wire-mesh-core 0.0.0 → 1.0.2

package/dist/adapters/tcp-transport.mjs

@@ -0,0 +1,153 @@
+import { frameSchema } from "../generated/protocol.mjs";
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+import { connect, createServer } from "node:net";
+//#region src/adapters/tcp-transport.ts
+const LENGTH_PREFIX_BYTES = 4;
+function parseAddress(address) {
+	const lastColon = address.lastIndexOf(":");
+	if (lastColon === -1) throw new Error(`expected "host:port", got "${address}"`);
+	return {
+		host: address.slice(0, lastColon),
+		port: Number(address.slice(lastColon + 1))
+	};
+}
+function writeFrame(socket, frame) {
+	const body = encode(frame, cdeEncodeOptions);
+	const header = Buffer.alloc(LENGTH_PREFIX_BYTES);
+	header.writeUInt32BE(body.length, 0);
+	socket.write(header);
+	socket.write(body);
+}
+/** Reassembles length-prefixed CBOR frames from a byte stream, validating each against frameSchema before handing it to a consumer. A body that doesn't even decode as CBOR rejects the receive() iteration and destroys the connection -- hostile wire input is a connection-level failure, surfaced through the Transport port rather than crashing the process or being silently swallowed. */
+function frameReader(socket) {
+	let buffer = Buffer.alloc(0);
+	const pending = [];
+	const waiters = [];
+	let ended = false;
+	let failure = null;
+	function tryDrain() {
+		while (buffer.length >= LENGTH_PREFIX_BYTES) {
+			const bodyLength = buffer.readUInt32BE(0);
+			if (buffer.length < LENGTH_PREFIX_BYTES + bodyLength) break;
+			const body = buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + bodyLength);
+			buffer = buffer.subarray(LENGTH_PREFIX_BYTES + bodyLength);
+			let decoded;
+			try {
+				decoded = decode(body, cdeDecodeOptions);
+			} catch (error) {
+				const connectionError = error instanceof Error ? error : /* @__PURE__ */ new Error(`frame body failed to decode: ${String(error)}`);
+				failAll(connectionError);
+				socket.destroy(connectionError);
+				return;
+			}
+			const result = frameSchema.safeParse(decoded);
+			if (result.success) {
+				const waiter = waiters.shift();
+				if (waiter) waiter.resolve({
+					value: result.data,
+					done: false
+				});
+				else pending.push(result.data);
+			}
+		}
+	}
+	function endAll() {
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.resolve({
+			value: void 0,
+			done: true
+		});
+	}
+	/** Ends the iteration with the connection-level error: pending and future next() calls reject, so a consumer iterating receive() sees the failure where it consumed the stream. */
+	function failAll(error) {
+		failure = error;
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.reject(error);
+	}
+	socket.on("data", (chunk) => {
+		buffer = Buffer.concat([buffer, chunk]);
+		tryDrain();
+	});
+	socket.on("end", endAll);
+	socket.on("close", endAll);
+	socket.on("error", () => void 0);
+	return { [Symbol.asyncIterator]() {
+		return { async next() {
+			const next = pending.shift();
+			if (next !== void 0) return Promise.resolve({
+				value: next,
+				done: false
+			});
+			if (failure !== null) return Promise.reject(failure);
+			if (ended) return Promise.resolve({
+				value: void 0,
+				done: true
+			});
+			return new Promise((resolve, reject) => {
+				waiters.push({
+					resolve,
+					reject
+				});
+			});
+		} };
+	} };
+}
+function wrapSocket(socket) {
+	const frames = frameReader(socket);
+	return {
+		send: async (frame) => {
+			writeFrame(socket, frame);
+			return Promise.resolve();
+		},
+		receive: () => frames,
+		close: async () => new Promise((resolve) => {
+			socket.end(() => {
+				resolve();
+			});
+		})
+	};
+}
+/** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
+function createTcpTransport() {
+	return {
+		async connect(address) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const socket = connect({
+					host,
+					port
+				});
+				socket.once("connect", () => {
+					resolve(wrapSocket(socket));
+				});
+				socket.once("error", reject);
+			});
+		},
+		async listen(address, onConnection) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const server = createServer((socket) => {
+					onConnection(wrapSocket(socket));
+				});
+				server.once("error", reject);
+				server.listen(port, host, () => {
+					const bound = server.address();
+					if (bound === null || typeof bound === "string") {
+						reject(/* @__PURE__ */ new Error("listener did not report a bound address"));
+						return;
+					}
+					resolve({
+						close: async () => new Promise((resolveClose) => {
+							server.close(() => {
+								resolveClose();
+							});
+						}),
+						address: `${bound.address}:${String(bound.port)}`
+					});
+				});
+			});
+		}
+	};
+}
+//#endregion
+export { createTcpTransport };

