docs(typedef): sync specs with ADRs 099-102 (19 kinds, aligned-mode restrictions, read factory)

- schema-layer.md: 17→19 kinds, add Int64/Uint64 to table + TypeDefKind
  enum, update method tables (12 fixed-size kinds, 8-byte alignment for
  i64/u64/f64), add ADR-099 to design decisions.
- layout-engine.md: document ADR-100 (non-final inline variable field
  rejection), ADR-102 (TUnion rejected in aligned mode), ADR-101
  (sequential_reader returns owned reader). Update TUnion section to
  note aligned-mode rejection. Add ADRs to design decisions table.
- data-access.md: add I64/U64 to FieldValue enum, update
  sequential_reader() signature (factory, ADR-101).
- validation.md: 17→19 kinds, update TypedefEngine struct (no stored
  reader in Layout::Packed), update sequential_reader() signature.
- overview.md: 17→19 kinds, add ADRs 099-102 to design decisions.
- README.md (typedef): 17→19 kinds, add ADRs 099-102 to applicable ADRs.
- README.md (top-level): add ADRs 099-102 to ADR table, update typedef
  doc descriptions (17→19 kinds).

.gitignore

@@ -1,2 +1,3 @@
 target/
 node_modules/
+.worktrees/

.opencode/agents/architect.md

@@ -176,8 +176,23 @@ Before requesting external review:
 - Check that README has a complete ADR table and doc table
 - Ensure documents are focused (split if a spec exceeds ~700 lines)
 - Verify frontmatter statuses are correct
+- **Circular-reasoning guard**: For each deferred OQ, check that the
+  blocking condition (for `deferred(scope)`) or investigation target
+  (for `deferred(unclear)`) isn't a *prerequisite* of the thing you're
+  deferring. If the blocker needs what you're deferring, you have a
+  prerequisite inversion — either make the decision now (the pieces
+  exist) or reframe honestly (the shape isn't clear, here's what would
+  make it clear).
 
-### 5. Request Architecture Review
+### 5. Safe Exit: Deferred Decisions
+
+When you encounter a decision that genuinely can't be made:
+
+1. Mark the OQ as `deferred(scope)` with a concrete blocking condition
+2. Create a blocker task in `tasks/architecture/` naming the dependency
+3. Continue to decisions that *can* be made — do not stall on one question
+
+### 6. Request Architecture Review
 
 Spawn a review subagent:
 
@@ -197,19 +212,20 @@ task(
 )
 ```
 
-### 6. Iterate Based on Review
+### 7. Iterate Based on Review
 
 Address feedback:
 
-- **Critical**: Must fix before stabilization — inline decisions not extracted,
-  ADR references that point to nonexistent files, undefined terms
+- **Critical**: Must fix before stabilization — inline decisions not
+  extracted, ADR references that point to nonexistent files, undefined
+  terms, circular deferrals
 - **Warning**: Should fix — missing cross-references, documents approaching
   split threshold
 - **Suggestion**: Consider — minor clarity improvements
 
 Iterate until zero critical issues.
 
-### 7. Mark Review Status
+### 8. Mark Review Status
 
 When all open questions for a document are resolved and review is complete:
 
@@ -241,9 +257,31 @@ last_updated: 2026-05-29
 5. **WHAT not HOW**: Specs describe components and interfaces. ADRs explain
    why. Neither describes code-level implementation.
 6. **No historical artifacts**: Specs describe what IS, not what WAS. Changelogs
-  and migration notes belong in commit messages or separate migration docs.
+   and migration notes belong in commit messages or separate migration docs.
 7. **Lifecycle states**: Every doc has a status. Draft → reviewed → stable →
    deprecated. Stale `draft` docs are a sign of unfinished work.
+8. **Decisions are made, not deferred**: An open question that has a clear
+   answer is resolved, not left "open" with hedging language like "v1 default"
+   or "can be revisited later." If the decision is made, mark it resolved. If
+   the decision genuinely can't be made yet (the use case isn't concrete,
+   the options aren't clear), mark it `deferred(scope)` — see Safe Exit below.
+   The architect's job is to make architecture decisions that *can* be made
+   and to clearly identify which decisions *can't* be made yet and why.
+
+## Door Types and Decision Urgency
+
+Door type classifies **reversal cost** (one-way vs two-way), not
+urgency. A two-way door is a decision you make now and can revert
+later — not a decision to defer. Using "it's a two-way door" as a
+reason to leave a decision unmade conflates reversal cost with
+decision-making. See ADR-009 §"What this framework is NOT" for the
+full rationale.
+
+Architecture decisions are the architect's, regardless of door type.
+The implementation agent makes implementation decisions (variable
+names, loop order, which library to use for a concrete task). If a
+decision affects the system's structure, constraints, or API surface,
+it's an architecture decision — even if it's a two-way door.
 
 ## Anti-Patterns to Avoid
 
@@ -258,6 +296,127 @@ last_updated: 2026-05-29
 6. **Missing ADR for a visible choice**: If a reader would ask "why X over Y?",
    write an ADR
 7. **No README index**: Without the index table, ADRs and docs are unfindable
+8. **Door type as deferral**: Using "two-way door" as a reason to leave a
+   decision unmade. See "Door Types and Decision Urgency" above.
+9. **Circular deferral**: A deferred OQ whose blocking condition is a
+   prerequisite of the thing being deferred. If the blocker needs what
+   you're deferring, you have a prerequisite inversion, not a deferral.
+
+Hedging detection (resolved OQs with escape hatches, "v1 default"
+language, hedging synonyms) is the **reviewer's** job, not the
+architect's self-review. The architect is too close to its own
+reasoning to see its own circular hedges; a fresh context catches them.
+
+## Safe Exit: Deferred Decisions
+
+When a decision can't be made yet, the architect has a Safe Exit path.
+This is not a failure — it's scope management. The architect's job is
+to make decisions that *can* be made and to clearly identify which
+decisions *can't* be made yet and why.
+
+There are two kinds of deferral. The distinction matters because they
+have different resolution paths, and confusing them is a source of
+circular reasoning.
+
+### `deferred(scope)` — the information is genuinely missing
+
+The decision can't be made because something the decision depends on
+doesn't exist yet. Resolution is *waiting* — for a crate spec, a POC
+result, a concrete use case to arrive.
+
+A decision should be `deferred(scope)` when:
+
+- The use case isn't concrete (e.g., "we don't know what the agent crate
+  will need from the call protocol")
+- The options depend on something that doesn't exist yet (e.g.,
+  "depends on the alknet-http crate spec")
+- The trade-off requires data that can only come from implementation
+  (e.g., "need performance benchmarks to choose between X and Y")
+- The decision is genuinely not needed for the current scope (e.g., "the
+  current scope is core + call crates; this question is about the agent
+  crate")
+
+### `deferred(unclear)` — the pieces exist but the shape isn't clear
+
+The pieces of the decision exist (decided in other ADRs, existing
+types, existing patterns) but the composition — how they fit together
+into a coherent shape — isn't clear yet. Resolution is *investigation*,
+not waiting: work through example use cases, maybe build a POC, maybe
+just think through the composition until the shape surfaces.
+
+This state exists because not every project is well-defined enough for
+rigid "decide or defer" to work. In a well-defined project (a reverse
+proxy, a known problem with a known solution), the pieces and the shape
+are usually clear together. In a project creating new protocols, the
+pieces can be decided (verifier selection, crypto provider, fingerprint
+normalization) while the shape they compose into (the client config
+type) is still unclear. Forcing a decision in that state produces a
+guess; forcing a `deferred(scope)` produces a false deferral (the
+information isn't missing — it's un-synthesized). `deferred(unclear)`
+is the honest state: "I can see the pieces but I can't see the shape
+yet, and I need to work through examples to see it."
+
+A decision should be `deferred(unclear)` when:
+
+- The pieces exist (cite them: "ADR-X, ADR-Y, ADR-Z are all decided")
+  but the composition isn't clear
+- Resolution requires *work* (thinking through examples, building a
+  POC), not *waiting* (for a spec or use case to arrive)
+- The architect can articulate what investigation would help ("work
+  through 2+ example outbound-dial use cases") — if you can't, that's a
+  signal the deferral might be circular
+
+### How to Defer
+
+1. **Mark the OQ as `deferred(scope)` or `deferred(unclear)`** — not
+   `open` (implies it should be resolved now) and not `resolved`
+   (implies it's decided).
+2. **State the blocking condition** (`deferred(scope)`) or
+   **investigation target** (`deferred(unclear)`) — what specific thing
+   would unblock this? Be concrete: "blocked on: alknet-agent crate spec
+   exists" or "investigation: work through 2+ example outbound-dial use
+   cases (hub→worker, worker→hub) to see how verifier-selection +
+   provider + connector compose."
+3. **State the impacts** — what does this block downstream? Be
+   specific: "blocks the first hub deployment because the hub dials
+   workers" not "blocks the hub crate." This is the triage signal that
+   makes the deferral's urgency visible. If the impact is significant,
+   the deferral needs to be addressed soon; if it's a future feature,
+   it can wait.
+4. **Move on** — the architect continues to decisions that *can* be
+   made. Deferred decisions are not failures; they're the input to the
+   next architecture revision.
+
+### Deferred OQ Format
+
+```markdown
+### OQ-NN: <Question>
+
+- **Origin**: [spec-doc.md]
+- **Status**: deferred(scope) | deferred(unclear)
+- **Door type**: <one-way | two-way>
+- **Priority**: <high | medium | low>
+- **Impacts**: <what this blocks downstream — be specific>
+- **Blocked on**: <concrete dependency> (for deferred(scope))
+  **Investigation**: <what work would make the shape clear> (for deferred(unclear))
+- **Resolution**: Not yet decidable. <Why — either the information
+  doesn't exist yet (deferred(scope)) or the pieces exist but the
+  composition isn't clear (deferred(unclear), cite the pieces).>
+- **Cross-references**: OQ-NN, ADR-NNN
+```
+
+### What NOT to Do
+
+- Do not mark a deferred decision as `resolved` with caveats. "Resolved
+  with an escape hatch" is hedging.
+- Do not leave a deferred decision as `open` without a blocking
+  condition. "Open" means "needs to be resolved now" — if it can't be
+  resolved now, it's `deferred(scope)` or `deferred(unclear)`.
+- Do not confuse the two deferral kinds. If the information is missing,
+  it's `deferred(scope)`. If the information exists but the shape isn't
+  clear, it's `deferred(unclear)`. Confusing them produces circular
+  reasoning — a `deferred(scope)` whose blocker is actually a
+  prerequisite of the thing being deferred.
 
 ## When to Redirect
 

.opencode/agents/architecture-reviewer.md

@@ -82,6 +82,91 @@ Check coverage of:
 - **Maintainability**: Testability, observability, modifiability
 - **Scalability**: Horizontal/vertical scaling approach
 
+#### F. Decision Quality and Deferral Honesty
+
+This is the category the architect cannot do for itself — the architect
+is too close to its own reasoning to see its own circular hedges. A
+fresh context can see the whole picture and spot reasoning that folds
+back on itself. This is often the highest-value category on projects
+creating new protocols or solving poorly-defined problems, where the
+shape isn't always clear and the architect may reach for a deferral to
+avoid committing to an unclear shape.
+
+Check for three cases:
+
+**1. Hedging on a resolved decision.** An OQ marked `resolved` whose
+resolution contains temporal language or escape hatches:
+
+- "v1 default," "phase_n," "when x arrives," "can be revisited" — if
+  the decision is made, state it cleanly. Reserve temporal language
+  for genuinely deferred decisions.
+- "feature extension, not an unmade decision" — if it's not decided,
+  it's not resolved.
+- "additive, not blocking" — if it's not decided, don't claim it is.
+- "two-way door — can be changed later if needed" — door type
+  classifies reversal cost, not whether a decision is made.
+- "not a v1 blocker" — if it's not decided, it's deferred. Say what
+  unblocks it.
+- "for now" / "not yet" on a resolved OQ — if the resolution has an
+  expiration date, it's not resolved.
+- Resolution text primarily about how the decision can be changed
+  later ("X, but here's how we'd undo X") — the decision is made; drop
+  the undo instructions. If it's "X for now, Y later," the decision is
+  not made.
+
+Flag as **critical**: the decision is either made (state it cleanly,
+drop the hedge) or not made (mark it `deferred(scope)` or
+`deferred(unclear)`). It cannot be both.
+
+**2. False deferral / circular hedge.** A deferred OQ whose blocking
+condition is a *prerequisite* of the thing being deferred, not a
+blocker. This is the most damaging pattern — it creates a circular
+dependency where the deferred thing can never resolve because its
+blocker needs it.
+
+Check each deferred OQ:
+
+- For `deferred(scope)`: does the blocking condition *need* what this
+  OQ is deferring? If A is "blocked on B" and B needs A, that's a
+  prerequisite inversion, not a deferral.
+- For `deferred(unclear)`: is the investigation target actually the
+  thing being deferred? If the investigation is "wait for X to exist"
+  and X needs this decision, it's circular.
+- Is the information actually missing (`deferred(scope)` is correct),
+  or do the pieces exist but the shape wasn't synthesized
+  (`deferred(unclear)` is correct), or do the pieces *and* the shape
+  exist and the architect just didn't see the composition (should be
+  `resolved` — the decision is ready to make)?
+
+Flag as **critical**: the deferral is circular or inverted. Suggest
+the correct state — `resolved` if the pieces compose, `deferred(unclear)`
+if the pieces exist but the shape needs investigation, `deferred(scope)`
+only if the information genuinely is missing.
+
+**3. Legitimate deferral.** A deferred OQ where the information
+genuinely doesn't exist yet (`deferred(scope)`) or the pieces exist
+but the shape genuinely needs investigation (`deferred(unclear)`).
+Leave these — they're honest. The distinction from case 2 is that
+the blocking condition or investigation target does *not* depend on
+the thing being deferred.
+
+#### G. Impacts Field Coverage
+
+Every unresolved OQ (`open`, `deferred(scope)`, `deferred(unclear)`,
+`partially resolved`) should have an **impacts** field stating what it
+blocks downstream. Check:
+
+- Is the impacts field present? Absence is a warning — without it, the
+  deferral's urgency is invisible and triage is guesswork.
+- Is it specific? "Blocks the first hub deployment because the hub
+  dials workers" is useful. "Blocks the hub crate" is boilerplate.
+- Does it match the priority? A `deferred(unclear)` with high priority
+  but a vague impacts field ("blocks future features") is a mismatch —
+  if it's high priority, it blocks something specific; say what.
+
+Flag missing impacts fields as **warning**, vague ones as
+**suggestion**.
+
 ### 3. Categorize Findings
 
 **Critical**: Must fix before stabilization
@@ -90,6 +175,8 @@ Check coverage of:
 - Missing quality attributes with significant impact
 - Architectural decisions without rationale
 - Inconsistencies in the specification
+- Hedging on a resolved decision (case 1 of Decision Quality)
+- Circular or inverted deferrals (case 2 of Decision Quality)
 
 **Warning**: Should fix if possible
 
@@ -97,12 +184,14 @@ Check coverage of:
 - Missing edge cases
 - Incomplete interface definitions
 - Implicit assumptions
+- Missing impacts fields on unresolved OQs
 
 **Suggestion**: Consider but optional
 
 - Alternative phrasing
 - Additional context that might help
 - Documentation organization improvements
+- Vague impacts fields on unresolved OQs
 
 ### 4. Write Review Report
 
@@ -168,3 +257,7 @@ section 2"
 - Focus on architecture-level issues, not code-level
 - Be constructive and specific
 - Critical issues must block stabilization
+- The Decision Quality (F) category is often the highest-value check on
+  projects creating new protocols or solving poorly-defined problems.
+  The architect cannot self-review this category — circular reasoning
+  is invisible from inside the circle. Prioritize it.

.opencode/agents/implementation-specialist.md

@@ -212,12 +212,24 @@ Read `AGENTS.md` at project root for full details. Key rules:
 1. **No comments in code** — Per project convention.
 2. **Error handling** — Use `anyhow::Result` for application code, `thiserror` for
    library error types. Never panic in library code.
-3. **Feature flags** — Transports are feature-gated (`tls`, `iroh`, `acme`). Base
+3. **No `unwrap()` or `expect()` outside tests** — These are debug signals that
+   something wasn't clear. If you reach for `unwrap()`, it means the error
+   handling path wasn't specified — stop and think about what should actually
+   happen on that error. For poisoned locks, use
+   `unwrap_or_else(|e| e.into_inner())` or explicit error propagation. A panic
+   in one operation must not cascade to other operations.
+4. **Cryptographic nonces use `OsRng`** — AES-GCM IVs and any other cryptographic
+   nonces must use `OsRng` (or equivalent CSPRNG), never `rand::random()`. IV
+   reuse under the same key is catastrophic for GCM.
+5. **Secret material is zeroized on drop** — Any type holding derived keys,
+   decrypted credentials, or other secret material must derive `Zeroize` and
+   `ZeroizeOnDrop`. Secrets must not linger in freed heap memory.
+6. **Feature flags** — Transports are feature-gated (`tls`, `iroh`, `acme`). Base
    crate should compile lean.
-4. **Async runtime** — `tokio` is the async runtime. All I/O is async.
-5. **Naming conventions** — Rust standard: `snake_case` for functions/variables/
+7. **Async runtime** — `tokio` is the async runtime. All I/O is async.
+8. **Naming conventions** — Rust standard: `snake_case` for functions/variables/
    modules, `PascalCase` for types/traits, `SCREAMING_SNAKE_CASE` for constants.
-6. **Module structure** — One module per component under `src/`. Re-export via
+9. **Module structure** — One module per component under `src/`. Re-export via
    `mod.rs` or `lib.rs` as appropriate.
 
 ## Key Principles

Cargo.toml

@@ -1,9 +1,15 @@
 [workspace]
 members = [
+    "crates/alknet-vault",
     "crates/alknet-core",
-    "crates/alknet",
-    "crates/alknet-napi",
-    "crates/alknet-secret",
+    "crates/alknet-call",
+    "crates/alknet-endpoint",
+    "crates/alknet-http",
+    "crates/alknet-tls",
+    "crates/alknet-tty",
+    "crates/alknet-tty-local",
+    "crates/alknet-client",
+    "crates/alknet-typedef",
 ]
 resolver = "2"
 
@@ -14,5 +20,3 @@ license = "MIT OR Apache-2.0"
 repository = "https://git.alk.dev/alkdev/alknet"
 
 [workspace.dependencies]
-irpc = "0.16"
-irpc-derive = "0.16"

README.md

@@ -1,233 +1,37 @@
 # Alknet
 
-> **Status: Alpha** — This project is in early development. It depends on solid libraries (russh, tokio, iroh) for core functionality, but the glue code and integration between them has not been fully vetted for production use. Because alknet operates low in the network stack, bugs can cause serious problems downstream (leaked connections, broken tunnels, auth failures). Use with caution and report issues.
+> **Status: Pre-alpha** — This project is undergoing a major architectural pivot to an ALPN-as-service model. The previous implementation has been archived and a greenfield rebuild is in progress.
 
-A self-hostable SSH-based tunnel tool that provides VPN-like functionality without being a VPN protocol.
+A self-hostable networking toolkit built on QUIC+TLS with ALPN-based protocol dispatch. Each protocol handler (SSH, SFTP, Git, HTTP, DNS, messaging, call protocol) registers an ALPN string on a shared endpoint. The ALPN negotiation during the TLS/QUIC handshake routes connections to the correct handler before any application bytes are read.
 
-## What it does
+## Core Insight
 
-- **Private tunneling** — Route traffic to internal services (Postgres, Redis, APIs) over SSH
-- **Censorship circumvention** — SSH over TLS on port 443 is indistinguishable from HTTPS to DPI
-- **NAT traversal** — The iroh transport enables peer-to-peer connections without public IPs or port forwarding
-- **Service mesh connectivity** — Lightweight transport layer for event systems via reserved `alknet-*` destinations
-
-The core insight: SSH tunnels work because SSH is fundamental infrastructure. Blocking it breaks the internet. Alknet makes SSH tunneling accessible through a simple CLI with pluggable transports.
-
-## Quick start
-
-### Build
-
-```bash
-cargo build --release
-```
-
-The default build includes TLS and iroh transports. To build a minimal binary with just TCP:
-
-```bash
-cargo build --release --no-default-features -p alknet
-```
-
-### Server
-
-```bash
-# Generate a host key
-ssh-keygen -t ed25519 -f ssh_host_ed25519_key -N ""
-
-# Start the server on port 22 (TCP)
-alknet serve --key ssh_host_ed25519_key \
-    --authorized-keys ~/.ssh/authorized_keys
-
-# TLS with stealth mode (looks like nginx 404 to scanners)
-alknet serve --key ssh_host_ed25519_key \
-    --transport tls \
-    --acme-domain example.com \
-    --stealth
-
-# iroh (no public IP needed)
-alknet serve --key ssh_host_ed25519_key \
-    --transport iroh
-```
-
-### Client
-
-```bash
-# Connect via TCP and start a SOCKS5 proxy on 127.0.0.1:1080
-alknet connect --server example.com:22 \
-    --identity ~/.ssh/id_ed25519
-
-# Connect via TLS
-alknet connect --server example.com:443 \
-    --transport tls \
-    --identity ~/.ssh/id_ed25519
-
-# Connect via iroh (peer-to-peer, no public IP)
-alknet connect --peer <endpoint-id> \
-    --transport iroh \
-    --identity ~/.ssh/id_ed25519
-
-# With port forwarding
-alknet connect --server example.com:22 \
-    --identity ~/.ssh/id_ed25519 \
-    --forward 5432:db.internal:5432 \
-    --forward 6379:redis.internal:6379
-```
-
-### Use the SOCKS5 proxy
-
-Once connected, point any SOCKS5-aware application at `127.0.0.1:1080`:
-
-```bash
-curl --socks5 127.0.0.1:1080 http://internal-api:8080/health
-```
-
-For VPN-like "route all traffic" behavior, use [tun2proxy](https://github.com/tun2proxy/tun2proxy) alongside alknet's SOCKS5 proxy (see [ADR-014](docs/architecture/decisions/014-defer-tun-recommend-socks5-proxy.md)).
+**A service IS an ALPN.** One endpoint, one port, many protocols — dispatched by the TLS handshake, not by application-level peeking or separate listeners.
 
 ## Crates
 
-| Crate | Description |
-|-------|-------------|
-| `alknet-core` | Core library: transport trait, SOCKS5 server, port forwarding, auth, server handler |
-| `alknet` | CLI binary (`alknet connect` / `alknet serve`) |
-| `alknet-napi` | Node.js native addon via napi-rs (`connect()` / `serve()`) |
+| Crate | Status | Description |
+|-------|--------|-------------|
+| `alknet-vault` | stable | Local key vault: BIP39/SLIP-0010/AES-GCM key derivation and encryption |
+| `alknet-core` | planned | ProtocolHandler trait, ALPN router, auth/identity, config |
+| `alknet-ssh` | planned | SSH handler (russh), SOCKS5, port forwarding |
+| `alknet-call` | planned | JSON-RPC call protocol (EventEnvelope framing) |
+| `alknet-fs` | planned | Content-addressed file storage (iroh-blobs backend) |
+| `alknet-sftp` | planned | SFTP handler (russh-sftp protocol core) |
+| `alknet-git` | planned | Git smart protocol handler (gix) |
+| `alknet-http` | planned | HTTP handler (axum, REST API, MCP) |
+| `alknet-dns` | planned | DNS handler (hickory-proto, pkarr) |
+| `alknet-msg` | planned | E2E encrypted messaging, mixnet support |
+| `alknet` | planned | CLI binary (assembles and registers handlers) |
 
-## Feature flags
+## Documentation
 
-| Feature | Crate | Default | Description |
-|---------|-------|---------|-------------|
-| `tls` | `alknet-core`, `alknet` | yes | TLS transport (tokio-rustls) |
-| `iroh` | `alknet-core`, `alknet` | yes | iroh QUIC P2P transport |
-| `acme` | `alknet-core` | no | ACME/Let's Encrypt auto-cert provisioning |
-| `testutil` | `alknet-core` | no | Test utilities (for internal use) |
+- [ALPN-as-service architecture](docs/research/pivot/alpn-service-architecture.md) — pivot proposal
+- [Cleanup plan](docs/research/pivot/cleanup-plan.md) — greenfield transition plan
+- [SDD process](docs/sdd_process.md) — spec-driven development process
+- [Research references](docs/research/references/) — iroh, russh, russh-sftp deep dives
 
-## Transport modes
-
-| Transport | Client | Server | Notes |
-|-----------|--------|--------|-------|
-| **TCP** | `--transport tcp --server addr:port` | `--transport tcp --listen addr:port` | Direct SSH over TCP. Default. |
-| **TLS** | `--transport tls --server addr:port` | `--transport tls --tls-cert/--tls-key or --acme-domain` | SSH wrapped in TLS. Looks like HTTPS. |
-| **iroh** | `--transport iroh --peer <id>` | `--transport iroh` | QUIC P2P via iroh. No public IP needed. |
-
-## Authentication
-
-- **Ed25519 public keys** — Default. Load authorized keys from a file via `--authorized-keys`.
-- **OpenSSH certificate authority** — Optional. Use `--cert-authority` for multi-user deployments.
-- **No password authentication** — Key-based auth only (see [ADR-012](docs/architecture/decisions/012-auth-ed25519-and-cert-authority.md)).
-
-Key formats are OpenSSH throughout (private keys: `-----BEGIN OPENSSH PRIVATE KEY-----`, public keys: `ssh-ed25519 AAAA...`). PEM-encoded keys (PKCS#1, PKCS#8) are not supported.
-
-## Architecture
-
-Alknet's core architectural decision is that SSH never touches the network directly. The transport layer produces a duplex byte stream, and SSH runs over it via `russh::client::connect_stream()` / `russh::server::run_stream()`. This makes transports fully pluggable.
-
-```
-Client                                          Server
-  │  transport.connect()                          │  transport_acceptor.accept()
-  │  ─────────────────────────────────────────────▶│
-  │        (duplex byte stream established)        │
-  │  russh::client::connect_stream(stream)        │  russh::server::run_stream(stream, handler)
-  │  ═══════ SSH session over stream ═════════════ │
-  │  channel_open_direct_tcpip(host, port)        │
-  │  ─────────────────────────────────────────────▶│
-  │  ┌─────── TCP proxy ──────────────────┐       │
-  │  │  SSH channel ←→ TcpStream::connect │       │
-  │  └────────────────────────────────────┘       │
-```
-
-See [docs/architecture/](docs/architecture/) for full specifications and [ADR index](docs/architecture/README.md).
-
-## Node.js API
-
-The `alknet-napi` crate provides a Node.js native addon via napi-rs:
-
-```js
-const { connect, serve } = require('alknet-napi');
-
-// Client: open a duplex stream through SSH
-const stream = await connect({
-  server: "example.com:22",
-  transport: "tcp",
-  identity: "/path/to/key",
-});
-const data = await stream.read(1024);
-await stream.write(Buffer.from("hello"));
-await stream.close();
-
-// Server: accept connections and receive streams
-const server = await serve({
-  transport: "tcp",
-  hostKey: "/path/to/host_key",
-  authorizedKeys: "/path/to/authorized_keys",
-  listen: "0.0.0.0:22",
-});
-server.onConnection((event) => {
-  const { stream, info } = event;
-  // handle stream
-});
-```
-
-### iroh (peer-to-peer)
-
-iroh transport eliminates the need for public IPs or port forwarding. Both sides discover each other through a relay, then establish a direct QUIC connection. This is ideal for services behind NAT, distributed systems, or any scenario where opening ports is impractical.
-
-```js
-// Server: starts an iroh endpoint and prints its peer ID
-const server = await serve({
-  transport: "iroh",
-  hostKey: "/path/to/host_key",
-  authorizedKeys: "/path/to/authorized_keys",
-  irohRelay: "https://relay.iroh.network/",  // optional, defaults to iroh's relay
-  proxy: "socks5://proxy.example.com:1080", // optional, for restrictive networks
-});
-console.log("iroh endpoint ID:", server.endpointId);
-// e.g. iroh endpoint ID: abc23xyz...
-
-// Clients connect using that peer ID
-const stream = await connect({
-  peer: server.endpointId,
-  transport: "iroh",
-  identity: "/path/to/key",
-  irohRelay: "https://relay.iroh.network/",  // must match the server's relay
-  proxy: "socks5://proxy.example.com:1080",   // optional
-});
-```
-
-The `endpointId` property returns the server's z-base-32 encoded iroh node ID. Share this ID with clients so they can connect — no DNS, no public IP, no port forwarding required.
-
-### TLS
-
-TLS transport wraps SSH in TLS, making the connection indistinguishable from HTTPS traffic to deep packet inspection:
-
-```js
-// Server
-const server = await serve({
-  transport: "tls",
-  hostKey: "/path/to/host_key",
-  authorizedKeys: "/path/to/authorized_keys",
-  listen: "0.0.0.0:443",
-  tlsCert: "/path/to/cert.pem",
-  tlsKey: "/path/to/key.pem",
-});
-
-// Client
-const stream = await connect({
-  server: "example.com:443",
-  transport: "tls",
-  identity: "/path/to/key",
-  tlsServerName: "example.com",  // optional, SNI hostname
-  insecure: true,                 // accept self-signed certs (dev only)
-});
-```
-
-## Status and stability
-
-This is **alpha software**. While it depends on well-established libraries (russh, tokio, rustls, iroh) for SSH, async I/O, TLS, and QUIC respectively, the integration layer that ties them together has not been battle-tested. Potential concerns include:
-
-- **Connection handling edge cases** — reconnection logic, graceful shutdown, resource cleanup
-- **Security review** — the auth layer, rate limiting, and stealth mode should be audited before production use
-- **API stability** — the library API (`alknet-core`) and NAPI interface may change between versions
-- **Performance** — no load testing or benchmarking has been done yet
-
-Please test thoroughly and [file issues](https://git.alk.dev/alkdev/alknet/issues) for any problems you encounter.
+Reference implementation (previous architecture) is preserved at `/workspace/@alkdev/alknet-main/`.
 
 ## License
 

crates/alknet-call/Cargo.toml

@@ -0,0 +1,25 @@
+[package]
+name = "alknet-call"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Structured RPC over ALPN `alknet/call`: operations, streaming subscriptions, service discovery"
+repository.workspace = true
+
+[lib]
+name = "alknet_call"
+
+[features]
+default = []
+
+[dependencies]
+alknet-core = { path = "../alknet-core" }
+tokio = { version = "1", features = ["full"] }
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+async-trait = "0.1"
+tracing = "0.1"
+thiserror = "2"
+uuid = { version = "1", features = ["v4"] }
+futures = "0.3"
+parking_lot = "0.12"

crates/alknet-call/src/client/call_client.rs

@@ -0,0 +1,197 @@
+//! `CallClient`: the outbound connection opener (ADR-017 §1).
+//!
+//! Runs the shared dispatch loop over a pre-established `Connection`
+//! (delegated to [`crate::protocol::dispatch::Dispatcher`]).
+//! `CallClient` is the connection-establishment half; `CallAdapter`'s accept
+//! path is the inbound half; both produce a `CallConnection` and hand it to
+//! the same `Dispatcher::run_loop` (ADR-017 §1).
+//!
+//! After establishment the connection is symmetric (ADR-017 §2): both sides
+//! can send and receive `call.requested`. The `CallClient` is both a caller
+//! (initiates outgoing calls via `CallConnection::call()`/`subscribe()`/
+//! `abort()`) and a callee (dispatches incoming calls against its registry).
+//!
+//! Transport-level connection establishment (QUIC dial, TCP+TLS, iroh) is
+//! handled by `alknet-client`; `CallClient::spawn_dispatch` takes a
+//! pre-established `Connection` and runs the call protocol over it.
+//!
+//! See `docs/architecture/crates/call/client-and-adapters.md` for the spec.
+
+use std::sync::Arc;
+
+use alknet_core::auth::IdentityProvider;
+use alknet_core::types::Connection;
+
+use crate::protocol::connection::CallConnection;
+use crate::protocol::dispatch::Dispatcher;
+use crate::registry::registration::OperationRegistry;
+
+/// Outbound `alknet/call` connection opener (the #1 gap, ADR-017 §1).
