }));
+        })
+            .catch(() => send(400, { error: 'read_error' }));
+        return;
+    }
+    if (req.method !== 'GET' || url.pathname !== '/pair/resolve') {
+        send(404, { error: 'not_found' });
+        return;
+    }
+    if (!options.onPairResolve) {
+        send(404, { error: 'pairing_disabled' });
+        return;
+    }
+    const code = url.searchParams.get('code');
+    if (!code) {
+        send(400, { error: 'missing_code' });
+        return;
+    }
+    const ip = req.socket.remoteAddress ?? 'unknown';
+    const result = options.onPairResolve(code, ip);
+    send(result.status, result.json);
+}
+/** Collect a request body (capped at 1 MiB) as a UTF-8 string. */
+function readBody(req) {
+    return new Promise((resolve, reject) => {
+        let data = '';
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > 1_048_576) {
+                reject(new Error('body too large'));
+                req.destroy();
+                return;
+            }
+            data += chunk.toString('utf-8');
+        });
+        req.on('end', () => resolve(data));
+        req.on('error', reject);
+    });
+}
+//# sourceMappingURL=lan-server.js.map

package/dist/src/transport/lan-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lan-server.js","sourceRoot":"","sources":["../../../src/transport/lan-server.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,eAAe,EAAkB,MAAM,IAAI,CAAC;AAErD,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAqChD,MAAM,UAAU,cAAc,CAAC,OAAyB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,GAAG,CAAC,EAAE,CAAC,YAAY,EAAE,CAAC,EAAa,EAAE,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAEjF,MAAM,OAAO,GAAG,CAAC,GAAU,EAAQ,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAClC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,EAAE;YACjD,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;YACrC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;YAC3F,OAAO,CAAC;gBACN,IAAI;gBACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,GAAG,EAAE,EAAE;oBACxB,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;gBACjD,CAAC,CAAC;aACL,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,GAAoB,EAAE,GAAmB,EAAE,OAAyB;IACtF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAQ,EAAE;QACnD,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC,CAAC;IACF,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QACpC,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,sBAAsB,EAAE,CAAC;QACrE,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,CAAC;YAC5B,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;YACvC,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,IAAI,IAAa,CAAC;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;gBACjC,OAAO;YACT,CAAC;YACD,KAAK,OAAO,CAAC,cAAe,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;iBAC9E,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;iBAClD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC;aACD,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,QAAQ,KAAK,eAAe,EAAE,CAAC;QAC7D,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC,CAAC;QACzC,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;QACrC,OAAO;IACT,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,SAAS,CAAC;IACjD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC;AAED,kEAAkE;AAClE,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;gBACrB,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACT,CAAC;YACD,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/src/transport/local-hosts.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Enumerate the bridge's directly-reachable `host:port` addresses so they can be
+ * advertised in the pairing QR. The phone tries these FIRST (direct LAN/Tailscale)
+ * and falls back to the relay.
+ *
+ * Includes every non-internal IPv4 the machine has — the LAN address(es) and, when
+ * present, a Tailscale `100.x` address (its interface is a normal non-internal
+ * IPv4, so a phone on the same tailnet connects directly with no hosted relay).
+ *
+ * Pure over an injected `networkInterfaces()` result so it can be unit-tested.
+ */
+import { type NetworkInterfaceInfo } from 'node:os';
+export type InterfaceMap = NodeJS.Dict<NetworkInterfaceInfo[]>;
+/** The non-internal IPv4 addresses (no port) — e.g. for mDNS A records. */
+export declare function localIPv4s(ifaces?: InterfaceMap): string[];
+/** Build `host:port` strings from the non-internal IPv4 addresses in `ifaces`. */
+export declare function localHostPorts(port: number, ifaces?: InterfaceMap): string[];

package/dist/src/transport/local-hosts.js

@@ -0,0 +1,30 @@
+/**
+ * Enumerate the bridge's directly-reachable `host:port` addresses so they can be
+ * advertised in the pairing QR. The phone tries these FIRST (direct LAN/Tailscale)
+ * and falls back to the relay.