package/dist/adapters/tls-transport.cjs

@@ -0,0 +1,178 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_adapters_node_identity = require("./node-identity.cjs");
+let cbor2 = require("cbor2");
+let node_tls = require("node:tls");
+//#region src/adapters/tls-transport.ts
+const LENGTH_PREFIX_BYTES = 4;
+function parseAddress(address) {
+	const lastColon = address.lastIndexOf(":");
+	if (lastColon === -1) throw new Error(`expected "host:port", got "${address}"`);
+	return {
+		host: address.slice(0, lastColon),
+		port: Number(address.slice(lastColon + 1))
+	};
+}
+function writeFrame(socket, frame) {
+	const body = (0, cbor2.encode)(frame, cbor2.cdeEncodeOptions);
+	const header = Buffer.alloc(LENGTH_PREFIX_BYTES);
+	header.writeUInt32BE(body.length, 0);
+	socket.write(header);
+	socket.write(body);
+}
+/** Reassembles length-prefixed CBOR frames from a byte stream, validating each against frameSchema before handing it to a consumer -- identical framing to createTcpTransport's own frameReader, since TLS terminates before framing and the wire shape above it is unchanged. A body that doesn't even decode as CBOR rejects the receive() iteration and destroys the connection. */
+function frameReader(socket) {
+	let buffer = Buffer.alloc(0);
+	const pending = [];
+	const waiters = [];
+	let ended = false;
+	let failure = null;
+	function tryDrain() {
+		while (buffer.length >= LENGTH_PREFIX_BYTES) {
+			const bodyLength = buffer.readUInt32BE(0);
+			if (buffer.length < LENGTH_PREFIX_BYTES + bodyLength) break;
+			const body = buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + bodyLength);
+			buffer = buffer.subarray(LENGTH_PREFIX_BYTES + bodyLength);
+			let decoded;
+			try {
+				decoded = (0, cbor2.decode)(body, cbor2.cdeDecodeOptions);
+			} catch (error) {
+				const connectionError = error instanceof Error ? error : /* @__PURE__ */ new Error(`frame body failed to decode: ${String(error)}`);
+				failAll(connectionError);
+				socket.destroy(connectionError);
+				return;
+			}
+			const result = require_generated_protocol.frameSchema.safeParse(decoded);
+			if (result.success) {
+				const waiter = waiters.shift();
+				if (waiter) waiter.resolve({
+					value: result.data,
+					done: false
+				});
+				else pending.push(result.data);
+			}
+		}
+	}
+	function endAll() {
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.resolve({
+			value: void 0,
+			done: true
+		});
+	}
+	function failAll(error) {
+		failure = error;
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.reject(error);
+	}
+	socket.on("data", (chunk) => {
+		buffer = Buffer.concat([buffer, chunk]);
+		tryDrain();
+	});
+	socket.on("end", endAll);
+	socket.on("close", endAll);
+	socket.on("error", () => void 0);
+	return { [Symbol.asyncIterator]() {
+		return { async next() {
+			const next = pending.shift();
+			if (next !== void 0) return Promise.resolve({
+				value: next,
+				done: false
+			});
+			if (failure !== null) return Promise.reject(failure);
+			if (ended) return Promise.resolve({
+				value: void 0,
+				done: true
+			});
+			return new Promise((resolve, reject) => {
+				waiters.push({
+					resolve,
+					reject
+				});
+			});
+		} };
+	} };
+}
+/** Authenticates the socket's peer, if it presented a certificate: derives a device-id from the certificate's own raw public-key bytes -- never from anything the peer merely claims -- and returns undefined only when no certificate was presented at all (never on a mismatch; there is nothing to mismatch against at this layer, only a fact to report). Node's TLS layer has already verified the peer actually holds the matching private key by the time a socket reaches this point, so this device-id is cryptographically backed, not self-asserted. */