+///
+/// Peer authorization flows through the existing `AccessControl::check` gate
+/// in `OperationRegistry::invoke` (ADR-029 §3) — no parallel `remote_safe`/
+/// `trusted_peer` gate.
+pub struct CallClient {
+    registry: Arc<OperationRegistry>,
+    identity_provider: Arc<dyn IdentityProvider>,
+}
+
+impl CallClient {
+    pub fn new(
+        registry: Arc<OperationRegistry>,
+        identity_provider: Arc<dyn IdentityProvider>,
+    ) -> Self {
+        Self {
+            registry,
+            identity_provider,
+        }
+    }
+
+    pub fn registry(&self) -> &Arc<OperationRegistry> {
+        &self.registry
+    }
+
+    pub fn identity_provider(&self) -> &Arc<dyn IdentityProvider> {
+        &self.identity_provider
+    }
+
+    /// Run the shared dispatch loop over a pre-established `Connection`. The
+    /// `CallClient` spawns the dispatcher task and returns a live
+    /// `CallConnection` the caller can use immediately. Used by the assembly
+    /// layer after `AlknetClient::dial_*` + `spawn_dispatch` and by
+    /// integration tests that wire a mock/loopback `Connection` directly.
+    pub fn spawn_dispatch(&self, connection: Connection) -> CallConnection {
+        let call_connection = Arc::new(CallConnection::new(connection));
+        let dispatcher = Dispatcher::new(
+            Arc::clone(&self.registry),
+            Arc::clone(&self.identity_provider),
+        );
+        let run_conn = Arc::clone(&call_connection);
+        tokio::spawn(async move {
+            dispatcher.run_loop(run_conn).await;
+        });
+        (*call_connection).clone()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::protocol::connection::CallConnection;
+    use crate::protocol::wire::ResponseEnvelope;
+    use crate::registry::registration::{
+        make_handler, Handler, HandlerKind, HandlerRegistration, OperationProvenance,
+    };
+    use crate::registry::spec::{AccessControl, OperationSpec, OperationType, Visibility};
+    use alknet_core::auth::Identity;
+    use alknet_core::types::Capabilities;
+
+    use crate::protocol::sink_empty_connection as stub_connection;
+
+    fn external_spec(name: &str) -> OperationSpec {
+        OperationSpec::new(
+            name,
+            OperationType::Query,
+            Visibility::External,
+            serde_json::json!({}),
+            serde_json::json!({}),
+            vec![],
+            AccessControl::default(),
+            None,
+        )
+    }
+
+    fn caps_inspect_handler() -> Handler {
+        make_handler(|_input, context| async move {
+            let has_google = context.capabilities.get("google").is_some();
+            ResponseEnvelope::ok(
+                context.request_id,
+                serde_json::json!({ "has_google_capability": has_google }),
+            )
+        })
+    }
+
+    struct NoopIdentityProvider;
+    impl alknet_core::auth::IdentityProvider for NoopIdentityProvider {
+        fn resolve_from_fingerprint(&self, _fp: &str) -> Option<Identity> {
+            None
+        }
+        fn resolve_from_token(&self, _token: &alknet_core::auth::AuthToken) -> Option<Identity> {
+            None
+        }
+    }
+
+    fn registry_with_caps() -> Arc<OperationRegistry> {
+        let mut registry = OperationRegistry::new();
+        registry
+            .register(HandlerRegistration::new(
+                external_spec("pub/run"),
+                HandlerKind::Once(caps_inspect_handler()),
+                OperationProvenance::Local,
+                None,
+                None,
+                Capabilities::new().with_api_key("google", "pub-key".to_string()),
+            ))
+            .unwrap();
+        Arc::new(registry)
+    }
+
+    fn dispatcher(registry: &Arc<OperationRegistry>) -> Dispatcher {
+        Dispatcher::new(Arc::clone(registry), Arc::new(NoopIdentityProvider))
+    }
+
+    async fn dispatch(d: &Dispatcher, conn: &Arc<CallConnection>, op: &str) -> ResponseEnvelope {
+        d.dispatch_requested(
+            conn,
+            "req-test".to_string(),
+            serde_json::json!({ "operationId": op, "input": {} }),
+        )
+        .await
+    }
+
+    #[tokio::test]
+    async fn external_op_dispatches_and_populates_capabilities() {
+        let registry = registry_with_caps();
+        let d = dispatcher(&registry);
+        let conn = Arc::new(CallConnection::new(stub_connection()));
+        let response = dispatch(&d, &conn, "pub/run").await;
+        let out = response.result.expect("ok");
+        assert_eq!(
+            out["has_google_capability"],
+            serde_json::json!(true),
+            "an External op's call must populate capabilities for the handler"
+        );
+    }
+
+    #[tokio::test]
+    async fn unknown_op_returns_not_found() {
+        let registry = Arc::new(OperationRegistry::new());
+        let d = dispatcher(&registry);
+        let conn = Arc::new(CallConnection::new(stub_connection()));
+        let response = dispatch(&d, &conn, "no/such").await;
+        match response.result {
+            Err(e) => assert_eq!(e.code, "NOT_FOUND"),
+            other => panic!("expected NOT_FOUND, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn spawn_dispatch_returns_live_call_connection() {
+        let registry = registry_with_caps();
+        let client = CallClient::new(Arc::clone(&registry), Arc::new(NoopIdentityProvider));
+        let conn = client.spawn_dispatch(stub_connection());
+        assert_eq!(
+            conn.connection()
+                .expect("quic connection present")
+                .remote_alpn(),
+            b"alknet/call"
+        );
+        std::mem::drop(conn);
+    }
+
+    #[test]
+    fn call_client_is_send_sync() {
+        fn assert_send_sync<T: Send + Sync>() {}
+        assert_send_sync::<CallClient>();
+    }
+}

crates/alknet-call/src/client/mod.rs

@@ -0,0 +1,107 @@
+//! Client adapters: turn external operation sources (JSON Schema, OpenAPI,
+//! MCP, remote `from_call` peers) into `HandlerRegistration` bundles.
+//!
+//! See `docs/architecture/crates/call/client-and-adapters.md` for the
+//! OperationAdapter trait and the Adapter Location Map, and
+//! `docs/architecture/decisions/017-call-protocol-client-and-adapter-contract.md`
+//! §5 for the trait contract.
+
+mod call_client;
+mod from_call;
+
+pub use call_client::CallClient;
+pub use from_call::{from_call, FromCallConfig};
+
+use crate::registry::registration::HandlerRegistration;
+
+/// Errors produced by [`OperationAdapter::import`].
+///
+/// The variant set is the v1 default (two-way-door remainder, OQ-26);
+/// `#[non_exhaustive]` lets downstream adapters (e.g. `alknet-http`'s
+/// `from_openapi`/`from_mcp`) extend without breaking match arms. All
+/// payloads are string messages — kept simple and `Send + Sync` by
+/// construction.
+#[derive(Debug, thiserror::Error)]
+#[non_exhaustive]
+pub enum AdapterError {
+    /// `from_call` remote unreachable / `services/list` failed.
+    #[error("discovery failed: {message}")]
+    DiscoveryFailed { message: String },
+
+    /// `from_openapi` / `from_jsonschema` couldn't parse the spec.
+    #[error("schema parse error: {message}")]
+    SchemaParse { message: String },
+
+    /// Underlying transport error (QUIC for `from_call`, HTTP for adapters).
+    #[error("transport error: {message}")]
+    Transport { message: String },
+
+    /// HTTP 401 for `from_openapi`/`from_mcp`, auth rejected for `from_call`.
+    #[error("unauthorized: {message}")]
+    Unauthorized { message: String },
+
+    /// Same-peer namespace collision in `from_call` (ADR-029 §5; OQ-26).
+    /// Cross-peer collision dissolves (same name on different peers lives in
+    /// separate sub-overlays); same-peer collision stays an error — a peer
+    /// shouldn't expose two ops with the same name.
+    #[error("same-peer collision: {message}")]
+    SamePeerCollision { message: String },
+}
+
+/// Import a set of operations as `HandlerRegistration` bundles.
+///
+/// Async because `from_call` requires async discovery (`services/list` +
+/// `services/schema` over a QUIC connection); sync adapters (e.g.
+/// `from_openapi` reading a static spec) trivially satisfy
+/// an async trait — their `import()` bodies contain no `.await` points.
+///
+/// See ADR-017 §5 (`docs/architecture/decisions/017-call-protocol-client-and-adapter-contract.md`)
+/// and `docs/architecture/crates/call/client-and-adapters.md`.
+#[async_trait::async_trait]
+pub trait OperationAdapter: Send + Sync {
+    async fn import(&self) -> Result<Vec<HandlerRegistration>, AdapterError>;
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    struct OkAdapter;
+
+    #[async_trait::async_trait]
+    impl OperationAdapter for OkAdapter {
+        async fn import(&self) -> Result<Vec<HandlerRegistration>, AdapterError> {
+            Ok(vec![])
+        }
+    }
+
+    struct ErrAdapter;
+
+    #[async_trait::async_trait]
+    impl OperationAdapter for ErrAdapter {
+        async fn import(&self) -> Result<Vec<HandlerRegistration>, AdapterError> {
+            Err(AdapterError::SchemaParse {
+                message: "x".into(),
+            })
+        }
+    }
+
+    #[tokio::test]
+    async fn ok_adapter_imports_empty() {
+        let adapter = OkAdapter;
+        match adapter.import().await {
+            Ok(bundles) => assert!(bundles.is_empty()),
+            Err(e) => panic!("expected Ok, got Err: {e}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn err_adapter_returns_schema_parse() {
+        let adapter = ErrAdapter;
+        match adapter.import().await {
+            Ok(_) => panic!("expected Err"),
+            Err(AdapterError::SchemaParse { message }) => assert_eq!(message, "x"),
+            Err(other) => panic!("expected SchemaParse, got {other}"),
+        }
+    }
+}

crates/alknet-call/src/lib.rs

@@ -0,0 +1,11 @@
+//! alknet-call: Structured RPC — operations, streaming, service discovery.
+//!
+//! Implements [`alknet_core::types::ProtocolHandler`] on ALPN `alknet/call`.
+//!
+//! The crate has two subsystems:
+//! - [`registry`] — operation specs, context, dispatch, and the operation registry.
+//! - [`protocol`] — wire format, streams, and the call adapter.
+
+pub mod client;
+pub mod protocol;
+pub mod registry;

crates/alknet-call/src/protocol/abort.rs

@@ -0,0 +1,393 @@
+//! Abort cascade logic for nested calls (ADR-016).
+//!
+//! When `call.aborted` arrives for a parent request, the protocol cascades
+//! the abort to all non-terminal descendants in the call tree. The default
+//! policy is `abort-dependents`; `continue-running` is an opt-in for
+//! long-running work that should survive a parent's abort.
+//!
+//! The call tree is indexed by `parent_request_id` in the
+//! `PendingRequestMap`. The root request has `parent_request_id: None`;
+//! each composed call has `parent_request_id: Some(parent.request_id)`.
+//! Composed child request IDs are internal — they appear in the map for
+//! abort-cascade indexing but are not sent as `call.requested` to any
+//! peer. The client only sees `call.aborted` for the root ID it sent; the
+//! server cascades internally to descendants.
+
+use super::pending::PendingRequestMap;
+use crate::registry::context::AbortPolicy;
+
+pub struct AbortCascade<'a> {
+    pending: &'a mut PendingRequestMap,
+}
+
+impl<'a> AbortCascade<'a> {
+    pub fn new(pending: &'a mut PendingRequestMap) -> Self {
+        Self { pending }
+    }
+
+    /// Cascade an abort from the given request ID to all non-terminal
+    /// descendants in the call tree. Returns the list of descendant
+    /// request IDs that were aborted (for logging/auditing), sorted for
+    /// determinism. The root request itself is not touched by this
+    /// method — the caller is responsible for aborting the root (the
+    /// trigger of the cascade).
+    ///
+    /// Under `AbortDependents` (default): all descendants are aborted,
+    /// regardless of whether they have started.
+    ///
+    /// Under `ContinueRunning`: only descendants that have not started
+    /// are aborted; started descendants continue to completion. No new
+    /// descendants start (the parent is gone). This is the conservative
+    /// approximation noted in ADR-016: a descendant is "started" if
+    /// `PendingEntry::started` is true (the handler has begun
+    /// executing). A `call.aborted` for an unknown request ID is
+    /// silently discarded — `cascade_abort` on an unknown root returns
+    /// an empty list and removes nothing.
+    pub fn cascade_abort(&mut self, root_request_id: &str, policy: AbortPolicy) -> Vec<String> {
+        if !self.pending.contains(root_request_id) {
+            return Vec::new();
+        }
+
+        let descendants = self.find_descendants(root_request_id);
+
+        let mut aborted = Vec::new();
+        match policy {
+            AbortPolicy::AbortDependents => {
+                for id in &descendants {
+                    if self.pending.handle_aborted(id) {
+                        aborted.push(id.clone());
+                    }
+                }
+            }
+            AbortPolicy::ContinueRunning => {
+                for id in &descendants {
+                    let started = self.pending.is_started(id).unwrap_or(false);
+                    if !started && self.pending.handle_aborted(id) {
+                        aborted.push(id.clone());
+                    }
+                }
+            }
+        }
+
+        aborted.sort();
+        aborted
+    }
+
+    /// Find all descendants of a request ID in the call tree by walking
+    /// the `parent_request_id` index. Returns descendants in
+    /// breadth-first order with each level's children sorted for
+    /// determinism. The root itself is not included in the result.
+    fn find_descendants(&self, parent_id: &str) -> Vec<String> {
+        let mut descendants = Vec::new();
+        let mut frontier: Vec<String> = vec![parent_id.to_string()];
+
+        while let Some(current) = frontier.pop() {
+            let mut children: Vec<String> = self
+                .pending
+                .request_ids()
+                .into_iter()
+                .filter(|id| {
+                    self.pending
+                        .parent_of(id)
+                        .flatten()
+                        .is_some_and(|p| p == current)
+                })
+                .collect();
+            children.sort();
+            for child in children {
+                descendants.push(child.clone());
+                frontier.push(child);
+            }
+        }
+
+        descendants
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::protocol::wire::CallError;
+    use std::time::{Duration, Instant};
+
+    fn register_call(map: &mut PendingRequestMap, id: &str, parent: Option<&str>) {
+        map.register_call(
+            id.to_string(),
+            Instant::now() + Duration::from_secs(30),
+            parent.map(|p| p.to_string()),
+        );
+    }
+
+    fn register_subscribe(map: &mut PendingRequestMap, id: &str, parent: Option<&str>) {
+        map.register_subscribe(id.to_string(), None, parent.map(|p| p.to_string()));
+    }
+
+    #[test]
+    fn cascade_abort_unknown_root_returns_empty_and_is_noop() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("does-not-exist", AbortPolicy::AbortDependents);
+        assert!(aborted.is_empty());
+        assert!(cascade.pending.contains("r1"));
+    }
+
+    #[test]
+    fn cascade_abort_abort_dependents_aborts_all_descendants() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-b", Some("r1"));
+        register_call(&mut map, "r1-a-1", Some("r1-a"));
+        register_call(&mut map, "r1-a-2", Some("r1-a"));
+        register_call(&mut map, "r1-b-1", Some("r1-b"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+
+        assert_eq!(
+            aborted,
+            vec![
+                "r1-a".to_string(),
+                "r1-a-1".to_string(),
+                "r1-a-2".to_string(),
+                "r1-b".to_string(),
+                "r1-b-1".to_string(),
+            ]
+        );
+        assert!(cascade.pending.contains("r1"));
+        assert!(!cascade.pending.contains("r1-a"));
+        assert!(!cascade.pending.contains("r1-b"));
+        assert!(!cascade.pending.contains("r1-a-1"));
+        assert!(!cascade.pending.contains("r1-a-2"));
+        assert!(!cascade.pending.contains("r1-b-1"));
+    }
+
+    #[test]
+    fn cascade_abort_continue_running_aborts_only_unstarted_descendants() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-b", Some("r1"));
+        register_call(&mut map, "r1-a-1", Some("r1-a"));
+
+        map.mark_started("r1-a");
+        // r1-b and r1-a-1 are unstarted
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::ContinueRunning);
+
+        assert_eq!(aborted, vec!["r1-a-1".to_string(), "r1-b".to_string()]);
+        assert!(cascade.pending.contains("r1"));
+        assert!(cascade.pending.contains("r1-a"));
+        assert!(!cascade.pending.contains("r1-b"));
+        assert!(!cascade.pending.contains("r1-a-1"));
+    }
+
+    #[test]
+    fn cascade_abort_continue_running_aborts_all_when_none_started() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-b", Some("r1"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::ContinueRunning);
+
+        assert_eq!(aborted, vec!["r1-a".to_string(), "r1-b".to_string()]);
+        assert!(!cascade.pending.contains("r1-a"));
+        assert!(!cascade.pending.contains("r1-b"));
+    }
+
+    #[test]
+    fn cascade_abort_depth_three_aborts_all_descendants() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "root", None);
+        register_call(&mut map, "root-a", Some("root"));
+        register_call(&mut map, "root-b", Some("root"));
+        register_call(&mut map, "root-a-1", Some("root-a"));
+        register_call(&mut map, "root-a-2", Some("root-a"));
+        register_call(&mut map, "root-a-1-x", Some("root-a-1"));
+        register_call(&mut map, "root-a-1-y", Some("root-a-1"));
+        register_call(&mut map, "root-b-1", Some("root-b"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("root", AbortPolicy::AbortDependents);
+
+        assert_eq!(
+            aborted,
+            vec![
+                "root-a".to_string(),
+                "root-a-1".to_string(),
+                "root-a-1-x".to_string(),
+                "root-a-1-y".to_string(),
+                "root-a-2".to_string(),
+                "root-b".to_string(),
+                "root-b-1".to_string(),
+            ]
+        );
+        assert!(cascade.pending.contains("root"));
+        assert_eq!(cascade.pending.len(), 1);
+    }
+
+    #[test]
+    fn cascade_abort_root_with_no_descendants_returns_empty() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "lonely", None);
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("lonely", AbortPolicy::AbortDependents);
+        assert!(aborted.is_empty());
+        assert!(cascade.pending.contains("lonely"));
+    }
+
+    #[test]
+    fn cascade_abort_only_aborts_descendants_not_siblings() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r2", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r2-a", Some("r2"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+
+        assert_eq!(aborted, vec!["r1-a".to_string()]);
+        assert!(cascade.pending.contains("r1"));
+        assert!(cascade.pending.contains("r2"));
+        assert!(cascade.pending.contains("r2-a"));
+        assert!(!cascade.pending.contains("r1-a"));
+    }
+
+    #[test]
+    fn cascade_abort_handles_mixed_call_and_subscribe_entries() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_subscribe(&mut map, "r1-sub", Some("r1"));
+        register_call(&mut map, "r1-sub-child", Some("r1-sub"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+
+        assert_eq!(
+            aborted,
+            vec!["r1-sub".to_string(), "r1-sub-child".to_string(),]
+        );
+        assert!(cascade.pending.contains("r1"));
+        assert_eq!(cascade.pending.len(), 1);
+    }
+
+    #[test]
+    fn cascade_abort_continue_running_with_started_descendant_keeps_its_unstarted_children() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-a-1", Some("r1-a"));
+
+        map.mark_started("r1-a");
+        // r1-a is started and continues; r1-a-1 is unstarted.
+        // Under ContinueRunning, r1-a-1 is aborted (conservative: still pending).
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::ContinueRunning);
+
+        assert_eq!(aborted, vec!["r1-a-1".to_string()]);
+        assert!(cascade.pending.contains("r1-a"));
+        assert!(!cascade.pending.contains("r1-a-1"));
+    }
+
+    #[test]
+    fn cascade_abort_abort_dependents_aborts_started_descendants_too() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-b", Some("r1"));
+
+        map.mark_started("r1-a");
+        map.mark_started("r1-b");
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+
+        assert_eq!(aborted, vec!["r1-a".to_string(), "r1-b".to_string()]);
+        assert!(!cascade.pending.contains("r1-a"));
+        assert!(!cascade.pending.contains("r1-b"));
+    }
+
+    #[test]
+    fn find_descendants_does_not_include_root() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+
+        let cascade = AbortCascade::new(&mut map);
+        let descendants = cascade.find_descendants("r1");
+        assert_eq!(descendants, vec!["r1-a".to_string()]);
+        assert!(!descendants.contains(&"r1".to_string()));
+    }
+
+    #[test]
+    fn cascade_abort_default_policy_is_abort_dependents() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        map.mark_started("r1-a");
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted_default = cascade.cascade_abort("r1", AbortPolicy::default());
+        assert_eq!(aborted_default, vec!["r1-a".to_string()]);
+    }
+
+    #[test]
+    fn cascade_abort_does_not_remove_root() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let _ = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+        assert!(cascade.pending.contains("r1"));
+    }
+
+    #[test]
+    fn cascade_abort_returns_sorted_descendants_for_determinism() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-z", Some("r1"));
+        register_call(&mut map, "r1-a", Some("r1"));
+        register_call(&mut map, "r1-m", Some("r1"));
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::AbortDependents);
+        assert_eq!(
+            aborted,
+            vec!["r1-a".to_string(), "r1-m".to_string(), "r1-z".to_string(),]
+        );
+    }
+
+    #[test]
+    fn unknown_request_id_silently_discarded_no_panic() {
+        let mut map = PendingRequestMap::new();
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("totally-unknown", AbortPolicy::AbortDependents);
+        assert!(aborted.is_empty());
+    }
+
+    #[test]
+    fn cascade_abort_continue_running_started_descendant_survives() {
+        let mut map = PendingRequestMap::new();
+        register_call(&mut map, "r1", None);
+        register_call(&mut map, "r1-a", Some("r1"));
+        map.mark_started("r1-a");
+
+        let mut cascade = AbortCascade::new(&mut map);
+        let aborted = cascade.cascade_abort("r1", AbortPolicy::ContinueRunning);
+        assert!(aborted.is_empty());
+        assert!(cascade.pending.contains("r1-a"));
+    }
+
+    #[test]
+    fn cascade_abort_handles_call_error_unused() {
+        let _ = CallError::internal("unused");
+    }
+}

crates/alknet-call/src/protocol/mod.rs

@@ -0,0 +1,18 @@
+//! Call protocol: wire format, streams, and the call adapter.
+//!
+//! Implements `ProtocolHandler` for ALPN `alknet/call` on top of the
+//! operation registry. See `docs/architecture/crates/call/call-protocol.md`
+//! for the full specification.
+
+pub mod abort;
+pub mod adapter;
+pub mod connection;
+pub mod dispatch;
+pub mod pending;
+pub mod wire;
+
+#[cfg(test)]
+mod test_support;
+
+#[cfg(test)]
+pub(crate) use test_support::sink_empty_connection;

crates/alknet-call/src/protocol/pending.rs

@@ -0,0 +1,584 @@
+use std::collections::HashMap;
+use std::time::Instant;
+
+use serde_json::Value;
+use tokio::sync::{mpsc, oneshot};
+
+use crate::protocol::wire::CallError;
+
+const SUBSCRIBE_CHANNEL_CAPACITY: usize = 32;
+
+pub struct PendingRequestMap {
+    pending: HashMap<String, PendingEntry>,
+}
+
+pub(crate) enum PendingEntry {
+    Call {
+        tx: oneshot::Sender<Result<Value, CallError>>,
+        timeout: Instant,
+        parent_request_id: Option<String>,
+        started: bool,
+    },
+    Subscribe {
+        tx: mpsc::Sender<Result<Value, CallError>>,
+        timeout: Option<Instant>,
+        parent_request_id: Option<String>,
+        started: bool,
+    },
+}
+
+impl PendingEntry {
+    pub(crate) fn parent_request_id(&self) -> Option<&str> {
+        match self {
+            PendingEntry::Call {
+                parent_request_id, ..
+            } => parent_request_id.as_deref(),
+            PendingEntry::Subscribe {
+                parent_request_id, ..
+            } => parent_request_id.as_deref(),
+        }
+    }
+
+    pub(crate) fn started(&self) -> bool {
+        match self {
+            PendingEntry::Call { started, .. } => *started,
+            PendingEntry::Subscribe { started, .. } => *started,
+        }
+    }
+}
+
+impl PendingRequestMap {
+    pub fn new() -> Self {
+        Self {
+            pending: HashMap::new(),
+        }
+    }
+
+    pub fn register_call(
+        &mut self,
+        request_id: String,
+        timeout: Instant,
+        parent_request_id: Option<String>,
+    ) -> oneshot::Receiver<Result<Value, CallError>> {
+        let (tx, rx) = oneshot::channel();
+        self.pending.insert(
+            request_id,
+            PendingEntry::Call {
+                tx,
+                timeout,
+                parent_request_id,
+                started: false,
+            },
+        );
+        rx
+    }
+
+    pub fn register_subscribe(
+        &mut self,
+        request_id: String,
+        timeout: Option<Instant>,
+        parent_request_id: Option<String>,
+    ) -> mpsc::Receiver<Result<Value, CallError>> {
+        let (tx, rx) = mpsc::channel(SUBSCRIBE_CHANNEL_CAPACITY);
+        self.pending.insert(
+            request_id,
+            PendingEntry::Subscribe {
+                tx,
+                timeout,
+                parent_request_id,
+                started: false,
+            },
+        );
+        rx
+    }
+
+    pub fn mark_started(&mut self, request_id: &str) -> bool {
+        let Some(entry) = self.pending.get_mut(request_id) else {
+            return false;
+        };
+        match entry {
+            PendingEntry::Call { started, .. } => *started = true,
+            PendingEntry::Subscribe { started, .. } => *started = true,
+        }
+        true
+    }
+
+    pub fn handle_responded(&mut self, request_id: &str, output: Value) -> bool {
+        let Some(entry) = self.pending.remove(request_id) else {
+            return false;
+        };
+        match entry {
+            PendingEntry::Call { tx, .. } => {
+                let _ = tx.send(Ok(output));
+                true
+            }
+            PendingEntry::Subscribe {
+                tx,
+                timeout,
+                parent_request_id,
+                started,
+            } => {
+                let send_result = tx.try_send(Ok(output));
+                match send_result {
+                    Ok(()) => {
+                        self.pending.insert(
+                            request_id.to_string(),
+                            PendingEntry::Subscribe {
+                                tx,
+                                timeout,
+                                parent_request_id,
+                                started,
+                            },
+                        );
+                        true
+                    }
+                    Err(mpsc::error::TrySendError::Full(_)) => {
+                        tracing::warn!(
+                            request_id,
+                            "subscribe channel full; dropping entry and closing subscription"
+                        );
+                        true
+                    }
+                    Err(mpsc::error::TrySendError::Closed(_)) => true,
+                }
+            }
+        }
+    }
+
+    pub fn handle_completed(&mut self, request_id: &str) -> bool {
+        self.pending.remove(request_id).is_some()
+    }
+
+    pub fn handle_aborted(&mut self, request_id: &str) -> bool {
+        self.pending.remove(request_id).is_some()
+    }
+
+    pub fn handle_error(&mut self, request_id: &str, error: CallError) -> bool {
+        let Some(entry) = self.pending.remove(request_id) else {
+            return false;
+        };
+        match entry {
+            PendingEntry::Call { tx, .. } => {
+                let _ = tx.send(Err(error));
+                true
+            }
+            PendingEntry::Subscribe { tx, .. } => {
+                let _ = tx.try_send(Err(error));
+                true
+            }
+        }
+    }
+
+    pub fn evict_expired(&mut self) -> Vec<String> {
+        let now = Instant::now();
+        let mut evicted = Vec::new();
+        let mut to_remove: Vec<String> = Vec::new();
+        for (id, entry) in self.pending.iter() {
+            let expired = match entry {
+                PendingEntry::Call { timeout, .. } => *timeout <= now,
+                PendingEntry::Subscribe {
+                    timeout: Some(t), ..
