wire-mesh-core 0.0.0 → 1.0.2

package/dist/generated/protocol.mjs

@@ -0,0 +1,382 @@
+import { z } from "zod";
+//#region src/generated/protocol.ts
+const dataHaveFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("data-have"),
+	"peer": z.lazy(() => deviceIdSchema),
+	"head-seq": z.number().int().nonnegative()
+}));
+const dataRequestFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("data-request"),
+	"peer": z.lazy(() => deviceIdSchema),
+	"from-seq": z.number().int().nonnegative()
+}));
+const dataEntriesFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("data-entries"),
+	"peer": z.lazy(() => deviceIdSchema),
+	"from-seq": z.number().int().nonnegative(),
+	"entries": z.array(z.instanceof(Uint8Array))
+}));
+const handleClaimsSchema = z.lazy(() => z.object({
+	"handle": z.string(),
+	"device-id": z.lazy(() => deviceIdSchema),
+	"identity-key": z.lazy(() => identityKeySchema),
+	"candidates": z.array(z.lazy(() => wireCandidateSchema)).optional(),
+	"mailboxes": z.array(z.lazy(() => deviceIdSchema)).optional(),
+	"issued": z.number().int().nonnegative(),
+	"expires": z.number().int().nonnegative()
+}));
+const handleRecordSchema = z.lazy(() => z.lazy(() => coseSign1Schema));
+const manageCommandParamsSchema = z.lazy(() => z.union([
+	z.union([
+		z.lazy(() => ptySpawnSchema),
+		z.lazy(() => ptyWriteSchema),
+		z.lazy(() => ptyResizeSchema),
+		z.lazy(() => ptyKillSchema),
+		z.lazy(() => procSpawnSchema),
+		z.lazy(() => procSignalSchema),
+		z.lazy(() => procKillSchema),
+		z.lazy(() => execListSchema)
+	]),
+	z.object({}).catchall(z.unknown()),
+	z.union([
+		z.lazy(() => roomSendSchema),
+		z.lazy(() => roomReadSchema),
+		z.lazy(() => roomLeaveSchema),
+		z.lazy(() => roomMembersSchema)
+	]),
+	z.union([z.lazy(() => roomJoinSchema), z.lazy(() => roomInviteSchema)]),
+	z.union([
+		z.lazy(() => webrtcOfferSchema),
+		z.lazy(() => webrtcAnswerSchema),
+		z.lazy(() => webrtcIceCandidateSchema)
+	])
+]));
+const ptySpawnSchema = z.lazy(() => z.object({
+	"verb": z.literal("pty.spawn"),
+	"shell": z.string().optional(),
+	"argv": z.array(z.string()),
+	"cwd": z.string().optional(),
+	"env": z.object({}).catchall(z.string()),
+	"cols": z.number().int().nonnegative(),
+	"rows": z.number().int().nonnegative()
+}));
+const ptyWriteSchema = z.lazy(() => z.object({
+	"verb": z.literal("pty.write"),
+	"session": z.lazy(() => streamSessionSchema),
+	"bytes": z.instanceof(Uint8Array)
+}));
+const ptyResizeSchema = z.lazy(() => z.object({
+	"verb": z.literal("pty.resize"),
+	"session": z.lazy(() => streamSessionSchema),
+	"cols": z.number().int().nonnegative(),
+	"rows": z.number().int().nonnegative()
+}));
+const ptyKillSchema = z.lazy(() => z.object({
+	"verb": z.literal("pty.kill"),
+	"session": z.lazy(() => streamSessionSchema),
+	"signal": z.number().int()
+}));
+const procSpawnSchema = z.lazy(() => z.object({
+	"verb": z.literal("proc.spawn"),
+	"argv": z.array(z.string()),
+	"cwd": z.string().optional(),
+	"env": z.object({}).catchall(z.string())
+}));
+const procSignalSchema = z.lazy(() => z.object({
+	"verb": z.literal("proc.signal"),
+	"session": z.lazy(() => streamSessionSchema),
+	"signal": z.number().int()
+}));
+const procKillSchema = z.lazy(() => z.object({
+	"verb": z.literal("proc.kill"),
+	"session": z.lazy(() => streamSessionSchema)
+}));
+const execListSchema = z.lazy(() => z.object({ "verb": z.literal("exec.list") }));
+const execSessionInfoSchema = z.lazy(() => z.object({
+	"session": z.lazy(() => streamSessionSchema),
+	"kind": z.union([z.literal("pty"), z.literal("proc")]),
+	"argv": z.array(z.string()).optional(),
+	"cwd": z.string().optional()
+}));
+const frameVariantSchema = z.lazy(() => z.union([
+	z.lazy(() => handshakeFrameSchema),
+	z.lazy(() => pingFrameSchema),
+	z.lazy(() => closeFrameSchema),
+	z.lazy(() => gossipFrameSchema),
+	z.lazy(() => candidatesFrameSchema),
+	z.lazy(() => syncPunchFrameSchema),