+ *
+ * Includes every non-internal IPv4 the machine has — the LAN address(es) and, when
+ * present, a Tailscale `100.x` address (its interface is a normal non-internal
+ * IPv4, so a phone on the same tailnet connects directly with no hosted relay).
+ *
+ * Pure over an injected `networkInterfaces()` result so it can be unit-tested.
+ */
+import { networkInterfaces } from 'node:os';
+/** The non-internal IPv4 addresses (no port) — e.g. for mDNS A records. */
+export function localIPv4s(ifaces = networkInterfaces()) {
+    const addrs = new Set();
+    for (const infos of Object.values(ifaces)) {
+        for (const info of infos ?? []) {
+            // Node 18+ may report `family` as the string 'IPv4' or the number 4.
+            const isIPv4 = info.family === 'IPv4' || info.family === 4;
+            if (isIPv4 && !info.internal && info.address)
+                addrs.add(info.address);
+        }
+    }
+    return [...addrs].sort();
+}
+/** Build `host:port` strings from the non-internal IPv4 addresses in `ifaces`. */
+export function localHostPorts(port, ifaces = networkInterfaces()) {
+    return localIPv4s(ifaces).map((address) => `${address}:${port}`);
+}
+//# sourceMappingURL=local-hosts.js.map

package/dist/src/transport/local-hosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-hosts.js","sourceRoot":"","sources":["../../../src/transport/local-hosts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,iBAAiB,EAA6B,MAAM,SAAS,CAAC;AAIvE,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,SAAuB,iBAAiB,EAAE;IACnE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI,EAAE,EAAE,CAAC;YAC/B,qEAAqE;YACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAK,IAAI,CAAC,MAAkB,KAAK,CAAC,CAAC;YACxE,IAAI,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO;gBAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,SAAuB,iBAAiB,EAAE;IACrF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,OAAO,IAAI,IAAI,EAAE,CAAC,CAAC;AACnE,CAAC"}

package/dist/src/transport/mdns-advertiser.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Minimal mDNS / DNS-SD advertiser (RFC 6762 / 6763) — Phase 2 of manual-code
+ * pairing. The bridge announces a `_uxnan._tcp.local` service on the LAN so the
+ * phone can DISCOVER it (no typing the host); the user then enters the pairing
+ * code shown on the PC and the phone calls `GET /pair/resolve?code=` (Phase 1).
+ *
+ * Deliberately dependency-free (hand-rolled over `node:dgram`): the bridge ships
+ * as a global npm install / single binary, so we avoid a third-party mDNS stack
+ * (no native build, no supply-chain surface). Scope is bounded — advertise ONE
+ * service type and answer the standard browse queries; this is NOT a general mDNS
+ * implementation.
+ *
+ * Records advertised (in response to a PTR browse, plus unsolicited announcements):
+ *   - PTR  `_uxnan._tcp.local`            → `<instance>._uxnan._tcp.local`
+ *   - SRV  `<instance>._uxnan._tcp.local` → 0 0 <port> `<host>.local`
+ *   - TXT  `<instance>._uxnan._tcp.local` → v=1, id=<deviceId>, port=<port>, addr=<ip>
+ *   - A    `<host>.local`                 → <ipv4>
+ * The TXT carries `addr`/`port` too, so a phone can connect without resolving the
+ * `.local` A record. It is best-effort: a failed bind (port 5353 busy, no perms)
+ * degrades silently — pairing still works by typing the host.
+ *
+ * Security: the advertisement carries only non-secret discovery hints (name,
+ * port, device id). The pairing CODE is never advertised — it stays the consent
+ * gate handed out on screen. See bridge/FOR-DEV.md.