+                } => *t <= now,
+                PendingEntry::Subscribe { timeout: None, .. } => false,
+            };
+            if expired {
+                to_remove.push(id.clone());
+            }
+        }
+        for id in to_remove {
+            let Some(entry) = self.pending.remove(&id) else {
+                continue;
+            };
+            let timeout_err = CallError::timeout("request timed out");
+            match entry {
+                PendingEntry::Call { tx, .. } => {
+                    let _ = tx.send(Err(timeout_err));
+                }
+                PendingEntry::Subscribe { tx, .. } => {
+                    let _ = tx.try_send(Err(timeout_err));
+                }
+            }
+            evicted.push(id);
+        }
+        evicted
+    }
+
+    pub fn fail_all(&mut self, error: CallError) -> Vec<String> {
+        let ids: Vec<String> = self.pending.keys().cloned().collect();
+        for id in &ids {
+            if let Some(entry) = self.pending.remove(id) {
+                match entry {
+                    PendingEntry::Call { tx, .. } => {
+                        let _ = tx.send(Err(error.clone()));
+                    }
+                    PendingEntry::Subscribe { tx, .. } => {
+                        let _ = tx.try_send(Err(error.clone()));
+                    }
+                }
+            }
+        }
+        ids
+    }
+
+    pub fn contains(&self, request_id: &str) -> bool {
+        self.pending.contains_key(request_id)
+    }
+
+    pub(crate) fn parent_of(&self, request_id: &str) -> Option<Option<String>> {
+        self.pending
+            .get(request_id)
+            .map(|e| e.parent_request_id().map(|s| s.to_string()))
+    }
+
+    pub(crate) fn is_started(&self, request_id: &str) -> Option<bool> {
+        self.pending.get(request_id).map(|e| e.started())
+    }
+
+    pub(crate) fn request_ids(&self) -> Vec<String> {
+        self.pending.keys().cloned().collect()
+    }
+
+    pub fn len(&self) -> usize {
+        self.pending.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.pending.is_empty()
+    }
+}
+
+impl Default for PendingRequestMap {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use std::time::Duration;
+    use tokio::time::timeout;
+
+    fn timeout_error() -> CallError {
+        CallError::timeout("request timed out")
+    }
+
+    fn internal_error(message: &str) -> CallError {
+        CallError::internal(message)
+    }
+
+    #[tokio::test]
+    async fn register_call_then_handle_responded_resolves_oneshot() {
+        let mut map = PendingRequestMap::new();
+        let rx = map.register_call(
+            "req-1".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+
+        assert!(map.contains("req-1"));
+        assert_eq!(map.len(), 1);
+
+        assert!(map.handle_responded("req-1", json!(42)));
+
+        let result = timeout(Duration::from_millis(100), rx).await;
+        match result {
+            Ok(Ok(Ok(value))) => assert_eq!(value, json!(42)),
+            other => panic!("expected Ok(42), got {other:?}"),
+        }
+        assert!(!map.contains("req-1"));
+        assert_eq!(map.len(), 0);
+    }
+
+    #[tokio::test]
+    async fn register_subscribe_then_handle_responded_pushes_to_channel() {
+        let mut map = PendingRequestMap::new();
+        let mut rx = map.register_subscribe("sub-1".to_string(), None, None);
+
+        assert!(map.handle_responded("sub-1", json!("first")));
+        assert!(map.handle_responded("sub-1", json!("second")));
+        assert!(map.contains("sub-1"));
+
+        let first = timeout(Duration::from_millis(100), rx.recv()).await;
+        let second = timeout(Duration::from_millis(100), rx.recv()).await;
+        match (first, second) {
+            (Ok(Some(Ok(a))), Ok(Some(Ok(b)))) => {
+                assert_eq!(a, json!("first"));
+                assert_eq!(b, json!("second"));
+            }
+            other => panic!("expected two Ok values, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn subscribe_handle_completed_closes_channel_and_deletes_entry() {
+        let mut map = PendingRequestMap::new();
+        let mut rx = map.register_subscribe("sub-2".to_string(), None, None);
+
+        assert!(map.handle_responded("sub-2", json!("a")));
+        assert!(map.handle_completed("sub-2"));
+        assert!(!map.contains("sub-2"));
+
+        let _ = timeout(Duration::from_millis(100), rx.recv()).await;
+        let after_close = timeout(Duration::from_millis(100), rx.recv()).await;
+        match after_close {
+            Ok(None) => {}
+            other => panic!("expected channel closed (None), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn expired_call_is_evicted_with_timeout_error() {
+        let mut map = PendingRequestMap::new();
+        let rx = map.register_call(
+            "req-2".to_string(),
+            Instant::now() - Duration::from_millis(1),
+            None,
+        );
+
+        let evicted = map.evict_expired();
+        assert_eq!(evicted, vec!["req-2".to_string()]);
+        assert!(!map.contains("req-2"));
+
+        let result = timeout(Duration::from_millis(100), rx).await;
+        match result {
+            Ok(Ok(Err(e))) => {
+                assert_eq!(e.code, "TIMEOUT");
+                assert!(e.retryable);
+            }
+            other => panic!("expected Err(TIMEOUT), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn expired_subscribe_is_evicted_with_timeout_error() {
+        let mut map = PendingRequestMap::new();
+        let mut rx = map.register_subscribe(
+            "sub-3".to_string(),
+            Some(Instant::now() - Duration::from_millis(1)),
+            None,
+        );
+
+        let evicted = map.evict_expired();
+        assert_eq!(evicted, vec!["sub-3".to_string()]);
+
+        let result = timeout(Duration::from_millis(100), rx.recv()).await;
+        match result {
+            Ok(Some(Err(e))) => {
+                assert_eq!(e.code, "TIMEOUT");
+                assert!(e.retryable);
+            }
+            other => panic!("expected Err(TIMEOUT), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn unbounded_subscribe_is_not_evicted() {
+        let mut map = PendingRequestMap::new();
+        let _rx = map.register_subscribe("sub-4".to_string(), None, None);
+
+        let evicted = map.evict_expired();
+        assert!(evicted.is_empty());
+        assert!(map.contains("sub-4"));
+    }
+
+    #[tokio::test]
+    async fn fail_all_resolves_all_pending_with_internal_error() {
+        let mut map = PendingRequestMap::new();
+        let rx_call = map.register_call(
+            "c-1".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+        let mut rx_sub = map.register_subscribe(
+            "s-1".to_string(),
+            Some(Instant::now() + Duration::from_secs(30)),
+            None,
+        );
+
+        let failed = map.fail_all(internal_error("connection closed"));
+        assert_eq!(failed.len(), 2);
+        assert!(failed.contains(&"c-1".to_string()));
+        assert!(failed.contains(&"s-1".to_string()));
+        assert!(map.is_empty());
+
+        let call_result = timeout(Duration::from_millis(100), rx_call).await;
+        match call_result {
+            Ok(Ok(Err(e))) => {
+                assert_eq!(e.code, "INTERNAL");
+                assert_eq!(e.message, "connection closed");
+            }
+            other => panic!("expected Err(INTERNAL), got {other:?}"),
+        }
+
+        let sub_result = timeout(Duration::from_millis(100), rx_sub.recv()).await;
+        match sub_result {
+            Ok(Some(Err(e))) => {
+                assert_eq!(e.code, "INTERNAL");
+                assert_eq!(e.message, "connection closed");
+            }
+            other => panic!("expected Err(INTERNAL), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn handle_responded_unknown_request_id_returns_false() {
+        let mut map = PendingRequestMap::new();
+        assert!(!map.handle_responded("nonexistent", json!(1)));
+        assert_eq!(map.len(), 0);
+    }
+
+    #[tokio::test]
+    async fn handle_completed_unknown_request_id_returns_false() {
+        let mut map = PendingRequestMap::new();
+        assert!(!map.handle_completed("nonexistent"));
+    }
+
+    #[tokio::test]
+    async fn handle_aborted_unknown_request_id_returns_false() {
+        let mut map = PendingRequestMap::new();
+        assert!(!map.handle_aborted("nonexistent"));
+    }
+
+    #[tokio::test]
+    async fn handle_error_unknown_request_id_returns_false() {
+        let mut map = PendingRequestMap::new();
+        assert!(!map.handle_error("nonexistent", internal_error("x")));
+    }
+
+    #[tokio::test]
+    async fn handle_aborted_cancels_pending_call() {
+        let mut map = PendingRequestMap::new();
+        let rx = map.register_call(
+            "req-3".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+
+        assert!(map.handle_aborted("req-3"));
+        assert!(!map.contains("req-3"));
+
+        let result = timeout(Duration::from_millis(100), rx).await;
+        match result {
+            Ok(Err(_)) => {}
+            other => panic!("expected sender dropped (Err), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn handle_error_resolves_call_with_error() {
+        let mut map = PendingRequestMap::new();
+        let rx = map.register_call(
+            "req-4".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+
+        let err = CallError::new("FILE_NOT_FOUND", "missing", false);
+        assert!(map.handle_error("req-4", err.clone()));
+        assert!(!map.contains("req-4"));
+
+        let result = timeout(Duration::from_millis(100), rx).await;
+        match result {
+            Ok(Ok(Err(e))) => {
+                assert_eq!(e.code, "FILE_NOT_FOUND");
+                assert!(!e.retryable);
+            }
+            other => panic!("expected Err(FILE_NOT_FOUND), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn handle_error_pushes_to_subscribe_channel() {
+        let mut map = PendingRequestMap::new();
+        let mut rx = map.register_subscribe("sub-5".to_string(), None, None);
+
+        let err = CallError::new("RATE_LIMITED", "too fast", true);
+        assert!(map.handle_error("sub-5", err.clone()));
+        assert!(!map.contains("sub-5"));
+
+        let result = timeout(Duration::from_millis(100), rx.recv()).await;
+        match result {
+            Ok(Some(Err(e))) => {
+                assert_eq!(e.code, "RATE_LIMITED");
+                assert!(e.retryable);
+            }
+            other => panic!("expected Err(RATE_LIMITED), got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn correlation_by_id_not_by_stream() {
+        let mut map = PendingRequestMap::new();
+        let rx = map.register_call(
+            "req-stream-3".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+
+        assert!(map.handle_responded("req-stream-3", json!("response-from-stream-7")));
+        let result = timeout(Duration::from_millis(100), rx).await;
+        match result {
+            Ok(Ok(Ok(value))) => assert_eq!(value, json!("response-from-stream-7")),
+            other => panic!("expected Ok, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn register_call_overwrites_existing_entry() {
+        let mut map = PendingRequestMap::new();
+        let _rx_old = map.register_call(
+            "req-5".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+        let rx_new = map.register_call(
+            "req-5".to_string(),
+            Instant::now() + Duration::from_secs(30),
+            None,
+        );
+        assert_eq!(map.len(), 1);
+
+        assert!(map.handle_responded("req-5", json!("new")));
+        let result = timeout(Duration::from_millis(100), rx_new).await;
+        match result {
+            Ok(Ok(Ok(value))) => assert_eq!(value, json!("new")),
+            other => panic!("expected Ok from new receiver, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn evict_expired_skips_non_expired_entries() {
+        let mut map = PendingRequestMap::new();
+        let _rx_expired = map.register_call(
+            "expired".to_string(),
+            Instant::now() - Duration::from_millis(1),
+            None,
+        );
+        let _rx_alive = map.register_call(
+            "alive".to_string(),
+            Instant::now() + Duration::from_secs(60),
+            None,
+        );
+
+        let evicted = map.evict_expired();
+        assert_eq!(evicted, vec!["expired".to_string()]);
+        assert!(map.contains("alive"));
+        assert!(!map.contains("expired"));
+    }
+
+    #[tokio::test]
+    async fn default_is_empty_map() {
+        let map = PendingRequestMap::default();
+        assert!(map.is_empty());
+        assert_eq!(map.len(), 0);
+    }
+
+    #[tokio::test]
+    async fn timeout_error_helper() {
+        let err = timeout_error();
+        assert_eq!(err.code, "TIMEOUT");
+        assert!(err.retryable);
+    }
+}

crates/alknet-call/src/protocol/test_support.rs

@@ -0,0 +1,66 @@
+//! Shared test helpers for the call protocol's inline `#[cfg(test)]`
+//! modules. Kept here (not in each test module) so the `stub_connection()`
+//! shape is defined once — `Connection::from_stream` was removed (ADR-092)
+//! and every test stub that previously called it now calls
+//! `Connection::from_bidi(SinkEmpty, ...)` via `sink_empty_connection()`.
+
+use std::net::{IpAddr, Ipv4Addr, SocketAddr};
+use std::pin::Pin;
+use std::task::{Context, Poll};
+
+use alknet_core::types::Connection;
+use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
+
+/// A test-only `AsyncRead + AsyncWrite` pair equivalent to
+/// `tokio::io::sink() + tokio::io::empty()`: reads yield EOF immediately
+/// (zero bytes), writes discard. Exists because `Connection::from_bidi`
+/// (ADR-092 — the only public stream constructor, replacing
+/// `from_stream`) requires a single value that implements both traits.
+/// Used only to construct a `Connection` for tests that exercise
+/// `Connection`-level state (alpn, addr, identity, dispatcher run loop
+/// with an immediately-closed accept stream) without ever reading or
+/// writing real bytes.
+pub(crate) struct SinkEmpty;
+
+impl AsyncRead for SinkEmpty {
+    fn poll_read(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        _buf: &mut ReadBuf<'_>,
+    ) -> Poll<std::io::Result<()>> {
+        // EOF immediately — mirrors `tokio::io::empty()`.
+        Poll::Ready(Ok(()))
+    }
+}
+
+impl AsyncWrite for SinkEmpty {
+    fn poll_write(
+        self: Pin<&mut Self>,
+        _cx: &mut Context<'_>,
+        buf: &[u8],
+    ) -> Poll<std::io::Result<usize>> {
+        // Discard — mirrors `tokio::io::sink()`.
+        Poll::Ready(Ok(buf.len()))
+    }
+
+    fn poll_flush(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+
+    fn poll_shutdown(self: Pin<&mut Self>, _cx: &mut Context<'_>) -> Poll<std::io::Result<()>> {
+        Poll::Ready(Ok(()))
+    }
+}
+
+/// Construct a `Connection` whose `accept_bi` yields a `SinkEmpty` once,
+/// then `ConnectionClosed`. Used by tests that need a `Connection` for
+/// `CallConnection::new(conn)` or `adapter.handle(conn, &auth)` without
+/// exercising the wire protocol — `SinkEmpty` reads EOF (so the dispatch
+/// loop closes immediately) and discards writes.
+pub(crate) fn sink_empty_connection() -> Connection {
+    Connection::from_bidi(
+        SinkEmpty,
+        b"alknet/call".to_vec(),
+        Some(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 4321)),
+    )
+}

crates/alknet-call/src/protocol/wire.rs

@@ -0,0 +1,548 @@
+//! Wire format: `EventEnvelope`, `ResponseEnvelope`, `CallError`, and
+//! length-prefixed JSON framing.
+//!
+//! See `docs/architecture/crates/call/call-protocol.md` for the full
+//! specification.
+
+use std::io;
+
+use serde::{Deserialize, Serialize};
+use serde_json::Value;
+use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
+
+pub const EVENT_REQUESTED: &str = "call.requested";
+pub const EVENT_RESPONDED: &str = "call.responded";
+pub const EVENT_COMPLETED: &str = "call.completed";
+pub const EVENT_ABORTED: &str = "call.aborted";
+pub const EVENT_ERROR: &str = "call.error";
+
+const LENGTH_PREFIX_BYTES: usize = 4;
+const MAX_FRAME_SIZE: u32 = 64 * 1024 * 1024;
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct EventEnvelope {
+    #[serde(rename = "type")]
+    pub r#type: String,
+    pub id: String,
+    pub payload: Value,
+}
+
+impl EventEnvelope {
+    pub fn new(event_type: impl Into<String>, id: impl Into<String>, payload: Value) -> Self {
+        Self {
+            r#type: event_type.into(),
+            id: id.into(),
+            payload,
+        }
+    }
+
+    pub fn requested(id: impl Into<String>, payload: Value) -> Self {
+        Self::new(EVENT_REQUESTED, id, payload)
+    }
+
+    pub fn responded(id: impl Into<String>, output: Value) -> Self {
+        Self::new(EVENT_RESPONDED, id, serde_json::json!({ "output": output }))
+    }
+
+    pub fn completed(id: impl Into<String>) -> Self {
+        Self::new(EVENT_COMPLETED, id, serde_json::json!({}))
+    }
+
+    pub fn aborted(id: impl Into<String>) -> Self {
+        Self::new(EVENT_ABORTED, id, serde_json::json!({}))
+    }
+
+    pub fn error(id: impl Into<String>, error: &CallError) -> Self {
+        let payload = serde_json::to_value(error).unwrap_or(Value::Null);
+        Self::new(EVENT_ERROR, id, payload)
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct CallError {
+    pub code: String,
+    pub message: String,
+    pub retryable: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub details: Option<Value>,
+}
+
+impl CallError {
+    pub fn new(code: impl Into<String>, message: impl Into<String>, retryable: bool) -> Self {
+        Self {
+            code: code.into(),
+            message: message.into(),
+            retryable,
+            details: None,
+        }
+    }
+
+    pub fn with_details(mut self, details: Value) -> Self {
+        self.details = Some(details);
+        self
+    }
+
+    pub fn not_found(op_name: &str) -> Self {
+        Self::new(
+            "NOT_FOUND",
+            format!("operation not found: {op_name}"),
+            false,
+        )
+    }
+
+    pub fn forbidden(message: impl Into<String>) -> Self {
+        Self::new("FORBIDDEN", message, false)
+    }
+
+    pub fn invalid_input(message: impl Into<String>) -> Self {
+        Self::new("INVALID_INPUT", message, false)
+    }
+
+    pub fn internal(message: impl Into<String>) -> Self {
+        Self::new("INTERNAL", message, false)
+    }
+
+    pub fn timeout(message: impl Into<String>) -> Self {
+        Self::new("TIMEOUT", message, true)
+    }
+
+    pub fn invalid_operation_type(message: impl Into<String>) -> Self {
+        Self::new("INVALID_OPERATION_TYPE", message, false)
+    }
+}
+
+impl Eq for CallError {}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct ResponseEnvelope {
+    pub request_id: String,
+    pub result: Result<Value, CallError>,
+}
+
+impl ResponseEnvelope {
+    pub fn ok(request_id: impl Into<String>, output: Value) -> Self {
+        Self {
+            request_id: request_id.into(),
+            result: Ok(output),
+        }
+    }
+
+    pub fn error(request_id: impl Into<String>, error: CallError) -> Self {
+        Self {
+            request_id: request_id.into(),
+            result: Err(error),
+        }
+    }
+
+    pub fn not_found(request_id: impl Into<String>, op_name: &str) -> Self {
+        Self::error(request_id, CallError::not_found(op_name))
+    }
+
+    pub fn forbidden(request_id: impl Into<String>, message: impl Into<String>) -> Self {
+        Self::error(request_id, CallError::forbidden(message))
+    }
+
+    pub fn into_event(self) -> EventEnvelope {
+        let id = self.request_id;
+        match self.result {
+            Ok(output) => EventEnvelope::responded(id, output),
+            Err(ref err) => EventEnvelope::error(id, err),
+        }
+    }
+}
+
+impl From<ResponseEnvelope> for EventEnvelope {
+    fn from(envelope: ResponseEnvelope) -> EventEnvelope {
+        envelope.into_event()
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum FrameError {
+    #[error("io error: {0}")]
+    Io(#[from] io::Error),
+    #[error("json error: {0}")]
+    Json(#[from] serde_json::Error),
+    #[error("connection closed")]
+    ConnectionClosed,
+    #[error("invalid frame")]
+    InvalidFrame,
+}
+
+pub struct FrameFramedReader<R: AsyncRead + Unpin> {
+    reader: R,
+    len_buf: [u8; LENGTH_PREFIX_BYTES],
+}
+
+impl<R: AsyncRead + Unpin> FrameFramedReader<R> {
+    pub fn new(reader: R) -> Self {
+        Self {
+            reader,
+            len_buf: [0u8; LENGTH_PREFIX_BYTES],
+        }
+    }
+
+    pub fn into_inner(self) -> R {
+        self.reader
+    }
+
+    pub async fn read_frame(&mut self) -> Result<EventEnvelope, FrameError> {
+        match self.reader.read_exact(&mut self.len_buf).await {
+            Ok(_) => {}
+            Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => {
+                return Err(FrameError::ConnectionClosed);
+            }
+            Err(e) => return Err(FrameError::Io(e)),
+        }
+
+        let length = u32::from_be_bytes(self.len_buf);
+        if length == 0 {
+            return Err(FrameError::InvalidFrame);
+        }
+        if length > MAX_FRAME_SIZE {
+            return Err(FrameError::InvalidFrame);
+        }
+
+        let mut body = vec![0u8; length as usize];
+        match self.reader.read_exact(&mut body).await {
+            Ok(_) => {}
+            Err(e) if e.kind() == io::ErrorKind::UnexpectedEof => {
+                return Err(FrameError::ConnectionClosed);
+            }
+            Err(e) => return Err(FrameError::Io(e)),
+        }
+
+        let envelope: EventEnvelope = serde_json::from_slice(&body)?;
+        Ok(envelope)
+    }
+}
+
+pub struct FrameFramedWriter<W: AsyncWrite + Unpin> {
+    writer: W,
+}
+
+impl<W: AsyncWrite + Unpin> FrameFramedWriter<W> {
+    pub fn new(writer: W) -> Self {
+        Self { writer }
+    }
+
+    pub fn into_inner(self) -> W {
+        self.writer
+    }
+
+    pub async fn write_frame(&mut self, envelope: &EventEnvelope) -> Result<(), FrameError> {
+        let body = serde_json::to_vec(envelope)?;
+        let len = body.len();
+        if len > MAX_FRAME_SIZE as usize {
+            return Err(FrameError::InvalidFrame);
+        }
+        let len_bytes = (len as u32).to_be_bytes();
+        self.writer.write_all(&len_bytes).await?;
+        self.writer.write_all(&body).await?;
+        self.writer.flush().await?;
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tokio::io::{duplex, AsyncReadExt};
+
+    fn sample_envelope() -> EventEnvelope {
+        EventEnvelope::new(
+            "call.requested",
+            "req-1",
+            serde_json::json!({
+                "operationId": "/fs/readFile",
+                "input": { "path": "/etc/hosts" }
+            }),
+        )
+    }
+
+    #[tokio::test]
+    async fn round_trip_envelope() {
+        let (client, server) = duplex(8 * 1024);
+        let envelope = sample_envelope();
+
+        let mut writer = FrameFramedWriter::new(client);
+        writer.write_frame(&envelope).await.unwrap();
+        drop(writer);
+
+        let mut reader = FrameFramedReader::new(server);
+        let read = reader.read_frame().await.unwrap();
+        assert_eq!(read, envelope);
+    }
+
+    #[tokio::test]
+    async fn round_trip_multiple_frames() {
+        let (client, server) = duplex(8 * 1024);
+
+        let envelopes = vec![
+            EventEnvelope::responded("a", Value::String("hello".into())),
+            EventEnvelope::completed("a"),
+            EventEnvelope::aborted("b"),
+        ];
+
+        {
+            let mut writer = FrameFramedWriter::new(client);
+            for e in &envelopes {
+                writer.write_frame(e).await.unwrap();
+            }
+        }
+
+        let mut reader = FrameFramedReader::new(server);
+        for expected in envelopes {
+            let read = reader.read_frame().await.unwrap();
+            assert_eq!(read, expected);
+        }
+    }
+
+    #[tokio::test]
+    async fn read_frame_on_closed_reader_returns_connection_closed() {
+        let (_, server) = duplex(8 * 1024);
+        let mut reader = FrameFramedReader::new(server);
+        match reader.read_frame().await {
+            Err(FrameError::ConnectionClosed) => {}
+            other => panic!("expected ConnectionClosed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn truncated_body_returns_connection_closed() {
+        let (mut client, server) = duplex(8 * 1024);
+        let envelope = sample_envelope();
+        let body = serde_json::to_vec(&envelope).unwrap();
+        let len_bytes = (body.len() as u32).to_be_bytes();
+        client.write_all(&len_bytes).await.unwrap();
+        client.write_all(&body[..body.len() / 2]).await.unwrap();
+        drop(client);
+
+        let mut reader = FrameFramedReader::new(server);
+        match reader.read_frame().await {
+            Err(FrameError::ConnectionClosed) => {}
+            other => panic!("expected ConnectionClosed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn zero_length_frame_is_invalid() {
+        let (mut client, server) = duplex(8 * 1024);
+        client.write_all(&[0u8, 0, 0, 0]).await.unwrap();
+        drop(client);
+
+        let mut reader = FrameFramedReader::new(server);
+        match reader.read_frame().await {
+            Err(FrameError::InvalidFrame) => {}
+            other => panic!("expected InvalidFrame, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn oversized_frame_is_invalid() {
+        let (mut client, server) = duplex(8 * 1024);
+        let too_big = (MAX_FRAME_SIZE + 1u32).to_be_bytes();
+        client.write_all(&too_big).await.unwrap();
+        drop(client);
+
+        let mut reader = FrameFramedReader::new(server);
+        match reader.read_frame().await {
+            Err(FrameError::InvalidFrame) => {}
+            other => panic!("expected InvalidFrame, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn framing_handles_large_payload() {
+        let (client, server) = duplex(1024 * 1024);
+        let big = "x".repeat(64 * 1024);
+        let envelope = EventEnvelope::responded("big", Value::String(big.clone()));
+
+        let mut writer = FrameFramedWriter::new(client);
+        writer.write_frame(&envelope).await.unwrap();
+        drop(writer);
+
+        let mut reader = FrameFramedReader::new(server);
+        let read = reader.read_frame().await.unwrap();
+        assert_eq!(read, envelope);
+        match read.payload {
+            Value::Object(map) => match map.get("output") {
+                Some(Value::String(s)) => assert_eq!(s, &big),
+                other => panic!("expected output string, got {other:?}"),
+            },
+            other => panic!("expected object payload, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn response_envelope_ok_produces_call_responded_event() {
+        let response = ResponseEnvelope::ok("req-1", Value::String("hi".into()));
+        let event: EventEnvelope = response.into();
+        assert_eq!(event.r#type, EVENT_RESPONDED);
+        assert_eq!(event.id, "req-1");
+        let map = event.payload.as_object().expect("payload is object");
+        assert_eq!(map.get("output"), Some(&Value::String("hi".into())));
+    }
+
+    #[test]
+    fn response_envelope_error_produces_call_error_event() {
+        let err = CallError::new("FILE_NOT_FOUND", "file not found: /etc/x", false)
+            .with_details(serde_json::json!({ "path": "/etc/x" }));
+        let response = ResponseEnvelope::error("req-2", err);
+        let event: EventEnvelope = response.into();
+        assert_eq!(event.r#type, EVENT_ERROR);
+        assert_eq!(event.id, "req-2");
+        assert_eq!(
+            event.payload.get("code"),
+            Some(&Value::String("FILE_NOT_FOUND".into()))
+        );
+        assert_eq!(
+            event.payload.get("message"),
+            Some(&Value::String("file not found: /etc/x".into()))
+        );
+        assert_eq!(event.payload.get("retryable"), Some(&Value::Bool(false)));
+        assert_eq!(
+            event.payload.get("details"),
+            Some(&serde_json::json!({ "path": "/etc/x" }))
+        );
+    }
+
+    #[test]
+    fn response_envelope_not_found_helper() {
+        let response = ResponseEnvelope::not_found("req-3", "fs/missing");
+        assert_eq!(response.request_id, "req-3");
+        match &response.result {
+            Err(e) => {
+                assert_eq!(e.code, "NOT_FOUND");
+                assert!(!e.retryable);
+                assert!(e.message.contains("fs/missing"));
+            }
+            other => panic!("expected Err, got {other:?}"),
+        }
+        let event: EventEnvelope = response.into();
+        assert_eq!(event.r#type, EVENT_ERROR);
+        assert_eq!(event.id, "req-3");
+        assert_eq!(
+            event.payload.get("code"),
+            Some(&Value::String("NOT_FOUND".into()))
+        );
+    }
+
+    #[test]
+    fn response_envelope_forbidden_helper() {
+        let response = ResponseEnvelope::forbidden("req-4", "authentication required");
+        match &response.result {
+            Err(e) => {
+                assert_eq!(e.code, "FORBIDDEN");
+                assert_eq!(e.message, "authentication required");
+            }
+            other => panic!("expected Err, got {other:?}"),
+        }
+        let event: EventEnvelope = response.into();
+        assert_eq!(event.r#type, EVENT_ERROR);
+        assert_eq!(event.id, "req-4");
+    }
+
+    #[test]
+    fn event_envelope_completed_has_empty_payload() {
+        let event = EventEnvelope::completed("sub-1");
+        assert_eq!(event.r#type, EVENT_COMPLETED);
+        assert_eq!(event.id, "sub-1");
+        assert_eq!(event.payload, serde_json::json!({}));
+    }
+
+    #[test]
+    fn event_envelope_aborted_has_empty_payload() {
+        let event = EventEnvelope::aborted("req-9");
+        assert_eq!(event.r#type, EVENT_ABORTED);
+        assert_eq!(event.id, "req-9");
+        assert_eq!(event.payload, serde_json::json!({}));
+    }
+
+    #[test]
+    fn event_envelope_responded_wraps_output() {
+        let event = EventEnvelope::responded("req-1", Value::Number(42.into()));
+        assert_eq!(event.r#type, EVENT_RESPONDED);
+        assert_eq!(event.payload.get("output"), Some(&Value::Number(42.into())));
+    }
+
+    #[test]
+    fn event_envelope_serializes_type_field() {
+        let event = sample_envelope();
+        let json = serde_json::to_string(&event).unwrap();
+        assert!(json.contains("\"type\":\"call.requested\""));
+        assert!(!json.contains("\"r#type\""));
+
+        let parsed: EventEnvelope = serde_json::from_str(&json).unwrap();
+        assert_eq!(parsed, event);
+    }
+
+    #[test]
+    fn call_error_skips_missing_details() {
+        let err = CallError::new("INTERNAL", "boom", false);
+        let json = serde_json::to_string(&err).unwrap();
+        assert!(!json.contains("details"));
+    }
+
+    #[tokio::test]
+    async fn read_after_eof_then_eof_returns_connection_closed() {
+        let mut data = Vec::new();
+        let envelope = EventEnvelope::responded("one", Value::Null);
+        let body = serde_json::to_vec(&envelope).unwrap();
+        data.extend_from_slice(&(body.len() as u32).to_be_bytes());
+        data.extend_from_slice(&body);
+        let cursor = std::io::Cursor::new(data);
+        let mut reader = FrameFramedReader::new(cursor);
+        let first = reader.read_frame().await.unwrap();
+        assert_eq!(first, envelope);
+        match reader.read_frame().await {
+            Err(FrameError::ConnectionClosed) => {}
+            other => panic!("expected ConnectionClosed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn writer_into_inner_recovers_stream() {
+        let (client, server) = duplex(8 * 1024);
+        let envelope = sample_envelope();
+        let mut writer = FrameFramedWriter::new(client);
+        writer.write_frame(&envelope).await.unwrap();
+        let mut recovered = writer.into_inner();
+        recovered.shutdown().await.unwrap();
+        drop(recovered);
+
+        let mut reader = FrameFramedReader::new(server);
+        let read = reader.read_frame().await.unwrap();
+        assert_eq!(read, envelope);
+        let _ = reader.into_inner();
+    }
+
+    #[tokio::test]
+    async fn reader_handles_partial_length_prefix() {
+        let (mut client, server) = duplex(8 * 1024);
+        client.write_all(&[0u8, 0]).await.unwrap();
+        drop(client);
+        let mut reader = FrameFramedReader::new(server);
+        match reader.read_frame().await {
+            Err(FrameError::ConnectionClosed) => {}
+            other => panic!("expected ConnectionClosed, got {other:?}"),
+        }
+    }
+
+    #[tokio::test]
+    async fn reader_drains_remaining_after_read() {
+        let mut data = Vec::new();
+        let envelope = sample_envelope();
+        let body = serde_json::to_vec(&envelope).unwrap();
+        data.extend_from_slice(&(body.len() as u32).to_be_bytes());
+        data.extend_from_slice(&body);
+        data.extend_from_slice(&[9u8; 4]);
+        let mut cursor = tokio::io::BufReader::new(std::io::Cursor::new(data));
+        let mut reader = FrameFramedReader::new(&mut cursor);
+        let read = reader.read_frame().await.unwrap();
+        assert_eq!(read, envelope);
+        let mut leftover = Vec::new();
+        let _ = cursor.read_to_end(&mut leftover).await.unwrap();
+        assert_eq!(leftover, vec![9u8; 4]);
+    }
+}

crates/alknet-call/src/registry/context.rs

@@ -0,0 +1,313 @@
+use std::collections::{HashMap, HashSet};
+use std::sync::Arc;
+use std::time::Instant;
+
+use alknet_core::auth::Identity;
+use alknet_core::ownership::OwnershipProvider;
+use alknet_core::types::Capabilities;
+use serde_json::Value;
+
+use super::env::{OperationEnv, PeerId, PeerRef};
+
+pub struct OperationContext {
+    pub request_id: String,
+    pub parent_request_id: Option<String>,
+    pub identity: Option<Identity>,
+    pub handler_identity: Option<CompositionAuthority>,
+    /// The original caller when this call was forwarded by a `from_call`
+    /// handler (ADR-032). **Metadata only** — `AccessControl::check` never
+    /// reads it; the ACL always authorizes `identity` (the direct caller).
+    /// Handlers may read it for logging, auditing, per-user rate limiting,
+    /// or application context. Populated from
+    /// `call.requested.forwarded_for` by the dispatch path; set to `None`
+    /// for composed children (wire-ingress only, not composition-ingress).
+    /// The forwarder's claim, not a verified identity — a malicious hub can
+    /// lie (same property as HTTP `X-Forwarded-For`). See ADR-032.
+    pub forwarded_for: Option<Identity>,
+    pub capabilities: Capabilities,
+    pub metadata: HashMap<String, Value>,
+    pub scoped_env: ScopedPeerEnv,
+    pub env: Arc<dyn OperationEnv + Send + Sync>,
+    pub abort_policy: AbortPolicy,
+    pub deadline: Option<Instant>,
+    pub internal: bool,
+    /// `None` when no ownership provider is wired (backward compat —
+    /// `check` falls back to static `Identity.resources` path). Wired by
+    /// the assembly layer via `CallAdapter`/`Dispatcher` (ADR-050).
+    pub ownership: Option<Arc<dyn OwnershipProvider>>,
+}
+
+impl OperationContext {
+    pub fn is_internal(&self) -> bool {
+        self.internal
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
+pub enum AbortPolicy {
+    #[default]
+    AbortDependents,
+    ContinueRunning,
+}
+
+#[derive(Debug, Clone)]
+pub struct CompositionAuthority {
+    pub label: String,
+    pub scopes: Vec<String>,
+    pub resources: HashMap<String, Vec<String>>,
+}
+
+impl CompositionAuthority {
+    pub fn none() -> Option<Self> {
+        None
+    }
+
+    pub fn new(label: &str, scopes: impl IntoIterator<Item = String>) -> Self {
+        Self {
+            label: label.to_string(),
+            scopes: scopes.into_iter().collect(),
+            resources: HashMap::new(),
+        }
+    }
+
+    pub fn as_identity(&self) -> Option<Identity> {
+        Some(Identity {
+            id: self.label.clone(),
+            scopes: self.scopes.clone(),
+            resources: self.resources.clone(),
+        })
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct ScopedPeerEnv {
+    /// Peer-agnostic reachability — reachable via `PeerRef::Any` or
+    /// `PeerRef::Specific(any)`. The common case (peer-agnostic composition).
+    pub allowed_ops: HashSet<String>,
+    /// Peer-pinned reachability — `"peer-id/op-name"`, reachable only via
+    /// `PeerRef::Specific(that peer)`. Additive to `allowed_ops`; opt-in for
+    /// the disambiguation case (ADR-029 §4).