+	z.lazy(() => observedAddressFrameSchema),
+	z.lazy(() => relayOfferFrameSchema),
+	z.lazy(() => relayConnectFrameSchema),
+	z.lazy(() => relayDataFrameSchema),
+	z.lazy(() => relayInboundFrameSchema),
+	z.lazy(() => coordinatorFrameSchema),
+	z.lazy(() => manageRequestFrameSchema),
+	z.lazy(() => manageResponseFrameSchema),
+	z.lazy(() => revocationAnnounceFrameSchema),
+	z.lazy(() => streamDataFrameSchema),
+	z.lazy(() => streamAckFrameSchema),
+	z.lazy(() => streamEndFrameSchema),
+	z.lazy(() => dataHaveFrameSchema),
+	z.lazy(() => dataRequestFrameSchema),
+	z.lazy(() => dataEntriesFrameSchema)
+]));
+const frameSchema = z.lazy(() => z.lazy(() => frameVariantSchema));
+const protocolVersionSchema = z.lazy(() => z.number().int().nonnegative());
+const domainIdSchema = z.lazy(() => z.union([
+	z.lazy(() => coreDomainNameSchema),
+	z.lazy(() => namespacedDomainIdSchema),
+	z.lazy(() => privateUseDomainIdSchema)
+]));
+const coreDomainNameSchema = z.lazy(() => z.union([
+	z.literal("core/management"),
+	z.literal("core/exec"),
+	z.literal("core/data"),
+	z.literal("core/federation"),
+	z.literal("core/webrtc"),
+	z.literal("core/room")
+]));
+const namespacedDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
+const privateUseDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
+const handshakeFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("handshake"),
+	"version": z.lazy(() => protocolVersionSchema),
+	"domains": z.array(z.lazy(() => domainIdSchema)),
+	"params": z.object({}).catchall(z.unknown()).optional()
+}));
+const identityKeySchema = z.lazy(() => z.object({
+	"alg": z.number().int(),
+	"public-key": z.instanceof(Uint8Array)
+}));
+const deviceIdSchema = z.lazy(() => z.instanceof(Uint8Array).refine((v) => v.length === 32, { message: "expected exactly 32 bytes" }));
+const peerIdentitySchema = z.lazy(() => z.object({
+	"device-id": z.lazy(() => deviceIdSchema),
+	"identity-key": z.lazy(() => identityKeySchema),
+	"certificate": z.instanceof(Uint8Array).optional()
+}));
+const manageCommandSchema = z.lazy(() => z.object({
+	"verb": z.lazy(() => capabilityVerbSchema),
+	"params": z.lazy(() => manageCommandParamsSchema)
+}));
+const manageRequestFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("manage-request"),
+	"request-id": z.number().int().nonnegative(),
+	"command": z.lazy(() => manageCommandSchema),
+	"scope": z.lazy(() => capabilityScopeSchema),
+	"token": z.lazy(() => capabilityTokenSchema).optional()
+}));
+const manageOkSchema = z.lazy(() => z.object({ "result": z.literal("ok") }).catchall(z.unknown()));
+const manageErrorSchema = z.lazy(() => z.object({
+	"result": z.literal("error"),
+	"code": z.string(),
+	"message": z.string().optional()
+}));
+const manageResponseFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("manage-response"),
+	"request-id": z.number().int().nonnegative(),
+	"outcome": z.union([z.lazy(() => manageOkSchema), z.lazy(() => manageErrorSchema)])
+}));
+const revocationClaimsSchema = z.lazy(() => z.object({
+	"token-id": z.instanceof(Uint8Array),
+	"issuer": z.lazy(() => deviceIdSchema),
+	"issuer-key": z.lazy(() => identityKeySchema),
+	"revoked-at": z.number().int().nonnegative()
+}));
+const revocationEntrySchema = z.lazy(() => z.lazy(() => coseSign1Schema));
+const revocationAnnounceFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("revocation-announce"),
+	"entries": z.array(z.lazy(() => revocationEntrySchema))
+}));
+const roomPathSchema = z.lazy(() => z.union([z.lazy(() => ownerNamedRoomPathSchema), z.lazy(() => dmRoomPathSchema)]));
+const deviceIdHexSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}")));
+const ownerNamedRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}/[A-Za-z0-9_-]+")));
+const dmRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}\\+[0-9a-f]{64}")));
+const roomSendSchema = z.lazy(() => z.object({
