wire-mesh-core 0.0.0 → 1.0.2

package/README.md

@@ -0,0 +1,32 @@
+# wire-mesh-core
+
+The TypeScript implementation of wire-mesh's protocol, built ports/adapters: domain logic (`src/domain/`) depends only on port contracts (`src/ports/`) and the [cddl.js](https://github.com/ExaDev/cddl.js)-generated Zod schemas (`src/generated/protocol.ts`, regenerated from `../../../spec/protocol.cddl` via `generate.ts` -- never edited by hand), never on a specific adapter's own imports.
+
+## Ports
+
+- **Transport** (`src/ports/transport.ts`) -- an async contract for sending/receiving `Frame` values over a connection. Adapter: `src/adapters/tcp-transport.ts` (length-prefixed CBOR frames over plain `node:net`, matching Cascade's own transport shape).
+- **Storage** (`src/ports/storage.ts`) -- an async key/value contract. Adapter: `src/adapters/memory-storage.ts` (in-process, for tests and single-process nodes).
+- **Identity** (`src/ports/identity.ts`) -- device-id derivation and COSE signing/verification. Adapter: `src/adapters/node-identity.ts` (Web Crypto, ECDSA P-256 and Ed25519 -- the two algorithms the spec's own conformance vectors use).
+- **Clock** (`src/ports/clock.ts`) -- injected time, never `Date.now()` pulled directly into domain logic. Adapter: `src/adapters/system-clock.ts`.
+
+## Domain logic implemented
+
+- **Handshake negotiation** (`src/domain/handshake.ts`) -- protocol-version and capability-domain negotiation between two peers, the mechanism agent-comms issue #31 is fixed by.
+- **Capability-token verification** (`src/domain/tokens.ts`) -- the full chain tokens.cddl documents: COSE_Sign1 signature verification, the self-certifying issuer-key check (`sha256(issuer-key.public-key) == issuer`), expiry/not-before, issuer-matched revocation (only a token's own issuer's signed revocation-entry counts, checked across every ancestor in the delegation chain, not just the leaf), and recursive delegation-chain narrowing across all three axes of authority: a delegated token's issuer must be its parent's bearer (the chain is unbroken), its expiry must not exceed its parent's, and its scope must narrow its parent's (identical kind, equal-or-descendant path when the parent carries one) with an identical capability verb (the verb grammar has no sub-verb relation, so a different verb is different authority, not narrower). Also exports `verifyRevocationEntry` for ingesting gossiped revocation-announce frames: each entry is itself a signed, self-certifying COSE_Sign1 over revocation-claims, verified before it may enter the revocation view.
+
+## Deliberately deferred
+
+Every other frame family (management/exec, streaming, data-domain, discovery, coordinator election) is covered by schema validation only -- `conformance-check` proves the generated schemas decode and re-encode every golden vector byte-exactly, including these families, but no domain-level business logic (dispatch, session bookkeeping, PTY/proc lifecycle, oplog replication, coordinator term tracking) exists for them yet. This first pass deliberately scopes domain logic to transport + handshake + tokens (the families with real business rules worth pinning down before the others), because the conformance suite already covers every family's wire shape either way -- nothing here is unverified, only unimplemented. (The federation link protocol no longer exists in the spec at all: cross-scope sharing is ordinary capability-token delegation, and `src/domain/tokens.ts`'s verification chain is exactly the mechanism that governs it.)
+
+## Regenerating the schema
+
+```sh
+pnpm generate   # rewrites src/generated/protocol.ts from ../../../spec/protocol.cddl
+pnpm test       # confirms it still round-trips every conformance vector
+```
+
+CI regenerates and diffs against the committed file, the same way `conformance/`'s own vector files are verified never to drift from hand-editing.
+
+## Publishing
+
+Published to npm as [`wire-mesh-core`](https://www.npmjs.com/package/wire-mesh-core). A push to `main` runs `semantic-release` (`ts/packages/core/release.config.ts`, tagged `core-v*` to keep this package's releases distinct from any other publishable package in the workspace), which versions from conventional-commit messages, builds `dist/` fresh, and publishes it -- `dist/` itself is never committed to the repo.

