fleetmesh-node 0.2.0__py3-none-any.whl

node/commands/transport_cmds.py

@@ -0,0 +1,451 @@
+"""Transport CLI subcommands: FIPS native, Iroh QUIC, and Hardware Enclave."""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import time
+from typing import Any, Mapping, TypedDict
+
+from node.interfaces import DIDCommMessage
+from node.config.parameter import Parameter
+from .adapter import CommandDispatcher
+from .base import add_command, emit, fail, load_json_arg, resolve_peer_or_raw
+
+
+class FipsFlowInfo(TypedDict):
+    flow: str
+    fileno: int
+    status: str
+
+
+def _message_arg(a: argparse.Namespace) -> DIDCommMessage | Mapping[str, Any]:
+    """--message as a DIDComm-ish body: JSON (inline or @file) when it parses,
+    otherwise wrapped as a raw string. Default is a ping."""
+    msg_str = getattr(a, 'message', None) or '{"type":"fleetmesh/ping"}'
+    return load_json_arg(msg_str, '--message', on_error=lambda raw: {'type': 'fleetmesh/raw', 'content': raw})
+
+
+# ---- 1. Hardware Enclave ---------------------------------------------------
+
+def _enclave_status(det: dict) -> None:
+    print('Hardware Enclave Status:')
+    print('  Platform:             %s' % det['platform'])
+    print('  Hardware Tier:        %s' % det['hardware_tier'])
+    print('  Apple Secure Enclave: %s' % ('present' if det['has_secure_enclave'] else 'absent'))
+    print('  Biometrics/TouchID:   %s' % ('supported' if det['has_biometrics'] else 'absent'))
+    print('  Supported Curves:     %s' % ', '.join(det['supported_curves']))
+
+
+def _cmd_enclave_status(a: argparse.Namespace) -> int:
+    from node.keystore import enclave as enclave_mod
+    return emit(a, enclave_mod.detect_hardware_enclave(), _enclave_status)
+
+
+def _cmd_enclave_generate(a: argparse.Namespace) -> int:
+    from node.keystore import enclave as enclave_mod
+    ktype = getattr(a, 'type', 'p256') or 'p256'
+    key = enclave_mod.EnclaveKey.generate(key_type=ktype)
+    res = {
+        'key_id': key.key_id,
+        'key_type': key.key_type,
+        'hardware_tier': key.hardware_tier,
+        'public_key_hex': key.public_key_hex,
+        'multikey': key.multikey,
+    }
+
+    def generated(_: dict) -> None:
+        print('Generated Enclave Key:')
+        print('  ID:       %s' % key.key_id)
+        print('  Type:     %s (%s)' % (key.key_type, key.hardware_tier))
+        print('  Multikey: %s' % key.multikey)
+    return emit(a, res, generated)
+
+
+def _cmd_enclave_sign(a: argparse.Namespace) -> int:
+    from node.keystore import enclave as enclave_mod
+    if not getattr(a, 'message', None):
+        fail('sign requires --message <text>')
+    key = enclave_mod.EnclaveKey.generate(key_type=getattr(a, 'type', 'p256') or 'p256')
+    msg = a.message.encode('utf-8')
+    sig = key.sign(msg)
+    res = {
+        'message': a.message,
+        'multikey': key.multikey,
+        'signature_raw': sig.raw_signature.hex(),
+        'attestation': sig.attestation,
+    }
+
+    def signed(_: dict) -> None:
+        print('Enclave Signature:')
+        print('  Multikey:  %s' % key.multikey)
+        print('  Signature: %s' % sig.raw_signature.hex())
+        print('  Tier:      %s' % sig.attestation.get('hardware_tier'))
+    return emit(a, res, signed)
+
+
+def _cmd_enclave_verify(a: argparse.Namespace) -> int:
+    from node.keystore import enclave as enclave_mod
+    if not getattr(a, 'message', None) or not getattr(a, 'sig', None) or not getattr(a, 'pub', None):
+        fail('verify requires --message, --sig (hex), and --pub (multikey)')
+    msg = a.message.encode('utf-8')
+    try:
+        sig_bytes = bytes.fromhex(a.sig)
+    except Exception:
+        fail('sig must be a valid hex string')
+    ok_v, reason = enclave_mod.verify_signature(msg, a.pub, sig_bytes)
+    emit(a, {'valid': ok_v, 'reason': reason},
+         lambda _: print('Enclave Verification: %s (%s)' % ('VALID' if ok_v else 'INVALID', reason)), indent=None)
+    return 0 if ok_v else 1
+
+