+    pub peer_pinned: HashSet<String>,
+}
+
+impl ScopedPeerEnv {
+    pub fn empty() -> Self {
+        Self {
+            allowed_ops: HashSet::new(),
+            peer_pinned: HashSet::new(),
+        }
+    }
+
+    pub fn new(ops: impl IntoIterator<Item = impl Into<String>>) -> Self {
+        Self {
+            allowed_ops: ops.into_iter().map(|s| s.into()).collect(),
+            peer_pinned: HashSet::new(),
+        }
+    }
+
+    /// Peer-pinned reachability: `"peer-id/op-name"`. Reachable only via
+    /// `PeerRef::Specific(that peer)`. Additive to `new` — call `new` for the
+    /// peer-agnostic set, then `with_pinned` for the pinned set.
+    pub fn with_pinned(mut self, pinned: impl IntoIterator<Item = impl Into<String>>) -> Self {
+        self.peer_pinned = pinned.into_iter().map(|s| s.into()).collect();
+        self
+    }
+
+    /// Peer-agnostic reachability — unchanged from `ScopedOperationEnv::allows`.
+    /// A name here is reachable via any routing path (`PeerRef::Any` or
+    /// `Specific`).
+    pub fn allows(&self, name: &str) -> bool {
+        self.allowed_ops.contains(name)
+    }
+
+    /// Peer-pinned reachability — reachable only via `PeerRef::Specific(peer)`.
+    /// The entry shape is `"peer-id/op-name"` (ADR-029 §4, OQ-33).
+    pub fn allows_pinned(&self, peer: &PeerId, name: &str) -> bool {
+        self.peer_pinned.contains(&format!("{peer}/{name}"))
+    }
+
+    /// Does this scoped env permit `name` via `peer`? Used by the reachability
+    /// gate in `invoke_peer` / `invoke_with_policy`.
+    /// - `PeerRef::Any` → `allows(name)`
+    /// - `PeerRef::Specific(peer)` → `allows(name) || allows_pinned(peer, name)`
+    pub fn allows_via(&self, peer: &PeerRef, name: &str) -> bool {
+        match peer {
+            PeerRef::Any => self.allows(name),
+            PeerRef::Specific(p) => self.allows(name) || self.allows_pinned(p, name),
+        }
+    }
+}
+
+impl Default for ScopedPeerEnv {
+    fn default() -> Self {
+        Self::empty()
+    }
+}
+
+#[allow(dead_code)]
+pub(crate) fn generate_request_id() -> String {
+    uuid::Uuid::new_v4().to_string()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn scoped_env_allows_in_set() {
+        let env = ScopedPeerEnv::new(["fs/readFile", "agent/chat"]);
+        assert!(env.allows("fs/readFile"));
+        assert!(env.allows("agent/chat"));
+    }
+
+    #[test]
+    fn scoped_env_disallows_not_in_set() {
+        let env = ScopedPeerEnv::new(["fs/readFile"]);
+        assert!(!env.allows("agent/chat"));
+        assert!(!env.allows(""));
+    }
+
+    #[test]
+    fn scoped_env_empty_allows_nothing() {
+        let env = ScopedPeerEnv::empty();
+        assert!(!env.allows("fs/readFile"));
+    }
+
+    #[test]
+    fn scoped_peer_env_new_with_pinned_populates_both_fields() {
+        let env = ScopedPeerEnv::new(["fs/readFile"]).with_pinned(["worker-a/container/exec"]);
+        assert!(env.allowed_ops.contains("fs/readFile"));
+        assert!(env.peer_pinned.contains("worker-a/container/exec"));
+        assert!(!env.allowed_ops.contains("worker-a/container/exec"));
+        assert!(!env.peer_pinned.contains("fs/readFile"));
+    }
+
+    #[test]
+    fn scoped_peer_env_allows_checks_allowed_ops_only() {
+        let env = ScopedPeerEnv::empty().with_pinned(["worker-a/container/exec"]);
+        assert!(
+            !env.allows("container/exec"),
+            "pinned-only op not in allowed_ops"
+        );
+        let env2 = ScopedPeerEnv::new(["container/exec"]).with_pinned(["worker-a/container/exec"]);
+        assert!(
+            env2.allows("container/exec"),
+            "op in allowed_ops is allowed"
+        );
+    }
+
+    #[test]
+    fn scoped_peer_env_allows_pinned_checks_peer_pinned_shape() {
+        let env = ScopedPeerEnv::empty().with_pinned(["worker-a/container/exec"]);
+        assert!(env.allows_pinned(&"worker-a".to_string(), "container/exec"));
+        assert!(
+            !env.allows_pinned(&"worker-b".to_string(), "container/exec"),
+            "wrong peer"
+        );
+        assert!(
+            !env.allows_pinned(&"worker-a".to_string(), "other/op"),
+            "wrong op"
+        );
+    }
+
+    #[test]
+    fn scoped_peer_env_allows_via_any_uses_allowed_ops_only() {
+        let env = ScopedPeerEnv::new(["fs/readFile"]).with_pinned(["worker-a/container/exec"]);
+        assert!(
+            env.allows_via(&PeerRef::Any, "fs/readFile"),
+            "allowed op via Any"
+        );
+        assert!(
+            !env.allows_via(&PeerRef::Any, "container/exec"),
+            "pinned-only op NOT reachable via Any"
+        );
+    }
+
+    #[test]
+    fn scoped_peer_env_allows_via_specific_uses_allowed_ops_or_peer_pinned() {
+        let env = ScopedPeerEnv::new(["fs/readFile"]).with_pinned(["worker-a/container/exec"]);
+        assert!(
+            env.allows_via(&PeerRef::Specific("worker-a".to_string()), "container/exec"),
+            "pinned-only op reachable via Specific(pinned peer)"
+        );
+        assert!(
+            env.allows_via(&PeerRef::Specific("worker-a".to_string()), "fs/readFile"),
+            "allowed op reachable via Specific(any peer)"
+        );
+        assert!(
+            !env.allows_via(&PeerRef::Specific("worker-b".to_string()), "container/exec"),
+            "pinned-only op NOT reachable via Specific(wrong peer)"
+        );
+    }
+
+    #[test]
+    fn scoped_peer_env_op_in_both_sets_reachable_via_both_any_and_specific() {
+        let env = ScopedPeerEnv::new(["container/exec"]).with_pinned(["worker-a/container/exec"]);
+        assert!(
+            env.allows_via(&PeerRef::Any, "container/exec"),
+            "op in allowed_ops reachable via Any"
+        );
+        assert!(
+            env.allows_via(&PeerRef::Specific("worker-a".to_string()), "container/exec"),
+            "op in both sets reachable via Specific(peer)"
+        );
+        assert!(
+            env.allows_via(&PeerRef::Specific("worker-b".to_string()), "container/exec"),
+            "op in allowed_ops reachable via Specific(other peer) too"
+        );
+    }
+
+    #[test]
+    fn composition_authority_as_identity_correct() {
+        let mut resources = HashMap::new();
+        resources.insert("service".to_string(), vec!["vastai".to_string()]);
+        let authority = CompositionAuthority {
+            label: "agent-chat".to_string(),
+            scopes: vec!["llm:call".to_string(), "fs:read".to_string()],
+            resources,
+        };
+        let identity = authority.as_identity().expect("as_identity returns Some");
+        assert_eq!(identity.id, "agent-chat");
+        assert_eq!(
+            identity.scopes,
+            vec!["llm:call".to_string(), "fs:read".to_string()]
+        );
+        assert_eq!(
+            identity.resources.get("service"),
+            Some(&vec!["vastai".to_string()])
+        );
+    }
+
+    #[test]
+    fn composition_authority_new_populates_label_and_scopes() {
+        let authority = CompositionAuthority::new(
+            "agent-chat",
+            ["llm:call".to_string(), "fs:read".to_string()],
+        );
+        assert_eq!(authority.label, "agent-chat");
+        assert_eq!(
+            authority.scopes,
+            vec!["llm:call".to_string(), "fs:read".to_string()]
+        );
+        assert!(authority.resources.is_empty());
+    }
+
+    #[test]
+    fn composition_authority_none_is_none() {
+        assert!(CompositionAuthority::none().is_none());
+    }
+
+    #[test]
+    fn abort_policy_default_is_abort_dependents() {
+        let policy = AbortPolicy::default();
+        assert!(matches!(policy, AbortPolicy::AbortDependents));
+    }
+
+    #[test]
+    fn generate_request_id_is_unique_and_non_deterministic() {
+        let a = generate_request_id();
+        let b = generate_request_id();
+        assert_ne!(a, b);
+        assert!(!a.is_empty());
+    }
+}

crates/alknet-call/src/registry/mod.rs

@@ -0,0 +1,12 @@
+//! Operation registry: specs, handlers, access control, service discovery.
+//!
+//! Maps operation names to specs and handlers, enforces access control, and
+//! dispatches `call.requested` events to local handlers. The registry is
+//! layered by trust boundary (ADR-024): a curated layer (immutable after
+//! startup) plus dynamic session and connection overlays.
+
+pub mod context;
+pub mod discovery;
+pub mod env;
+pub mod registration;
+pub mod spec;

crates/alknet-call/src/registry/spec.rs

@@ -0,0 +1,530 @@
+//! Operation specifications: `OperationSpec`, `OperationType`, `Visibility`,
+//! `ErrorDefinition`, and `AccessControl`.
+//!
+//! See `docs/architecture/crates/call/operation-registry.md` for the full
+//! specification.
+
+use alknet_core::auth::Identity;
+use alknet_core::ownership::OwnershipProvider;
+use serde_json::Value;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum OperationType {
+    Query,
+    Mutation,
+    Subscription,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum Visibility {
+    External,
+    Internal,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ErrorDefinition {
+    pub code: String,
+    pub description: String,
+    pub schema: Value,
+    pub http_status: Option<u16>,
+}
+
+#[derive(Debug, Clone, Default, PartialEq, Eq)]
+pub struct AccessControl {
+    pub required_scopes: Vec<String>,
+    pub required_scopes_any: Option<Vec<String>>,
+    pub resource_type: Option<String>,
+    pub resource_action: Option<String>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AccessResult {
+    Allowed,
+    Forbidden(String),
+}
+
+impl AccessResult {
+    pub fn is_allowed(&self) -> bool {
+        matches!(self, AccessResult::Allowed)
+    }
+}
+
+impl AccessControl {
+    pub fn has_restrictions(&self) -> bool {
+        !self.required_scopes.is_empty()
+            || self.required_scopes_any.is_some()
+            || self.resource_type.is_some()
+            || self.resource_action.is_some()
+    }
+
+    pub fn check(
+        &self,
+        identity: Option<&Identity>,
+        resource_id: Option<&str>,
+        ownership: Option<&dyn OwnershipProvider>,
+    ) -> AccessResult {
+        if !self.has_restrictions() {
+            return AccessResult::Allowed;
+        }
+        let identity = match identity {
+            Some(id) => id,
+            None => return AccessResult::Forbidden("authentication required".to_string()),
+        };
+
+        for scope in &self.required_scopes {
+            if !identity.scopes.iter().any(|s| s == scope) {
+                return AccessResult::Forbidden(format!("missing required scope: {scope}"));
+            }
+        }
+
+        if let Some(any) = &self.required_scopes_any {
+            let has_one = any.iter().any(|s| identity.scopes.iter().any(|i| i == s));
+            if !has_one {
+                return AccessResult::Forbidden(
+                    "missing required scope (any of: ".to_string() + &any.join(", ") + ")",
+                );
+            }
+        }
+
+        if let Some(p) = ownership {
+            if let Some(rt) = &self.resource_type {
+                match resource_id {
+                    Some(rid) => {
+                        let action = self.resource_action.as_deref().unwrap_or("");
+                        if !p.owns(identity, rt, rid, action) {
+                            return AccessResult::Forbidden(format!(
+                                "not owner of resource: {rt}/{rid}"
+                            ));
+                        }
+                    }
+                    None => {
+                        if !p.owns_any(identity, rt) {
+                            return AccessResult::Forbidden(format!(
+                                "no owned resources of type: {rt}"
+                            ));
+                        }
+                    }
+                }
+                return AccessResult::Allowed;
+            }
+        }
+
+        if let Some(rt) = &self.resource_type {
+            let allowed = identity.resources.get(rt);
+            match &self.resource_action {
+                Some(action) => match allowed {
+                    Some(actions) if actions.iter().any(|a| a == action) => {}
+                    _ => {
+                        return AccessResult::Forbidden(format!("missing resource: {rt}/{action}"))
+                    }
+                },
+                None => match allowed {
+                    Some(actions) if !actions.is_empty() => {}
+                    _ => return AccessResult::Forbidden(format!("missing resource: {rt}")),
+                },
+            }
+        } else if let Some(action) = &self.resource_action {
+            let found = identity
+                .resources
+                .values()
+                .any(|actions| actions.iter().any(|a| a == action));
+            if !found {
+                return AccessResult::Forbidden(format!("missing resource action: {action}"));
+            }
+        }
+
+        AccessResult::Allowed
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct OperationSpec {
+    pub name: String,
+    pub namespace: String,
+    pub op_type: OperationType,
+    pub visibility: Visibility,
+    pub input_schema: Value,
+    pub output_schema: Value,
+    pub error_schemas: Vec<ErrorDefinition>,
+    pub access_control: AccessControl,
+    /// JSON pointer into the input for the resource ID, when
+    /// `access_control.resource_type` is set and the operation targets a
+    /// specific runtime-spawned resource (ADR-050). e.g. `"$.containerId"`
+    /// for `docker/container/exec`. Absent for no-specific-resource
+    /// operations (the `list` case). `None` for operations with no
+    /// `resource_type` or with static resource sets.
+    pub resource_id_path: Option<String>,
+}
+
+impl OperationSpec {
+    #[allow(clippy::too_many_arguments)]
+    pub fn new(
+        name: impl Into<String>,
+        op_type: OperationType,
+        visibility: Visibility,
+        input_schema: Value,
+        output_schema: Value,
+        error_schemas: Vec<ErrorDefinition>,
+        access_control: AccessControl,
+        resource_id_path: Option<String>,
+    ) -> Self {
+        let name = name.into();
+        let namespace = name
+            .split('/')
+            .next()
+            .filter(|s| !s.is_empty())
+            .unwrap_or("")
+            .to_string();
+        Self {
+            name,
+            namespace,
+            op_type,
+            visibility,
+            input_schema,
+            output_schema,
+            error_schemas,
+            access_control,
+            resource_id_path,
+        }
+    }
+
+    pub fn path(&self) -> String {
+        format!("/{}", self.name)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::collections::HashMap;
+
+    fn identity(scopes: &[&str], resources: &[(&str, &[&str])]) -> Identity {
+        let mut res = HashMap::new();
+        for (k, v) in resources {
+            res.insert(
+                (*k).to_string(),
+                v.iter().map(|s| (*s).to_string()).collect(),
+            );
+        }
+        Identity {
+            id: "caller".to_string(),
+            scopes: scopes.iter().map(|s| (*s).to_string()).collect(),
+            resources: res,
+        }
+    }
+
+    #[test]
+    fn path_has_leading_slash() {
+        let spec = OperationSpec::new(
+            "fs/readFile",
+            OperationType::Query,
+            Visibility::External,
+            serde_json::json!({}),
+            serde_json::json!({}),
+            vec![],
+            AccessControl::default(),
+            None,
+        );
+        assert_eq!(spec.path(), "/fs/readFile");
+    }
+
+    #[test]
+    fn namespace_derived_from_name() {
+        let spec = OperationSpec::new(
+            "agent/chat",
+            OperationType::Subscription,
+            Visibility::External,
+            serde_json::json!({}),
+            serde_json::json!({}),
+            vec![],
+            AccessControl::default(),
+            None,
+        );
+        assert_eq!(spec.namespace, "agent");
+        assert_eq!(spec.name, "agent/chat");
+    }
+
+    #[test]
+    fn namespace_for_single_segment() {
+        let spec = OperationSpec::new(
+            "list",
+            OperationType::Query,
+            Visibility::Internal,
+            serde_json::json!({}),
+            serde_json::json!({}),
+            vec![],
+            AccessControl::default(),
+            None,
+        );
+        assert_eq!(spec.namespace, "list");
+    }
+
+    #[test]
+    fn resource_id_path_defaults_to_none() {
+        let spec = OperationSpec::new(
+            "fs/readFile",
+            OperationType::Query,
+            Visibility::External,
+            serde_json::json!({}),
+            serde_json::json!({}),
+            vec![],
+            AccessControl::default(),
+            None,
+        );
+        assert_eq!(spec.resource_id_path, None);
+    }
+
+    #[test]
+    fn empty_access_control_allowed_for_all() {
+        let acl = AccessControl::default();
+        assert_eq!(acl.check(None, None, None), AccessResult::Allowed);
+        let id = identity(&[], &[]);
+        assert_eq!(acl.check(Some(&id), None, None), AccessResult::Allowed);
+    }
+
+    #[test]
+    fn none_identity_with_restrictions_forbidden() {
+        let acl = AccessControl {
+            required_scopes: vec!["read".to_string()],
+            ..Default::default()
+        };
+        assert_eq!(
+            acl.check(None, None, None),
+            AccessResult::Forbidden("authentication required".to_string())
+        );
+
+        let acl2 = AccessControl {
+            required_scopes_any: Some(vec!["read".to_string()]),
+            ..Default::default()
+        };
+        assert_eq!(
+            acl2.check(None, None, None),
+            AccessResult::Forbidden("authentication required".to_string())
+        );
+
+        let acl3 = AccessControl {
+            resource_type: Some("service".to_string()),
+            ..Default::default()
+        };
+        assert_eq!(
+            acl3.check(None, None, None),
+            AccessResult::Forbidden("authentication required".to_string())
+        );
+    }
+
+    #[test]
+    fn required_scopes_and_checked() {
+        let acl = AccessControl {
+            required_scopes: vec!["a".to_string(), "b".to_string()],
+            ..Default::default()
+        };
+        let id_missing = identity(&["a"], &[]);
+        assert!(matches!(
+            acl.check(Some(&id_missing), None, None),
+            AccessResult::Forbidden(_)
+        ));
+        let id_ok = identity(&["a", "b", "c"], &[]);
+        assert_eq!(acl.check(Some(&id_ok), None, None), AccessResult::Allowed);
+    }
+
+    #[test]
+    fn required_scopes_any_or_checked() {
+        let acl = AccessControl {
+            required_scopes_any: Some(vec!["x".to_string(), "y".to_string()]),
+            ..Default::default()
+        };
+        let id_x = identity(&["x"], &[]);
+        assert_eq!(acl.check(Some(&id_x), None, None), AccessResult::Allowed);
+        let id_y = identity(&["y"], &[]);
+        assert_eq!(acl.check(Some(&id_y), None, None), AccessResult::Allowed);
+        let id_none = identity(&["z"], &[]);
+        assert!(matches!(
+            acl.check(Some(&id_none), None, None),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    #[test]
+    fn resource_check_with_type_and_action() {
+        let acl = AccessControl {
+            resource_type: Some("service".to_string()),
+            resource_action: Some("read".to_string()),
+            ..Default::default()
+        };
+        let id_ok = identity(&[], &[("service", &["read"])]);
+        assert_eq!(acl.check(Some(&id_ok), None, None), AccessResult::Allowed);
+        let id_missing_action = identity(&[], &[("service", &["write"])]);
+        assert!(matches!(
+            acl.check(Some(&id_missing_action), None, None),
+            AccessResult::Forbidden(_)
+        ));
+        let id_missing_type = identity(&[], &[("other", &["read"])]);
+        assert!(matches!(
+            acl.check(Some(&id_missing_type), None, None),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    #[test]
+    fn combined_scopes_and_resources() {
+        let acl = AccessControl {
+            required_scopes: vec!["admin".to_string()],
+            resource_type: Some("service".to_string()),
+            resource_action: Some("read".to_string()),
+            ..Default::default()
+        };
+        let id_ok = identity(&["admin"], &[("service", &["read"])]);
+        assert_eq!(acl.check(Some(&id_ok), None, None), AccessResult::Allowed);
+        let id_missing_scope = identity(&["user"], &[("service", &["read"])]);
+        assert!(matches!(
+            acl.check(Some(&id_missing_scope), None, None),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    struct MockOwnership {
+        owned: Vec<(String, String)>,
+    }
+
+    impl OwnershipProvider for MockOwnership {
+        fn owns(
+            &self,
+            _identity: &Identity,
+            resource_type: &str,
+            resource_id: &str,
+            _action: &str,
+        ) -> bool {
+            self.owned
+                .iter()
+                .any(|(rt, rid)| rt == resource_type && rid == resource_id)
+        }
+
+        fn owned_resources(&self, _identity: &Identity, resource_type: &str) -> Vec<String> {
+            self.owned
+                .iter()
+                .filter(|(rt, _)| rt == resource_type)
+                .map(|(_, rid)| rid.clone())
+                .collect()
+        }
+
+        fn owns_any(&self, _identity: &Identity, resource_type: &str) -> bool {
+            self.owned.iter().any(|(rt, _)| rt == resource_type)
+        }
+    }
+
+    fn empty_identity(id: &str) -> Identity {
+        Identity {
+            id: id.to_string(),
+            scopes: vec![],
+            resources: HashMap::new(),
+        }
+    }
+
+    #[test]
+    fn ownership_provider_allows_owned_resource() {
+        let acl = AccessControl {
+            resource_type: Some("container".to_string()),
+            resource_action: Some("exec".to_string()),
+            ..Default::default()
+        };
+        let id = empty_identity("alice");
+        let provider = MockOwnership {
+            owned: vec![("container".to_string(), "c1".to_string())],
+        };
+        assert_eq!(
+            acl.check(
+                Some(&id),
+                Some("c1"),
+                Some(&provider as &dyn OwnershipProvider)
+            ),
+            AccessResult::Allowed
+        );
+    }
+
+    #[test]
+    fn ownership_provider_forbids_unowned_resource() {
+        let acl = AccessControl {
+            resource_type: Some("container".to_string()),
+            resource_action: Some("exec".to_string()),
+            ..Default::default()
+        };
+        let id = empty_identity("alice");
+        let provider = MockOwnership {
+            owned: vec![("container".to_string(), "c1".to_string())],
+        };
+        assert!(matches!(
+            acl.check(
+                Some(&id),
+                Some("c2"),
+                Some(&provider as &dyn OwnershipProvider)
+            ),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    #[test]
+    fn ownership_provider_forbids_none_identity() {
+        let acl = AccessControl {
+            resource_type: Some("container".to_string()),
+            resource_action: Some("exec".to_string()),
+            ..Default::default()
+        };
+        let provider = MockOwnership {
+            owned: vec![("container".to_string(), "c1".to_string())],
+        };
+        assert!(matches!(
+            acl.check(None, Some("c1"), Some(&provider as &dyn OwnershipProvider)),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    #[test]
+    fn ownership_provider_list_allowed_when_owns_any() {
+        let acl = AccessControl {
+            resource_type: Some("container".to_string()),
+            resource_action: Some("exec".to_string()),
+            ..Default::default()
+        };
+        let id = empty_identity("alice");
+        let provider = MockOwnership {
+            owned: vec![("container".to_string(), "c1".to_string())],
+        };
+        assert_eq!(
+            acl.check(Some(&id), None, Some(&provider as &dyn OwnershipProvider)),
+            AccessResult::Allowed
+        );
+    }
+
+    #[test]
+    fn ownership_provider_list_forbidden_when_not_owns_any() {
+        let acl = AccessControl {
+            resource_type: Some("container".to_string()),
+            resource_action: Some("exec".to_string()),
+            ..Default::default()
+        };
+        let id = empty_identity("alice");
+        let provider = MockOwnership {
+            owned: vec![("volume".to_string(), "v1".to_string())],
+        };
+        assert!(matches!(
+            acl.check(Some(&id), None, Some(&provider as &dyn OwnershipProvider)),
+            AccessResult::Forbidden(_)
+        ));
+    }
+
+    #[test]
+    fn ownership_none_falls_back_to_static() {
+        let acl = AccessControl {
+            resource_type: Some("service".to_string()),
+            resource_action: Some("read".to_string()),
+            ..Default::default()
+        };
+        let id_ok = identity(&[], &[("service", &["read"])]);
+        assert_eq!(acl.check(Some(&id_ok), None, None), AccessResult::Allowed);
+        let id_missing = identity(&[], &[("service", &["write"])]);
+        assert!(matches!(
+            acl.check(Some(&id_missing), None, None),
+            AccessResult::Forbidden(_)
+        ));
+    }
+}

crates/alknet-client/Cargo.toml

@@ -0,0 +1,31 @@
+[package]
+name = "alknet-client"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+description = "Native client dial seam — multi-transport dialer that produces Connections for protocol take-overs"
+repository.workspace = true
+
+[lib]
+name = "alknet_client"
+
+[features]
+default = []
+quinn = ["dep:quinn", "alknet-tls/quinn", "alknet-core/quinn"]
+tcp = ["dep:tokio-rustls", "alknet-tls/tcp"]
+iroh = ["dep:iroh", "alknet-core/iroh"]
+socks5 = ["dep:fast-socks5"]
+
+[dependencies]
+alknet-core = { path = "../alknet-core" }
+alknet-tls = { path = "../alknet-tls" }
+tokio = { version = "1", features = ["full"] }
+thiserror = "2"
+tracing = "0.1"
+quinn = { version = "0.11", optional = true }
+tokio-rustls = { version = "0.26", optional = true }
+iroh = { version = "1.0", optional = true, default-features = false, features = ["tls-aws-lc-rs"] }
+fast-socks5 = { version = "1", optional = true }
+rustls = "0.23"
+rustls-pki-types = "1"
+hex = "0.4"

crates/alknet-client/src/client.rs

@@ -0,0 +1,154 @@
+//! `AlknetClient` — native client dial seam, the client-side analogue of
+//! `AlknetEndpoint`. Holds pre-built transport handles, all optional — the
+//! client dials with whichever transport the remote endpoint type implies.
+
+use std::fmt;
+
+#[cfg(feature = "iroh")]
+use iroh;
+#[cfg(feature = "quinn")]
+use quinn;
+#[cfg(feature = "tcp")]
+use tokio_rustls;
+
+#[cfg(feature = "socks5")]
+use crate::socks5::Socks5ProxyConfig;
+
+/// Native client dial seam — multi-transport dialer that produces
+/// `Connection`s for protocol take-overs.
+///
+/// Holds pre-built transport handles, all optional — the client dials
+/// with whichever transport the remote endpoint type implies. The
+/// builder mirrors `AlknetEndpoint`'s `with_quinn` / `with_iroh` /
+/// `with_tcp_tls` (ADR-083) — the assembly layer builds the transport
+/// handles and hands them to the client via builder methods.
+pub struct AlknetClient {
+    #[cfg(feature = "quinn")]
+    pub(crate) quinn: Option<quinn::Endpoint>,
+    #[cfg(feature = "tcp")]
+    pub(crate) tcp_connector: Option<tokio_rustls::TlsConnector>,
+    #[cfg(feature = "iroh")]
+    pub(crate) iroh: Option<iroh::Endpoint>,
+    /// When set, `dial_quic` and `dial_tcp_tls` route through this
+    /// SOCKS5 proxy (UDP ASSOCIATE / CONNECT respectively). `dial_iroh`
+    /// forces relay-only via an HTTP-to-SOCKS5 bridge — see ADR-090 §5.
+    /// Feature-gated on `socks5`.
+    #[cfg(feature = "socks5")]
+    pub(crate) socks5: Option<Socks5ProxyConfig>,
+}
+
+impl AlknetClient {
+    /// Create a new `AlknetClient` with no transport handles configured.
+    /// Use the builder methods to add transports.
+    pub fn new() -> Self {
+        Self {
+            #[cfg(feature = "quinn")]
+            quinn: None,
+            #[cfg(feature = "tcp")]
+            tcp_connector: None,
+            #[cfg(feature = "iroh")]
+            iroh: None,
+            #[cfg(feature = "socks5")]
+            socks5: None,
+        }
+    }
+
+    /// Set the QUIC transport handle. The assembly layer builds a
+    /// `quinn::Endpoint` (with or without a SOCKS5 proxy — the proxy
+    /// is applied inside `dial_quic`, not at construction time) and
+    /// hands it to the client.
+    #[cfg(feature = "quinn")]
+    pub fn with_quinn(mut self, endpoint: quinn::Endpoint) -> Self {
+        self.quinn = Some(endpoint);
+        self
+    }
+
+    /// Set the TCP+TLS transport handle. The assembly layer builds a
+    /// `tokio_rustls::TlsConnector` and hands it to the client.
+    #[cfg(feature = "tcp")]
+    pub fn with_tcp_tls(mut self, connector: tokio_rustls::TlsConnector) -> Self {
+        self.tcp_connector = Some(connector);
+        self
+    }
+
+    /// Set the iroh transport handle. The assembly layer builds an
+    /// `iroh::Endpoint` and hands it to the client.
+    #[cfg(feature = "iroh")]
+    pub fn with_iroh(mut self, endpoint: iroh::Endpoint) -> Self {
+        self.iroh = Some(endpoint);
+        self
+    }
+
+    /// Set the SOCKS5 proxy for all subsequent dials. When set, every
+    /// dial routes its transport through this proxy: UDP ASSOCIATE for
+    /// `dial_quic`, CONNECT for `dial_tcp_tls`, and force-relay-only +
+    /// HTTP-to-SOCKS5 bridge for `dial_iroh` (ADR-090 §5).
+    /// Feature-gated on `socks5`.
+    #[cfg(feature = "socks5")]
+    pub fn with_socks5_proxy(mut self, proxy: Socks5ProxyConfig) -> Self {
+        self.socks5 = Some(proxy);
+        self
+    }
+}
+
+impl Default for AlknetClient {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl fmt::Debug for AlknetClient {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        #[allow(unused_mut)]
+        let mut configured: Vec<&str> = Vec::new();
+        #[cfg(feature = "quinn")]
+        if self.quinn.is_some() {
+            configured.push("quinn");
+        }
+        #[cfg(feature = "tcp")]
+        if self.tcp_connector.is_some() {
+            configured.push("tcp");
+        }
+        #[cfg(feature = "iroh")]
+        if self.iroh.is_some() {
+            configured.push("iroh");
+        }
+        #[cfg(feature = "socks5")]
+        if self.socks5.is_some() {
+            configured.push("socks5");
+        }
+        f.debug_struct("AlknetClient")
+            .field("transports", &configured)
+            .finish()
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn new_creates_empty_client() {
+        let client = AlknetClient::new();
+        let debug = format!("{:?}", client);
+        assert!(debug.contains("AlknetClient"));
+    }
+
+    #[test]
+    fn default_delegates_to_new() {
+        let _client = AlknetClient::default();
+    }
+
+    #[test]
+    fn alknet_client_is_send_sync() {
+        fn assert_send_sync<T: Send + Sync>() {}
+        assert_send_sync::<AlknetClient>();
+    }
+
+    #[test]
+    fn debug_lists_configured_transports() {
+        let client = AlknetClient::new();
+        let debug = format!("{:?}", client);
+        assert!(!debug.is_empty());
+    }
+}

crates/alknet-client/src/dial/iroh.rs

@@ -0,0 +1,132 @@
+//! `dial_iroh` — iroh dial, producing a `Connection`.
+//!
+//! Feature-gated on `iroh`. The iroh path does NOT use `TlsClientConfig` —
+//! iroh has its own TLS (shares the `Ed25519SecretKey`, not the rustls config
+//! — ADR-087 §3, ADR-089 §3). The local key is set on the pre-built iroh
+//! endpoint at `with_iroh` time (the assembly layer reads it from
+//! `StaticConfig` and feeds it to `iroh::Endpoint::builder().secret_key()`);
+//! the dial consumes only `creds.remote_identity` (deriving the remote
+//! `EndpointId` from `creds.remote_identity.fingerprint`) and ignores
+//! `creds.local_identity`.