package/dist/adapters/frame-codec.cjs

@@ -0,0 +1,37 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+let cbor2 = require("cbor2");
+//#region src/adapters/frame-codec.ts
+function messageFromFrame(frame) {
+	return new Uint8Array((0, cbor2.encode)(frame, cbor2.cdeEncodeOptions));
+}
+/** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */
+var SchemaInvalidFrameError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SchemaInvalidFrameError";
+	}
+};
+/** Decodes one message, distinguishing a decode failure (connection-level) from a schema failure (drop this frame, keep the connection). */
+function decodeMessage(data) {
+	const decoded = (0, cbor2.decode)(new Uint8Array(data), cbor2.cdeDecodeOptions);
+	const result = require_generated_protocol.frameSchema.safeParse(decoded);
+	if (!result.success) throw new SchemaInvalidFrameError(result.error.message);
+	return result.data;
+}
+/** Best-effort decode of a nested Frame from raw bytes, e.g. a relay-data frame's opaque payload -- unlike decodeMessage, neither a CBOR decode failure nor a schema mismatch is a connection-level failure here: the bytes may simply not be a nested Frame at all (ordinary opaque relay-data with some other meaning), so this returns null instead of throwing either way. */
+function tryDecodeFrame(bytes) {
+	let decoded;
+	try {
+		decoded = (0, cbor2.decode)(bytes, cbor2.cdeDecodeOptions);
+	} catch {
+		return null;
+	}
+	const result = require_generated_protocol.frameSchema.safeParse(decoded);
+	return result.success ? result.data : null;
+}
+//#endregion
+exports.SchemaInvalidFrameError = SchemaInvalidFrameError;
+exports.decodeMessage = decodeMessage;
+exports.messageFromFrame = messageFromFrame;
+exports.tryDecodeFrame = tryDecodeFrame;

package/dist/adapters/frame-codec.d.cts

@@ -0,0 +1,12 @@
+import { w as Frame } from "../protocol-B26-5VX7.cjs";
+//#region src/adapters/frame-codec.d.ts
+export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
+/** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */
+export declare class SchemaInvalidFrameError extends Error {
+  constructor(message: string);
+}
+/** Decodes one message, distinguishing a decode failure (connection-level) from a schema failure (drop this frame, keep the connection). */
+export declare function decodeMessage(data: Readonly<ArrayBuffer>): Frame;
+/** Best-effort decode of a nested Frame from raw bytes, e.g. a relay-data frame's opaque payload -- unlike decodeMessage, neither a CBOR decode failure nor a schema mismatch is a connection-level failure here: the bytes may simply not be a nested Frame at all (ordinary opaque relay-data with some other meaning), so this returns null instead of throwing either way. */
+export declare function tryDecodeFrame(bytes: Readonly<Uint8Array>): Frame | null;
+//#endregion

package/dist/adapters/frame-codec.d.mts

@@ -0,0 +1,12 @@
+import { w as Frame } from "../protocol-B26-5VX7.mjs";
+//#region src/adapters/frame-codec.d.ts
+export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
+/** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */
+export declare class SchemaInvalidFrameError extends Error {
+  constructor(message: string);
+}
+/** Decodes one message, distinguishing a decode failure (connection-level) from a schema failure (drop this frame, keep the connection). */
+export declare function decodeMessage(data: Readonly<ArrayBuffer>): Frame;
+/** Best-effort decode of a nested Frame from raw bytes, e.g. a relay-data frame's opaque payload -- unlike decodeMessage, neither a CBOR decode failure nor a schema mismatch is a connection-level failure here: the bytes may simply not be a nested Frame at all (ordinary opaque relay-data with some other meaning), so this returns null instead of throwing either way. */
+export declare function tryDecodeFrame(bytes: Readonly<Uint8Array>): Frame | null;
+//#endregion