+enclave_dispatcher = CommandDispatcher('enclave', default_action='status')
+enclave_dispatcher.add_custom('status', _cmd_enclave_status)
+enclave_dispatcher.add_custom('generate', _cmd_enclave_generate, parameters=(
+    Parameter(key='type', name='type', description='enclave curve', type=str, default='p256', choices=('p256', 'secp256k1')),
+))
+enclave_dispatcher.add_custom('sign', _cmd_enclave_sign, parameters=(
+    Parameter(key='type', name='type', description='enclave curve', type=str, default='p256', choices=('p256', 'secp256k1')),
+    Parameter(key='message', name='message', description='message string to sign or verify', type=str, default=''),
+))
+enclave_dispatcher.add_custom('verify', _cmd_enclave_verify, parameters=(
+    Parameter(key='message', name='message', description='message string to sign or verify', type=str, default=''),
+    Parameter(key='sig', name='sig', description='hex signature to verify', type=str, default=''),
+    Parameter(key='pub', name='pub', description='public multikey string to verify', type=str, default=''),
+))
+
+
+def cmd_enclave(a: argparse.Namespace) -> int:
+    return enclave_dispatcher.dispatch(a)
+
+
+# ---- 2. Iroh QUIC Transport -------------------------------------------------
+
+def _iroh_status(st: dict) -> None:
+    print('Iroh QUIC Engine Status:')
+    print('  Node ID:    %s' % st['node_id'])
+    print('  Endpoint:   %s' % st['endpoint'])
+    print('  Ticket:     %s' % st['ticket'])
+    print('  ALPN:       %s' % st['alpn'])
+    print('  Running:    %s' % st['running'])
+
+
+def _cmd_iroh_status(a: argparse.Namespace) -> int:
+    from node import keystore
+    from node.transport.iroh_rung import quic as iroh_live
+    ks = keystore.Keystore.load(a.dir)
+    host = getattr(a, 'host', '127.0.0.1') or '127.0.0.1'
+    port = getattr(a, 'port', 0) or 0
+    eng = iroh_live.IrohLiveEngine(node_id=ks.node_pk, host=host, port=port)
+    eng.start()
+    try:
+        return emit(a, eng.status(), _iroh_status)
+    finally:
+        eng.stop()
+
+
+def _cmd_iroh_probe(a: argparse.Namespace) -> int:
+    from node import keystore
+    from node.transport.iroh_rung import quic as iroh_live
+    ks = keystore.Keystore.load(a.dir)
+    host = getattr(a, 'host', '127.0.0.1') or '127.0.0.1'
+    port = getattr(a, 'port', 9012) or 9012
+    eng = iroh_live.IrohLiveEngine(node_id=ks.node_pk, host='127.0.0.1', port=0)
+    eng.start()
+    try:
+        res = eng.probe_nat(host, port, timeout=2.0)
+
+        def probed(_: dict) -> None:
+            if res:
+                print('NAT Probe Successful:')
+                print('  Target:     %s:%d' % (host, port))
+                print('  Reflexive:  %s:%d' % (res[0], res[1]))
+            else:
+                print('NAT Probe Timeout: no response from %s:%d' % (host, port))
+        emit(a, {'probed': f"{host}:{port}", 'reflexive': f"{res[0]}:{res[1]}" if res else None}, probed, indent=None)
+        return 0 if res else 1
+    finally:
+        eng.stop()
+
+
+def _cmd_iroh_punch(a: argparse.Namespace) -> int:
+    from node import keystore
+    from node.transport.iroh_rung import quic as iroh_live
+    ks = keystore.Keystore.load(a.dir)
+    host = getattr(a, 'host', '127.0.0.1') or '127.0.0.1'
+    port = getattr(a, 'port', 9012) or 9012
+    cnt = getattr(a, 'count', 5) or 5
+    eng = iroh_live.IrohLiveEngine(node_id=ks.node_pk, host='127.0.0.1', port=0)
+    eng.start()
+    try:
+        eng.punch_hole(host, port, count=cnt, interval=0.05)
+        return emit(a, {'punched': f"{host}:{port}", 'count': cnt},
+                    lambda _: print('Punched %d UDP pinhole packets to %s:%d' % (cnt, host, port)), indent=None)
+    finally:
+        eng.stop()
+
+
+def _cmd_iroh_send(a: argparse.Namespace) -> int:
+    from node import keystore
+    from node.transport.iroh_rung import quic as iroh_live
+    ks = keystore.Keystore.load(a.dir)
+    target = getattr(a, 'ticket', None) or getattr(a, 'to', None)
+    if not target:
+        fail('send requires --ticket <iroh_ticket> or --to <ticket/pubkey>')