+async function authenticatedPeerDeviceId(socket) {
+	const cert = socket.getPeerCertificate();
+	if (Object.keys(cert).length === 0 || !("pubkey" in cert)) return;
+	return require_adapters_node_identity.deriveDeviceId(cert.pubkey);
+}
+function wrapSocket(socket, peerDeviceId) {
+	const frames = frameReader(socket);
+	return {
+		send: async (frame) => {
+			writeFrame(socket, frame);
+			return Promise.resolve();
+		},
+		receive: () => frames,
+		close: async () => new Promise((resolve) => {
+			socket.end(() => {
+				resolve();
+			});
+		}),
+		...peerDeviceId !== void 0 ? { peerDeviceId } : {},
+		unref: () => {
+			socket.unref();
+		}
+	};
+}
+/** A Node tls.TLSSocket-based Transport: the identical length-prefixed CBOR framing createTcpTransport uses, but over mutually-authenticated TLS -- both sides always present the certificate from the identity passed in, and rejectUnauthorized stays false deliberately (this is certificate-pinning by device-id, the Syncthing trust model, not a CA hierarchy) while Connection.peerDeviceId carries the one thing that actually matters: what the presented certificate cryptographically proves the peer holds the key for. */
+function createTlsTransport(identity) {
+	const tlsOptions = {
+		key: identity.privateKeyPem,
+		cert: identity.certificatePem,
+		rejectUnauthorized: false
+	};
+	return {
+		async connect(address) {
+			const { host, port } = parseAddress(address);
+			const socket = await new Promise((resolve, reject) => {
+				const s = (0, node_tls.connect)({
+					...tlsOptions,
+					host,
+					port
+				}, () => {
+					resolve(s);
+				});
+				s.once("error", reject);
+			});
+			return wrapSocket(socket, await authenticatedPeerDeviceId(socket));
+		},
+		async listen(address, onConnection) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const server = (0, node_tls.createServer)({
+					...tlsOptions,
+					requestCert: true
+				}, (socket) => {
+					authenticatedPeerDeviceId(socket).then((peerDeviceId) => {
+						onConnection(wrapSocket(socket, peerDeviceId));
+					});
+				});
+				server.once("error", reject);
+				server.listen(port, host, () => {
+					const bound = server.address();
+					if (bound === null || typeof bound === "string") {
+						reject(/* @__PURE__ */ new Error("listener did not report a bound address"));
+						return;
+					}
+					resolve({
+						close: async () => new Promise((resolveClose) => {
+							server.close(() => {
+								resolveClose();
+							});
+						}),
+						address: `${bound.address}:${String(bound.port)}`,
+						unref: () => {
+							server.unref();
+						}
+					});
+				});
+			});
+		}
+	};
+}
+//#endregion
+exports.createTlsTransport = createTlsTransport;

package/dist/adapters/tls-transport.d.cts

@@ -0,0 +1,9 @@
+import { Transport } from "../ports/transport.cjs";
+//#region src/adapters/tls-transport.d.ts
+export interface TlsIdentity {
+  certificatePem: string;
+  privateKeyPem: string;
+}
+/** A Node tls.TLSSocket-based Transport: the identical length-prefixed CBOR framing createTcpTransport uses, but over mutually-authenticated TLS -- both sides always present the certificate from the identity passed in, and rejectUnauthorized stays false deliberately (this is certificate-pinning by device-id, the Syncthing trust model, not a CA hierarchy) while Connection.peerDeviceId carries the one thing that actually matters: what the presented certificate cryptographically proves the peer holds the key for. */
+export declare function createTlsTransport(identity: Readonly<TlsIdentity>): Transport;
+//#endregion