+	"verb": z.literal("room.send"),
+	"message-id": z.instanceof(Uint8Array),
+	"sent-at": z.number().int().nonnegative(),
+	"text": z.string(),
+	"content-type": z.string().optional(),
+	"refs": z.array(z.lazy(() => messageRefSchema)).optional()
+}).catchall(z.unknown()));
+const roomReadSchema = z.lazy(() => z.object({
+	"verb": z.literal("room.read"),
+	"messages": z.array(z.instanceof(Uint8Array)),
+	"at": z.number().int().nonnegative()
+}).catchall(z.unknown()));
+const roomLeaveSchema = z.lazy(() => z.object({ "verb": z.literal("room.leave") }).catchall(z.unknown()));
+const roomMembersSchema = z.lazy(() => z.object({ "verb": z.literal("room.members") }).catchall(z.unknown()));
+const messageRefSchema = z.lazy(() => z.object({
+	"id": z.instanceof(Uint8Array),
+	"relation": z.string()
+}));
+const roomJoinSchema = z.lazy(() => z.object({ "verb": z.literal("room.join") }).catchall(z.unknown()));
+const roomInviteSchema = z.lazy(() => z.object({
+	"verb": z.literal("room.invite"),
+	"invitee": z.lazy(() => deviceIdSchema),
+	"token": z.lazy(() => capabilityTokenSchema)
+}).catchall(z.unknown()));
+const roomMemberSchema = z.lazy(() => z.object({ "device": z.lazy(() => deviceIdSchema) }).catchall(z.unknown()));
+const roomJoinOkSchema = z.lazy(() => z.object({
+	"result": z.literal("ok"),
+	"granted-token": z.lazy(() => capabilityTokenSchema),
+	"members": z.array(z.lazy(() => roomMemberSchema))
+}).catchall(z.unknown()));
+const roomMembersOkSchema = z.lazy(() => z.object({
+	"result": z.literal("ok"),
+	"members": z.array(z.lazy(() => roomMemberSchema))
+}).catchall(z.unknown()));
+const roomNoticeSchema = z.lazy(() => z.lazy(() => coseSign1Schema));
+const roomNoticeClaimsSchema = z.lazy(() => z.object({
+	"room": z.lazy(() => roomPathSchema),
+	"poster": z.lazy(() => deviceIdSchema),
+	"poster-key": z.lazy(() => identityKeySchema),
+	"token": z.lazy(() => capabilityTokenSchema),
+	"notice-id": z.instanceof(Uint8Array),
+	"posted-at": z.number().int().nonnegative(),
+	"content-type": z.string(),
+	"content": z.instanceof(Uint8Array),
+	"refs": z.array(z.lazy(() => messageRefSchema)).optional()
+}).catchall(z.unknown()));
+const streamSessionSchema = z.lazy(() => z.number().int().nonnegative());
+const streamDataFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("stream-data"),
+	"session": z.lazy(() => streamSessionSchema),
+	"seq": z.number().int().nonnegative(),
+	"channel": z.string(),
+	"bytes": z.instanceof(Uint8Array)
+}));
+const streamAckFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("stream-ack"),
+	"session": z.lazy(() => streamSessionSchema),
+	"ack-seq": z.number().int().nonnegative(),
+	"window": z.number().int().nonnegative()
+}));
+const streamEndFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("stream-end"),
+	"session": z.lazy(() => streamSessionSchema),
+	"exit-code": z.number().int().optional(),
+	"exit-signal": z.number().int().optional()
+}));
+const capabilityVerbSchema = z.lazy(() => z.union([
+	z.lazy(() => coreCapabilitySchema),
+	z.lazy(() => namespacedCapabilitySchema),
+	z.lazy(() => privateUseCapabilitySchema)
+]));
+const coreCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z][a-z0-9-]*:[a-z][a-z0-9-]*")));
+const namespacedCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const privateUseCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const capabilityScopeSchema = z.lazy(() => z.object({
+	"kind": z.string(),
+	"path": z.string().optional()
+}));
+const coseHeaderAlgSchema = z.lazy(() => z.literal(1));
+const coseHeaderKidSchema = z.lazy(() => z.literal(4));
+const coseHeaderLabelSchema = z.lazy(() => z.union([z.number().int(), z.string()]));
+const coseTokenHeadersSchema = z.lazy(() => z.object({
+	"1": z.number().int().optional(),
+	"4": z.instanceof(Uint8Array).optional()
+}).catchall(z.unknown()));
+const coseSign1Schema = z.lazy(() => z.tuple([
+	z.instanceof(Uint8Array),