+    msg_obj = _message_arg(a)
+
+    eng = iroh_live.IrohLiveEngine(node_id=ks.node_pk, host='127.0.0.1', port=0)
+    eng.start()
+    try:
+        conn = eng.get_or_connect(target)
+        raw = json.dumps(msg_obj).encode('utf-8')
+        sid = eng.send_stream(conn, raw)
+        return emit(a, {'ok': True, 'stream_id': sid, 'peer': f"{conn.remote_addr[0]}:{conn.remote_addr[1]}"},
+                    lambda _: print('Sent QUIC stream %d to %s:%d (%d bytes)' % (sid, conn.remote_addr[0], conn.remote_addr[1], len(raw))),
+                    indent=None)
+    finally:
+        eng.stop()
+
+
+iroh_dispatcher = CommandDispatcher('iroh', default_action='status')
+iroh_dispatcher.add_custom('status', _cmd_iroh_status, parameters=(
+    Parameter(key='host', name='host', description='remote host for probe/punch', type=str, default='127.0.0.1'),
+    Parameter(key='port', name='port', description='remote port for probe/punch', type=int, default=0),
+))
+iroh_dispatcher.add_custom('probe', _cmd_iroh_probe, parameters=(
+    Parameter(key='host', name='host', description='remote host for probe/punch', type=str, default='127.0.0.1'),
+    Parameter(key='port', name='port', description='remote port for probe/punch', type=int, default=9012),
+))
+iroh_dispatcher.add_custom('punch', _cmd_iroh_punch, parameters=(
+    Parameter(key='host', name='host', description='remote host for probe/punch', type=str, default='127.0.0.1'),
+    Parameter(key='port', name='port', description='remote port for probe/punch', type=int, default=9012),
+    Parameter(key='count', name='count', description='probe/punch packet count', type=int, default=5),
+))
+iroh_dispatcher.add_custom('send', _cmd_iroh_send, parameters=(
+    Parameter(key='ticket', name='ticket', description='remote peer iroh ticket', type=str, default=''),
+    Parameter(key='to', name='to', description='recipient pubkey or ticket', type=str, default=''),
+    Parameter(key='message', name='message', description='message payload to transmit (JSON, @file, or raw text)', type=str, default=''),
+))
+
+
+def cmd_iroh(a: argparse.Namespace) -> int:
+    return iroh_dispatcher.dispatch(a)
+
+
+# ---- 3. FIPS Native Datagram Transport --------------------------------------
+
+def _fips_status(info: dict) -> None:
+    print('FIPS Native Transport Status:')
+    print('  Socket Path:   %s' % (info['socket_path'] or 'None'))
+    print('  Available:     %s' % ('YES' if info['available'] else 'NO'))
+    print('  Connected:     %s' % ('YES' if info.get('connected') else 'NO'))
+    print('  Default Port:  %d' % info['default_port'])
+    if info.get('node_pk'):
+        print('  Node ID:       %s' % info['node_pk'])
+    if info.get('error'):
+        print('  Error:         %s' % info['error'])
+    elif not info['available']:
+        print('  Note:          %s' % info['note'])
+
+
+def _fips_flows(r: dict) -> None:
+    flows_info = r['flows']
+    print('Active FIPS Datagram Flows (%d):' % len(flows_info))
+    if not flows_info:
+        print('  (no active flows)')
+    else:
+        for f in flows_info:
+            print('  Flow %s [fd %d]: %s' % (f['flow'], f['fileno'], f['status']))
+
+
+def _fips_context(a: argparse.Namespace) -> tuple[Any, str | None, int, Any]:
+    from node import keystore
+    from node.transport import fips_rung
+    sock_path = getattr(a, 'sock', None) or fips_rung.find_api_socket()
+    port = getattr(a, 'port', 11801) or 11801
+    ks = keystore.Keystore.load(a.dir) if hasattr(a, 'dir') and os.path.exists(os.path.join(a.dir, 'keys.json')) else None
+    return fips_rung, sock_path, port, ks
+
+
+def _cmd_fips_status(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, port, ks = _fips_context(a)
+    is_avail = bool(sock_path and os.path.exists(sock_path))
+    info = {
+        'socket_path': sock_path,
+        'available': is_avail,
+        'default_port': port,
+        'node_pk': ks.node_pk if ks else None,
+        'active_flows': 0,
+        'listeners': 0,