+ */
+import { type RemoteInfo } from 'node:dgram';
+import type { Logger } from '../logger.js';
+/** Minimal UDP socket surface the advertiser needs (so it can be faked in tests). */
+export interface UdpSocketLike {
+    on(event: 'message', listener: (msg: Buffer, rinfo: RemoteInfo) => void): void;
+    on(event: 'error', listener: (err: Error) => void): void;
+    bind(options: {
+        port: number;
+        exclusive?: boolean;
+    }, callback?: () => void): void;
+    addMembership(multicastAddress: string): void;
+    setMulticastTTL(ttl: number): void;
+    send(msg: Buffer, port: number, address: string, callback?: (err: Error | null) => void): void;
+    close(callback?: () => void): void;
+}
+export interface MdnsAdvertiserOptions {
+    /** Service instance name (the bridge display name; a single DNS-SD label). */
+    instanceName: string;
+    /** Host label for the A/SRV target (`<host>.local`); typically the machine name. */
+    hostName: string;
+    /** TCP port the LAN server listens on. */
+    port: number;
+    /** Non-internal IPv4 addresses to advertise (A records + TXT `addr`). */
+    addresses: string[];
+    /** Extra TXT key/values (e.g. `{ id: macDeviceId }`). */
+    txt?: Record<string, string>;
+    logger?: Logger;
+    /** Socket factory (tests inject a fake). */
+    socketFactory?: () => UdpSocketLike;
+    /** How many unsolicited announcements to send on start (default 2). */
+    announceCount?: number;
+}
+export declare class MdnsAdvertiser {
+    #private;
+    constructor(options: MdnsAdvertiserOptions);
+    /** Bind, join the multicast group, announce, and answer browse queries. Best-effort. */
+    start(): void;
+    /** Send a goodbye (TTL 0) and close. Best-effort. */
+    stop(): void;
+}
+interface Question {
+    labels: string[];
+    type: number;
+}
+interface ResourceRecord {
+    labels: string[];
+    type: number;
+    flush: boolean;
+    ttl: number;
+    rdata: Buffer;
+}
+/** Encode a domain name as a sequence of length-prefixed labels + a 0 terminator. */
+export declare function encodeName(labels: string[]): Buffer;
+/** Build an mDNS response message (QR=1, AA=1) carrying the given answer records. */
+export declare function buildMessage(records: ResourceRecord[]): Buffer;
+/** Parse just the question section of a DNS message into label arrays + qtype. */
+export declare function parseQuestions(msg: Buffer): Question[];
+export {};

package/dist/src/transport/mdns-advertiser.js

@@ -0,0 +1,282 @@
+/**
+ * Minimal mDNS / DNS-SD advertiser (RFC 6762 / 6763) — Phase 2 of manual-code
+ * pairing. The bridge announces a `_uxnan._tcp.local` service on the LAN so the
+ * phone can DISCOVER it (no typing the host); the user then enters the pairing
+ * code shown on the PC and the phone calls `GET /pair/resolve?code=` (Phase 1).
+ *
+ * Deliberately dependency-free (hand-rolled over `node:dgram`): the bridge ships
+ * as a global npm install / single binary, so we avoid a third-party mDNS stack
+ * (no native build, no supply-chain surface). Scope is bounded — advertise ONE
+ * service type and answer the standard browse queries; this is NOT a general mDNS
+ * implementation.
+ *
+ * Records advertised (in response to a PTR browse, plus unsolicited announcements):
+ *   - PTR  `_uxnan._tcp.local`            → `<instance>._uxnan._tcp.local`
+ *   - SRV  `<instance>._uxnan._tcp.local` → 0 0 <port> `<host>.local`
+ *   - TXT  `<instance>._uxnan._tcp.local` → v=1, id=<deviceId>, port=<port>, addr=<ip>
+ *   - A    `<host>.local`                 → <ipv4>
+ * The TXT carries `addr`/`port` too, so a phone can connect without resolving the
+ * `.local` A record. It is best-effort: a failed bind (port 5353 busy, no perms)
+ * degrades silently — pairing still works by typing the host.