+
+use alknet_core::credentials::ConnectionCredentials;
+use alknet_core::types::Connection;
+
+use crate::client::AlknetClient;
+use crate::error::ClientDialError;
+
+impl AlknetClient {
+    /// Iroh dial. Dials on `alpn` via the iroh endpoint. The iroh path
+    /// does NOT use `TlsClientConfig` — iroh has its own TLS (shares the
+    /// `Ed25519SecretKey`, not the rustls config — ADR-087 §3, ADR-089
+    /// §3). The local key is on the pre-built iroh endpoint (set at
+    /// `with_iroh` time); the dial consumes only
+    /// `creds.remote_identity` and ignores `creds.local_identity`.
+    /// The remote `EndpointId` is derived from
+    /// `creds.remote_identity.fingerprint`
+    /// (`ed25519:<hex>` → `EndpointId::from_bytes`). The verifier is iroh's
+    /// `EndpointId` match (fingerprint pin by another name — ADR-034 §3).
+    /// An unknown iroh remote fails closed (no CA). Feature-gated on
+    /// `iroh`.
+    #[cfg(feature = "iroh")]
+    pub async fn dial_iroh(
+        &self,
+        alpn: &[u8],
+        creds: &ConnectionCredentials,
+    ) -> Result<Connection, ClientDialError> {
+        let endpoint = self
+            .iroh
+            .as_ref()
+            .ok_or(ClientDialError::NoTransport { transport: "iroh" })?;
+
+        let node_id = match &creds.remote_identity {
+            Some(ri) => extract_iroh_endpoint_id(&ri.fingerprint)
+                .map_err(|e| ClientDialError::TlsConfig(alknet_tls::TlsError::Config(e)))?,
+            None => {
+                return Err(ClientDialError::TlsConfig(alknet_tls::TlsError::Config(
+                    "iroh requires a known remote (remote_identity must be Some); \
+                     unknown iroh remotes fail closed (ADR-034 §3)"
+                        .into(),
+                )));
+            }
+        };
+
+        let conn = endpoint
+            .connect(node_id, alpn)
+            .await
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+
+        Ok(Connection::from_iroh(conn))
+    }
+}
+
+/// Extract an `iroh::EndpointId` from a fingerprint string.
+///
+/// Supports two formats:
+/// - `"ed25519:<hex>"` — raw Ed25519 public key (64 hex chars)
+/// - `"SHA256:<base64>"` — SHA-256 hash of the cert (for X.509; not valid for iroh)
+///
+/// For iroh, only the `ed25519:` prefix is valid — iroh uses Ed25519 keys.
+fn extract_iroh_endpoint_id(fingerprint: &str) -> Result<iroh::EndpointId, String> {
+    if let Some(hex_str) = fingerprint.strip_prefix("ed25519:") {
+        let bytes =
+            hex::decode(hex_str).map_err(|e| format!("invalid ed25519 fingerprint hex: {e}"))?;
+        if bytes.len() != 32 {
+            return Err(format!(
+                "invalid ed25519 fingerprint length: expected 32 bytes, got {}",
+                bytes.len()
+            ));
+        }
+        let arr: [u8; 32] = bytes
+            .try_into()
+            .map_err(|_| "invalid ed25519 fingerprint length".to_string())?;
+        iroh::EndpointId::from_bytes(&arr).map_err(|e| format!("invalid iroh EndpointId: {e}"))
+    } else {
+        Err(format!(
+            "iroh requires an ed25519: fingerprint, got: {}",
+            fingerprint
+        ))
+    }
+}
+
+#[cfg(all(test, feature = "iroh"))]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn dial_iroh_no_transport_error() {
+        let client = AlknetClient::new();
+        let creds = ConnectionCredentials::new();
+        let result = client.dial_iroh(b"test/alpn", &creds).await;
+        assert!(matches!(result, Err(ClientDialError::NoTransport { .. })));
+    }
+
+    #[test]
+    fn extract_iroh_endpoint_id_valid_ed25519() {
+        let hex_key = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+        let fingerprint = format!("ed25519:{}", hex_key);
+        let result = extract_iroh_endpoint_id(&fingerprint);
+        assert!(result.is_ok());
+    }
+
+    #[test]
+    fn extract_iroh_endpoint_id_rejects_sha256() {
+        let fingerprint = "SHA256:abc123";
+        let result = extract_iroh_endpoint_id(fingerprint);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn extract_iroh_endpoint_id_rejects_invalid_hex() {
+        let fingerprint = "ed25519:nothex";
+        let result = extract_iroh_endpoint_id(fingerprint);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn extract_iroh_endpoint_id_rejects_wrong_length() {
+        let fingerprint = "ed25519:aaaa";
+        let result = extract_iroh_endpoint_id(fingerprint);
+        assert!(result.is_err());
+    }
+}

crates/alknet-client/src/dial/mod.rs

@@ -0,0 +1,12 @@
+//! Dial methods for `AlknetClient` — one per transport.
+//!
+//! Each dial method is feature-gated on the corresponding transport feature.
+//! All three are unified on `&ConnectionCredentials` (ADR-091) and return a
+//! `Connection` for protocol take-overs to consume.
+
+#[cfg(feature = "iroh")]
+pub mod iroh;
+#[cfg(feature = "quinn")]
+pub mod quinn;
+#[cfg(feature = "tcp")]
+pub mod tcp_tls;

crates/alknet-client/src/dial/quinn.rs

@@ -0,0 +1,120 @@
+//! `dial_quic` — QUIC dial via quinn, producing a `Connection`.
+//!
+//! Feature-gated on `quinn`. Builds a `TlsClientConfig` from
+//! `ConnectionCredentials`, constructs a `quinn::ClientConfig`, dials
+//! `addr` on `alpn`, and returns a `Connection` via
+//! `Connection::from_quinn_with_alpn`.
+
+use std::net::SocketAddr;
+#[cfg(feature = "socks5")]
+use std::sync::Arc;
+
+use alknet_core::credentials::ConnectionCredentials;
+use alknet_core::types::Connection;
+use alknet_tls::client::TlsClientConfig;
+
+use crate::client::AlknetClient;
+use crate::error::ClientDialError;
+
+impl AlknetClient {
+    /// QUIC dial. Builds a `TlsClientConfig` from `creds`
+    /// (ADR-034 verifier selection + ADR-084 provider), dials `addr`
+    /// on `alpn`, returns a `Connection` via
+    /// `Connection::from_quinn_with_alpn`. The `server_name` is the
+    /// TLS SNI / name (for X.509; ignored for raw-key pinning).
+    /// Feature-gated on `quinn`.
+    #[cfg(feature = "quinn")]
+    pub async fn dial_quic(
+        &self,
+        addr: SocketAddr,
+        server_name: &str,
+        alpn: &[u8],
+        creds: &ConnectionCredentials,
+    ) -> Result<Connection, ClientDialError> {
+        let tls_config = TlsClientConfig::new(creds, alpn)?;
+        let client_config = tls_config.for_quinn()?;
+
+        #[cfg(feature = "socks5")]
+        let conn = if let Some(proxy) = &self.socks5 {
+            let socket = crate::socks5::Socks5UdpSocket::bind(proxy).await?;
+            let endpoint = quinn::Endpoint::new_with_abstract_socket(
+                quinn::EndpointConfig::default(),
+                None,
+                Arc::new(socket),
+                Arc::new(quinn::TokioRuntime),
+            )
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+            endpoint
+                .connect_with(client_config, addr, server_name)
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+        } else {
+            let endpoint = self
+                .quinn
+                .as_ref()
+                .ok_or(ClientDialError::NoTransport { transport: "quinn" })?;
+            endpoint
+                .connect_with(client_config, addr, server_name)
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+        };
+
+        #[cfg(not(feature = "socks5"))]
+        let conn = {
+            let endpoint = self
+                .quinn
+                .as_ref()
+                .ok_or(ClientDialError::NoTransport { transport: "quinn" })?;
+            endpoint
+                .connect_with(client_config, addr, server_name)
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?
+        };
+
+        Ok(Connection::from_quinn_with_alpn(conn, alpn.to_vec()))
+    }
+}
+
+#[cfg(all(test, feature = "quinn"))]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn dial_quic_no_transport_error() {
+        let client = AlknetClient::new();
+        let creds = ConnectionCredentials::new();
+        let result = client
+            .dial_quic(
+                "127.0.0.1:0".parse().unwrap(),
+                "localhost",
+                b"test/alpn",
+                &creds,
+            )
+            .await;
+        assert!(matches!(result, Err(ClientDialError::NoTransport { .. })));
+    }
+
+    #[tokio::test]
+    async fn dial_quic_tls_config_error_on_acme_identity() {
+        use alknet_core::config::{AcmeDirectory, TlsIdentity};
+        let creds = ConnectionCredentials::new().with_local_identity(TlsIdentity::Acme {
+            domains: vec!["example.com".into()],
+            directory: AcmeDirectory::Staging,
+            cache_dir: std::path::PathBuf::from("/tmp"),
+            contact: vec![],
+        });
+        let client = AlknetClient::new();
+        let result = client
+            .dial_quic(
+                "127.0.0.1:0".parse().unwrap(),
+                "localhost",
+                b"test/alpn",
+                &creds,
+            )
+            .await;
+        assert!(matches!(result, Err(ClientDialError::TlsConfig(_))));
+    }
+}

crates/alknet-client/src/dial/tcp_tls.rs

@@ -0,0 +1,106 @@
+//! `dial_tcp_tls` — TCP+TLS dial via tokio-rustls, producing a `Connection`.
+//!
+//! Feature-gated on `tcp`. Builds a `TlsClientConfig` from
+//! `ConnectionCredentials`, connects a `TcpStream` to `addr`, wraps with
+//! `TlsConnector` using `host` as the SNI, and returns a `Connection` via
+//! `Connection::from_bidi` (ADR-065).
+
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use alknet_core::credentials::ConnectionCredentials;
+use alknet_core::types::Connection;
+use alknet_tls::client::TlsClientConfig;
+use tokio::net::TcpStream;
+
+use crate::client::AlknetClient;
+use crate::error::ClientDialError;
+
+impl AlknetClient {
+    /// TCP+TLS dial. Builds a `TlsClientConfig` from `creds`,
+    /// connects a `TcpStream` to `addr`, wraps with `TlsConnector`
+    /// using `host` as the SNI, returns a `Connection` via
+    /// `Connection::from_bidi` (ADR-065). Feature-gated on `tcp`.
+    #[cfg(feature = "tcp")]
+    pub async fn dial_tcp_tls(
+        &self,
+        host: &str,
+        addr: SocketAddr,
+        alpn: &[u8],
+        creds: &ConnectionCredentials,
+    ) -> Result<Connection, ClientDialError> {
+        let tls_config = TlsClientConfig::new(creds, alpn)?;
+
+        let connector = match &self.tcp_connector {
+            Some(c) => c.clone(),
+            None => {
+                let rustls_config = Arc::new(tls_config.into_rustls_config());
+                tokio_rustls::TlsConnector::from(rustls_config)
+            }
+        };
+
+        #[cfg(feature = "socks5")]
+        let tls_stream = if let Some(proxy) = &self.socks5 {
+            let mut tcp = TcpStream::connect(proxy.addr)
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+            crate::socks5::socks5_connect(&mut tcp, proxy, addr)
+                .await
+                .map_err(ClientDialError::Proxy)?;
+            let server_name: rustls::pki_types::ServerName = host.to_owned().try_into().map_err(
+                |e: rustls::pki_types::InvalidDnsNameError| ClientDialError::Connect(e.to_string()),
+            )?;
+            connector
+                .connect(server_name, tcp)
+                .await
+                .map_err(|e| ClientDialError::Handshake(e.to_string()))?
+        } else {
+            let tcp_stream = TcpStream::connect(addr)
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+            let server_name: rustls::pki_types::ServerName = host.to_owned().try_into().map_err(
+                |e: rustls::pki_types::InvalidDnsNameError| ClientDialError::Connect(e.to_string()),
+            )?;
+            connector
+                .connect(server_name, tcp_stream)
+                .await
+                .map_err(|e| ClientDialError::Handshake(e.to_string()))?
+        };
+
+        #[cfg(not(feature = "socks5"))]
+        let tls_stream = {
+            let tcp_stream = TcpStream::connect(addr)
+                .await
+                .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+            let server_name: rustls::pki_types::ServerName = host.to_owned().try_into().map_err(
+                |e: rustls::pki_types::InvalidDnsNameError| ClientDialError::Connect(e.to_string()),
+            )?;
+            connector
+                .connect(server_name, tcp_stream)
+                .await
+                .map_err(|e| ClientDialError::Handshake(e.to_string()))?
+        };
+
+        Ok(Connection::from_bidi(tls_stream, alpn.to_vec(), Some(addr)))
+    }
+}
+
+#[cfg(all(test, feature = "tcp"))]
+mod tests {
+    use super::*;
+
+    #[tokio::test]
+    async fn dial_tcp_tls_no_transport_error() {
+        let client = AlknetClient::new();
+        let creds = ConnectionCredentials::new();
+        let result = client
+            .dial_tcp_tls(
+                "localhost",
+                "127.0.0.1:0".parse().unwrap(),
+                b"test/alpn",
+                &creds,
+            )
+            .await;
+        assert!(matches!(result, Err(ClientDialError::Connect(_))));
+    }
+}

crates/alknet-client/src/error.rs

@@ -0,0 +1,83 @@
+//! `ClientDialError` — error type for all three dial methods.
+
+use thiserror::Error;
+
+/// Errors produced by `AlknetClient` dial methods.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum ClientDialError {
+    /// TLS config construction failure — `TlsClientConfig::new` failed
+    /// (verifier build, cert load, provider init). Wraps `TlsError`
+    /// from alknet-tls.
+    #[error("TLS config construction: {0}")]
+    TlsConfig(#[from] alknet_tls::TlsError),
+
+    /// Transport connect failure — quinn connect, TcpStream::connect,
+    /// or iroh connect. The transport's own error type, stringified.
+    #[error("transport connect: {0}")]
+    Connect(String),
+
+    /// TLS handshake failure — the handshake started but failed
+    /// (rejected cert, ALPN mismatch, unknown raw-key remote
+    /// fail-closed). Distinct from TlsConfig (which is pre-handshake).
+    #[error("TLS handshake: {0}")]
+    Handshake(String),
+
+    /// No transport handle configured for the requested dial — e.g.,
+    /// `dial_quic` called but `with_quinn` was not set.
+    #[error("no transport handle configured for {transport}")]
+    NoTransport { transport: &'static str },
+
+    /// SOCKS5 proxy failure — handshake rejected, UDP ASSOCIATE
+    /// unsupported, auth failed, or the proxy closed the control
+    /// connection (ADR-090). The dial did not reach the remote; the
+    /// caller decides whether to fall back to a direct dial or
+    /// surface the error. The dial never silently falls back — that
+    /// would defeat the privacy posture.
+    #[cfg(feature = "socks5")]
+    #[error("SOCKS5 proxy: {0}")]
+    Proxy(String),
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn tls_config_from_tls_error() {
+        let err = alknet_tls::TlsError::Config("test".into());
+        let dial_err: ClientDialError = err.into();
+        assert!(matches!(dial_err, ClientDialError::TlsConfig(_)));
+    }
+
+    #[test]
+    fn no_transport_displays_transport_name() {
+        let err = ClientDialError::NoTransport { transport: "quinn" };
+        assert!(err.to_string().contains("quinn"));
+    }
+
+    #[test]
+    fn connect_displays_message() {
+        let err = ClientDialError::Connect("connection refused".into());
+        assert!(err.to_string().contains("connection refused"));
+    }
+
+    #[test]
+    fn handshake_displays_message() {
+        let err = ClientDialError::Handshake("certificate rejected".into());
+        assert!(err.to_string().contains("certificate rejected"));
+    }
+
+    #[cfg(feature = "socks5")]
+    #[test]
+    fn proxy_displays_message() {
+        let err = ClientDialError::Proxy("UDP ASSOCIATE rejected".into());
+        assert!(err.to_string().contains("UDP ASSOCIATE rejected"));
+    }
+
+    #[test]
+    fn client_dial_error_is_send_sync() {
+        fn assert_send_sync<T: Send + Sync>() {}
+        assert_send_sync::<ClientDialError>();
+    }
+}

crates/alknet-client/src/lib.rs

@@ -0,0 +1,23 @@
+//! alknet-client: Native client dial seam — multi-transport dialer that
+//! produces `Connection`s for protocol take-overs.
+//!
+//! `AlknetClient` is the client-side analogue of `AlknetEndpoint`: a
+//! multi-transport dialer that takes pre-built transport handles (quinn,
+//! TCP+TLS, iroh), dials a remote `AlknetEndpoint` on a chosen ALPN, and
+//! produces a `Connection`. The protocol take-overs
+//! (`CallClient::spawn_dispatch`, `ChannelClient::from_connection`)
+//! consume the `Connection` — the dial is below the protocol.
+//!
+//! An optional SOCKS5 proxy (ADR-090) routes the dials through a proxy
+//! to hide the client's real IP from the hub.
+
+pub mod client;
+pub mod dial;
+pub mod error;
+#[cfg(feature = "socks5")]
+pub mod socks5;
+
+pub use client::AlknetClient;
+pub use error::ClientDialError;
+#[cfg(feature = "socks5")]
+pub use socks5::{Socks5Credentials, Socks5ProxyConfig};

crates/alknet-client/src/socks5.rs

@@ -0,0 +1,461 @@
+//! SOCKS5 proxy support for `AlknetClient` (ADR-090).
+//!
+//! When a proxy is configured via `with_socks5_proxy`, the rustls dials
+//! route their transport through the proxy — the hub sees the proxy's IP,
+//! not the client's.
+//!
+//! Feature-gated on `socks5`. The `Socks5UdpSocket` additionally requires
+//! the `quinn` feature (it implements `quinn::AsyncUdpSocket`).
+
+use std::net::SocketAddr;
+
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpStream;
+
+#[cfg(feature = "quinn")]
+use std::io;
+#[cfg(feature = "quinn")]
+use std::pin::Pin;
+#[cfg(feature = "quinn")]
+use std::sync::{Arc, Mutex};
+#[cfg(feature = "quinn")]
+use std::task::{Context, Poll, Waker};
+
+#[cfg(feature = "quinn")]
+use crate::error::ClientDialError;
+
+/// Configuration for a SOCKS5 proxy (ADR-090).
+///
+/// When set on `AlknetClient` via `with_socks5_proxy`, all rustls dials
+/// route their transport through this proxy: UDP ASSOCIATE for `dial_quic`,
+/// CONNECT for `dial_tcp_tls`. The proxy config comes from `Capabilities` /
+/// the assembly layer (ADR-014), never from environment variables.
+#[derive(Debug, Clone)]
+pub struct Socks5ProxyConfig {
+    /// The proxy's TCP address (where the SOCKS5 control connection
+    /// connects). For UDP ASSOCIATE (the QUIC dial), the proxy replies
+    /// with a UDP relay address that may differ; the dial uses that.
+    pub addr: SocketAddr,
+    /// Optional username/password auth (RFC 1929). None = no-auth.
+    pub credentials: Option<Socks5Credentials>,
+}
+
+/// SOCKS5 username/password credentials (RFC 1929).
+#[derive(Debug, Clone)]
+pub struct Socks5Credentials {
+    pub username: String,
+    pub password: String,
+}
+
+/// A `quinn::AsyncUdpSocket` implementation that tunnels QUIC datagrams
+/// through a SOCKS5 UDP ASSOCIATE tunnel.
+///
+/// The implementation follows the pattern validated by the quinn-proxy PoC
+/// (`docs/research/quinn-quic-proxy/findings.md`).
+///
+/// Requires both `socks5` and `quinn` features.
+#[cfg(feature = "quinn")]
+pub struct Socks5UdpSocket {
+    socket: std::net::UdpSocket,
+    relay_addr: SocketAddr,
+    local_addr: SocketAddr,
+    _control: TcpStream,
+}
+
+#[cfg(feature = "quinn")]
+impl Socks5UdpSocket {
+    /// Perform the SOCKS5 UDP ASSOCIATE handshake and return a socket
+    /// that tunnels QUIC datagrams through the proxy.
+    pub async fn bind(proxy: &Socks5ProxyConfig) -> Result<Self, ClientDialError> {
+        let mut control = TcpStream::connect(proxy.addr)
+            .await
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+
+        socks5_handshake(&mut control, proxy).await?;
+
+        let relay_addr = socks5_udp_associate(&mut control).await?;
+
+        let socket = std::net::UdpSocket::bind("0.0.0.0:0")
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+        socket
+            .set_nonblocking(true)
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+        let local_addr = socket
+            .local_addr()
+            .map_err(|e| ClientDialError::Connect(e.to_string()))?;
+
+        Ok(Self {
+            socket,
+            relay_addr,
+            local_addr,
+            _control: control,
+        })
+    }
+}
+
+#[cfg(feature = "quinn")]
+impl quinn::AsyncUdpSocket for Socks5UdpSocket {
+    fn create_io_poller(self: Arc<Self>) -> Pin<Box<dyn quinn::UdpPoller>> {
+        Box::pin(UdpPollerImpl {
+            socket: self.socket.try_clone().ok(),
+            waker: Mutex::new(None),
+        })
+    }
+
+    fn try_send(&self, transmit: &quinn::udp::Transmit) -> io::Result<()> {
+        let mut buf = Vec::with_capacity(10 + transmit.contents.len());
+        buf.extend_from_slice(&[0u8, 0, 0]);
+        match transmit.destination {
+            SocketAddr::V4(addr) => {
+                buf.push(0x01);
+                buf.extend_from_slice(&addr.ip().octets());
+                buf.extend_from_slice(&addr.port().to_be_bytes());
+            }
+            SocketAddr::V6(addr) => {
+                buf.push(0x04);
+                buf.extend_from_slice(&addr.ip().octets());
+                buf.extend_from_slice(&addr.port().to_be_bytes());
+            }
+        }
+        buf.extend_from_slice(transmit.contents);
+
+        let sent = self.socket.send_to(&buf, self.relay_addr)?;
+        if sent < buf.len() {
+            return Err(io::Error::new(io::ErrorKind::WouldBlock, "partial send"));
+        }
+        Ok(())
+    }
+
+    fn poll_recv(
+        &self,
+        _cx: &mut Context,
+        bufs: &mut [io::IoSliceMut<'_>],
+        meta: &mut [quinn::udp::RecvMeta],
+    ) -> Poll<io::Result<usize>> {
+        let mut buf = [0u8; 65536];
+        match self.socket.recv_from(&mut buf) {
+            Ok((n, _src)) => {
+                if n < 10 {
+                    return Poll::Ready(Ok(0));
+                }
+                let header_end = 3;
+                let atyp = buf[header_end];
+                let addr_len: usize = match atyp {
+                    0x01 => 4,
+                    0x04 => 16,
+                    _ => return Poll::Ready(Ok(0)),
+                };
+                let payload_start = header_end + 1 + addr_len + 2;
+                if n < payload_start {
+                    return Poll::Ready(Ok(0));
+                }
+                let payload = &buf[payload_start..n];
+                let copy_len = payload.len().min(bufs.iter().map(|b| b.len()).sum());
+                let mut offset = 0;
+                for b in bufs.iter_mut() {
+                    let end = (offset + b.len()).min(copy_len);
+                    if offset < end {
+                        b.copy_from_slice(&payload[offset..end]);
+                    }
+                    offset = end;
+                    if offset >= copy_len {
+                        break;
+                    }
+                }
+                meta[0] = quinn::udp::RecvMeta {
+                    len: copy_len,
+                    stride: copy_len,
+                    addr: self.relay_addr,
+                    ecn: None,
+                    dst_ip: None,
+                };
+                Poll::Ready(Ok(1))
+            }
+            Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => Poll::Pending,
+            Err(e) => Poll::Ready(Err(e)),
+        }
+    }
+
+    fn local_addr(&self) -> io::Result<SocketAddr> {
+        Ok(self.local_addr)
+    }
+
+    fn may_fragment(&self) -> bool {
+        false
+    }
+}
+
+#[cfg(feature = "quinn")]
+struct UdpPollerImpl {
+    socket: Option<std::net::UdpSocket>,
+    waker: Mutex<Option<Waker>>,
+}
+
+#[cfg(feature = "quinn")]
+impl std::fmt::Debug for UdpPollerImpl {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("UdpPollerImpl").finish()
+    }
+}
+
+#[cfg(feature = "quinn")]
+impl quinn::UdpPoller for UdpPollerImpl {
+    fn poll_writable(self: Pin<&mut Self>, cx: &mut Context) -> Poll<io::Result<()>> {
+        if let Some(ref socket) = self.socket {
+            match socket.send_to(
+                &[],
+                socket
+                    .local_addr()
+                    .ok()
+                    .unwrap_or_else(|| "0.0.0.0:0".parse().unwrap()),
+            ) {
+                Ok(_) => Poll::Ready(Ok(())),
+                Err(ref e) if e.kind() == io::ErrorKind::WouldBlock => {
+                    *self.waker.lock().unwrap() = Some(cx.waker().clone());
+                    Poll::Pending
+                }
+                Err(e) => Poll::Ready(Err(e)),
+            }
+        } else {
+            Poll::Ready(Ok(()))
+        }
+    }
+}
+
+#[cfg(feature = "quinn")]
+impl std::fmt::Debug for Socks5UdpSocket {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Socks5UdpSocket")
+            .field("relay_addr", &self.relay_addr)
+            .field("local_addr", &self.local_addr)
+            .finish()
+    }
+}
+
+/// Perform the SOCKS5 handshake (greeting + auth).
+#[cfg(feature = "quinn")]
+async fn socks5_handshake(
+    stream: &mut TcpStream,
+    proxy: &Socks5ProxyConfig,
+) -> Result<(), ClientDialError> {
+    if let Some(creds) = &proxy.credentials {
+        stream
+            .write_all(&[0x05, 0x01, 0x02])
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        let mut resp = [0u8; 2];
+        stream
+            .read_exact(&mut resp)
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        if resp[0] != 0x05 || resp[1] != 0x02 {
+            return Err(ClientDialError::Proxy(
+                "SOCKS5 server does not support username/password auth".into(),
+            ));
+        }
+        let mut auth_msg = Vec::with_capacity(3 + creds.username.len() + creds.password.len());
+        auth_msg.push(0x01);
+        auth_msg.push(creds.username.len() as u8);
+        auth_msg.extend_from_slice(creds.username.as_bytes());
+        auth_msg.push(creds.password.len() as u8);
+        auth_msg.extend_from_slice(creds.password.as_bytes());
+        stream
+            .write_all(&auth_msg)
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        let mut auth_resp = [0u8; 2];
+        stream
+            .read_exact(&mut auth_resp)
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        if auth_resp[1] != 0x00 {
+            return Err(ClientDialError::Proxy(
+                "SOCKS5 username/password authentication failed".into(),
+            ));
+        }
+    } else {
+        stream
+            .write_all(&[0x05, 0x01, 0x00])
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        let mut resp = [0u8; 2];
+        stream
+            .read_exact(&mut resp)
+            .await
+            .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+        if resp[0] != 0x05 || resp[1] != 0x00 {
+            return Err(ClientDialError::Proxy(
+                "SOCKS5 server rejected no-auth method".into(),
+            ));
+        }
+    }
+    Ok(())
+}
+
+/// Perform the SOCKS5 UDP ASSOCIATE request and return the relay address.
+#[cfg(feature = "quinn")]
+async fn socks5_udp_associate(stream: &mut TcpStream) -> Result<SocketAddr, ClientDialError> {
+    let req = vec![0x05, 0x03, 0x00, 0x01, 0, 0, 0, 0, 0, 0];
+    stream
+        .write_all(&req)
+        .await
+        .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+
+    let mut resp = [0u8; 10];
+    stream
+        .read_exact(&mut resp)
+        .await
+        .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+
+    if resp[0] != 0x05 {
+        return Err(ClientDialError::Proxy(
+            "invalid SOCKS5 version in reply".into(),
+        ));
+    }
+    if resp[1] != 0x00 {
+        return Err(ClientDialError::Proxy(format!(
+            "SOCKS5 UDP ASSOCIATE rejected with code {}",
+            resp[1]
+        )));
+    }
+
+    let bind_port = u16::from_be_bytes([resp[8], resp[9]]);
+    let bind_addr = match resp[3] {
+        0x01 => {
+            let mut addr = [0u8; 4];
+            stream
+                .read_exact(&mut addr)
+                .await
+                .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+            SocketAddr::new(std::net::Ipv4Addr::from(addr).into(), bind_port)
+        }
+        0x04 => {
+            let mut addr = [0u8; 16];
+            stream
+                .read_exact(&mut addr)
+                .await
+                .map_err(|e| ClientDialError::Proxy(e.to_string()))?;
+            SocketAddr::new(std::net::Ipv6Addr::from(addr).into(), bind_port)
+        }
+        _ => {
+            return Err(ClientDialError::Proxy(format!(
+                "unsupported address type in UDP ASSOCIATE reply: {}",
+                resp[3]
+            )))
+        }
+    };
+
+    Ok(bind_addr)
+}
+
+/// Perform the SOCKS5 CONNECT handshake to the target address.
+pub async fn socks5_connect(
+    stream: &mut TcpStream,
+    proxy: &Socks5ProxyConfig,
+    target: SocketAddr,
+) -> Result<(), String> {
+    socks5_handshake_connect(stream, proxy).await?;
+
+    let mut req = vec![0x05, 0x01, 0x00];
+    match target {
+        SocketAddr::V4(addr) => {
+            req.push(0x01);
+            req.extend_from_slice(&addr.ip().octets());
+            req.extend_from_slice(&addr.port().to_be_bytes());
+        }
+        SocketAddr::V6(addr) => {
+            req.push(0x04);
+            req.extend_from_slice(&addr.ip().octets());
+            req.extend_from_slice(&addr.port().to_be_bytes());
+        }
+    }
+    stream
+        .write_all(&req)
+        .await
+        .map_err(|e| format!("SOCKS5 CONNECT write: {e}"))?;
+
+    let mut resp = [0u8; 10];
+    stream
+        .read_exact(&mut resp)
+        .await
+        .map_err(|e| format!("SOCKS5 CONNECT read: {e}"))?;
+
+    if resp[0] != 0x05 {
+        return Err("invalid SOCKS5 version in CONNECT reply".into());
+    }
+    if resp[1] != 0x00 {
+        return Err(format!("SOCKS5 CONNECT rejected with code {}", resp[1]));
+    }
+
+    match resp[3] {
+        0x01 => {
+            let mut _addr = [0u8; 4];
+            stream
+                .read_exact(&mut _addr)
+                .await
+                .map_err(|e| format!("SOCKS5 CONNECT bind addr read: {e}"))?;
+        }
+        0x04 => {
+            let mut _addr = [0u8; 16];
+            stream
+                .read_exact(&mut _addr)
+                .await
+                .map_err(|e| format!("SOCKS5 CONNECT bind addr read: {e}"))?;
+        }
+        _ => {}
+    }
+
+    Ok(())
+}
+
+async fn socks5_handshake_connect(
+    stream: &mut TcpStream,
+    proxy: &Socks5ProxyConfig,
+) -> Result<(), String> {
+    if let Some(creds) = &proxy.credentials {
+        stream
+            .write_all(&[0x05, 0x01, 0x02])
+            .await
+            .map_err(|e| format!("SOCKS5 greeting write: {e}"))?;
+        let mut resp = [0u8; 2];
+        stream
+            .read_exact(&mut resp)
+            .await
+            .map_err(|e| format!("SOCKS5 greeting read: {e}"))?;
+        if resp[0] != 0x05 || resp[1] != 0x02 {
+            return Err("SOCKS5 server does not support username/password auth".into());
+        }
+        let mut auth_msg = Vec::with_capacity(3 + creds.username.len() + creds.password.len());
+        auth_msg.push(0x01);
+        auth_msg.push(creds.username.len() as u8);
+        auth_msg.extend_from_slice(creds.username.as_bytes());
+        auth_msg.push(creds.password.len() as u8);
+        auth_msg.extend_from_slice(creds.password.as_bytes());
+        stream
+            .write_all(&auth_msg)
+            .await
+            .map_err(|e| format!("SOCKS5 auth write: {e}"))?;
+        let mut auth_resp = [0u8; 2];
+        stream
+            .read_exact(&mut auth_resp)
+            .await
+            .map_err(|e| format!("SOCKS5 auth read: {e}"))?;
+        if auth_resp[1] != 0x00 {
+            return Err("SOCKS5 username/password authentication failed".into());
+        }
+    } else {
+        stream
+            .write_all(&[0x05, 0x01, 0x00])
+            .await
+            .map_err(|e| format!("SOCKS5 greeting write: {e}"))?;
+        let mut resp = [0u8; 2];
+        stream
+            .read_exact(&mut resp)
+            .await
+            .map_err(|e| format!("SOCKS5 greeting read: {e}"))?;
+        if resp[0] != 0x05 || resp[1] != 0x00 {
+            return Err("SOCKS5 server rejected no-auth method".into());
+        }
+    }
+    Ok(())
+}

crates/alknet-client/tests/dial_and_takeover.rs

@@ -0,0 +1,28 @@
+//! Integration test: dial + take-over composition.