package/dist/adapters/tls-transport.d.mts

@@ -0,0 +1,9 @@
+import { Transport } from "../ports/transport.mjs";
+//#region src/adapters/tls-transport.d.ts
+export interface TlsIdentity {
+  certificatePem: string;
+  privateKeyPem: string;
+}
+/** A Node tls.TLSSocket-based Transport: the identical length-prefixed CBOR framing createTcpTransport uses, but over mutually-authenticated TLS -- both sides always present the certificate from the identity passed in, and rejectUnauthorized stays false deliberately (this is certificate-pinning by device-id, the Syncthing trust model, not a CA hierarchy) while Connection.peerDeviceId carries the one thing that actually matters: what the presented certificate cryptographically proves the peer holds the key for. */
+export declare function createTlsTransport(identity: Readonly<TlsIdentity>): Transport;
+//#endregion

package/dist/adapters/tls-transport.mjs

@@ -0,0 +1,177 @@
+import { frameSchema } from "../generated/protocol.mjs";
+import { deriveDeviceId } from "./node-identity.mjs";
+import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
+import { connect, createServer } from "node:tls";
+//#region src/adapters/tls-transport.ts
+const LENGTH_PREFIX_BYTES = 4;
+function parseAddress(address) {
+	const lastColon = address.lastIndexOf(":");
+	if (lastColon === -1) throw new Error(`expected "host:port", got "${address}"`);
+	return {
+		host: address.slice(0, lastColon),
+		port: Number(address.slice(lastColon + 1))
+	};
+}
+function writeFrame(socket, frame) {
+	const body = encode(frame, cdeEncodeOptions);
+	const header = Buffer.alloc(LENGTH_PREFIX_BYTES);
+	header.writeUInt32BE(body.length, 0);
+	socket.write(header);
+	socket.write(body);
+}
+/** Reassembles length-prefixed CBOR frames from a byte stream, validating each against frameSchema before handing it to a consumer -- identical framing to createTcpTransport's own frameReader, since TLS terminates before framing and the wire shape above it is unchanged. A body that doesn't even decode as CBOR rejects the receive() iteration and destroys the connection. */
+function frameReader(socket) {
+	let buffer = Buffer.alloc(0);
+	const pending = [];
+	const waiters = [];
+	let ended = false;
+	let failure = null;
+	function tryDrain() {
+		while (buffer.length >= LENGTH_PREFIX_BYTES) {
+			const bodyLength = buffer.readUInt32BE(0);
+			if (buffer.length < LENGTH_PREFIX_BYTES + bodyLength) break;
+			const body = buffer.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + bodyLength);
+			buffer = buffer.subarray(LENGTH_PREFIX_BYTES + bodyLength);
+			let decoded;
+			try {
+				decoded = decode(body, cdeDecodeOptions);
+			} catch (error) {
+				const connectionError = error instanceof Error ? error : /* @__PURE__ */ new Error(`frame body failed to decode: ${String(error)}`);
+				failAll(connectionError);
+				socket.destroy(connectionError);
+				return;
+			}
+			const result = frameSchema.safeParse(decoded);
+			if (result.success) {
+				const waiter = waiters.shift();
+				if (waiter) waiter.resolve({
+					value: result.data,
+					done: false
+				});
+				else pending.push(result.data);
+			}
+		}
+	}
+	function endAll() {
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.resolve({
+			value: void 0,
+			done: true
+		});
+	}
+	function failAll(error) {
+		failure = error;
+		ended = true;
+		for (const waiter of waiters.splice(0)) waiter.reject(error);
+	}
+	socket.on("data", (chunk) => {
+		buffer = Buffer.concat([buffer, chunk]);
+		tryDrain();
+	});
+	socket.on("end", endAll);
+	socket.on("close", endAll);
+	socket.on("error", () => void 0);
+	return { [Symbol.asyncIterator]() {