+ *
+ * Security: the advertisement carries only non-secret discovery hints (name,
+ * port, device id). The pairing CODE is never advertised — it stays the consent
+ * gate handed out on screen. See bridge/FOR-DEV.md.
+ */
+import { createSocket } from 'node:dgram';
+const MDNS_ADDRESS = '224.0.0.251';
+const MDNS_PORT = 5353;
+const SERVICE_TYPE_LABELS = ['_uxnan', '_tcp', 'local'];
+const DNSSD_META_LABELS = ['_services', '_dns-sd', '_udp', 'local'];
+const TYPE_A = 1;
+const TYPE_PTR = 12;
+const TYPE_TXT = 16;
+const TYPE_SRV = 33;
+const CLASS_IN = 1;
+const FLUSH = 0x8000; // cache-flush bit for unique records (A/SRV/TXT)
+const DEFAULT_TTL = 120;
+export class MdnsAdvertiser {
+    #opts;
+    #logger;
+    #socket;
+    #started = false;
+    constructor(options) {
+        this.#opts = options;
+        this.#logger = options.logger;
+    }
+    /** Bind, join the multicast group, announce, and answer browse queries. Best-effort. */
+    start() {
+        if (this.#started)
+            return;
+        try {
+            const socket = (this.#opts.socketFactory ?? defaultSocketFactory)();
+            this.#socket = socket;
+            socket.on('error', (err) => {
+                this.#logger?.warn(`mDNS socket error: ${err.message}`);
+                this.stop();
+            });
+            socket.on('message', (msg) => this.#onMessage(msg));
+            socket.bind({ port: MDNS_PORT, exclusive: false }, () => {
+                try {
+                    socket.addMembership(MDNS_ADDRESS);
+                    socket.setMulticastTTL(255);
+                }
+                catch (err) {
+                    this.#logger?.warn(`mDNS membership failed: ${errMsg(err)}`);
+                }
+                this.#announce();
+            });
+            this.#started = true;
+            this.#logger?.info(`mDNS advertising _uxnan._tcp on :${this.#opts.port}`);
+        }
+        catch (err) {
+            this.#logger?.warn(`mDNS advertise disabled: ${errMsg(err)}`);
+        }
+    }
+    /** Send a goodbye (TTL 0) and close. Best-effort. */
+    stop() {
+        const socket = this.#socket;
+        if (!socket)
+            return;
+        this.#socket = undefined;
+        this.#started = false;
+        try {
+            socket.send(this.#buildResponse(0), MDNS_PORT, MDNS_ADDRESS, () => socket.close());
+        }
+        catch {
+            try {
+                socket.close();
+            }
+            catch {
+                /* already closed */
+            }
+        }
+    }
+    #announce() {
+        const times = this.#opts.announceCount ?? 2;
+        for (let i = 0; i < times; i += 1)
+            this.#sendResponse();
+    }
+    #onMessage(msg) {
+        let questions;
+        try {
+            questions = parseQuestions(msg);
+        }
+        catch {
+            return;
+        }
+        // Respond if any question targets our service type, the DNS-SD meta-query, our
+        // instance, or our host record.