+//!
+//! Verifies that the AlknetClient type exists and compiles correctly.
+//! Full end-to-end dial tests (with a real quinn endpoint) are tested
+//! in the assembly layer integration tests (future hub/worker tests).
+
+use alknet_client::AlknetClient;
+use alknet_core::credentials::ConnectionCredentials;
+
+#[tokio::test]
+async fn alknet_client_new_creates_empty_client() {
+    let client = AlknetClient::new();
+    let creds = ConnectionCredentials::new();
+    let _ = (client, creds);
+}
+
+#[test]
+fn alknet_client_is_send_sync() {
+    fn assert_send_sync<T: Send + Sync>() {}
+    assert_send_sync::<AlknetClient>();
+}
+
+#[test]
+fn client_dial_error_is_send_sync() {
+    use alknet_client::ClientDialError;
+    fn assert_send_sync<T: Send + Sync>() {}
+    assert_send_sync::<ClientDialError>();
+}

crates/alknet-core/Cargo.toml

@@ -3,54 +3,37 @@ name = "alknet-core"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
-description = "Core library for Alknet: pluggable SSH tunnel transport, SOCKS5 proxy, port forwarding, and authentication"
+description = "Core library for ALPN-based protocol dispatch: ProtocolHandler trait, Connection, auth, config, and transport-level credentials"
 repository.workspace = true
 
 [lib]
 name = "alknet_core"
 
 [features]
-default = []
-tls = ["dep:tokio-rustls", "dep:rustls", "dep:rustls-pki-types", "dep:webpki-roots"]
-iroh = ["dep:iroh", "dep:url"]
-acme = ["dep:rustls-acme", "dep:futures", "tls"]
-http = ["dep:axum", "dep:hyper", "dep:hyper-util", "dep:tower", "dep:http-body-util"]
-irpc = []
-testutil = []
-transport-traits = []
+default = ["quinn"]
+quinn = ["dep:quinn"]
+iroh = ["dep:iroh"]
 
 [dependencies]
-russh = "0.49"
 tokio = { version = "1", features = ["full"] }
-tracing = "0.1"
-anyhow = "1"
-thiserror = "2"
-tokio-util = { version = "0.7", features = ["compat"] }
-tokio-rustls = { version = "0.26", optional = true }
-rustls = { version = "0.23", optional = true, features = ["aws_lc_rs"] }
-rustls-pki-types = { version = "1", optional = true }
-rustls-acme = { version = "0.12", optional = true }
-futures = { version = "0.3", optional = true }
-webpki-roots = { version = "0.26", optional = true }
-iroh = { version = "0.34", optional = true }
-url = { version = "2", optional = true }
-async-trait = "0.1"
-ipnetwork = "0.21.1"
-arc-swap = "1"
+quinn = { version = "0.11", optional = true }
+iroh = { version = "1.0", optional = true, default-features = false, features = ["tls-aws-lc-rs"] }
+rustls = "0.23"
+rustls-pki-types = "1"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
+toml = "0.8"
+arc-swap = "1"
+async-trait = "0.1"
+tracing = "0.1"
+thiserror = "2"
+zeroize = { version = "1", features = ["alloc", "derive"] }
+bytes = "1"
+futures = "0.3"
 sha2 = "0.10"
 hex = "0.4"
-axum = { version = "0.8", optional = true }
-hyper = { version = "1", optional = true }
-hyper-util = { version = "0.1", features = ["tokio", "server", "service"], optional = true }
-tower = { version = "0.5", optional = true }
-http-body-util = { version = "0.1", optional = true }
+rand = "0.8"
+ed25519-dalek = { version = "2", features = ["rand_core"] }
 
 [dev-dependencies]
-alknet-core = { path = ".", features = ["testutil", "tls", "iroh", "http"] }
 tempfile = "3"
-rcgen = "0.14"
-rand_core = "0.6"
-ssh-key = { version = "0.6", features = ["ed25519", "alloc"] }
-rand = "0.10.1"

crates/alknet-core/src/auth.rs

@@ -0,0 +1,638 @@
+//! Authentication: `AuthContext`, `Identity`, `IdentityProvider`, `AuthToken`,
+//! `ConfigIdentityProvider`.
+//!
+//! See `docs/architecture/crates/core/auth.md` for the full specification and
+//! [ADR-034](../../../docs/architecture/decisions/034-outgoing-only-x509-and-three-peer-roles.md)
+//! for the three-remote-roles decision.
+//!
+//! # Three remote roles (ADR-034 §1)
+//!
+//! The three credential types (`PeerEntry.fingerprints` entries) describe how
+//! a *single* `PeerEntry` can be authenticated. Separately, there are three
+//! distinct remote roles that must not be conflated:
+//!
+//! | Role | Identity | alknet peer? | `PeerEntry` on local side? |
+//! |------|----------|--------------|----------------------------|
+//! | **Public X.509 endpoint** | Domain + CA-issued X.509 | No (local node is a client) | No |
+//! | **Transport relay** (iroh's DERP-equivalent) | iroh `NodeId` (Ed25519) | No (infrastructure) | No |
+//! | **Hub / hosting node** | Ed25519 raw key **and/or** X.509 | Yes (full peer) | Yes |
+//!
+//! `PeerEntry` (and the `PeerId` it resolves to) is the model for peers in
+//! the call-protocol peer graph (ADR-029) — peers that get a stable logical
+//! identity, are addressable via `PeerRef::Specific`, and whose ops land in
+//! the peer-keyed overlay. A pure-client connection to a public X.509
+//! endpoint (e.g. a third-party API) is **not** in that graph on the client
+//! side: no `PeerEntry`, no `PeerId`, no `PeerRef::Specific` routing. The
+//! asymmetry is deliberate — a public domain's operator can change hands, so
+//! there is no stable logical identity to attach.
+//!
+//! The hub case is an ordinary `PeerEntry` that happens to expose both an
+//! Ed25519 fingerprint (P2P path) and an X.509 fingerprint
+//! (`SHA256:<hex>`, WebTransport/HTTPS path) — already supported by
+//! `PeerEntry.fingerprints: Vec<String>` (ADR-030).
+//!
+//! # Client-side verifier selection (ADR-034 §3)
+//!
+//! The `CallClient` / `from_openapi` / `from_mcp` client-side
+//! `ServerCertVerifier` is selected by **whether the local node has a
+//! `PeerEntry` for the remote**, not by key type alone:
+//!
+//! | Local has `PeerEntry` for remote? | Remote cert type | Client verifier |
+//! |----------------------------------|------------------|-----------------|
+//! | No (public X.509 endpoint) | X.509 | `WebPkiServerVerifier` (CA verification) |
+//! | No | Ed25519 raw key | fails closed (no CA to fall back to) |
+//! | Yes (hub, Ed25519 path) | Ed25519 raw key | fingerprint match (`ed25519:<hex>`) |
+//! | Yes (hub, X.509 path) | X.509 | fingerprint match (`SHA256:<hex>`) |
+//!
+//! This is the key-type-aware verifier from OQ-29, with the peer-model
+//! criterion (ADR-034) made explicit. The client-side verifier selection is
+//! a `CallClient` concern (`call/call-client-verifier-selection`), not an
+//! `IdentityProvider` concern — `IdentityProvider` is unchanged by ADR-034.
+
+use std::collections::HashMap;
+use std::net::SocketAddr;
+use std::sync::Arc;
+
+use arc_swap::ArcSwap;
+use async_trait::async_trait;
+use serde::{Deserialize, Serialize};
+
+use crate::config::{DynamicConfig, PeerEntry};
+use crate::store::StoreError;
+
+#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
+pub struct Identity {
+    pub id: String,
+    pub scopes: Vec<String>,
+    pub resources: HashMap<String, Vec<String>>,
+}
+
+#[derive(Debug, Clone)]
+pub struct AuthToken {
+    pub raw: Vec<u8>,
+}
+
+#[derive(Clone)]
+pub struct AuthContext {
+    pub identity: Option<Identity>,
+    pub alpn: Vec<u8>,
+    pub remote_addr: Option<SocketAddr>,
+    pub tls_client_fingerprint: Option<String>,
+}
+
+impl AuthContext {
+    /// Construct an `AuthContext` with no identity, no fingerprint, and no
+    /// remote address — only the ALPN is set. For POCs, tests, and handlers
+    /// that don't require auth. Not gated behind a `test-utils` feature:
+    /// it's a plain `pub fn` useful for any caller that constructs an
+    /// `AuthContext` outside the endpoint's resolution path. The name is
+    /// honest about the semantics: no identity, no fingerprint.
+    pub fn anonymous(alpn: impl Into<Vec<u8>>) -> Self {
+        Self {
+            identity: None,
+            alpn: alpn.into(),
+            remote_addr: None,
+            tls_client_fingerprint: None,
+        }
+    }
+}
+
+pub trait IdentityProvider: Send + Sync + 'static {
+    fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity>;
+    fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity>;
+}
+
+/// Write trait — management path, async (ADR-035). `ConfigIdentityProvider`
+/// does NOT implement this (config reload is its write path). A persistence
+/// adapter (e.g. `SqliteIdentityProvider` in `alknet-store-sqlite`) does:
+/// writes hit the backend, emit a honker `NOTIFY`, and the local `LISTEN`
+/// refreshes the in-memory read index.
+#[async_trait]
+pub trait IdentityStore: IdentityProvider {
+    async fn put_peer(&self, peer: &PeerEntry) -> Result<(), StoreError>;
+    async fn update_peer(&self, peer_id: &str, peer: &PeerEntry) -> Result<(), StoreError>;
+    async fn remove_peer(&self, peer_id: &str) -> Result<(), StoreError>;
+}
+
+pub struct ConfigIdentityProvider {
+    dynamic: Arc<ArcSwap<DynamicConfig>>,
+}
+
+impl ConfigIdentityProvider {
+    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
+        Self { dynamic }
+    }
+}
+
+impl IdentityProvider for ConfigIdentityProvider {
+    fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
+        let config = self.dynamic.load();
+        config.auth.resolve_identity_from_fingerprint(fingerprint)
+    }
+
+    fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
+        let config = self.dynamic.load();
+        let token_str = String::from_utf8_lossy(&token.raw);
+        config.auth.resolve_identity_from_token(&token_str)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::config::{ApiKeyEntry, AuthPolicy, DynamicConfig, PeerEntry, RateLimitConfig};
+
+    fn compute_api_key_hash(token: &str) -> String {
+        use sha2::{Digest, Sha256};
+        let mut hasher = Sha256::new();
+        hasher.update(token.as_bytes());
+        let result = hasher.finalize();
+        format!("sha256:{}", hex::encode(result))
+    }
+
+    fn make_provider(
+        config: DynamicConfig,
+    ) -> (ConfigIdentityProvider, Arc<ArcSwap<DynamicConfig>>) {
+        let arc_swap = Arc::new(ArcSwap::new(Arc::new(config)));
+        let provider = ConfigIdentityProvider::new(Arc::clone(&arc_swap));
+        (provider, arc_swap)
+    }
+
+    fn peer_entry_with_fingerprint(peer_id: &str, fingerprint: &str) -> PeerEntry {
+        PeerEntry {
+            peer_id: peer_id.to_string(),
+            fingerprints: vec![fingerprint.to_string()],
+            auth_token_hash: None,
+            scopes: vec!["relay:connect".to_string()],
+            resources: std::collections::HashMap::new(),
+            display_name: None,
+            enabled: true,
+        }
+    }
+
+    fn config_with_peer_entry(peer_id: &str, fingerprint: &str) -> DynamicConfig {
+        DynamicConfig {
+            auth: AuthPolicy {
+                peers: vec![peer_entry_with_fingerprint(peer_id, fingerprint)],
+                api_keys: Vec::new(),
+            },
+            rate_limits: RateLimitConfig::default(),
+        }
+    }
+
+    fn config_with_api_key(entry: ApiKeyEntry) -> DynamicConfig {
+        DynamicConfig {
+            auth: AuthPolicy {
+                peers: Vec::new(),
+                api_keys: vec![entry],
+            },
+            rate_limits: RateLimitConfig::default(),
+        }
+    }
+
+    fn compute_token_hash(token: &str) -> String {
+        use sha2::{Digest, Sha256};
+        let mut hasher = Sha256::new();
+        hasher.update(token.as_bytes());
+        let result = hasher.finalize();
+        format!("sha256:{}", hex::encode(result))
+    }
+
+    #[test]
+    fn identity_fields_and_equality() {
+        let mut resources = HashMap::new();
+        resources.insert(
+            "service".to_string(),
+            vec!["gitea".to_string(), "registry".to_string()],
+        );
+        let id = Identity {
+            id: "SHA256:abc123".to_string(),
+            scopes: vec!["relay:connect".to_string()],
+            resources,
+        };
+        let id2 = id.clone();
+        assert_eq!(id, id2);
+        assert_eq!(id.id, "SHA256:abc123");
+    }
+
+    #[test]
+    fn auth_token_is_clone() {
+        let token = AuthToken {
+            raw: b"alk_test".to_vec(),
+        };
+        let cloned = token.clone();
+        assert_eq!(token.raw, cloned.raw);
+    }
+
+    #[test]
+    fn auth_context_is_clone() {
+        let ctx = AuthContext {
+            identity: None,
+            alpn: b"alknet/test".to_vec(),
+            remote_addr: None,
+            tls_client_fingerprint: None,
+        };
+        let cloned = ctx.clone();
+        assert_eq!(cloned.alpn, b"alknet/test");
+        assert!(cloned.identity.is_none());
+    }
+
+    #[test]
+    fn auth_context_anonymous_sets_alpn_only() {
+        let ctx = AuthContext::anonymous(b"alknet/test");
+        assert_eq!(ctx.alpn, b"alknet/test");
+        assert!(ctx.identity.is_none());
+        assert!(ctx.remote_addr.is_none());
+        assert!(ctx.tls_client_fingerprint.is_none());
+    }
+
+    #[test]
+    fn fingerprint_resolution_known_returns_some() {
+        let (provider, _) = make_provider(config_with_peer_entry("worker-a", "SHA256:abc123"));
+        let identity = provider
+            .resolve_from_fingerprint("SHA256:abc123")
+            .expect("known fingerprint resolves");
+        assert_eq!(identity.id, "worker-a");
+        assert_eq!(identity.scopes, vec!["relay:connect".to_string()]);
+        assert!(identity.resources.is_empty());
+    }
+
+    #[test]
+    fn fingerprint_resolution_unknown_returns_none() {
+        let (provider, _) = make_provider(config_with_peer_entry("worker-a", "SHA256:abc123"));
+        assert!(provider
+            .resolve_from_fingerprint("SHA256:unknown")
+            .is_none());
+    }
+
+    #[test]
+    fn fingerprint_resolution_empty_config_returns_none() {
+        let (provider, _) = make_provider(DynamicConfig::default());
+        assert!(provider
+            .resolve_from_fingerprint("SHA256:anything")
+            .is_none());
+    }
+
+    #[test]
+    fn token_resolution_valid_non_expired_returns_some() {
+        let token_str = "alk_testsecret123";
+        let hash = compute_api_key_hash(token_str);
+        let entry = ApiKeyEntry {
+            prefix: "alk_test".to_string(),
+            hash,
+            scopes: vec!["relay:connect".to_string()],
+            description: "test key".to_string(),
+            expires_at: None,
+        };
+        let (provider, _) = make_provider(config_with_api_key(entry));
+        let token = AuthToken {
+            raw: token_str.as_bytes().to_vec(),
+        };
+        let identity = provider
+            .resolve_from_token(&token)
+            .expect("valid non-expired token resolves");
+        assert_eq!(identity.id, "alk_test");
+        assert_eq!(identity.scopes, vec!["relay:connect".to_string()]);
+    }
+
+    #[test]
+    fn token_resolution_expired_returns_none() {
+        let token_str = "alk_testsecret123";
+        let hash = compute_api_key_hash(token_str);
+        let entry = ApiKeyEntry {
+            prefix: "alk_test".to_string(),
+            hash,
+            scopes: vec!["relay:connect".to_string()],
+            description: "expired key".to_string(),
+            expires_at: Some(1),
+        };
+        let (provider, _) = make_provider(config_with_api_key(entry));
+        let token = AuthToken {
+            raw: token_str.as_bytes().to_vec(),
+        };
+        assert!(provider.resolve_from_token(&token).is_none());
+    }
+
+    #[test]
+    fn token_resolution_unknown_returns_none() {
+        let token_str = "alk_testsecret123";
+        let hash = compute_api_key_hash(token_str);
+        let entry = ApiKeyEntry {
+            prefix: "alk_test".to_string(),
+            hash,
+            scopes: vec!["relay:connect".to_string()],
+            description: "test key".to_string(),
+            expires_at: None,
+        };
+        let (provider, _) = make_provider(config_with_api_key(entry));
+        let token = AuthToken {
+            raw: b"alk_unknown".to_vec(),
+        };
+        assert!(provider.resolve_from_token(&token).is_none());
+    }
+
+    #[test]
+    fn token_resolution_wrong_hash_returns_none() {
+        let entry = ApiKeyEntry {
+            prefix: "alk_test".to_string(),
+            hash: "sha256:deadbeef".to_string(),
+            scopes: vec!["relay:connect".to_string()],
+            description: "wrong hash".to_string(),
+            expires_at: None,
+        };
+        let (provider, _) = make_provider(config_with_api_key(entry));
+        let token = AuthToken {
+            raw: b"alk_testsecret123".to_vec(),
+        };
+        assert!(provider.resolve_from_token(&token).is_none());
+    }
+
+    #[test]
+    fn token_resolution_non_alk_prefix_returns_none() {
+        let (provider, _) = make_provider(DynamicConfig::default());
+        let token = AuthToken {
+            raw: b"bearer_token".to_vec(),
+        };
+        assert!(provider.resolve_from_token(&token).is_none());
+    }
+
+    #[test]
+    fn config_reload_changes_resolution_immediately() {
+        let (provider, arc_swap) = make_provider(DynamicConfig::default());
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_none());
+
+        let new_config = config_with_peer_entry("worker-a", "SHA256:abc123");
+        arc_swap.store(Arc::new(new_config));
+
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_some());
+    }
+
+    #[test]
+    fn config_reload_removes_fingerprint_access_immediately() {
+        let (provider, arc_swap) =
+            make_provider(config_with_peer_entry("worker-a", "SHA256:abc123"));
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_some());
+
+        arc_swap.store(Arc::new(DynamicConfig::default()));
+
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_none());
+    }
+
+    #[test]
+    fn config_reload_handle_reloads_config() {
+        use crate::config::ConfigReloadHandle;
+        let arc_swap = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
+        let provider = ConfigIdentityProvider::new(Arc::clone(&arc_swap));
+        let handle = ConfigReloadHandle::new(arc_swap);
+
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_none());
+
+        handle.reload(config_with_peer_entry("worker-a", "SHA256:abc123"));
+
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_some());
+    }
+
+    #[test]
+    fn config_identity_provider_is_identity_provider_not_store() {
+        fn assert_provider<T: IdentityProvider>() {}
+        fn assert_not_store<T>() {}
+        assert_provider::<ConfigIdentityProvider>();
+        assert_not_store::<ConfigIdentityProvider>();
+    }
+
+    #[test]
+    fn token_resolution_via_peer_entry_auth_token_hash_returns_peer_id() {
+        let token_str = "peer-bearer-secret";
+        let mut entry = peer_entry_with_fingerprint("worker-a", "SHA256:abc123");
+        entry.auth_token_hash = Some(compute_token_hash(token_str));
+        let config = DynamicConfig {
+            auth: AuthPolicy {
+                peers: vec![entry],
+                api_keys: Vec::new(),
+            },
+            rate_limits: RateLimitConfig::default(),
+        };
+        let (provider, _) = make_provider(config);
+        let token = AuthToken {
+            raw: token_str.as_bytes().to_vec(),
+        };
+        let identity = provider
+            .resolve_from_token(&token)
+            .expect("matching PeerEntry.auth_token_hash resolves");
+        assert_eq!(identity.id, "worker-a");
+        assert_eq!(identity.scopes, vec!["relay:connect".to_string()]);
+    }
+
+    #[test]
+    fn token_resolution_falls_through_to_api_key_when_no_peer_entry_matches() {
+        let api_token = "alk_test_secret";
+        let mut entry = peer_entry_with_fingerprint("worker-a", "SHA256:abc123");
+        entry.auth_token_hash = Some(compute_token_hash("different-token"));
+        let api_entry = ApiKeyEntry {
+            prefix: "alk_test".to_string(),
+            hash: compute_api_key_hash(api_token),
+            scopes: vec!["admin".to_string()],
+            description: "fall-through key".to_string(),
+            expires_at: None,
+        };
+        let config = DynamicConfig {
+            auth: AuthPolicy {
+                peers: vec![entry],
+                api_keys: vec![api_entry],
+            },
+            rate_limits: RateLimitConfig::default(),
+        };
+        let (provider, _) = make_provider(config);
+        let token = AuthToken {
+            raw: api_token.as_bytes().to_vec(),
+        };
+        let identity = provider
+            .resolve_from_token(&token)
+            .expect("api key fall-through resolves");
+        assert_eq!(identity.id, "alk_test");
+        assert_eq!(identity.scopes, vec!["admin".to_string()]);
+    }
+
+    #[test]
+    fn disabled_peer_entry_returns_none_on_fingerprint_resolution() {
+        let mut entry = peer_entry_with_fingerprint("worker-a", "SHA256:abc123");
+        entry.enabled = false;
+        let config = DynamicConfig {
+            auth: AuthPolicy {
+                peers: vec![entry],
+                api_keys: Vec::new(),
+            },
+            rate_limits: RateLimitConfig::default(),
+        };
+        let (provider, _) = make_provider(config);
+        assert!(provider.resolve_from_fingerprint("SHA256:abc123").is_none());
+    }
+
+    #[test]
+    fn disabled_peer_entry_returns_none_on_token_resolution() {
+        let token_str = "peer-bearer-secret";
+        let mut entry = peer_entry_with_fingerprint("worker-a", "SHA256:abc123");
+        entry.auth_token_hash = Some(compute_token_hash(token_str));
+        entry.enabled = false;
+        let config = DynamicConfig {
+            auth: AuthPolicy {
+                peers: vec![entry],
+                api_keys: Vec::new(),
+            },
+            rate_limits: RateLimitConfig::default(),
+        };
+        let (provider, _) = make_provider(config);
+        let token = AuthToken {
+            raw: token_str.as_bytes().to_vec(),
+        };
+        assert!(provider.resolve_from_token(&token).is_none());
+    }
+}
+
+#[cfg(test)]
+mod identity_store_tests {
+    use super::*;
+    use crate::config::PeerEntry;
+    use std::collections::HashMap as StdHashMap;
+    use std::sync::RwLock;
+
+    fn make_peer(peer_id: &str) -> PeerEntry {
+        PeerEntry {
+            peer_id: peer_id.to_string(),
+            fingerprints: vec![format!("SHA256:{peer_id}")],
+            auth_token_hash: None,
+            scopes: vec!["relay:connect".to_string()],
+            resources: StdHashMap::new(),
+            display_name: None,
+            enabled: true,
+        }
+    }
+
+    struct MockIdentityStore {
+        peers: RwLock<HashMap<String, PeerEntry>>,
+    }
+
+    impl MockIdentityStore {
+        fn new() -> Self {
+            Self {
+                peers: RwLock::new(HashMap::new()),
+            }
+        }
+    }
+
+    impl IdentityProvider for MockIdentityStore {
+        fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
+            let peers = self.peers.read().unwrap_or_else(|e| e.into_inner());
+            peers.values().find_map(|p| {
+                if p.fingerprints.iter().any(|f| f == fingerprint) && p.enabled {
+                    Some(Identity {
+                        id: p.peer_id.clone(),
+                        scopes: p.scopes.clone(),
+                        resources: p.resources.clone(),
+                    })
+                } else {
+                    None
+                }
+            })
+        }
+
+        fn resolve_from_token(&self, _token: &AuthToken) -> Option<Identity> {
+            None
+        }
+    }
+
+    #[async_trait]
+    impl IdentityStore for MockIdentityStore {
+        async fn put_peer(&self, peer: &PeerEntry) -> Result<(), StoreError> {
+            let mut peers = self.peers.write().unwrap_or_else(|e| e.into_inner());
+            peers.insert(peer.peer_id.clone(), peer.clone());
+            Ok(())
+        }
+
+        async fn update_peer(&self, peer_id: &str, peer: &PeerEntry) -> Result<(), StoreError> {
+            let mut peers = self.peers.write().unwrap_or_else(|e| e.into_inner());
+            if !peers.contains_key(peer_id) {
+                return Err(StoreError::NotFound {
+                    entity: peer_id.to_string(),
+                });
+            }
+            peers.remove(peer_id);
+            peers.insert(peer.peer_id.clone(), peer.clone());
+            Ok(())
+        }
+
+        async fn remove_peer(&self, peer_id: &str) -> Result<(), StoreError> {
+            let mut peers = self.peers.write().unwrap_or_else(|e| e.into_inner());
+            if peers.remove(peer_id).is_none() {
+                return Err(StoreError::NotFound {
+                    entity: peer_id.to_string(),
+                });
+            }
+            Ok(())
+        }
+    }
+
+    #[tokio::test]
+    async fn mock_put_peer_upserts() {
+        let store = MockIdentityStore::new();
+        let mut peer = make_peer("worker-a");
+        store.put_peer(&peer).await.unwrap();
+        assert_eq!(
+            store
+                .resolve_from_fingerprint("SHA256:worker-a")
+                .unwrap()
+                .id,
+            "worker-a"
+        );
+
+        peer.display_name = Some("renamed".to_string());
+        store.put_peer(&peer).await.unwrap();
+        let peers = store.peers.read().unwrap_or_else(|e| e.into_inner());
+        assert_eq!(peers.len(), 1);
+        assert_eq!(
+            peers.get("worker-a").unwrap().display_name.as_deref(),
+            Some("renamed")
+        );
+    }
+
+    #[tokio::test]
+    async fn mock_update_peer_existing_succeeds() {
+        let store = MockIdentityStore::new();
+        store.put_peer(&make_peer("worker-a")).await.unwrap();
+        let updated = make_peer("worker-b");
+        store.update_peer("worker-a", &updated).await.unwrap();
+        assert!(store.resolve_from_fingerprint("SHA256:worker-a").is_none());
+        assert!(store.resolve_from_fingerprint("SHA256:worker-b").is_some());
+    }
+
+    #[tokio::test]
+    async fn mock_update_peer_missing_returns_not_found() {
+        let store = MockIdentityStore::new();
+        let err = store
+            .update_peer("ghost", &make_peer("ghost"))
+            .await
+            .unwrap_err();
+        assert!(matches!(err, StoreError::NotFound { .. }));
+    }
+
+    #[tokio::test]
+    async fn mock_remove_peer_existing_succeeds() {
+        let store = MockIdentityStore::new();
+        store.put_peer(&make_peer("worker-a")).await.unwrap();
+        store.remove_peer("worker-a").await.unwrap();
+        assert!(store.resolve_from_fingerprint("SHA256:worker-a").is_none());
+    }
+
+    #[tokio::test]
+    async fn mock_remove_peer_missing_returns_not_found() {
+        let store = MockIdentityStore::new();
+        let err = store.remove_peer("ghost").await.unwrap_err();
+        assert!(matches!(err, StoreError::NotFound { .. }));
+    }
+
+    #[test]
+    fn mock_identity_store_is_identity_provider() {
+        fn assert_provider<T: IdentityProvider>() {}
+        assert_provider::<MockIdentityStore>();
+    }
+}

crates/alknet-core/src/auth/auth_protocol.rs

@@ -1,262 +0,0 @@
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-
-use crate::auth::identity::{AuthToken, ConfigIdentityProvider, Identity, IdentityProvider};
-use crate::config::DynamicConfig;
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum AuthProtocol {
-    VerifyPubkey {
-        fingerprint: String,
-        key_data: Vec<u8>,
-    },
-    VerifyToken {
-        token_bytes: Vec<u8>,
-        timestamp: u64,
-    },
-    ReloadKeys,
-    CheckAccess {
-        identity: Identity,
-        operation: String,
-    },
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum AuthResult {
-    Ok(Identity),
-    Denied(String),
-}
-
-pub struct AuthServiceImpl {
-    provider: ConfigIdentityProvider,
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-}
-
-impl AuthServiceImpl {
-    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
-        let provider = ConfigIdentityProvider::new(Arc::clone(&dynamic));
-        Self { provider, dynamic }
-    }
-
-    pub fn verify_pubkey(&self, fingerprint: &str) -> AuthResult {
-        match self.provider.resolve_from_fingerprint(fingerprint) {
-            Some(identity) => AuthResult::Ok(identity),
-            None => AuthResult::Denied(format!("key not authorized: {}", fingerprint)),
-        }
-    }
-
-    pub fn verify_token(&self, token: &AuthToken) -> AuthResult {
-        match self.provider.resolve_from_token(token) {
-            Some(identity) => AuthResult::Ok(identity),
-            None => AuthResult::Denied("token verification failed".to_string()),
-        }
-    }
-
-    pub fn reload_keys(&self) {
-        self.dynamic.rcu(Arc::clone);
-    }
-
-    pub fn check_access(&self, identity: &Identity, operation: &str) -> AuthResult {
-        if identity.scopes.iter().any(|s| s == operation) {
-            AuthResult::Ok(identity.clone())
-        } else {
-            AuthResult::Denied(format!(
-                "identity {} lacks scope: {}",
-                identity.id, operation
-            ))
-        }
-    }
-}
-
-impl std::fmt::Debug for AuthServiceImpl {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AuthServiceImpl").finish()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::keys::KeySource;
-    use crate::auth::ServerAuthConfig;
-    use crate::config::AuthPolicy;
-    use russh::keys::ssh_key::HashAlg;
-    use russh::keys::PrivateKey;
-    use std::io::Write;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const ED25519_PUBLIC_KEY: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV ubuntu@ns528096";
-
-    fn load_key() -> PrivateKey {
-        russh::keys::decode_secret_key(ED25519_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn make_authorized_keys_file(keys_content: &str) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        f.write_all(keys_content.as_bytes()).unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    fn make_service(keys_content: &str) -> (AuthServiceImpl, Arc<ArcSwap<DynamicConfig>>) {
-        let f = make_authorized_keys_file(keys_content);
-        let server_auth =
-            ServerAuthConfig::from_keys_and_ca(Some(KeySource::File(f.path().to_path_buf())), None)
-                .unwrap();
-        let auth_policy = AuthPolicy::from_server_auth_config(server_auth);
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let service = AuthServiceImpl::new(Arc::clone(&arc_swap));
-        (service, arc_swap)
-    }
-
-    #[test]
-    fn auth_service_verify_pubkey_valid() {
-        let (service, _) = make_service(ED25519_PUBLIC_KEY);
-        let key = load_key().public_key().clone();
-        let fingerprint = format!("{}", key.fingerprint(HashAlg::Sha256));
-        let result = service.verify_pubkey(&fingerprint);
-        assert!(matches!(result, AuthResult::Ok(_)));
-        if let AuthResult::Ok(identity) = result {
-            assert_eq!(identity.id, fingerprint);
-        }
-    }
-
-    #[test]
-    fn auth_service_verify_pubkey_invalid() {
-        let (service, _) = make_service(ED25519_PUBLIC_KEY);
-        let result = service.verify_pubkey("SHA256:invalid");
-        assert!(matches!(result, AuthResult::Denied(_)));
-    }
-
-    #[test]
-    fn auth_service_verify_pubkey_matches_identity_provider() {
-        let (service, arc_swap) = make_service(ED25519_PUBLIC_KEY);
-        let provider = ConfigIdentityProvider::new(Arc::clone(&arc_swap));
-        let key = load_key().public_key().clone();
-        let fingerprint = format!("{}", key.fingerprint(HashAlg::Sha256));
-
-        let service_result = service.verify_pubkey(&fingerprint);
-        let provider_result = provider.resolve_from_fingerprint(&fingerprint);
-
-        match service_result {
-            AuthResult::Ok(identity) => {
-                assert_eq!(identity, provider_result.unwrap());
-            }
-            AuthResult::Denied(_) => {
-                assert!(provider_result.is_none());
-            }
-        }
-    }
-
-    #[test]
-    fn auth_service_verify_token_returns_denied() {
-        let (service, _) = make_service(ED25519_PUBLIC_KEY);
-        let token = AuthToken {
-            raw: b"test-token".to_vec(),
-        };
-        let result = service.verify_token(&token);
-        assert!(matches!(result, AuthResult::Denied(_)));
-    }
-
-    #[test]
-    fn auth_service_check_access_granted() {
-        let (service, _) = make_service(ED25519_PUBLIC_KEY);
-        let key = load_key().public_key().clone();
-        let fingerprint = format!("{}", key.fingerprint(HashAlg::Sha256));
-        let identity = Identity {
-            id: fingerprint,
-            scopes: vec!["relay:connect".to_string()],
-            resources: std::collections::HashMap::new(),
-        };
-        let result = service.check_access(&identity, "relay:connect");
-        assert!(matches!(result, AuthResult::Ok(_)));
-    }
-
-    #[test]
-    fn auth_service_check_access_denied() {
-        let (service, _) = make_service(ED25519_PUBLIC_KEY);
-        let identity = Identity {
-            id: "test".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: std::collections::HashMap::new(),
-        };
-        let result = service.check_access(&identity, "admin:write");
-        assert!(matches!(result, AuthResult::Denied(_)));
-    }
-
-    #[test]
-    fn auth_protocol_variants() {
-        let identity = Identity {
-            id: "SHA256:abc".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: std::collections::HashMap::new(),
-        };
-
-        let verify_pubkey = AuthProtocol::VerifyPubkey {
-            fingerprint: "SHA256:abc".to_string(),
-            key_data: vec![1, 2, 3],
-        };
-        match &verify_pubkey {
-            AuthProtocol::VerifyPubkey {
-                fingerprint,
-                key_data,
-            } => {
-                assert_eq!(fingerprint, "SHA256:abc");
-                assert_eq!(key_data, &vec![1, 2, 3]);
-            }
-            _ => panic!("expected VerifyPubkey variant"),
-        }
-
-        let verify_token = AuthProtocol::VerifyToken {
-            token_bytes: vec![4, 5, 6],
-            timestamp: 12345,
-        };
-        match &verify_token {
-            AuthProtocol::VerifyToken {
-                token_bytes,
-                timestamp,
-            } => {
-                assert_eq!(token_bytes, &vec![4, 5, 6]);
-                assert_eq!(*timestamp, 12345);
-            }
-            _ => panic!("expected VerifyToken variant"),
-        }
-
-        assert!(matches!(AuthProtocol::ReloadKeys, AuthProtocol::ReloadKeys));
-
-        let check = AuthProtocol::CheckAccess {
-            identity: identity.clone(),
-            operation: "relay:connect".to_string(),
-        };
-        match &check {
-            AuthProtocol::CheckAccess {
-                identity: id,
-                operation,
-            } => {
-                assert_eq!(id.id, "SHA256:abc");
-                assert_eq!(operation, "relay:connect");
-            }
-            _ => panic!("expected CheckAccess variant"),
-        }
-    }
-
-    #[test]
-    fn auth_result_ok_identity() {
-        let identity = Identity {
-            id: "test".to_string(),
-            scopes: vec![],
-            resources: std::collections::HashMap::new(),
-        };
-        let result = AuthResult::Ok(identity.clone());
-        assert_eq!(result, AuthResult::Ok(identity));
-    }
-
-    #[test]
-    fn auth_result_denied_message() {
-        let result = AuthResult::Denied("access denied".to_string());
-        assert_eq!(result, AuthResult::Denied("access denied".to_string()));
-    }
-}

crates/alknet-core/src/auth/client_auth.rs

@@ -1,176 +0,0 @@
-use std::sync::Arc;
-
-use async_trait::async_trait;
-use russh::client;
-use russh::keys::key::PrivateKeyWithHashAlg;
-use russh::keys::{PrivateKey, PublicKey};
-
-use crate::auth::keys::KeySource;
-use crate::error::ConfigError;
-
-/// Client-side SSH authentication configuration.