+		return { async next() {
+			const next = pending.shift();
+			if (next !== void 0) return Promise.resolve({
+				value: next,
+				done: false
+			});
+			if (failure !== null) return Promise.reject(failure);
+			if (ended) return Promise.resolve({
+				value: void 0,
+				done: true
+			});
+			return new Promise((resolve, reject) => {
+				waiters.push({
+					resolve,
+					reject
+				});
+			});
+		} };
+	} };
+}
+/** Authenticates the socket's peer, if it presented a certificate: derives a device-id from the certificate's own raw public-key bytes -- never from anything the peer merely claims -- and returns undefined only when no certificate was presented at all (never on a mismatch; there is nothing to mismatch against at this layer, only a fact to report). Node's TLS layer has already verified the peer actually holds the matching private key by the time a socket reaches this point, so this device-id is cryptographically backed, not self-asserted. */
+async function authenticatedPeerDeviceId(socket) {
+	const cert = socket.getPeerCertificate();
+	if (Object.keys(cert).length === 0 || !("pubkey" in cert)) return;
+	return deriveDeviceId(cert.pubkey);
+}
+function wrapSocket(socket, peerDeviceId) {
+	const frames = frameReader(socket);
+	return {
+		send: async (frame) => {
+			writeFrame(socket, frame);
+			return Promise.resolve();
+		},
+		receive: () => frames,
+		close: async () => new Promise((resolve) => {
+			socket.end(() => {
+				resolve();
+			});
+		}),
+		...peerDeviceId !== void 0 ? { peerDeviceId } : {},
+		unref: () => {
+			socket.unref();
+		}
+	};
+}
+/** A Node tls.TLSSocket-based Transport: the identical length-prefixed CBOR framing createTcpTransport uses, but over mutually-authenticated TLS -- both sides always present the certificate from the identity passed in, and rejectUnauthorized stays false deliberately (this is certificate-pinning by device-id, the Syncthing trust model, not a CA hierarchy) while Connection.peerDeviceId carries the one thing that actually matters: what the presented certificate cryptographically proves the peer holds the key for. */
+function createTlsTransport(identity) {
+	const tlsOptions = {
+		key: identity.privateKeyPem,
+		cert: identity.certificatePem,
+		rejectUnauthorized: false
+	};
+	return {
+		async connect(address) {
+			const { host, port } = parseAddress(address);
+			const socket = await new Promise((resolve, reject) => {
+				const s = connect({
+					...tlsOptions,
+					host,
+					port
+				}, () => {
+					resolve(s);
+				});
+				s.once("error", reject);
+			});
+			return wrapSocket(socket, await authenticatedPeerDeviceId(socket));
+		},
+		async listen(address, onConnection) {
+			const { host, port } = parseAddress(address);
+			return new Promise((resolve, reject) => {
+				const server = createServer({
+					...tlsOptions,
+					requestCert: true
+				}, (socket) => {
+					authenticatedPeerDeviceId(socket).then((peerDeviceId) => {
+						onConnection(wrapSocket(socket, peerDeviceId));
+					});
+				});
+				server.once("error", reject);
+				server.listen(port, host, () => {
+					const bound = server.address();
+					if (bound === null || typeof bound === "string") {
+						reject(/* @__PURE__ */ new Error("listener did not report a bound address"));
+						return;
+					}
+					resolve({
+						close: async () => new Promise((resolveClose) => {
+							server.close(() => {
+								resolveClose();
+							});
+						}),
+						address: `${bound.address}:${String(bound.port)}`,
+						unref: () => {
+							server.unref();
+						}
+					});
+				});
+			});
+		}
+	};
+}
+//#endregion
+export { createTlsTransport };