package/dist/adapters/frame-codec.mjs

@@ -0,0 +1,33 @@
+import { frameSchema } from "../generated/protocol.mjs";
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+//#region src/adapters/frame-codec.ts
+function messageFromFrame(frame) {
+	return new Uint8Array(encode(frame, cdeEncodeOptions));
+}
+/** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */
+var SchemaInvalidFrameError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SchemaInvalidFrameError";
+	}
+};
+/** Decodes one message, distinguishing a decode failure (connection-level) from a schema failure (drop this frame, keep the connection). */
+function decodeMessage(data) {
+	const decoded = decode(new Uint8Array(data), cdeDecodeOptions);
+	const result = frameSchema.safeParse(decoded);
+	if (!result.success) throw new SchemaInvalidFrameError(result.error.message);
+	return result.data;
+}
+/** Best-effort decode of a nested Frame from raw bytes, e.g. a relay-data frame's opaque payload -- unlike decodeMessage, neither a CBOR decode failure nor a schema mismatch is a connection-level failure here: the bytes may simply not be a nested Frame at all (ordinary opaque relay-data with some other meaning), so this returns null instead of throwing either way. */
+function tryDecodeFrame(bytes) {
+	let decoded;
+	try {
+		decoded = decode(bytes, cdeDecodeOptions);
+	} catch {
+		return null;
+	}
+	const result = frameSchema.safeParse(decoded);
+	return result.success ? result.data : null;
+}
+//#endregion
+export { SchemaInvalidFrameError, decodeMessage, messageFromFrame, tryDecodeFrame };

package/dist/adapters/memory-storage.cjs

@@ -0,0 +1,14 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/adapters/memory-storage.ts
+/** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
+function createMemoryStorage() {
+	const store = /* @__PURE__ */ new Map();
+	return {
+		get: async (key) => Promise.resolve(store.get(key)),
+		set: async (key, value) => Promise.resolve(store.set(key, value)).then(() => void 0),
+		delete: async (key) => Promise.resolve(store.delete(key)).then(() => void 0),
+		keys: async (prefix) => Promise.resolve([...store.keys()].filter((key) => key.startsWith(prefix)))
+	};
+}
+//#endregion
+exports.createMemoryStorage = createMemoryStorage;

package/dist/adapters/memory-storage.d.cts

@@ -0,0 +1,5 @@
+import { KeyValueStorage } from "../ports/storage.cjs";
+//#region src/adapters/memory-storage.d.ts
+/** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
+export declare function createMemoryStorage(): KeyValueStorage;
+//#endregion

package/dist/adapters/memory-storage.d.mts

@@ -0,0 +1,5 @@
+import { KeyValueStorage } from "../ports/storage.mjs";
+//#region src/adapters/memory-storage.d.ts
+/** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
+export declare function createMemoryStorage(): KeyValueStorage;
+//#endregion

package/dist/adapters/memory-storage.mjs

@@ -0,0 +1,13 @@
+//#region src/adapters/memory-storage.ts
+/** An in-process KeyValueStorage backed by a Map -- for tests and single-process nodes; a real deployment substitutes a persistent adapter behind the same contract without touching anything that depends on the port. Not declared `async`: every operation is genuinely synchronous under the hood, so the contract's Promise return is satisfied directly via Promise.resolve() rather than an async function with no await in its body. */
+function createMemoryStorage() {
+	const store = /* @__PURE__ */ new Map();
+	return {
+		get: async (key) => Promise.resolve(store.get(key)),
+		set: async (key, value) => Promise.resolve(store.set(key, value)).then(() => void 0),
+		delete: async (key) => Promise.resolve(store.delete(key)).then(() => void 0),
+		keys: async (prefix) => Promise.resolve([...store.keys()].filter((key) => key.startsWith(prefix)))
+	};
+}
+//#endregion
+export { createMemoryStorage };