+        const wantsUs = questions.some((q) => {
+            const n = q.labels;
+            return (labelsEqual(n, SERVICE_TYPE_LABELS) ||
+                labelsEqual(n, DNSSD_META_LABELS) ||
+                labelsEqual(n, this.#instanceLabels()) ||
+                labelsEqual(n, this.#hostLabels()));
+        });
+        if (wantsUs)
+            this.#sendResponse();
+    }
+    #sendResponse() {
+        const socket = this.#socket;
+        if (!socket)
+            return;
+        try {
+            socket.send(this.#buildResponse(DEFAULT_TTL), MDNS_PORT, MDNS_ADDRESS);
+        }
+        catch (err) {
+            this.#logger?.warn(`mDNS send failed: ${errMsg(err)}`);
+        }
+    }
+    #instanceLabels() {
+        return [this.#opts.instanceName, ...SERVICE_TYPE_LABELS];
+    }
+    #hostLabels() {
+        return [this.#opts.hostName, 'local'];
+    }
+    /** Build the full announcement/response message (PTR + SRV + TXT + A). */
+    #buildResponse(ttl) {
+        const instance = this.#instanceLabels();
+        const host = this.#hostLabels();
+        const txt = {
+            v: '1',
+            port: String(this.#opts.port),
+            ...(this.#opts.addresses[0] ? { addr: this.#opts.addresses[0] } : {}),
+            ...this.#opts.txt,
+        };
+        const records = [
+            {
+                labels: SERVICE_TYPE_LABELS,
+                type: TYPE_PTR,
+                flush: false,
+                ttl,
+                rdata: encodeName(instance),
+            },
+            {
+                labels: instance,
+                type: TYPE_SRV,
+                flush: true,
+                ttl,
+                rdata: encodeSrv(0, 0, this.#opts.port, host),
+            },
+            { labels: instance, type: TYPE_TXT, flush: true, ttl, rdata: encodeTxt(txt) },
+            ...this.#opts.addresses.map((addr) => ({
+                labels: host,
+                type: TYPE_A,
+                flush: true,
+                ttl,
+                rdata: encodeIPv4(addr),
+            })),
+        ];
+        return buildMessage(records);
+    }
+}
+function defaultSocketFactory() {
+    return createSocket({ type: 'udp4', reuseAddr: true });
+}
+/** Encode a domain name as a sequence of length-prefixed labels + a 0 terminator. */
+export function encodeName(labels) {
+    const parts = [];
+    for (const label of labels) {
+        const bytes = Buffer.from(label, 'utf-8');
+        if (bytes.length > 63)
+            throw new Error('label too long');
+        parts.push(Buffer.from([bytes.length]), bytes);
+    }
+    parts.push(Buffer.from([0]));
+    return Buffer.concat(parts);
+}
+function encodeSrv(priority, weight, port, target) {
+    const head = Buffer.alloc(6);
+    head.writeUInt16BE(priority, 0);
+    head.writeUInt16BE(weight, 2);
+    head.writeUInt16BE(port, 4);
+    return Buffer.concat([head, encodeName(target)]);
+}
+function encodeTxt(entries) {
+    const parts = [];
+    for (const [key, value] of Object.entries(entries)) {
+        const s = Buffer.from(`${key}=${value}`, 'utf-8');
+        parts.push(Buffer.from([Math.min(s.length, 255)]), s.subarray(0, 255));
+    }
+    if (parts.length === 0)
+        parts.push(Buffer.from([0])); // empty TXT = one zero-length string
+    return Buffer.concat(parts);
+}
+function encodeIPv4(address) {
+    const octets = address.split('.').map((o) => Number.parseInt(o, 10));
+    if (octets.length !== 4 || octets.some((o) => !Number.isInteger(o) || o < 0 || o > 255)) {
+        throw new Error(`bad IPv4: ${address}`);
+    }
+    return Buffer.from(octets);
+}
+/** Build an mDNS response message (QR=1, AA=1) carrying the given answer records. */
+export function buildMessage(records) {
+    const header = Buffer.alloc(12);
+    header.writeUInt16BE(0, 0); // ID
+    header.writeUInt16BE(0x8400, 2); // flags: QR + AA
+    header.writeUInt16BE(0, 4); // QDCOUNT
+    header.writeUInt16BE(records.length, 6); // ANCOUNT
+    const body = [header];
+    for (const rr of records) {
+        const name = encodeName(rr.labels);
+        const meta = Buffer.alloc(10);
+        meta.writeUInt16BE(rr.type, 0);
+        meta.writeUInt16BE(CLASS_IN | (rr.flush ? FLUSH : 0), 2);
+        meta.writeUInt32BE(rr.ttl, 4);
+        meta.writeUInt16BE(rr.rdata.length, 8);
+        body.push(name, meta, rr.rdata);
+    }
+    return Buffer.concat(body);
+}
+/** Parse just the question section of a DNS message into label arrays + qtype. */
+export function parseQuestions(msg) {