package/dist/clock-DiSx-WKM.d.cts

@@ -0,0 +1,7 @@
+//#region src/ports/clock.d.ts
+interface Clock {
+  /** Current time as Unix milliseconds, matching every uint timestamp field in the protocol (token-claims.expires, revocation-entry.revoked-at, handshake params, etc.). */
+  now: () => number;
+}
+//#endregion
+export { Clock as t };

package/dist/clock-DiSx-WKM.d.mts

@@ -0,0 +1,7 @@
+//#region src/ports/clock.d.ts
+interface Clock {
+  /** Current time as Unix milliseconds, matching every uint timestamp field in the protocol (token-claims.expires, revocation-entry.revoked-at, handshake params, etc.). */
+  now: () => number;
+}
+//#endregion
+export { Clock as t };

package/dist/domain/device-id.cjs

@@ -0,0 +1,27 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+//#region src/domain/device-id.ts
+const HEX_RADIX = 16;
+const HEX_BYTE_WIDTH = 2;
+const DEVICE_ID_HEX_LENGTH = 64;
+/** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
+function bytesToHex(bytes) {
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(HEX_RADIX).padStart(HEX_BYTE_WIDTH, "0");
+	return hex;
+}
+/** Lowercase, byte-exact hex -- the same encoding room.cddl's device-id-hex regex and the conformance vectors' synthetic device-ids already use. */
+function deviceIdToHex(device) {
+	return bytesToHex(device);
+}
+/** Parses a lowercase, 64-character device-id-hex string back into the 32-byte DeviceId it encodes. Throws on anything that isn't exactly that shape, rather than silently truncating or zero-padding a malformed input. */
+function deviceIdFromHex(hex) {
+	if (!/^[0-9a-f]{64}$/.test(hex)) throw new Error(`expected a 64-character lowercase hex string, got ${JSON.stringify(hex)}`);
+	const bytes = new Uint8Array(DEVICE_ID_HEX_LENGTH / HEX_BYTE_WIDTH);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = Number.parseInt(hex.slice(i * HEX_BYTE_WIDTH, (i + 1) * HEX_BYTE_WIDTH), HEX_RADIX);
+	return require_generated_protocol.deviceIdSchema.parse(bytes);
+}
+//#endregion
+exports.bytesToHex = bytesToHex;
+exports.deviceIdFromHex = deviceIdFromHex;
+exports.deviceIdToHex = deviceIdToHex;

package/dist/domain/device-id.d.cts

@@ -0,0 +1,9 @@
+import { v as DeviceId } from "../protocol-B26-5VX7.cjs";
+//#region src/domain/device-id.d.ts
+/** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Lowercase, byte-exact hex -- the same encoding room.cddl's device-id-hex regex and the conformance vectors' synthetic device-ids already use. */
+export declare function deviceIdToHex(device: DeviceId): string;
+/** Parses a lowercase, 64-character device-id-hex string back into the 32-byte DeviceId it encodes. Throws on anything that isn't exactly that shape, rather than silently truncating or zero-padding a malformed input. */
+export declare function deviceIdFromHex(hex: string): DeviceId;
+//#endregion

package/dist/domain/device-id.d.mts

@@ -0,0 +1,9 @@
+import { v as DeviceId } from "../protocol-B26-5VX7.mjs";
+//#region src/domain/device-id.d.ts
+/** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
+export declare function bytesToHex(bytes: Uint8Array): string;
+/** Lowercase, byte-exact hex -- the same encoding room.cddl's device-id-hex regex and the conformance vectors' synthetic device-ids already use. */
+export declare function deviceIdToHex(device: DeviceId): string;
+/** Parses a lowercase, 64-character device-id-hex string back into the 32-byte DeviceId it encodes. Throws on anything that isn't exactly that shape, rather than silently truncating or zero-padding a malformed input. */
+export declare function deviceIdFromHex(hex: string): DeviceId;
+//#endregion