package/dist/adapters/node-identity.cjs

@@ -0,0 +1,55 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let node_crypto = require("node:crypto");
+//#region src/adapters/node-identity.ts
+const ES256 = -7;
+const EDDSA = -8;
+function algParams(alg) {
+	if (alg === ES256) return {
+		name: "ECDSA",
+		hash: "SHA-256"
+	};
+	if (alg === EDDSA) return { name: "Ed25519" };
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
+/** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
+function toBufferSource(bytes) {
+	return Uint8Array.from(bytes);
+}
+async function importPublicKey(key) {
+	if (key.alg === ES256) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	if (key.alg === EDDSA) return node_crypto.webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
+	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+}
+async function deriveDeviceId(publicKey) {
+	return new Uint8Array(await node_crypto.webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));
+}
+async function verifyWithPublicKey(key, message, signature) {
+	const cryptoKey = await importPublicKey(key);
+	return node_crypto.webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
+}
+/**
+* Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+*/
+async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
+	const identityKey = {
+		alg,
+		"public-key": toBufferSource(publicKeyBytes)
+	};
+	return {
+		deviceId: await deriveDeviceId(publicKeyBytes),
+		identityKey,
+		async sign(message) {
+			const signature = await node_crypto.webcrypto.subtle.sign(algParams(alg), privateKey, toBufferSource(message));
+			return new Uint8Array(signature);
+		},
+		verify: verifyWithPublicKey,
+		deriveDeviceId
+	};
+}
+//#endregion
+exports.createNodeIdentity = createNodeIdentity;
+exports.deriveDeviceId = deriveDeviceId;
+exports.verifyWithPublicKey = verifyWithPublicKey;

package/dist/adapters/node-identity.d.cts

@@ -0,0 +1,11 @@
+import { j as IdentityKey, v as DeviceId } from "../protocol-B26-5VX7.cjs";
+import { t as IdentityPort } from "../identity-BRLEUfVY.cjs";
+import { webcrypto } from "node:crypto";
+//#region src/adapters/node-identity.d.ts
+export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;
+export declare function verifyWithPublicKey(key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
+/**
+ * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+ */
+export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number): Promise<IdentityPort>;
+//#endregion

package/dist/adapters/node-identity.d.mts

@@ -0,0 +1,11 @@
+import { j as IdentityKey, v as DeviceId } from "../protocol-B26-5VX7.mjs";
+import { t as IdentityPort } from "../identity-qNkmGytv.mjs";
+import { webcrypto } from "node:crypto";
+//#region src/adapters/node-identity.d.ts
+export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;
+export declare function verifyWithPublicKey(key: IdentityKey, message: Uint8Array, signature: Uint8Array): Promise<boolean>;
+/**
+ * Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+ */
+export declare function createNodeIdentity(privateKey: webcrypto.CryptoKey, publicKeyBytes: Uint8Array, alg: number): Promise<IdentityPort>;
+//#endregion