+    }
+    if is_avail:
+        try:
+            client = fips_rung.FipsNativeTransport(sock_path=sock_path)
+            client.connect()
+            info['connected'] = True
+            info['active_flows'] = len(client.open_flows)
+            info['listeners'] = len(client.listeners)
+            client.close()
+        except Exception as e:
+            info['connected'] = False
+            info['error'] = str(e)
+    else:
+        info['connected'] = False
+        info['note'] = 'FIPS control socket not found or daemon not running'
+    emit(a, info, _fips_status)
+    return 0 if info.get('connected') or info['available'] else 1
+
+
+def _cmd_fips_flows(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, _port, _ks = _fips_context(a)
+    sock_p = sock_path or fips_rung.find_api_socket()
+    flows_info: list[FipsFlowInfo] = []
+    if sock_p and os.path.exists(sock_p):
+        try:
+            client = fips_rung.FipsNativeTransport(sock_path=sock_p)
+            client.connect()
+            for key, sock in client.open_flows.items():
+                flows_info.append({'flow': key, 'fileno': sock.fileno(), 'status': 'open'})
+            client.close()
+        except Exception:
+            pass
+    return emit(a, {'flows': flows_info, 'count': len(flows_info)}, _fips_flows)
+
+
+def _cmd_fips_connect(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, port, _ks = _fips_context(a)
+    peer = getattr(a, 'peer', None)
+    if not peer:
+        fail('connect requires --peer <pubkey|npub|did>')
+    peer_pk = resolve_peer_or_raw(a, peer)
+    if not sock_path:
+        fail('FIPS control socket not found; pass --sock <path>')
+    client = fips_rung.FipsNativeTransport(sock_path=sock_path)
+    client.connect()
+    try:
+        flow_sock = client.open_flow(peer_pk, port=port)
+        res = {'ok': True, 'peer': peer_pk, 'port': port, 'fileno': flow_sock.fileno()}
+        return emit(a, res, lambda _: print('Connected FSP flow to %s:%d (fd %d)' % (peer_pk[:16], port, flow_sock.fileno())))
+    finally:
+        client.close()
+
+
+def _cmd_fips_listen(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, port, _ks = _fips_context(a)
+    if not sock_path:
+        fail('FIPS control socket not found; pass --sock <path>')
+    client = fips_rung.FipsNativeTransport(sock_path=sock_path)
+    client.connect()
+    try:
+        list_sock = client.listen_port(port=port)
+        res = {'ok': True, 'port': port, 'fileno': list_sock.fileno(), 'status': 'listening'}
+        return emit(a, res, lambda _: print('Bound FSP listener on port %d (fd %d)' % (port, list_sock.fileno())))
+    finally:
+        client.close()
+
+
+def _cmd_fips_send(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, port, ks = _fips_context(a)
+    peer = getattr(a, 'peer', None)
+    if not peer:
+        fail('send requires --peer <pubkey|npub|did>')
+    peer_pk = resolve_peer_or_raw(a, peer)
+    if not sock_path:
+        fail('FIPS control socket not found; pass --sock <path>')
+    msg_obj = dict(_message_arg(a))
+    msg_obj.setdefault('from', ks.did if ks else f'did:nostr:{peer_pk}')
+    msg_obj.setdefault('to', [f'did:nostr:{peer_pk}'])
+    msg_obj.setdefault('created_time', int(time.time()))
+    raw = json.dumps(msg_obj, separators=(',', ':'), sort_keys=True).encode('utf-8')
+
+    client = fips_rung.FipsNativeTransport(sock_path=sock_path)
+    client.connect()
+    try:
+        flow_sock = client.open_flow(peer_pk, port=port)
+        n_sent = client.send_framed(
+            flow_sock,
+            payload=raw,
+            flags=fips_rung.FLAG_DIDCOMM | fips_rung.FLAG_FINAL,
+        )
+        res = {'ok': True, 'peer': peer_pk, 'port': port, 'bytes_sent': n_sent}
+        time.sleep(0.02)
+        return emit(a, res, lambda _: print('Sent %d bytes over FSP flow to %s:%d' % (n_sent, peer_pk[:16], port)))
+    finally:
+        client.close()
+
+
+def _cmd_fips_probe(a: argparse.Namespace) -> int:
+    fips_rung, sock_path, port, _ks = _fips_context(a)