-///
-/// Holds the private key used for SSH authentication and an optional
-/// public key override. When no public key is provided, it is derived
-/// from the private key.
-pub struct ClientAuthConfig {
-    private_key: Arc<PrivateKey>,
-    public_key: PublicKey,
-}
-
-impl ClientAuthConfig {
-    /// Load a `ClientAuthConfig` from a key source (file or in-memory).
-    pub fn from_key_source(source: KeySource) -> Result<Self, ConfigError> {
-        let private_key = crate::auth::keys::load_private_key(source)?;
-        let public_key = private_key.public_key().clone();
-        Ok(Self {
-            private_key: Arc::new(private_key),
-            public_key,
-        })
-    }
-
-    /// Returns the private key wrapped in `Arc` for use with russh authentication.
-    pub fn private_key(&self) -> Arc<PrivateKey> {
-        Arc::clone(&self.private_key)
-    }
-
-    /// Returns the public key derived from (or overridden for) this config.
-    pub fn public_key(&self) -> &PublicKey {
-        &self.public_key
-    }
-
-    /// Authenticate with the given SSH session handle and username.
-    pub async fn authenticate<H: client::Handler>(
-        &self,
-        handle: &mut client::Handle<H>,
-        username: &str,
-    ) -> Result<bool, russh::Error> {
-        let key_with_alg = PrivateKeyWithHashAlg::new(Arc::clone(&self.private_key), None)?;
-        handle.authenticate_publickey(username, key_with_alg).await
-    }
-}
-
-/// Client handler implementing `russh::client::Handler`.
-///
-/// Provides the callbacks required by russh during the SSH handshake.
-/// Server key verification is delegated to a configurable callback;
-/// the default accepts all server keys (suitable for testing or when
-/// transport-layer verification — e.g. TLS — is already in place).
-pub struct ClientHandler {
-    pub_key: PublicKey,
-    check_server_key_fn: Box<dyn Fn(&PublicKey) -> bool + Send + Sync>,
-}
-
-impl ClientHandler {
-    /// Create a new client handler from a `ClientAuthConfig`.
-    pub fn from_config(config: &ClientAuthConfig) -> Self {
-        Self {
-            pub_key: config.public_key().clone(),
-            check_server_key_fn: Box::new(|_| true),
-        }
-    }
-
-    /// Create a client handler with a custom server key verification callback.
-    pub fn with_server_key_check(
-        config: &ClientAuthConfig,
-        check_fn: impl Fn(&PublicKey) -> bool + Send + Sync + 'static,
-    ) -> Self {
-        Self {
-            pub_key: config.public_key().clone(),
-            check_server_key_fn: Box::new(check_fn),
-        }
-    }
-
-    /// Returns the public key associated with this handler.
-    pub fn public_key(&self) -> &PublicKey {
-        &self.pub_key
-    }
-}
-
-#[async_trait]
-impl client::Handler for ClientHandler {
-    type Error = russh::Error;
-
-    async fn check_server_key(
-        &mut self,
-        server_public_key: &PublicKey,
-    ) -> Result<bool, Self::Error> {
-        Ok((self.check_server_key_fn)(server_public_key))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use russh::client::Handler;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    #[test]
-    fn from_key_source_memory() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        assert_eq!(
-            config.public_key().algorithm(),
-            russh::keys::Algorithm::Ed25519
-        );
-    }
-
-    #[test]
-    fn handler_from_config() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        let handler = ClientHandler::from_config(&config);
-        assert_eq!(
-            handler.public_key().algorithm(),
-            russh::keys::Algorithm::Ed25519
-        );
-    }
-
-    #[test]
-    fn handler_with_custom_server_key_check() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        let handler = ClientHandler::with_server_key_check(&config, |_pk| false);
-        assert_eq!(
-            handler.public_key().algorithm(),
-            russh::keys::Algorithm::Ed25519
-        );
-    }
-
-    #[test]
-    fn from_key_source_invalid_key() {
-        let source = KeySource::Memory(b"not a key".to_vec());
-        let result = ClientAuthConfig::from_key_source(source);
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn handler_check_server_key_accepts_by_default() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        let mut handler = ClientHandler::from_config(&config);
-        let some_key = config.public_key().clone();
-        let result = handler.check_server_key(&some_key).await.unwrap();
-        assert!(result);
-    }
-
-    #[tokio::test]
-    async fn handler_check_server_key_rejects_with_custom_fn() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        let mut handler = ClientHandler::with_server_key_check(&config, |_pk| false);
-        let some_key = config.public_key().clone();
-        let result = handler.check_server_key(&some_key).await.unwrap();
-        assert!(!result);
-    }
-
-    #[test]
-    fn private_key_arc_dedup() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let config = ClientAuthConfig::from_key_source(source).unwrap();
-        let key1 = config.private_key();
-        let key2 = config.private_key();
-        assert!(Arc::ptr_eq(&key1, &key2));
-    }
-}

crates/alknet-core/src/auth/identity.rs

@@ -1,349 +0,0 @@
-//! Identity resolution and the `IdentityProvider` trait.
-//!
-//! See [ADR-029](docs/architecture/decisions/029-identity-provider.md) and
-//! [ADR-028](docs/architecture/decisions/028-identity-model.md).
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-
-use crate::config::DynamicConfig;
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct Identity {
-    pub id: String,
-    pub scopes: Vec<String>,
-    pub resources: HashMap<String, Vec<String>>,
-}
-
-#[derive(Debug, Clone)]
-pub struct AuthToken {
-    pub raw: Vec<u8>,
-}
-
-pub trait IdentityProvider: Send + Sync + 'static {
-    fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity>;
-
-    fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity>;
-}
-
-pub struct ConfigIdentityProvider {
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-}
-
-impl ConfigIdentityProvider {
-    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
-        Self { dynamic }
-    }
-}
-
-impl IdentityProvider for ConfigIdentityProvider {
-    fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
-        let config = self.dynamic.load();
-        let auth = &config.auth;
-        auth.resolve_identity_from_fingerprint(fingerprint)
-    }
-
-    fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
-        let config = self.dynamic.load();
-        let auth = &config.auth;
-        let token_str = String::from_utf8_lossy(&token.raw);
-        if token_str.starts_with(crate::config::API_KEY_PREFIX) {
-            return auth.resolve_api_key(&token_str);
-        }
-        None
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::keys::KeySource;
-    use crate::auth::ServerAuthConfig;
-    use crate::config::AuthPolicy;
-    use russh::keys::ssh_key::HashAlg;
-    use russh::keys::PrivateKey;
-    use std::io::Write;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const ED25519_PUBLIC_KEY: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV ubuntu@ns528096";
-
-    fn load_key() -> PrivateKey {
-        russh::keys::decode_secret_key(ED25519_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn make_authorized_keys_file(keys_content: &str) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        f.write_all(keys_content.as_bytes()).unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    fn make_provider(keys_content: &str) -> (ConfigIdentityProvider, Arc<ArcSwap<DynamicConfig>>) {
-        let f = make_authorized_keys_file(keys_content);
-        let server_auth =
-            ServerAuthConfig::from_keys_and_ca(Some(KeySource::File(f.path().to_path_buf())), None)
-                .unwrap();
-        let auth_policy = AuthPolicy::from_server_auth_config(server_auth);
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(Arc::clone(&arc_swap));
-        (provider, arc_swap)
-    }
-
-    #[test]
-    fn identity_fields() {
-        let mut resources = HashMap::new();
-        resources.insert(
-            "service".to_string(),
-            vec!["gitea".to_string(), "registry".to_string()],
-        );
-        let identity = Identity {
-            id: "SHA256:abc123".to_string(),
-            scopes: vec![
-                "relay:connect".to_string(),
-                "service:gitea:read".to_string(),
-            ],
-            resources,
-        };
-        assert_eq!(identity.id, "SHA256:abc123");
-        assert_eq!(identity.scopes, vec!["relay:connect", "service:gitea:read"]);
-        assert_eq!(
-            identity.resources.get("service").unwrap(),
-            &vec!["gitea".to_string(), "registry".to_string()]
-        );
-    }
-
-    #[test]
-    fn identity_equality() {
-        let id1 = Identity {
-            id: "test".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        let id2 = Identity {
-            id: "test".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        assert_eq!(id1, id2);
-    }
-
-    #[test]
-    fn identity_inequality_different_id() {
-        let id1 = Identity {
-            id: "a".to_string(),
-            scopes: vec![],
-            resources: HashMap::new(),
-        };
-        let id2 = Identity {
-            id: "b".to_string(),
-            scopes: vec![],
-            resources: HashMap::new(),
-        };
-        assert_ne!(id1, id2);
-    }
-
-    #[test]
-    fn config_identity_provider_resolves_valid_fingerprint() {
-        let (provider, _) = make_provider(ED25519_PUBLIC_KEY);
-        let key = load_key().public_key().clone();
-        let fingerprint = format!("{}", key.fingerprint(HashAlg::Sha256));
-        let identity = provider.resolve_from_fingerprint(&fingerprint);
-        assert!(identity.is_some());
-        let identity = identity.unwrap();
-        assert_eq!(identity.id, fingerprint);
-        assert!(!identity.scopes.is_empty());
-    }
-
-    #[test]
-    fn config_identity_provider_rejects_invalid_fingerprint() {
-        let (provider, _) = make_provider(ED25519_PUBLIC_KEY);
-        let identity = provider.resolve_from_fingerprint("SHA256:invalid");
-        assert!(identity.is_none());
-    }
-
-    #[test]
-    fn config_identity_provider_empty_config_rejects_all() {
-        let dynamic = DynamicConfig::default();
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-        let identity = provider.resolve_from_fingerprint("SHA256:anything");
-        assert!(identity.is_none());
-    }
-
-    #[test]
-    fn config_identity_provider_resolve_from_token_returns_none() {
-        let (provider, _) = make_provider(ED25519_PUBLIC_KEY);
-        let token = AuthToken {
-            raw: b"test-token".to_vec(),
-        };
-        assert!(provider.resolve_from_token(&token).is_none());
-    }
-
-    fn compute_api_key_hash(token: &str) -> String {
-        use sha2::{Digest, Sha256};
-        let mut hasher = Sha256::new();
-        hasher.update(token.as_bytes());
-        let result = hasher.finalize();
-        format!("sha256:{}", hex::encode(result))
-    }
-
-    #[test]
-    fn config_identity_provider_resolves_valid_api_key() {
-        let token = "alk_testsecret123";
-        let hash = compute_api_key_hash(token);
-        let entry = crate::config::ApiKeyEntry {
-            prefix: "alk_test".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "test key".to_string(),
-            expires_at: None,
-        };
-        let auth_policy = crate::config::AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry],
-        );
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-
-        let auth_token = AuthToken {
-            raw: token.as_bytes().to_vec(),
-        };
-        let identity = provider.resolve_from_token(&auth_token);
-        assert!(identity.is_some());
-        let identity = identity.unwrap();
-        assert_eq!(identity.id, "alk_test");
-        assert_eq!(identity.scopes, vec!["relay:connect"]);
-    }
-
-    #[test]
-    fn config_identity_provider_rejects_expired_api_key() {
-        let token = "alk_expiredkey1";
-        let hash = compute_api_key_hash(token);
-        let entry = crate::config::ApiKeyEntry {
-            prefix: "alk_expi".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "expired key".to_string(),
-            expires_at: Some(1),
-        };
-        let auth_policy = crate::config::AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry],
-        );
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-
-        let auth_token = AuthToken {
-            raw: token.as_bytes().to_vec(),
-        };
-        assert!(provider.resolve_from_token(&auth_token).is_none());
-    }
-
-    #[test]
-    fn config_identity_provider_rejects_wrong_hash_api_key() {
-        let entry = crate::config::ApiKeyEntry {
-            prefix: "alk_test".to_string(),
-            hash: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
-                .to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            description: "bad hash".to_string(),
-            expires_at: None,
-        };
-        let auth_policy = crate::config::AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry],
-        );
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-
-        let auth_token = AuthToken {
-            raw: b"alk_testsecret123".to_vec(),
-        };
-        assert!(provider.resolve_from_token(&auth_token).is_none());
-    }
-
-    #[test]
-    fn config_identity_provider_api_key_unknown_prefix_falls_through() {
-        let token = "alk_testsecret123";
-        let hash = compute_api_key_hash(token);
-        let entry = crate::config::ApiKeyEntry {
-            prefix: "alk_other".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "other key".to_string(),
-            expires_at: None,
-        };
-        let auth_policy = crate::config::AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry],
-        );
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-
-        let auth_token = AuthToken {
-            raw: token.as_bytes().to_vec(),
-        };
-        assert!(provider.resolve_from_token(&auth_token).is_none());
-    }
-
-    #[test]
-    fn config_identity_provider_api_key_scopes_in_identity() {
-        let token = "alk_scopedkey12";
-        let hash = compute_api_key_hash(token);
-        let entry = crate::config::ApiKeyEntry {
-            prefix: "alk_sco".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string(), "secrets:derive".to_string()],
-            description: "scoped key".to_string(),
-            expires_at: None,
-        };
-        let auth_policy = crate::config::AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry],
-        );
-        let dynamic = DynamicConfig::new(auth_policy);
-        let arc_swap = Arc::new(ArcSwap::new(Arc::new(dynamic)));
-        let provider = ConfigIdentityProvider::new(arc_swap);
-
-        let auth_token = AuthToken {
-            raw: token.as_bytes().to_vec(),
-        };
-        let identity = provider.resolve_from_token(&auth_token).unwrap();
-        assert_eq!(identity.scopes, vec!["relay:connect", "secrets:derive"]);
-    }
-
-    #[test]
-    fn auth_token_holds_raw_bytes() {
-        let token = AuthToken { raw: vec![1, 2, 3] };
-        assert_eq!(token.raw, vec![1, 2, 3]);
-    }
-
-    #[test]
-    fn config_identity_provider_reflects_config_reload() {
-        let (provider, arc_swap) = make_provider(ED25519_PUBLIC_KEY);
-        let key = load_key().public_key().clone();
-        let fingerprint = format!("{}", key.fingerprint(HashAlg::Sha256));
-
-        let identity = provider.resolve_from_fingerprint(&fingerprint);
-        assert!(identity.is_some());
-
-        let new_dynamic = DynamicConfig::default();
-        arc_swap.store(Arc::new(new_dynamic));
-
-        let identity = provider.resolve_from_fingerprint(&fingerprint);
-        assert!(identity.is_none());
-    }
-}

crates/alknet-core/src/auth/keys.rs

@@ -1,258 +0,0 @@
-//! Key loading and parsing for SSH authentication.
-//!
-//! Supports `KeySource` (file path or in-memory) for private keys, public keys,
-//! and certificate authority entries. All keys must be in OpenSSH format.
-//! PEM-encoded keys (PKCS#1, PKCS#8) are rejected with a clear error message.
-
-use std::path::PathBuf;
-
-use russh::keys::{decode_secret_key, parse_public_key_base64, PrivateKey, PublicKey};
-
-use crate::error::ConfigError;
-
-/// Source for key material — either a filesystem path or in-memory bytes.
-///
-/// Used throughout the API to accept keys without committing to a specific
-/// loading mechanism. In-memory keys are primarily for the NAPI wrapper.
-#[derive(Debug, Clone)]
-pub enum KeySource {
-    File(PathBuf),
-    Memory(Vec<u8>),
-}
-
-/// A certificate authority entry parsed from an `authorized_keys` file.
-///
-/// Contains the CA public key and its associated options (e.g., `cert-authority`,
-/// `permit-port-forwarding`). Used by `ServerAuthConfig` for certificate validation.
-#[derive(Debug, Clone)]
-pub struct CertAuthorityEntry {
-    pub public_key: PublicKey,
-    pub options: Vec<String>,
-}
-
-fn resolve_bytes(source: &KeySource) -> Result<Vec<u8>, ConfigError> {
-    match source {
-        KeySource::File(path) => {
-            if !path.exists() {
-                return Err(ConfigError::KeyFileNotFound {
-                    path: path.display().to_string(),
-                });
-            }
-            std::fs::read(path).map_err(|_| ConfigError::KeyFileNotFound {
-                path: path.display().to_string(),
-            })
-        }
-        KeySource::Memory(data) => Ok(data.clone()),
-    }
-}
-
-fn check_openssh_private_key(data: &[u8]) -> Result<(), ConfigError> {
-    let s = String::from_utf8_lossy(data);
-    if s.contains("-----BEGIN OPENSSH PRIVATE KEY-----") {
-        return Ok(());
-    }
-    if s.contains("-----BEGIN RSA PRIVATE KEY-----")
-        || s.contains("-----BEGIN PRIVATE KEY-----")
-        || s.contains("-----BEGIN ENCRYPTED PRIVATE KEY-----")
-        || s.contains("-----BEGIN EC PRIVATE KEY-----")
-    {
-        return Err(ConfigError::InvalidFlag {
-            name: "PEM-encoded key is not supported; use OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----)".to_string(),
-        });
-    }
-    Err(ConfigError::InvalidFlag {
-        name: "unrecognized private key format; expected OpenSSH format (-----BEGIN OPENSSH PRIVATE KEY-----)".to_string(),
-    })
-}
-
-pub fn load_private_key(source: KeySource) -> Result<PrivateKey, ConfigError> {
-    let data = resolve_bytes(&source)?;
-    check_openssh_private_key(&data)?;
-    let s = String::from_utf8_lossy(&data);
-    decode_secret_key(&s, None).map_err(|e| ConfigError::InvalidFlag {
-        name: format!("failed to decode private key: {e}"),
-    })
-}
-
-fn parse_authorized_keys_line(line: &str) -> Option<Result<(PublicKey, Vec<String>), ConfigError>> {
-    let line = line.trim();
-    if line.is_empty() || line.starts_with('#') {
-        return None;
-    }
-
-    let parts: Vec<&str> = line.splitn(4, ' ').collect();
-    if parts.len() < 2 {
-        return None;
-    }
-
-    let mut options = Vec::new();
-    let key_type_idx;
-
-    if parts[0].starts_with("cert-authority")
-        || parts[0].starts_with("no-")
-        || parts[0].starts_with("permit-")
-        || parts[0].starts_with("from=")
-        || parts[0].starts_with("command=")
-        || parts[0].starts_with("environment=")
-        || parts[0].starts_with("tunnel=")
-        || parts[0].starts_with("principals=")
-    {
-        let opts_str = parts[0];
-        options = opts_str.split(',').map(|s| s.to_string()).collect();
-        key_type_idx = 1;
-    } else if parts[0].starts_with("ssh-") || parts[0].starts_with("ecdsa-") {
-        key_type_idx = 0;
-    } else {
-        return None;
-    }
-
-    if parts.len() <= key_type_idx {
-        return None;
-    }
-
-    let key_base64 = parts[key_type_idx + 1];
-    match parse_public_key_base64(key_base64) {
-        Ok(pk) => Some(Ok((pk, options))),
-        Err(_) => None,
-    }
-}
-
-pub fn load_public_keys(source: KeySource) -> Result<Vec<PublicKey>, ConfigError> {
-    let data = resolve_bytes(&source)?;
-    let s = String::from_utf8_lossy(&data);
-    let mut keys = Vec::new();
-    for line in s.lines() {
-        if let Some(Ok((pk, _))) = parse_authorized_keys_line(line) {
-            keys.push(pk);
-        }
-    }
-    Ok(keys)
-}
-
-pub fn load_cert_authority_entries(
-    source: KeySource,
-) -> Result<Vec<CertAuthorityEntry>, ConfigError> {
-    let data = resolve_bytes(&source)?;
-    let s = String::from_utf8_lossy(&data);
-    let mut entries = Vec::new();
-    for line in s.lines() {
-        if let Some(result) = parse_authorized_keys_line(line) {
-            match result {
-                Ok((pk, options)) if !options.is_empty() => {
-                    entries.push(CertAuthorityEntry {
-                        public_key: pk,
-                        options,
-                    });
-                }
-                _ => {}
-            }
-        }
-    }
-    Ok(entries)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Write;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const ED25519_PUBLIC_KEY: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV ubuntu@ns528096";
-
-    const PEM_PRIVATE_KEY: &[u8] = b"-----BEGIN PRIVATE KEY-----\nMC4CAQAwBQYDK2VwBCIEINTuctv5E1hK1bbY8fdp+K06/nwoy/HU++CXqI9EdVhC\n-----END PRIVATE KEY-----\n";
-
-    fn make_authorized_keys(content: &str) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        write!(f, "{content}").unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    fn make_private_key_file(content: &str) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        f.write_all(content.as_bytes()).unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    #[test]
-    fn load_ed25519_key_from_file() {
-        let f = make_private_key_file(ED25519_PRIVATE_KEY);
-        let source = KeySource::File(f.path().to_path_buf());
-        let key = load_private_key(source).unwrap();
-        assert_eq!(key.algorithm(), russh::keys::Algorithm::Ed25519);
-    }
-
-    #[test]
-    fn load_ed25519_key_from_memory() {
-        let source = KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        let key = load_private_key(source).unwrap();
-        assert_eq!(key.algorithm(), russh::keys::Algorithm::Ed25519);
-    }
-
-    #[test]
-    fn load_key_file_not_found() {
-        let source = KeySource::File(PathBuf::from("/nonexistent/key"));
-        let result = load_private_key(source);
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert!(matches!(err, ConfigError::KeyFileNotFound { .. }));
-        assert!(err.to_string().contains("/nonexistent/key"));
-    }
-
-    #[test]
-    fn reject_pem_format() {
-        let source = KeySource::Memory(PEM_PRIVATE_KEY.to_vec());
-        let result = load_private_key(source);
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert!(matches!(err, ConfigError::InvalidFlag { .. }));
-        assert!(err.to_string().contains("PEM"));
-    }
-
-    const ED25519_PUBLIC_KEY_2: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeLC1lWiCYrXsf/85O/pkbUFZ6OGIt49PX3nw8iRoXE other@host";
-
-    #[test]
-    fn parse_authorized_keys_multiple_entries() {
-        let content = format!("{ED25519_PUBLIC_KEY}\n# comment line\n\n{ED25519_PUBLIC_KEY_2}\n");
-        let f = make_authorized_keys(&content);
-        let source = KeySource::File(f.path().to_path_buf());
-        let keys = load_public_keys(source).unwrap();
-        assert_eq!(keys.len(), 2);
-    }
-
-    #[test]
-    fn parse_authorized_keys_from_memory() {
-        let content = format!("{ED25519_PUBLIC_KEY}\n");
-        let source = KeySource::Memory(content.into_bytes());
-        let keys = load_public_keys(source).unwrap();
-        assert_eq!(keys.len(), 1);
-    }
-
-    #[test]
-    fn parse_cert_authority_entry() {
-        let content =
-            "cert-authority,permit-port-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV CA name\n";
-        let f = make_authorized_keys(content);
-        let source = KeySource::File(f.path().to_path_buf());
-        let entries = load_cert_authority_entries(source).unwrap();
-        assert_eq!(entries.len(), 1);
-        assert_eq!(entries[0].options.len(), 2);
-        assert_eq!(entries[0].options[0], "cert-authority");
-        assert_eq!(entries[0].options[1], "permit-port-forwarding");
-    }
-
-    #[test]
-    fn parse_mixed_authorized_keys() {
-        let content = format!(
-            "{ED25519_PUBLIC_KEY}\ncert-authority ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeLC1lWiCYrXsf/85O/pkbUFZ6OGIt49PX3nw8iRoXE CA name\n"
-        );
-        let source = KeySource::Memory(content.into_bytes());
-        let keys = load_public_keys(source.clone()).unwrap();
-        assert_eq!(keys.len(), 2);
-        let entries = load_cert_authority_entries(source).unwrap();
-        assert_eq!(entries.len(), 1);
-        assert_eq!(entries[0].options, vec!["cert-authority"]);
-    }
-}

crates/alknet-core/src/auth/mod.rs

@@ -1,18 +0,0 @@
-//! SSH authentication (Ed25519 public key and OpenSSH certificate authority).
-//!
-//! Supports file-path and in-memory key sources. No password authentication.
-//! See ADR-012 for the design rationale.
-
-#[cfg(feature = "irpc")]
-pub mod auth_protocol;
-pub mod client_auth;
-pub mod identity;
-pub mod keys;
-pub mod server_auth;
-
-#[cfg(feature = "irpc")]
-pub use auth_protocol::{AuthProtocol, AuthResult, AuthServiceImpl};
-pub use client_auth::{ClientAuthConfig, ClientHandler};
-pub use identity::{AuthToken, ConfigIdentityProvider, Identity, IdentityProvider};
-pub use keys::{load_private_key, load_public_keys, CertAuthorityEntry, KeySource};
-pub use server_auth::ServerAuthConfig;

crates/alknet-core/src/auth/server_auth.rs

@@ -1,395 +0,0 @@
-//! Server-side authentication configuration and validation.
-//!
-//! `ServerAuthConfig` holds the set of authorized public keys and optional certificate
-//! authority entries. Authentication is key-based only (Ed25519 + optional OpenSSH CA).
-//! No password authentication. See ADR-012.
-
-use std::collections::HashSet;
-use std::net::IpAddr;
-use std::str::FromStr;
-use std::time::SystemTime;
-
-use ipnetwork::IpNetwork;
-use russh::keys::helpers::EncodedExt;
-use russh::keys::{Certificate, PublicKey};
-
-use super::keys::{load_cert_authority_entries, load_public_keys, CertAuthorityEntry, KeySource};
-use crate::error::AuthError;
-
-/// Server-side authentication configuration.
-///
-/// Holds authorized public keys (constant-time comparison) and optional certificate
-/// authority entries for validating OpenSSH certificates.