+    if (msg.length < 12)
+        return [];
+    const qd = msg.readUInt16BE(4);
+    let offset = 12;
+    const questions = [];
+    for (let i = 0; i < qd; i += 1) {
+        const { labels, next } = readName(msg, offset);
+        offset = next;
+        if (offset + 4 > msg.length)
+            break;
+        const type = msg.readUInt16BE(offset);
+        offset += 4; // type(2) + class(2)
+        questions.push({ labels, type });
+    }
+    return questions;
+}
+/** Read a (possibly compressed) domain name; returns labels + the offset after it. */
+function readName(msg, start) {
+    const labels = [];
+    let offset = start;
+    let next = -1;
+    let guard = 0;
+    for (;;) {
+        if (guard++ > 128 || offset >= msg.length)
+            break;
+        const len = msg[offset];
+        if (len === 0) {
+            offset += 1;
+            break;
+        }
+        if ((len & 0xc0) === 0xc0) {
+            // compression pointer (2 bytes); the name continues at the pointed offset
+            if (next === -1)
+                next = offset + 2;
+            offset = ((len & 0x3f) << 8) | msg[offset + 1];
+            continue;
+        }
+        labels.push(msg.toString('utf-8', offset + 1, offset + 1 + len));
+        offset += 1 + len;
+    }
+    return { labels, next: next === -1 ? offset : next };
+}
+function labelsEqual(a, b) {
+    return (a.length === b.length && a.every((label, i) => label.toLowerCase() === b[i].toLowerCase()));
+}
+function errMsg(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+//# sourceMappingURL=mdns-advertiser.js.map

package/dist/src/transport/mdns-advertiser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mdns-advertiser.js","sourceRoot":"","sources":["../../../src/transport/mdns-advertiser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,YAAY,EAAgC,MAAM,YAAY,CAAC;AAGxE,MAAM,YAAY,GAAG,aAAa,CAAC;AACnC,MAAM,SAAS,GAAG,IAAI,CAAC;AACvB,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AACxD,MAAM,iBAAiB,GAAG,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAEpE,MAAM,MAAM,GAAG,CAAC,CAAC;AACjB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,EAAE,CAAC;AACpB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,iDAAiD;AACvE,MAAM,WAAW,GAAG,GAAG,CAAC;AA+BxB,MAAM,OAAO,cAAc;IAChB,KAAK,CAAwB;IAC7B,OAAO,CAAqB;IACrC,OAAO,CAA4B;IACnC,QAAQ,GAAG,KAAK,CAAC;IAEjB,YAAY,OAA8B;QACxC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IAChC,CAAC;IAED,wFAAwF;IACxF,KAAK;QACH,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,oBAAoB,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;YACtB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;gBACzB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,sBAAsB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;gBACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE;gBACtD,IAAI,CAAC;oBACH,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;oBACnC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,2BAA2B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC/D,CAAC;gBACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,CAAC,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;YACrB,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,oCAAoC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,4BAA4B,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC;IAED,qDAAqD;IACrD,IAAI;QACF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;QACzB,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACrF,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC;gBACH,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC;YAAC,MAAM,CAAC;gBACP,oBAAoB;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,SAAS;QACP,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC;YAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IAC1D,CAAC;IAED,UAAU,CAAC,GAAW;QACpB,IAAI,SAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,SAAS,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,+EAA+E;QAC/E,gCAAgC;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACnC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACnB,OAAO,CACL,WAAW,CAAC,CAAC,EAAE,mBAAmB,CAAC;gBACnC,WAAW,CAAC,CAAC,EAAE,iBAAiB,CAAC;gBACjC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC;gBACtC,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CACnC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,OAAO;YAAE,IAAI,CAAC,aAAa,EAAE,CAAC;IACpC,CAAC;IAED,aAAa;QACX,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;QAC5B,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,qBAAqB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