+    t0 = time.time()
+    if not sock_path or not os.path.exists(sock_path):
+        emit(a, {'ok': False, 'error': f'control socket not found at {sock_path}'},
+             lambda _: print('FIPS Probe FAILED: control socket not accessible at %s' % sock_path))
+        return 1
+    try:
+        client = fips_rung.FipsNativeTransport(sock_path=sock_path)
+        client.connect()
+        rtt_ms = round((time.time() - t0) * 1000, 2)
+
+        def probed(_: dict) -> None:
+            print('FIPS Probe SUCCESSFUL:')
+            print('  Control Socket: %s' % sock_path)
+            print('  Probe RTT:      %.2f ms' % rtt_ms)
+            print('  Status:         ready')
+        emit(a, {'ok': True, 'rtt_ms': rtt_ms, 'sock': sock_path, 'port': port}, probed)
+        client.close()
+        return 0
+    except Exception as e:
+        err = str(e)
+        emit(a, {'ok': False, 'error': err}, lambda _: print('FIPS Probe FAILED: %s' % err))
+        return 1
+
+
+fips_dispatcher = CommandDispatcher('fips', default_action='status')
+fips_dispatcher.add_custom('status', _cmd_fips_status, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+    Parameter(key='port', name='port', description='FSP service port (default: 11801)', type=int, default=11801),
+))
+fips_dispatcher.add_custom('flows', _cmd_fips_flows, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+))
+fips_dispatcher.add_custom('connect', _cmd_fips_connect, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+    Parameter(key='port', name='port', description='FSP service port (default: 11801)', type=int, default=11801),
+    Parameter(key='peer', name='peer', description='peer pubkey, npub, or did:nostr', type=str, default=''),
+))
+fips_dispatcher.add_custom('listen', _cmd_fips_listen, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+    Parameter(key='port', name='port', description='FSP service port (default: 11801)', type=int, default=11801),
+))
+fips_dispatcher.add_custom('send', _cmd_fips_send, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+    Parameter(key='port', name='port', description='FSP service port (default: 11801)', type=int, default=11801),
+    Parameter(key='peer', name='peer', description='peer pubkey, npub, or did:nostr', type=str, default=''),
+    Parameter(key='message', name='message', description='message payload to transmit (JSON, @file, or raw text)', type=str, default=''),
+))
+fips_dispatcher.add_custom('probe', _cmd_fips_probe, parameters=(
+    Parameter(key='sock', name='sock', description='path to FIPS Unix control socket', type=str, default=''),
+    Parameter(key='port', name='port', description='FSP service port (default: 11801)', type=int, default=11801),
+    Parameter(key='timeout', name='timeout', description='timeout in seconds', type=float, default=5.0),
+))
+
+
+def cmd_fips(a: argparse.Namespace) -> int:
+    return fips_dispatcher.dispatch(a)
+
+
+# ---- 4. Provider Registration -----------------------------------------------
+
+class TransportCommandProvider:
+    """Registers transport diagnostic and control commands."""
+
+    @classmethod
+    def register(cls, sub: argparse._SubParsersAction) -> None:
+        en = add_command(sub, 'enclave', cmd_enclave, 'inspect and interact with hardware enclaves and passkeys', js=True)
+        enclave_dispatcher.register_arguments(en, action_choices=('status', 'generate', 'sign', 'verify'))
+
+        ir = add_command(sub, 'iroh', cmd_iroh, 'iroh P2P QUIC transport diagnostics and control', js=True)
+        iroh_dispatcher.register_arguments(ir, action_choices=('status', 'probe', 'punch', 'send'))
+
+        fp = add_command(sub, 'fips', cmd_fips, 'FIPS Native Datagram API transport diagnostics and control', js=True)
+        fips_dispatcher.register_arguments(fp, action_choices=('status', 'flows', 'connect', 'listen', 'send', 'probe'))

node/commands/video_cmds.py

@@ -0,0 +1,99 @@
+"""video: live CMAF / LL-HLS video streams, Transit Reflector handovers, and barter settlement."""