+	z.lazy(() => coseTokenHeadersSchema),
+	z.union([z.instanceof(Uint8Array), z.null()]),
+	z.instanceof(Uint8Array)
+]));
+const capabilityTokenSchema = z.lazy(() => z.lazy(() => coseSign1Schema));
+const tokenClaimsSchema = z.lazy(() => z.object({
+	"token-id": z.instanceof(Uint8Array),
+	"issuer": z.lazy(() => deviceIdSchema),
+	"issuer-key": z.lazy(() => identityKeySchema),
+	"bearer": z.lazy(() => deviceIdSchema),
+	"capability": z.lazy(() => capabilityVerbSchema),
+	"scope": z.lazy(() => capabilityScopeSchema),
+	"expires": z.number().int().nonnegative(),
+	"not-before": z.number().int().nonnegative().optional(),
+	"parent": z.instanceof(Uint8Array).optional(),
+	"delegations-remaining": z.number().int().nonnegative().optional()
+}).catchall(z.unknown()));
+const pingFrameSchema = z.lazy(() => z.object({ "type": z.literal("ping") }));
+const closeFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("close"),
+	"reason": z.string().optional()
+}));
+const peerAdvertSchema = z.lazy(() => z.object({
+	"device": z.lazy(() => deviceIdSchema),
+	"addresses": z.array(z.string()),
+	"snapshot-seconds": z.number().int()
+}));
+const gossipFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("gossip"),
+	"peers": z.array(z.lazy(() => peerAdvertSchema))
+}));
+const candidateKindSchema = z.lazy(() => z.union([
+	z.literal("host"),
+	z.literal("server-reflexive"),
+	z.literal("relayed")
+]));
+const wireCandidateSchema = z.lazy(() => z.object({
+	"address": z.string(),
+	"kind": z.lazy(() => candidateKindSchema),
+	"priority": z.number().int().nonnegative()
+}));
+const candidatesFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("candidates"),
+	"candidates": z.array(z.lazy(() => wireCandidateSchema))
+}));
+const syncPunchFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("sync-punch"),
+	"nonce": z.number().int().nonnegative(),
+	"deadline-unix-ms": z.number().int().nonnegative()
+}));
+const observedAddressFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("observed-address"),
+	"address": z.string()
+}));
+const relayOfferFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("relay-offer"),
+	"addresses": z.array(z.string())
+}));
+const relayConnectFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("relay-connect"),
+	"target-device": z.lazy(() => deviceIdSchema)
+}));
+const relayDataFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("relay-data"),
+	"payload": z.instanceof(Uint8Array),
+	"to-device": z.lazy(() => deviceIdSchema).optional(),
+	"from-device": z.lazy(() => deviceIdSchema).optional()
+}));
+const relayInboundFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("relay-inbound"),
+	"source-device": z.lazy(() => deviceIdSchema)
+}));
+const coordinatorFrameSchema = z.lazy(() => z.object({
+	"type": z.literal("coordinator"),
+	"term": z.number().int().nonnegative(),
+	"coordinator": z.lazy(() => deviceIdSchema),
+	"capacity-hint": z.number().int().nonnegative().optional()
+}));
+const webrtcOfferSchema = z.lazy(() => z.object({
+	"verb": z.literal("webrtc.offer"),
+	"negotiation-id": z.number().int().nonnegative(),
+	"sdp": z.string()
+}));
+const webrtcAnswerSchema = z.lazy(() => z.object({
+	"verb": z.literal("webrtc.answer"),
+	"negotiation-id": z.number().int().nonnegative(),
+	"sdp": z.string()
+}));
+const webrtcIceCandidateSchema = z.lazy(() => z.object({
+	"verb": z.literal("webrtc.ice-candidate"),
+	"negotiation-id": z.number().int().nonnegative(),
+	"candidate": z.lazy(() => iceCandidateInitSchema).optional()
+}));
+const iceCandidateInitSchema = z.lazy(() => z.object({
+	"candidate": z.string(),
+	"sdp-mid": z.string().optional(),
+	"sdp-m-line-index": z.number().int().nonnegative().optional(),
+	"username-fragment": z.string().optional()
+}));
+//#endregion
+export { candidateKindSchema, candidatesFrameSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/runtime.cjs