package/dist/adapters/node-identity.mjs

@@ -0,0 +1,52 @@
+import { webcrypto } from "node:crypto";
+//#region src/adapters/node-identity.ts
+const ES256 = -7;
+const EDDSA = -8;
+function algParams(alg) {
+	if (alg === ES256) return {
+		name: "ECDSA",
+		hash: "SHA-256"
+	};
+	if (alg === EDDSA) return { name: "Ed25519" };
+	throw new Error(`unsupported identity-key alg ${String(alg)}`);
+}
+/** Copies into a fresh, non-shared, whole-buffer Uint8Array -- Web Crypto's BufferSource parameters reject a view over a SharedArrayBuffer or a sub-range view, neither of which a caller-supplied Uint8Array is guaranteed not to be. */
+function toBufferSource(bytes) {
+	return Uint8Array.from(bytes);
+}
+async function importPublicKey(key) {
+	if (key.alg === ES256) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), {
+		name: "ECDSA",
+		namedCurve: "P-256"
+	}, false, ["verify"]);
+	if (key.alg === EDDSA) return webcrypto.subtle.importKey("raw", toBufferSource(key["public-key"]), { name: "Ed25519" }, false, ["verify"]);
+	throw new Error(`unsupported identity-key alg ${String(key.alg)}`);
+}
+async function deriveDeviceId(publicKey) {
+	return new Uint8Array(await webcrypto.subtle.digest("SHA-256", toBufferSource(publicKey)));
+}
+async function verifyWithPublicKey(key, message, signature) {
+	const cryptoKey = await importPublicKey(key);
+	return webcrypto.subtle.verify(algParams(key.alg), cryptoKey, toBufferSource(signature), toBufferSource(message));
+}
+/**
+* Builds an IdentityPort from a Web Crypto private key already generated for this node -- ECDSA P-256 (alg -7) or Ed25519 (alg -8), the two algorithms identity-key.alg actually carries in the spec's own conformance vectors. Device-id derivation and signature verification are pure functions of the given key bytes (exported separately above), so they work for an arbitrary issuer-key too, not just this node's own.
+*/
+async function createNodeIdentity(privateKey, publicKeyBytes, alg) {
+	const identityKey = {
+		alg,
+		"public-key": toBufferSource(publicKeyBytes)
+	};
+	return {
+		deviceId: await deriveDeviceId(publicKeyBytes),
+		identityKey,
+		async sign(message) {
+			const signature = await webcrypto.subtle.sign(algParams(alg), privateKey, toBufferSource(message));
+			return new Uint8Array(signature);
+		},
+		verify: verifyWithPublicKey,
+		deriveDeviceId
+	};
+}
+//#endregion
+export { createNodeIdentity, deriveDeviceId, verifyWithPublicKey };

package/dist/adapters/system-clock.cjs

@@ -0,0 +1,8 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/adapters/system-clock.ts
+/** Wraps the system wall clock -- the only place Date.now() appears in this package. */
+function createSystemClock() {
+	return { now: () => Date.now() };
+}
+//#endregion
+exports.createSystemClock = createSystemClock;

package/dist/adapters/system-clock.d.cts

@@ -0,0 +1,5 @@
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+//#region src/adapters/system-clock.d.ts
+/** Wraps the system wall clock -- the only place Date.now() appears in this package. */
+export declare function createSystemClock(): Clock;
+//#endregion

package/dist/adapters/system-clock.d.mts

@@ -0,0 +1,5 @@
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+//#region src/adapters/system-clock.d.ts
+/** Wraps the system wall clock -- the only place Date.now() appears in this package. */
+export declare function createSystemClock(): Clock;
+//#endregion

package/dist/adapters/system-clock.mjs

@@ -0,0 +1,7 @@
+//#region src/adapters/system-clock.ts
+/** Wraps the system wall clock -- the only place Date.now() appears in this package. */
+function createSystemClock() {
+	return { now: () => Date.now() };
+}
+//#endregion
+export { createSystemClock };