package/dist/domain/device-id.mjs

@@ -0,0 +1,24 @@
+import { deviceIdSchema } from "../generated/protocol.mjs";
+//#region src/domain/device-id.ts
+const HEX_RADIX = 16;
+const HEX_BYTE_WIDTH = 2;
+const DEVICE_ID_HEX_LENGTH = 64;
+/** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
+function bytesToHex(bytes) {
+	let hex = "";
+	for (const byte of bytes) hex += byte.toString(HEX_RADIX).padStart(HEX_BYTE_WIDTH, "0");
+	return hex;
+}
+/** Lowercase, byte-exact hex -- the same encoding room.cddl's device-id-hex regex and the conformance vectors' synthetic device-ids already use. */
+function deviceIdToHex(device) {
+	return bytesToHex(device);
+}
+/** Parses a lowercase, 64-character device-id-hex string back into the 32-byte DeviceId it encodes. Throws on anything that isn't exactly that shape, rather than silently truncating or zero-padding a malformed input. */
+function deviceIdFromHex(hex) {
+	if (!/^[0-9a-f]{64}$/.test(hex)) throw new Error(`expected a 64-character lowercase hex string, got ${JSON.stringify(hex)}`);
+	const bytes = new Uint8Array(DEVICE_ID_HEX_LENGTH / HEX_BYTE_WIDTH);
+	for (let i = 0; i < bytes.length; i++) bytes[i] = Number.parseInt(hex.slice(i * HEX_BYTE_WIDTH, (i + 1) * HEX_BYTE_WIDTH), HEX_RADIX);
+	return deviceIdSchema.parse(bytes);
+}
+//#endregion
+export { bytesToHex, deviceIdFromHex, deviceIdToHex };

package/dist/domain/handshake.cjs

@@ -0,0 +1,23 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+//#region src/domain/handshake.ts
+/** The highest protocol version this build of core understands. */
+const SUPPORTED_PROTOCOL_VERSION = 1;
+/**
+* Domain names that must never be negotiated, per handshake.cddl: core/federation is retired (its string stays reserved, never reused) and "a peer must never advertise or negotiate it". Excluded here even if both peers advertise it -- two buggy advertisers must not end up speaking a dead domain.
+*/
+const RETIRED_DOMAINS = ["core/federation"];
+/**
+* Negotiates protocol version and capability domains between a local and remote handshake -- the mechanism wire-mesh's handshake exists to provide, and agent-comms issue #31's fix: a mixed fleet of old and new peers negotiates down to what they both actually support, rather than one side silently misinterpreting frames the other can't produce yet.
+*/
+function negotiate(local, remote) {
+	const version = Math.min(local.version, remote.version);
+	const sharedDomains = local.domains.filter((domain) => !RETIRED_DOMAINS.includes(domain) && remote.domains.includes(domain));
+	return {
+		ok: version >= 1 && sharedDomains.length > 0,
+		version,
+		sharedDomains
+	};
+}
+//#endregion
+exports.SUPPORTED_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSION;
+exports.negotiate = negotiate;

package/dist/domain/handshake.d.cts

@@ -0,0 +1,16 @@
+import { Z as ProtocolVersion, k as HandshakeFrame, x as DomainId } from "../protocol-B26-5VX7.cjs";
+//#region src/domain/handshake.d.ts
+/** The highest protocol version this build of core understands. */
+export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;
+export interface NegotiationResult {
+  ok: boolean;
+  /** The version both peers will speak for the rest of the session -- the lower of the two offered versions, so a peer never has to understand a frame shape it didn't advertise. */
+  version: ProtocolVersion;
+  /** Domains both peers advertised and that are not retired -- the only ones either side may address for the rest of the session. */
+  sharedDomains: DomainId[];
+}
+/**
+ * Negotiates protocol version and capability domains between a local and remote handshake -- the mechanism wire-mesh's handshake exists to provide, and agent-comms issue #31's fix: a mixed fleet of old and new peers negotiates down to what they both actually support, rather than one side silently misinterpreting frames the other can't produce yet.
+ */
+export declare function negotiate(local: HandshakeFrame, remote: HandshakeFrame): NegotiationResult;
+//#endregion