@@ -0,0 +1,8 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+let cddl_js_runtime = require("cddl.js/runtime");
+Object.defineProperty(exports, "cborDecodesAs", {
+	enumerable: true,
+	get: function() {
+		return cddl_js_runtime.cborDecodesAs;
+	}
+});

package/dist/generated/runtime.d.cts

@@ -0,0 +1,2 @@
+import { cborDecodesAs } from "cddl.js/runtime";
+export { cborDecodesAs };

package/dist/generated/runtime.d.mts

@@ -0,0 +1,2 @@
+import { cborDecodesAs } from "cddl.js/runtime";
+export { cborDecodesAs };

package/dist/generated/runtime.mjs

@@ -0,0 +1,2 @@
+import { cborDecodesAs } from "cddl.js/runtime";
+export { cborDecodesAs };

package/dist/identity-BRLEUfVY.d.cts

@@ -0,0 +1,17 @@
+import { j as IdentityKey, v as DeviceId } from "./protocol-B26-5VX7.cjs";
+//#region src/ports/identity.d.ts
+/**
+ * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
+ */
+interface IdentityPort {
+  readonly deviceId: DeviceId;
+  readonly identityKey: IdentityKey;
+  /** Signs an already-assembled message (e.g. a COSE Sig_structure) with the local node's own private key. Always a fresh buffer, never a view into shared or offset memory -- directly usable as a CapabilityToken tuple element without further normalisation. */
+  sign: (message: Uint8Array) => Promise<Uint8Array<ArrayBuffer>>;
+  /** Verifies a signature against an arbitrary identity-key -- not necessarily the local node's own, since capability-token verification checks a token's issuer-key. */
+  verify: (key: IdentityKey, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;
+  /** Derives the device-id an arbitrary public key would produce (SHA-256 of the raw public-key bytes -- never a certificate's own DER encoding, the bug both Cascade and agent-comms had to fix). Used to check a token's self-certifying issuer-key against its claimed issuer, not just the local node's own identity. */
+  deriveDeviceId: (publicKey: Uint8Array) => Promise<DeviceId>;
+}
+//#endregion
+export { IdentityPort as t };

package/dist/identity-qNkmGytv.d.mts

@@ -0,0 +1,17 @@
+import { j as IdentityKey, v as DeviceId } from "./protocol-B26-5VX7.mjs";
+//#region src/ports/identity.d.ts
+/**
+ * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
+ */
+interface IdentityPort {
+  readonly deviceId: DeviceId;
+  readonly identityKey: IdentityKey;
+  /** Signs an already-assembled message (e.g. a COSE Sig_structure) with the local node's own private key. Always a fresh buffer, never a view into shared or offset memory -- directly usable as a CapabilityToken tuple element without further normalisation. */
+  sign: (message: Uint8Array) => Promise<Uint8Array<ArrayBuffer>>;
+  /** Verifies a signature against an arbitrary identity-key -- not necessarily the local node's own, since capability-token verification checks a token's issuer-key. */
+  verify: (key: IdentityKey, message: Uint8Array, signature: Uint8Array) => Promise<boolean>;
+  /** Derives the device-id an arbitrary public key would produce (SHA-256 of the raw public-key bytes -- never a certificate's own DER encoding, the bug both Cascade and agent-comms had to fix). Used to check a token's self-certifying issuer-key against its claimed issuer, not just the local node's own identity. */
+  deriveDeviceId: (publicKey: Uint8Array) => Promise<DeviceId>;
+}
+//#endregion
+export { IdentityPort as t };