+from __future__ import annotations
+
+import argparse
+from typing import Any, Mapping
+
+from node.planes.services.video.compartment import VideoTransitCompartment
+from .adapter import CommandDispatcher
+from .base import add_command
+
+
+def _show_status(r: Mapping[str, Any]) -> None:
+    print(
+        'video streaming: %d active stream(s), %d reflector session(s)'
+        % (int(r.get('active_streams', 0)), len(r.get('reflector_sessions') or {}))
+    )
+    for s in r.get('streams') or []:
+        print(
+            '  stream %-24s  segments=%d  handover=%s'
+            % (
+                s.get('stream_id', ''),
+                int(s.get('segments_count', 0)),
+                'engaged' if s.get('handover_active') else 'origin',
+            )
+        )
+    for d in r.get('debts') or []:
+        state_str = 'audio-only' if d.get('degraded_audio_only') else 'full'
+        print(
+            '  peer %-18s  unsettled=%d B  barter=%d B  state=%s'
+            % (
+                str(d.get('debtor') or d.get('peer') or '')[:16],
+                int(d.get('unsettled_bytes', 0)),
+                int(d.get('bartered_bytes', 0)),
+                state_str,
+            )
+        )
+
+
+def _show_started(r: Mapping[str, Any]) -> None:
+    print('started stream %s (%s)' % (r.get('stream_id', ''), r.get('title', '')))
+    print('  genesis op: %s (seq %s)' % (r.get('genesis_op_id', ''), r.get('seq_num', 0)))
+    print('  announced:  %s' % ', '.join(r.get('announcements') or []))
+
+
+def _show_settled(r: Mapping[str, Any]) -> None:
+    debt = r.get('debt_after') or {}
+    state_str = 'audio-only' if debt.get('degraded_audio_only') else 'full'
+    print(
+        'credited %d transit bytes for %s via %s (%s units) -> state=%s'
+        % (
+            int(r.get('credited_bytes', 0)),
+            str(r.get('peer', ''))[:16],
+            r.get('utility_kind', ''),
+            r.get('units', 0),
+            state_str,
+        )
+    )
+
+
+def _show_solicited(r: Mapping[str, Any]) -> None:
+    sol = r.get('solicitation') or {}
+    print(
+        'transit solicitation for %s (mode=%s, sent=%s)'
+        % (sol.get('stream_id', ''), sol.get('mode', ''), bool(r.get('sent')))
+    )
+
+
+_cmd_map = {c.key: c for c in VideoTransitCompartment.COMMANDS}
+dispatcher = CommandDispatcher('video', default_action='status')
+dispatcher.add_command('status', _cmd_map['status'], human=_show_status, timeout=10)
+dispatcher.add_command('start', _cmd_map['start_stream'], human=lambda r, _a: _show_started(r), timeout=15)
+dispatcher.add_command('settle', _cmd_map['settle'], human=lambda r, _a: _show_settled(r), timeout=15)
+dispatcher.add_command('solicit', _cmd_map['solicit_transit'], human=lambda r, _a: _show_solicited(r), timeout=15)
+
+
+def cmd_video(a: argparse.Namespace) -> int:
+    return dispatcher.dispatch(a)
+
+
+class VideoCommandProvider:
+    """Registers the video streaming and transit reflector CLI commands."""
+
+    @classmethod
+    def register(cls, sub: argparse._SubParsersAction) -> None:
+        p = add_command(
+            sub,
+            'stream',
+            cmd_video,
+            'live CMAF/LL-HLS video streams, Transit Reflector handovers, and barter settlement',
+            js=True,
+        )
+        dispatcher.register_arguments(p, action_choices=('status', 'start', 'settle', 'solicit'))
+
+
+__all__ = [
+    'VideoCommandProvider',
+    'cmd_video',
+    'dispatcher',
+]

node/compartment/__init__.py

@@ -0,0 +1,124 @@
+"""The contract every mechanism in this node keeps, so that it can be watched.
+
+A mechanism used to be wired in eight places: constructed in `NodeApp.start`,
+hooked into `_tick`, given a key in `health`, a branch in the control dispatch,
+a row in the control table, a function in the CLI, a registration beside it, and
+a line in the README. Eight chances to forget one, and forgetting is silent.
+
+There was a ninth place that did not exist, and its absence cost a night. When
+`on_receipt` refused every receipt on a four-node mesh because the two ends
+named different grants, it recorded nothing at all: every other divergent branch
+counted a reason and that one did not, so an operator saw a window with no claim
+and no explanation for it. A refusal that is not recorded is indistinguishable
+from silence, and silence is the one thing this protocol is least able to read.