package/dist/adapters/tcp-transport.cjs

@@ -0,0 +1,154 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+let cbor2 = require("cbor2");
+let node_net = require("node:net");
+//#region src/adapters/tcp-transport.ts
+const LENGTH_PREFIX_BYTES = 4;
+function parseAddress(address) {
+	const lastColon = address.lastIndexOf(":");
+	if (lastColon === -1) throw new Error(`expected "host:port", got "${address}"`);
+	return {
+		host: address.slice(0, lastColon),
+		port: Number(address.slice(lastColon + 1))
+	};
+}
+function writeFrame(socket, frame) {
+	const body = (0, cbor2.encode)(frame, cbor2.cdeEncodeOptions);
+	const header = Buffer.alloc(LENGTH_PREFIX_BYTES);
+	header.writeUInt32BE(body.length, 0);
+	socket.write(header);
+	socket.write(body);
+}
+/** Reassembles length-prefixed CBOR frames from a byte stream, validating each against frameSchema before handing it to a consumer. A body that doesn't even decode as CBOR rejects the receive() iteration and destroys the connection -- hostile wire input is a connection-level failure, surfaced through the Transport port rather than crashing the process or being silently swallowed. */
+function frameReader(socket) {
+	let buffer = Buffer.alloc(0);
+	const pending = [];
+	const waiters = [];
+	let ended = false;
+	let failure = null;
+	function tryDrain() {
+		while (buffer.length >= LENGTH_PREFIX_BYTES) {
+			const bodyLength = buffer.readUInt32BE(0);
+			if (buffer.length < LENGTH_PREFIX_BYTES + bodyLength) break;
+			const body = buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + bodyLength);
+			buffer = buffer.subarray(LENGTH_PREFIX_BYTES + bodyLength);
+			let decoded;
+			try {
+				decoded = (0, cbor2.decode)(body, cbor2.cdeDecodeOptions);
+			} catch (error) {
+				const connectionError = error instanceof Error ? error : /* @__PURE__ */ new Error(`frame body failed to decode: ${String(error)}`);
+				failAll(connectionError);
+				socket.destroy(connectionError);
+				return;
+			}
+			const result = require_generated_protocol.frameSchema.safeParse(decoded);
+			if (result.success) {
+				const waiter = waiters.shift();
+				if (waiter) waiter.resolve({
+					value: result.data,
+					done: false
+				});
+				else pending.push(result.data);
+			}
+		}
+	}
+	function endAll() {
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.resolve({
+			value: void 0,
+			done: true
+		});
+	}
+	/** Ends the iteration with the connection-level error: pending and future next() calls reject, so a consumer iterating receive() sees the failure where it consumed the stream. */
+	function failAll(error) {
+		failure = error;
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.reject(error);
+	}
+	socket.on("data", (chunk) => {
+		buffer = Buffer.concat([buffer, chunk]);
+		tryDrain();
+	});
+	socket.on("end", endAll);
+	socket.on("close", endAll);
+	socket.on("error", () => void 0);
+	return { [Symbol.asyncIterator]() {
+		return { async next() {
+			const next = pending.shift();
+			if (next !== void 0) return Promise.resolve({
+				value: next,
+				done: false
+			});
+			if (failure !== null) return Promise.reject(failure);
+			if (ended) return Promise.resolve({
+				value: void 0,
+				done: true
+			});
+			return new Promise((resolve, reject) => {
+				waiters.push({
+					resolve,
+					reject
+				});
+			});
+		} };
+	} };
+}
+function wrapSocket(socket) {
+	const frames = frameReader(socket);
+	return {
+		send: async (frame) => {
+			writeFrame(socket, frame);
+			return Promise.resolve();
+		},
+		receive: () => frames,
+		close: async () => new Promise((resolve) => {
+			socket.end(() => {
+				resolve();
+			});
+		})
+	};
+}
+/** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
+function createTcpTransport() {
+	return {
+		async connect(address) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const socket = (0, node_net.connect)({
+					host,
+					port
+				});
+				socket.once("connect", () => {
+					resolve(wrapSocket(socket));
+				});
+				socket.once("error", reject);
+			});
+		},
+		async listen(address, onConnection) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const server = (0, node_net.createServer)((socket) => {
+					onConnection(wrapSocket(socket));
+				});
+				server.once("error", reject);
+				server.listen(port, host, () => {
+					const bound = server.address();
+					if (bound === null || typeof bound === "string") {
+						reject(/* @__PURE__ */ new Error("listener did not report a bound address"));
+						return;
+					}
+					resolve({
+						close: async () => new Promise((resolveClose) => {
+							server.close(() => {
+								resolveClose();
+							});
+						}),
+						address: `${bound.address}:${String(bound.port)}`
+					});
+				});
+			});
+		}
+	};
+}
+//#endregion
+exports.createTcpTransport = createTcpTransport;

package/dist/adapters/tcp-transport.d.cts

@@ -0,0 +1,5 @@
+import { Transport } from "../ports/transport.cjs";
+//#region src/adapters/tcp-transport.d.ts
+/** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
+export declare function createTcpTransport(): Transport;
+//#endregion

package/dist/adapters/tcp-transport.d.mts

@@ -0,0 +1,5 @@
+import { Transport } from "../ports/transport.mjs";
+//#region src/adapters/tcp-transport.d.ts
+/** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
+export declare function createTcpTransport(): Transport;
+//#endregion