package/dist/ports/clock.d.cts

@@ -0,0 +1,2 @@
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+export { Clock };

package/dist/ports/clock.d.mts

@@ -0,0 +1,2 @@
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+export { Clock };

package/dist/ports/clock.mjs

@@ -0,0 +1 @@
+export {};

package/dist/ports/identity.d.cts

@@ -0,0 +1,2 @@
+import { t as IdentityPort } from "../identity-BRLEUfVY.cjs";
+export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -0,0 +1,2 @@
+import { t as IdentityPort } from "../identity-qNkmGytv.mjs";
+export { IdentityPort };

package/dist/ports/identity.mjs

@@ -0,0 +1 @@
+export {};

package/dist/ports/storage.d.cts

@@ -0,0 +1,9 @@
+//#region src/ports/storage.d.ts
+export interface KeyValueStorage {
+  get: (key: string) => Promise<Uint8Array | undefined>;
+  set: (key: string, value: Uint8Array) => Promise<void>;
+  delete: (key: string) => Promise<void>;
+  /** Keys with the given prefix, in no particular order. */
+  keys: (prefix: string) => Promise<string[]>;
+}
+//#endregion

package/dist/ports/storage.d.mts

@@ -0,0 +1,9 @@
+//#region src/ports/storage.d.ts
+export interface KeyValueStorage {
+  get: (key: string) => Promise<Uint8Array | undefined>;
+  set: (key: string, value: Uint8Array) => Promise<void>;
+  delete: (key: string) => Promise<void>;
+  /** Keys with the given prefix, in no particular order. */
+  keys: (prefix: string) => Promise<string[]>;
+}
+//#endregion

package/dist/ports/storage.mjs

@@ -0,0 +1 @@
+export {};

package/dist/ports/transport.d.cts

@@ -0,0 +1,29 @@
+import { v as DeviceId, w as Frame } from "../protocol-B26-5VX7.cjs";
+//#region src/ports/transport.d.ts
+/**
+ * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
+ */
+export interface Connection {
+  send: (frame: Frame) => Promise<void>;
+  /** Frames received on this connection, in arrival order, until the connection closes. */
+  receive: () => AsyncIterable<Frame>;
+  close: () => Promise<void>;
+  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
+  readonly peerDeviceId?: DeviceId;
+  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
+  unref?: () => void;
+}
+export interface Listener {
+  /** Stops listening and closes the listener. */
+  close: () => Promise<void>;
+  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
+  address: string;
+  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
+  unref?: () => void;
+}
+export interface Transport {
+  connect: (address: string) => Promise<Connection>;
+  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
+  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
+}
+//#endregion

package/dist/ports/transport.d.mts

@@ -0,0 +1,29 @@
+import { v as DeviceId, w as Frame } from "../protocol-B26-5VX7.mjs";
+//#region src/ports/transport.d.ts
+/**
+ * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
+ */
+export interface Connection {
+  send: (frame: Frame) => Promise<void>;
+  /** Frames received on this connection, in arrival order, until the connection closes. */
+  receive: () => AsyncIterable<Frame>;
+  close: () => Promise<void>;
+  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
+  readonly peerDeviceId?: DeviceId;
+  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
+  unref?: () => void;
+}
+export interface Listener {
+  /** Stops listening and closes the listener. */
+  close: () => Promise<void>;
+  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
+  address: string;
+  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
+  unref?: () => void;
+}
+export interface Transport {
+  connect: (address: string) => Promise<Connection>;
+  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
+  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
+}
+//#endregion

package/dist/ports/transport.mjs

@@ -0,0 +1 @@
+export {};