,eAAe;QACb,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,mBAAmB,CAAC,CAAC;IAC3D,CAAC;IAED,WAAW;QACT,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAED,0EAA0E;IAC1E,cAAc,CAAC,GAAW;QACxB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG;YACV,CAAC,EAAE,GAAG;YACN,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAC7B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG;SAClB,CAAC;QACF,MAAM,OAAO,GAAqB;YAChC;gBACE,MAAM,EAAE,mBAAmB;gBAC3B,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,KAAK;gBACZ,GAAG;gBACH,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC;aAC5B;YACD;gBACE,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,KAAK,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;aAC9C;YACD,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;YAC7E,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACrC,MAAM,EAAE,IAAI;gBACZ,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,IAAI;gBACX,GAAG;gBACH,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC;aACxB,CAAC,CAAC;SACJ,CAAC;QACF,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;CACF;AAED,SAAS,oBAAoB;IAC3B,OAAO,YAAY,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAuC,CAAC;AAC/F,CAAC;AAiBD,qFAAqF;AACrF,MAAM,UAAU,UAAU,CAAC,MAAgB;IACzC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,MAAc,EAAE,IAAY,EAAE,MAAgB;IACjF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;IAChC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9B,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,SAAS,CAAC,OAA+B;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,EAAE,OAAO,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,qCAAqC;IAC3F,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,UAAU,CAAC,OAAe;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,OAAyB;IACpD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK;IACjC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,iBAAiB;IAClD,MAAM,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;IACtC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU;IACnD,MAAM,IAAI,GAAa,CAAC,MAAM,CAAC,CAAC;IAChC,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC9B,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAC/C,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM;YAAE,MAAM;QACnC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,CAAC,CAAC,qBAAqB;QAClC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,GAAW,EAAE,KAAa;IAC1C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,SAAS,CAAC;QACR,IAAI,KAAK,EAAE,GAAG,GAAG,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM;YAAE,MAAM;QACjD,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAE,CAAC;QACzB,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,CAAC;YACZ,MAAM;QACR,CAAC;QACD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1B,0EAA0E;YAC1E,IAAI,IAAI,KAAK,CAAC,CAAC;gBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QACjE,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,WAAW,CAAC,CAAW,EAAE,CAAW;IAC3C,OAAO,CACL,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAC5F,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAY;IAC1B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC"}

package/dist/src/transport/message-io.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Transport-agnostic binary message channel. Both the relay client and the LAN
+ * server adapt their WebSocket to this interface so the secure session logic is
+ * written once.
+ *
+ * Frames are raw bytes: UTF-8 JSON for handshake control messages and encrypted
+ * envelopes (matching the mobile app, which sends binary frames).
+ */
+export interface MessageIO {
+    /** Send a binary frame. */
+    send(bytes: Buffer): void;
+    /** Register an inbound-frame listener. */
+    onMessage(listener: (bytes: Buffer) => void): void;
+    /** Register a close listener. */
+    onClose(listener: () => void): void;
+    /** Close the underlying channel. */
+    close(): void;
+}
+/**
+ * An async FIFO over inbound frames. `next()` resolves with the next frame or
+ * rejects once the channel is closed and drained. Used to drive the request/
+ * response handshake sequentially.
+ */
+export declare class MessageQueue {
+    #private;
+    push(bytes: Buffer): void;
+    close(): void;
+    next(): Promise<Buffer>;
+}
+/** Attach a {@link MessageQueue} to a {@link MessageIO}. */
+export declare function queueFor(io: MessageIO): MessageQueue;
+/** Create a connected in-memory pair of {@link MessageIO}s (for tests). */
+export declare function createInMemoryIoPair(): [MessageIO, MessageIO];