+
+So a subsystem here declares what it is rather than being wired into what it is
+part of:
+
+    name        what it is called, on the wire of the control socket and the CLI
+    reads/live  the config keys it reads, and which of those it re-reads on a tick
+    commands    its own control surface, dispatched generically
+    tick        its periodic work, returning what it did
+    state       what it is, for monitoring
+    trouble     what an operator should be told without asking
+    refusals    every no it said, with the reason and enough detail to act
+
+`Refusals` is the part that is new. Everything else already existed by
+convention in one subsystem or another; this makes the convention checkable.
+
+A package since the sixth surface (STORES) arrived: the abstract base is in
+base.py where it can be read on its own, and the parts it is assembled from
+each have a file -
+
+    base.py       Compartment, the abstract base, and CompartmentProtocol
+    command.py    Command, BoundCommand: what a compartment can be asked
+    refusals.py   Refusals: every no it said
+    registry.py   Registry: the node's compartments, and the verbs over them
+
+Everything is re-exported here, so `from node.compartment import X` and
+`compartment_mod.X` read as they always did.
+"""
+from __future__ import annotations
+
+from .base import Compartment, CompartmentProtocol
+from .command import Alias, BoundCommand, Command, CommandError, CommandRecord, declared, every_command
+from .every import Every
+from .handler import Handler
+from .need import Need
+from .problem import (
+    DuplicateProblem,
+    IncompatibleProblem,
+    InvalidIdentifierProblem,
+    Note,
+    NoteList,
+    Problem,
+    Problems,
+    ReferenceProblem,
+    ShadowingProblem,
+    Trouble,
+    TroubleList,
+    TypeMismatchProblem,
+)
+from .refusals import Refusal, Refusals, why_detail
+from .registry import Registry, T
+from .schema import Column, Index, Migration, SchemaEntry, Table
+from .wire import Outbound, WireClient, WireProtocol
+from .worker import Worker
+from .context import NodeContext, NodeStores
+from . import context, lifecycle, sidecar, stores
+from .lifecycle import (
+    CONFIGURED,
+    DEGRADED,
+    DRAINING,
+    FAILED,
+    QUARANTINED,
+    RETIRED,
+    RUNNING,
+    STATES,
+    WIRED,
+    Breaker,
+    Lifecycle,
+    Tracker,
+    Transition,
+)
+from .sidecar import Bridge, Sidecar, SidecarError, jsonline_call
+from .stores import (
+    COUNTERS,
+    LRU,
+    MEMORY,
+    OLDEST,
+    REFUSE,
+    RING,
+    SET,
+    SNAPSHOT,
+    TABLE,
+    Counters,
+    Holdings,
+    Members,
+    Ring,
+    Store,
+    StoreFull,
+    Table as StoreTable,
+)
+
+__all__ = [
+    'Alias', 'BoundCommand', 'Command', 'CommandError', 'CommandRecord', 'Compartment', 'CompartmentProtocol', 'Every',
+    'Handler', 'Need', 'Refusal', 'Refusals', 'Registry', 'T', 'Worker', 'declared', 'every_command', 'why_detail',
+    'Column', 'Index', 'Table', 'Migration', 'SchemaEntry',
+    'Outbound', 'WireClient', 'WireProtocol',
+    'Problem', 'Problems', 'DuplicateProblem', 'InvalidIdentifierProblem', 'ReferenceProblem',
+    'TypeMismatchProblem', 'ShadowingProblem', 'IncompatibleProblem', 'Trouble', 'TroubleList',
+    'Note', 'NoteList',
+    'context', 'NodeContext', 'NodeStores',
+    'lifecycle', 'stores', 'sidecar',
+    'Breaker', 'Lifecycle', 'Tracker', 'Transition',
+    'CONFIGURED', 'DEGRADED', 'DRAINING', 'FAILED', 'QUARANTINED', 'RETIRED', 'RUNNING', 'STATES', 'WIRED',
+    'Bridge', 'Sidecar', 'SidecarError', 'jsonline_call',
+    'Store', 'Ring', 'Members', 'Counters', 'Holdings', 'StoreFull', 'StoreTable',
+    'RING', 'TABLE', 'SET', 'COUNTERS', 'OLDEST', 'LRU', 'REFUSE', 'MEMORY', 'SNAPSHOT',
+]
+
+
+
+
+