-#[derive(Debug, Clone)]
-pub struct ServerAuthConfig {
-    pub authorized_keys: HashSet<PublicKey>,
-    pub cert_authorities: Vec<CertAuthorityEntry>,
-    encoded_keys: HashSet<Vec<u8>>,
-}
-
-fn encode_key_data(key: &PublicKey) -> Vec<u8> {
-    key.key_data().encoded().unwrap_or_default()
-}
-
-impl ServerAuthConfig {
-    pub fn from_keys_and_ca(
-        authorized_keys_source: Option<KeySource>,
-        cert_authority_source: Option<KeySource>,
-    ) -> Result<Self, crate::error::ConfigError> {
-        let authorized_keys: HashSet<PublicKey> = match authorized_keys_source {
-            Some(src) => load_public_keys(src)?.into_iter().collect(),
-            None => HashSet::new(),
-        };
-
-        let encoded_keys: HashSet<Vec<u8>> = authorized_keys.iter().map(encode_key_data).collect();
-
-        let cert_authorities = match cert_authority_source {
-            Some(src) => load_cert_authority_entries(src)?,
-            None => Vec::new(),
-        };
-
-        Ok(ServerAuthConfig {
-            authorized_keys,
-            cert_authorities,
-            encoded_keys,
-        })
-    }
-
-    pub fn authenticate_publickey(&self, key: &PublicKey) -> Result<(), AuthError> {
-        let encoded = encode_key_data(key);
-        if self.encoded_keys.contains(&encoded) {
-            return Ok(());
-        }
-        Err(AuthError::KeyRejected)
-    }
-
-    pub fn authenticate_certificate(
-        &self,
-        cert: &Certificate,
-        user: &str,
-        client_ip: Option<IpAddr>,
-    ) -> Result<(), AuthError> {
-        let matching_ca = self
-            .cert_authorities
-            .iter()
-            .find(|ca| cert.signature_key() == ca.public_key.key_data());
-
-        let ca_entry = match matching_ca {
-            Some(entry) => entry,
-            None => return Err(AuthError::CertInvalid),
-        };
-
-        if cert.verify_signature().is_err() {
-            return Err(AuthError::CertInvalid);
-        }
-
-        let now = SystemTime::now();
-        let now_secs = now
-            .duration_since(SystemTime::UNIX_EPOCH)
-            .map(|d| d.as_secs())
-            .unwrap_or(0);
-
-        if now_secs < cert.valid_after() || now_secs >= cert.valid_before() {
-            return Err(AuthError::CertExpired);
-        }
-
-        let principals = cert.valid_principals();
-        if !principals.is_empty() && !principals.iter().any(|p| p == user) {
-            return Err(AuthError::CertPrincipalMismatch);
-        }
-
-        check_critical_options(cert, ca_entry, client_ip)?;
-
-        check_extensions(cert, ca_entry)?;
-
-        Ok(())
-    }
-}
-
-fn check_critical_options(
-    cert: &Certificate,
-    ca_entry: &CertAuthorityEntry,
-    client_ip: Option<IpAddr>,
-) -> Result<(), AuthError> {
-    let ca_has_no_pty = ca_entry.options.iter().any(|o| o == "no-pty");
-
-    for (name, data) in cert.critical_options().iter() {
-        match name.as_str() {
-            "source-address" => {
-                if !check_source_address(data, client_ip) {
-                    return Err(AuthError::CertInvalid);
-                }
-            }
-            "force-command" => {}
-            "no-pty" => {}
-            _ => {
-                let _ = ca_has_no_pty;
-                return Err(AuthError::CertInvalid);
-            }
-        }
-    }
-
-    Ok(())
-}
-
-fn check_extensions(cert: &Certificate, ca_entry: &CertAuthorityEntry) -> Result<(), AuthError> {
-    let ca_permit_port_forwarding = ca_entry
-        .options
-        .iter()
-        .any(|o| o == "permit-port-forwarding");
-
-    if ca_permit_port_forwarding {
-        let cert_allows = cert
-            .extensions()
-            .iter()
-            .any(|(n, _)| n == "permit-port-forwarding");
-        if !cert_allows {
-            return Err(AuthError::CertInvalid);
-        }
-    }
-
-    Ok(())
-}
-
-fn check_source_address(allowed: &str, client_ip: Option<IpAddr>) -> bool {
-    let Some(ip) = client_ip else {
-        return false;
-    };
-
-    for pattern in allowed.split(',') {
-        let pattern = pattern.trim();
-        if pattern.is_empty() {
-            continue;
-        }
-
-        if let Ok(cidr) = IpNetwork::from_str(pattern) {
-            if cidr.contains(ip) {
-                return true;
-            }
-        }
-
-        if let Ok(net_ip) = IpAddr::from_str(pattern) {
-            if net_ip == ip {
-                return true;
-            }
-        }
-    }
-
-    false
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rand_core::OsRng;
-    use russh::keys::ssh_key::certificate::{Builder, CertType};
-    use russh::keys::{decode_secret_key, Certificate, PrivateKey};
-    use std::io::Write;
-
-    const CA_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACA6pFKBI327JsRFmZULalNjpoUPJMVxzsk9bGbDByat+gAAAJjP22Bpz9tg\naQAAAAtzc2gtZWQyNTUxOQAAACA6pFKBI327JsRFmZULalNjpoUPJMVxzsk9bGbDByat+g\nAAAEBcRrWyUU+lLpjHbaaYN5YeOlvz6HnuBndUWevEmHk00jqkUoEjfbsmxEWZlQtqU2Om\nhQ8kxXHOyT1sZsMHJq36AAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const USER_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACAoTr8X7HqltuKBdBdB2Vjb+K7bi3vVPcuWAYIb3ur5NgAAAJgM/+f3DP/n\n9wAAAAtzc2gtZWQyNTUxOQAAACAoTr8X7HqltuKBdBdB2Vjb+K7bi3vVPcuWAYIb3ur5Ng\nAAAEADN/ZEFvX/mflX8aEGwS/tMzys564rYEaMzd4vmYKZkShOvxfseqW24oF0F0HZWNv4\nrtuLe9U9y5YBghve6vk2AAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const OTHER_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACC/7V2LLT4WRm1Mfje8eSPWlhN+kNXz2ryKoqCkSrGzdgAAAJgXj2UzF49l\nMwAAAAtzc2gtZWQyNTUxOQAAACC/7V2LLT4WRm1Mfje8eSPWlhN+kNXz2ryKoqCkSrGzdg\nAAAEBVadyi5nAUfkjpp4zyQ08b8h1o4RTEgwtLejTjX5Tycb/tXYstPhZGbUx+N7x5I9aW\nE36Q1fPavIqioKRKsbN2AAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    fn load_ca_key() -> PrivateKey {
-        decode_secret_key(CA_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn load_user_key() -> PrivateKey {
-        decode_secret_key(USER_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn load_other_key() -> PrivateKey {
-        decode_secret_key(OTHER_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn make_cert(
-        ca_key: &PrivateKey,
-        user_pub: &PublicKey,
-        valid_after: u64,
-        valid_before: u64,
-        principals: Vec<&str>,
-    ) -> Certificate {
-        let key_data: russh::keys::ssh_key::public::KeyData = user_pub.into();
-        let mut builder =
-            Builder::new_with_random_nonce(&mut OsRng, key_data, valid_after, valid_before)
-                .unwrap();
-
-        builder.cert_type(CertType::User).unwrap();
-
-        for p in principals {
-            builder.valid_principal(p).unwrap();
-        }
-
-        builder.sign(ca_key).unwrap()
-    }
-
-    fn make_authorized_keys_file(keys: &[&PublicKey]) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        for key in keys {
-            let line = format!("{}\n", key.to_openssh().unwrap());
-            f.write_all(line.as_bytes()).unwrap();
-        }
-        f.flush().unwrap();
-        f
-    }
-
-    fn make_ca_file(ca_pub: &PublicKey, options: &[&str]) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        let opts = if options.is_empty() {
-            "cert-authority".to_string()
-        } else {
-            format!("cert-authority,{}", options.join(","))
-        };
-        let line = format!("{} {} CA\n", opts, ca_pub.to_openssh().unwrap());
-        f.write_all(line.as_bytes()).unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    fn now_secs() -> u64 {
-        SystemTime::now()
-            .duration_since(SystemTime::UNIX_EPOCH)
-            .unwrap()
-            .as_secs()
-    }
-
-    #[test]
-    fn valid_key_accepted() {
-        let user_key = load_user_key();
-        let user_pub = user_key.public_key().clone();
-        let f = make_authorized_keys_file(&[&user_pub]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(Some(KeySource::File(f.path().to_path_buf())), None)
-                .unwrap();
-        assert!(config.authenticate_publickey(&user_pub).is_ok());
-    }
-
-    #[test]
-    fn invalid_key_rejected() {
-        let user_key = load_user_key();
-        let other_key = load_other_key();
-        let user_pub = user_key.public_key().clone();
-        let other_pub = other_key.public_key().clone();
-        let f = make_authorized_keys_file(&[&user_pub]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(Some(KeySource::File(f.path().to_path_buf())), None)
-                .unwrap();
-        assert_eq!(
-            config.authenticate_publickey(&other_pub),
-            Err(AuthError::KeyRejected)
-        );
-    }
-
-    #[test]
-    fn cert_authority_signed_cert_accepted() {
-        let ca_key = load_ca_key();
-        let user_key = load_user_key();
-        let ca_pub = ca_key.public_key().clone();
-        let user_pub = user_key.public_key().clone();
-        let now = now_secs();
-        let cert = make_cert(&ca_key, &user_pub, now - 60, now + 3600, vec!["testuser"]);
-        let f = make_ca_file(&ca_pub, &[]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(None, Some(KeySource::File(f.path().to_path_buf())))
-                .unwrap();
-        assert!(config
-            .authenticate_certificate(&cert, "testuser", None)
-            .is_ok());
-    }
-
-    #[test]
-    fn expired_cert_rejected() {
-        let ca_key = load_ca_key();
-        let user_key = load_user_key();
-        let ca_pub = ca_key.public_key().clone();
-        let user_pub = user_key.public_key().clone();
-        let now = now_secs();
-        let cert = make_cert(&ca_key, &user_pub, now - 7200, now - 3600, vec!["testuser"]);
-        let f = make_ca_file(&ca_pub, &[]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(None, Some(KeySource::File(f.path().to_path_buf())))
-                .unwrap();
-        assert_eq!(
-            config.authenticate_certificate(&cert, "testuser", None),
-            Err(AuthError::CertExpired)
-        );
-    }
-
-    #[test]
-    fn wrong_principal_rejected() {
-        let ca_key = load_ca_key();
-        let user_key = load_user_key();
-        let ca_pub = ca_key.public_key().clone();
-        let user_pub = user_key.public_key().clone();
-        let now = now_secs();
-        let cert = make_cert(&ca_key, &user_pub, now - 60, now + 3600, vec!["alice"]);
-        let f = make_ca_file(&ca_pub, &[]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(None, Some(KeySource::File(f.path().to_path_buf())))
-                .unwrap();
-        assert_eq!(
-            config.authenticate_certificate(&cert, "bob", None),
-            Err(AuthError::CertPrincipalMismatch)
-        );
-    }
-
-    #[test]
-    fn cert_wildcard_principals_accepts_any_user() {
-        let ca_key = load_ca_key();
-        let user_key = load_user_key();
-        let ca_pub = ca_key.public_key().clone();
-        let user_pub = user_key.public_key().clone();
-        let now = now_secs();
-        let key_data: russh::keys::ssh_key::public::KeyData = (&user_pub).into();
-        let mut builder =
-            Builder::new_with_random_nonce(&mut OsRng, key_data, now - 60, now + 3600).unwrap();
-        builder.cert_type(CertType::User).unwrap();
-        builder.all_principals_valid().unwrap();
-        let cert = builder.sign(&ca_key).unwrap();
-
-        let f = make_ca_file(&ca_pub, &[]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(None, Some(KeySource::File(f.path().to_path_buf())))
-                .unwrap();
-        assert!(config
-            .authenticate_certificate(&cert, "anyuser", None)
-            .is_ok());
-    }
-
-    #[test]
-    fn cert_wrong_ca_rejected() {
-        let user_key = load_user_key();
-        let other_ca_key = load_other_key();
-        let user_pub = user_key.public_key().clone();
-        let now = now_secs();
-        let cert = make_cert(
-            &other_ca_key,
-            &user_pub,
-            now - 60,
-            now + 3600,
-            vec!["testuser"],
-        );
-        let ca_key = load_ca_key();
-        let ca_pub = ca_key.public_key().clone();
-        let f = make_ca_file(&ca_pub, &[]);
-        let config =
-            ServerAuthConfig::from_keys_and_ca(None, Some(KeySource::File(f.path().to_path_buf())))
-                .unwrap();
-        assert_eq!(
-            config.authenticate_certificate(&cert, "testuser", None),
-            Err(AuthError::CertInvalid)
-        );
-    }
-
-    #[test]
-    fn no_config_accepts_nothing() {
-        let config = ServerAuthConfig::from_keys_and_ca(None, None).unwrap();
-        let other_pub = load_other_key().public_key().clone();
-        assert_eq!(
-            config.authenticate_publickey(&other_pub),
-            Err(AuthError::KeyRejected)
-        );
-    }
-}

crates/alknet-core/src/call/context.rs

@@ -1,58 +0,0 @@
-use std::collections::HashMap;
-
-use serde_json::Value;
-
-use crate::call::OperationEnv;
-
-#[derive(Debug, Clone)]
-pub struct OperationContext {
-    pub request_id: String,
-    pub parent_request_id: Option<String>,
-    pub identity: Option<crate::auth::Identity>,
-    pub metadata: HashMap<String, Value>,
-    pub env: OperationEnv,
-    pub trusted: bool,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::call::OperationRegistry;
-
-    fn make_context() -> OperationContext {
-        let registry = OperationRegistry::new();
-        OperationContext {
-            request_id: "req-1".to_string(),
-            parent_request_id: None,
-            identity: None,
-            metadata: HashMap::new(),
-            env: OperationEnv::local(registry),
-            trusted: false,
-        }
-    }
-
-    #[test]
-    fn operation_context_fields() {
-        let ctx = make_context();
-        assert_eq!(ctx.request_id, "req-1");
-        assert!(ctx.parent_request_id.is_none());
-        assert!(ctx.identity.is_none());
-        assert!(ctx.metadata.is_empty());
-        assert!(!ctx.trusted);
-    }
-
-    #[test]
-    fn operation_context_with_parent() {
-        let registry = OperationRegistry::new();
-        let ctx = OperationContext {
-            request_id: "req-2".to_string(),
-            parent_request_id: Some("req-1".to_string()),
-            identity: None,
-            metadata: HashMap::new(),
-            env: OperationEnv::local(registry),
-            trusted: true,
-        };
-        assert_eq!(ctx.parent_request_id, Some("req-1".to_string()));
-        assert!(ctx.trusted);
-    }
-}

crates/alknet-core/src/call/env.rs

@@ -1,190 +0,0 @@
-use std::sync::Arc;
-
-use serde_json::Value;
-
-use crate::call::context::OperationContext;
-use crate::call::registry::OperationRegistry;
-use crate::call::response::ResponseEnvelope;
-use crate::credentials::{CredentialProvider, CredentialSet, SecretStoreCredentialProvider};
-
-#[derive(Clone)]
-pub struct OperationEnv {
-    registry: Arc<OperationRegistry>,
-    credential_provider: Arc<dyn CredentialProvider>,
-}
-
-impl std::fmt::Debug for OperationEnv {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("OperationEnv")
-            .field("registry", &self.registry)
-            .finish()
-    }
-}
-
-impl OperationEnv {
-    pub fn local(registry: OperationRegistry) -> Self {
-        Self {
-            registry: Arc::new(registry),
-            credential_provider: Arc::new(SecretStoreCredentialProvider::new()),
-        }
-    }
-
-    pub fn with_credential_provider(
-        registry: OperationRegistry,
-        credential_provider: Arc<dyn CredentialProvider>,
-    ) -> Self {
-        Self {
-            registry: Arc::new(registry),
-            credential_provider,
-        }
-    }
-
-    pub fn credentials(&self, service: &str) -> Option<CredentialSet> {
-        self.credential_provider.get_credentials(service)
-    }
-
-    pub fn invoke(&self, namespace: &str, operation: &str, input: Value) -> ResponseEnvelope {
-        let name = format!("/{namespace}/{operation}");
-        let request_id = format!("env{name}");
-        let context = OperationContext {
-            request_id: request_id.clone(),
-            parent_request_id: None,
-            identity: None,
-            metadata: std::collections::HashMap::new(),
-            env: self.clone(),
-            trusted: true,
-        };
-        self.registry.invoke(&name, input, context)
-    }
-
-    pub fn registry_ref(&self) -> &OperationRegistry {
-        &self.registry
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::call::registry::OperationRegistryBuilder;
-    use crate::call::spec::{AccessControl, OperationSpec, OperationType};
-    use crate::config::{AuthPolicy, DynamicConfig};
-    use crate::credentials::ConfigCredentialProvider;
-    use arc_swap::ArcSwap;
-    use std::collections::HashMap;
-
-    fn make_spec(name: &str, namespace: &str) -> OperationSpec {
-        OperationSpec {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            op_type: OperationType::Query,
-            input_schema: serde_json::json!({}),
-            output_schema: serde_json::json!({}),
-            access_control: AccessControl {
-                required_scopes: vec![],
-                required_scopes_any: None,
-                resource_type: None,
-                resource_action: None,
-            },
-        }
-    }
-
-    #[test]
-    fn operation_env_local_invoke() {
-        let registry = OperationRegistryBuilder::new()
-            .with(
-                make_spec("/auth/verify", "auth"),
-                Arc::new(|_input, _ctx| {
-                    ResponseEnvelope::ok("env-/auth/verify", serde_json::json!({"verified": true}))
-                }),
-            )
-            .build();
-
-        let env = OperationEnv::local(registry);
-        let result = env.invoke("auth", "verify", serde_json::json!({"token": "abc"}));
-        assert!(result.result.is_ok());
-    }
-
-    #[test]
-    fn operation_env_invoke_missing() {
-        let registry = OperationRegistry::new();
-        let env = OperationEnv::local(registry);
-        let result = env.invoke("auth", "verify", serde_json::json!(null));
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "NOT_FOUND");
-    }
-
-    #[test]
-    fn operation_env_invoke_trusted() {
-        let registry = OperationRegistryBuilder::new()
-            .with(
-                make_spec("/auth/verify", "auth"),
-                Arc::new(|_input, ctx| {
-                    assert!(ctx.trusted);
-                    ResponseEnvelope::ok(&ctx.request_id, serde_json::json!({"ok": true}))
-                }),
-            )
-            .build();
-
-        let env = OperationEnv::local(registry);
-        let result = env.invoke("auth", "verify", serde_json::json!(null));
-        assert!(result.result.is_ok());
-    }
-
-    #[test]
-    fn operation_env_provides_credentials_from_handler_context() {
-        let mut credentials = HashMap::new();
-        credentials.insert(
-            "vast-ai".to_string(),
-            CredentialSet::Bearer {
-                token: "test-token".to_string(),
-            },
-        );
-        let config = DynamicConfig::new(AuthPolicy::empty()).with_credentials(credentials);
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(config)));
-        let provider = Arc::new(ConfigCredentialProvider::new(dynamic));
-
-        let registry = OperationRegistryBuilder::new()
-            .with(
-                make_spec("/test/creds", "test"),
-                Arc::new(|_input, ctx| {
-                    let creds = ctx.env.credentials("vast-ai");
-                    match creds {
-                        Some(CredentialSet::Bearer { token }) => ResponseEnvelope::ok(
-                            &ctx.request_id,
-                            serde_json::json!({"token": token}),
-                        ),
-                        _ => ResponseEnvelope::ok(
-                            &ctx.request_id,
-                            serde_json::json!({"found": false}),
-                        ),
-                    }
-                }),
-            )
-            .build();
-
-        let env = OperationEnv::with_credential_provider(registry, provider);
-        let result = env.invoke("test", "creds", serde_json::json!(null));
-        assert!(result.result.is_ok());
-        let value = result.result.unwrap();
-        assert_eq!(value["token"], "test-token");
-    }
-
-    #[test]
-    fn operation_env_credentials_returns_none_for_missing_service() {
-        let config = DynamicConfig::default();
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(config)));
-        let provider = Arc::new(ConfigCredentialProvider::new(dynamic));
-
-        let registry = OperationRegistry::new();
-        let env = OperationEnv::with_credential_provider(registry, provider);
-        assert!(env.credentials("nonexistent").is_none());
-    }
-
-    #[test]
-    fn operation_env_default_credentials_returns_none() {
-        let registry = OperationRegistry::new();
-        let env = OperationEnv::local(registry);
-        assert!(env.credentials("vast-ai").is_none());
-    }
-}

crates/alknet-core/src/call/envelope.rs

@@ -1,141 +0,0 @@
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-pub struct EventEnvelope {
-    #[serde(rename = "type")]
-    pub r#type: String,
-    pub id: String,
-    pub payload: Value,
-}
-
-impl EventEnvelope {
-    pub fn new(event_type: impl Into<String>, id: impl Into<String>, payload: Value) -> Self {
-        Self {
-            r#type: event_type.into(),
-            id: id.into(),
-            payload,
-        }
-    }
-
-    pub fn call_requested(id: impl Into<String>, payload: Value) -> Self {
-        Self::new(super::events::CALL_REQUESTED, id, payload)
-    }
-
-    pub fn call_responded(id: impl Into<String>, payload: Value) -> Self {
-        Self::new(super::events::CALL_RESPONDED, id, payload)
-    }
-
-    pub fn call_completed(id: impl Into<String>, payload: Value) -> Self {
-        Self::new(super::events::CALL_COMPLETED, id, payload)
-    }
-
-    pub fn call_aborted(id: impl Into<String>, payload: Value) -> Self {
-        Self::new(super::events::CALL_ABORTED, id, payload)
-    }
-
-    pub fn call_error(
-        id: impl Into<String>,
-        code: impl Into<String>,
-        message: impl Into<String>,
-        retryable: bool,
-    ) -> Self {
-        Self::new(
-            super::events::CALL_ERROR,
-            id,
-            serde_json::json!({
-                "code": code.into(),
-                "message": message.into(),
-                "retryable": retryable,
-            }),
-        )
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn event_envelope_new() {
-        let env = EventEnvelope::new(
-            "call.requested",
-            "req-1",
-            serde_json::json!({"key": "value"}),
-        );
-        assert_eq!(env.r#type, "call.requested");
-        assert_eq!(env.id, "req-1");
-        assert_eq!(env.payload, serde_json::json!({"key": "value"}));
-    }
-
-    #[test]
-    fn event_envelope_serialization() {
-        let env = EventEnvelope::new(
-            "call.requested",
-            "req-1",
-            serde_json::json!({"key": "value"}),
-        );
-        let serialized = serde_json::to_string(&env).unwrap();
-        let deserialized: EventEnvelope = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.r#type, "call.requested");
-        assert_eq!(deserialized.id, "req-1");
-        assert_eq!(deserialized.payload, serde_json::json!({"key": "value"}));
-    }
-
-    #[test]
-    fn event_envelope_serialization_type_field() {
-        let env = EventEnvelope::new("call.requested", "req-1", serde_json::json!(null));
-        let serialized = serde_json::to_string(&env).unwrap();
-        assert!(serialized.contains("\"type\""));
-    }
-
-    #[test]
-    fn event_envelope_deserialization() {
-        let json = r#"{"type":"call.responded","id":"req-42","payload":{"result":"ok"}}"#;
-        let env: EventEnvelope = serde_json::from_str(json).unwrap();
-        assert_eq!(env.r#type, "call.responded");
-        assert_eq!(env.id, "req-42");
-        assert_eq!(env.payload["result"], "ok");
-    }
-
-    #[test]
-    fn event_envelope_call_requested() {
-        let env = EventEnvelope::call_requested("req-1", serde_json::json!({"op": "test"}));
-        assert_eq!(env.r#type, "call.requested");
-        assert_eq!(env.id, "req-1");
-    }
-
-    #[test]
-    fn event_envelope_call_responded() {
-        let env = EventEnvelope::call_responded("req-1", serde_json::json!({"data": 42}));
-        assert_eq!(env.r#type, "call.responded");
-    }
-
-    #[test]
-    fn event_envelope_call_completed() {
-        let env = EventEnvelope::call_completed("req-1", serde_json::json!(null));
-        assert_eq!(env.r#type, "call.completed");
-    }
-
-    #[test]
-    fn event_envelope_call_aborted() {
-        let env = EventEnvelope::call_aborted("req-1", serde_json::json!({"reason": "cancelled"}));
-        assert_eq!(env.r#type, "call.aborted");
-    }
-
-    #[test]
-    fn event_envelope_call_error() {
-        let env = EventEnvelope::call_error("req-1", "TIMEOUT", "timed out", true);
-        assert_eq!(env.r#type, "call.error");
-        assert_eq!(env.id, "req-1");
-        assert_eq!(env.payload["code"], "TIMEOUT");
-        assert_eq!(env.payload["message"], "timed out");
-        assert_eq!(env.payload["retryable"], true);
-    }
-
-    #[test]
-    fn event_envelope_empty_id() {
-        let env = EventEnvelope::new("event.broadcast", "", serde_json::json!({"msg": "hello"}));
-        assert_eq!(env.id, "");
-    }
-}

crates/alknet-core/src/call/events.rs

@@ -1,28 +0,0 @@
-pub const CALL_REQUESTED: &str = "call.requested";
-pub const CALL_RESPONDED: &str = "call.responded";
-pub const CALL_COMPLETED: &str = "call.completed";
-pub const CALL_ABORTED: &str = "call.aborted";
-pub const CALL_ERROR: &str = "call.error";
-
-pub const SERVICE_LIST: &str = "/services/list";
-pub const SERVICE_SCHEMA: &str = "/services/schema";
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn event_type_constants() {
-        assert_eq!(CALL_REQUESTED, "call.requested");
-        assert_eq!(CALL_RESPONDED, "call.responded");
-        assert_eq!(CALL_COMPLETED, "call.completed");
-        assert_eq!(CALL_ABORTED, "call.aborted");
-        assert_eq!(CALL_ERROR, "call.error");
-    }
-
-    #[test]
-    fn service_operation_constants() {
-        assert_eq!(SERVICE_LIST, "/services/list");
-        assert_eq!(SERVICE_SCHEMA, "/services/schema");
-    }
-}

crates/alknet-core/src/call/frame.rs

@@ -1,239 +0,0 @@
-use std::io;
-
-use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
-
-use crate::call::envelope::EventEnvelope;
-
-pub fn encode(envelope: &EventEnvelope) -> Vec<u8> {
-    let json = serde_json::to_vec(envelope).expect("EventEnvelope serialization must not fail");
-    let len = json.len() as u32;
-    let mut frame = Vec::with_capacity(4 + json.len());
-    frame.extend_from_slice(&len.to_be_bytes());
-    frame.extend_from_slice(&json);
-    frame
-}
-
-pub fn decode(data: &[u8]) -> Result<EventEnvelope, FrameDecodeError> {
-    if data.len() < 4 {
-        return Err(FrameDecodeError::TooShort {
-            expected: 4,
-            actual: data.len(),
-        });
-    }
-    let len = u32::from_be_bytes([data[0], data[1], data[2], data[3]]) as usize;
-    if data.len() < 4 + len {
-        return Err(FrameDecodeError::Incomplete {
-            expected: 4 + len,
-            actual: data.len(),
-        });
-    }
-    let body = &data[4..4 + len];
-    let envelope: EventEnvelope = serde_json::from_slice(body).map_err(FrameDecodeError::Json)?;
-    Ok(envelope)
-}
-
-pub fn decode_with_remainder(data: &[u8]) -> Result<(EventEnvelope, usize), FrameDecodeError> {
-    if data.len() < 4 {
-        return Err(FrameDecodeError::TooShort {
-            expected: 4,
-            actual: data.len(),
-        });
-    }
-    let len = u32::from_be_bytes([data[0], data[1], data[2], data[3]]) as usize;
-    let total = 4 + len;
-    if data.len() < total {
-        return Err(FrameDecodeError::Incomplete {
-            expected: total,
-            actual: data.len(),
-        });
-    }
-    let body = &data[4..total];
-    let envelope: EventEnvelope = serde_json::from_slice(body).map_err(FrameDecodeError::Json)?;
-    Ok((envelope, total))
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum FrameDecodeError {
-    #[error("frame too short: expected at least {expected} bytes, got {actual}")]
-    TooShort { expected: usize, actual: usize },
-    #[error("incomplete frame: expected {expected} bytes, got {actual}")]
-    Incomplete { expected: usize, actual: usize },
-    #[error("JSON deserialization error: {0}")]
-    Json(#[from] serde_json::Error),
-}
-
-pub struct FrameFramedReader<S> {
-    stream: S,
-    buf: Vec<u8>,
-}
-
-impl<S> FrameFramedReader<S>
-where
-    S: AsyncRead + Unpin,
-{
-    pub fn new(stream: S) -> Self {
-        Self {
-            stream,
-            buf: Vec::with_capacity(4096),
-        }
-    }
-
-    pub async fn read_frame(&mut self) -> io::Result<Option<EventEnvelope>> {
-        loop {
-            if self.buf.len() >= 4 {
-                let len = u32::from_be_bytes([self.buf[0], self.buf[1], self.buf[2], self.buf[3]])
-                    as usize;
-                let total = 4 + len;
-                if self.buf.len() >= total {
-                    let body = &self.buf[4..total];
-                    match serde_json::from_slice(body) {
-                        Ok(envelope) => {
-                            self.buf.drain(..total);
-                            return Ok(Some(envelope));
-                        }
-                        Err(e) => {
-                            self.buf.drain(..total);
-                            return Err(io::Error::new(io::ErrorKind::InvalidData, e));
-                        }
-                    }
-                }
-            }
-
-            let mut tmp = [0u8; 4096];
-            match self.stream.read(&mut tmp).await {
-                Ok(0) => return Ok(None),
-                Ok(n) => self.buf.extend_from_slice(&tmp[..n]),
-                Err(e) => return Err(e),
-            }
-        }
-    }
-}
-
-pub struct FrameFramedWriter<S> {
-    stream: S,
-}
-
-impl<S> FrameFramedWriter<S>
-where
-    S: AsyncWrite + Unpin,
-{
-    pub fn new(stream: S) -> Self {
-        Self { stream }
-    }
-
-    pub async fn write_frame(&mut self, envelope: &EventEnvelope) -> io::Result<()> {
-        let frame = encode(envelope);
-        self.stream.write_all(&frame).await?;
-        self.stream.flush().await?;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::call::events;
-    use serde_json::json;
-
-    #[test]
-    fn frame_encode_decode_round_trip() {
-        let envelope = EventEnvelope::new(
-            events::CALL_REQUESTED,
-            "req-1",
-            json!({"namespace": "auth", "operation": "verify"}),
-        );
-        let frame = encode(&envelope);
-        let decoded = decode(&frame).unwrap();
-        assert_eq!(decoded, envelope);
-    }
-
-    #[test]
-    fn frame_encode_starts_with_length_prefix() {
-        let envelope = EventEnvelope::new(events::CALL_REQUESTED, "req-1", json!({}));
-        let frame = encode(&envelope);
-        let json = serde_json::to_vec(&envelope).unwrap();
-        let expected_len = json.len() as u32;
-        let stored_len = u32::from_be_bytes([frame[0], frame[1], frame[2], frame[3]]);
-        assert_eq!(stored_len, expected_len);
-        assert_eq!(frame.len(), 4 + json.len());
-    }
-
-    #[test]
-    fn frame_decode_too_short() {
-        let data = [0u8; 2];
-        let result = decode(&data);
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert!(matches!(
-            err,
-            FrameDecodeError::TooShort {
-                expected: 4,
-                actual: 2
-            }
-        ));
-    }
-
-    #[test]
-    fn frame_decode_incomplete() {
-        let len = 100u32;
-        let mut data = Vec::new();
-        data.extend_from_slice(&len.to_be_bytes());
-        data.extend_from_slice(&[0u8; 10]);
-        let result = decode(&data);
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert!(matches!(
-            err,
-            FrameDecodeError::Incomplete {
-                expected: 104,
-                actual: 14
-            }
-        ));
-    }
-
-    #[test]
-    fn frame_decode_invalid_json() {
-        let json = b"not valid json";
-        let mut data = Vec::new();
-        data.extend_from_slice(&(json.len() as u32).to_be_bytes());
-        data.extend_from_slice(json);
-        let result = decode(&data);
-        assert!(result.is_err());
-        assert!(matches!(result.unwrap_err(), FrameDecodeError::Json(_)));
-    }
-
-    #[test]
-    fn frame_decode_with_remainder() {
-        let envelope = EventEnvelope::new(events::CALL_RESPONDED, "req-1", json!({"result": 42}));
-        let frame = encode(&envelope);
-        let mut extended = frame.clone();
-        extended.extend_from_slice(&[0u8; 50]);
-        let (decoded, consumed) = decode_with_remainder(&extended).unwrap();
-        assert_eq!(decoded, envelope);
-        assert_eq!(consumed, frame.len());
-    }
-
-    #[test]
-    fn frame_encode_decode_empty_payload() {
-        let envelope = EventEnvelope::new(events::CALL_COMPLETED, "req-1", json!(null));
-        let frame = encode(&envelope);
-        let decoded = decode(&frame).unwrap();
-        assert_eq!(decoded, envelope);
-    }
-
-    #[test]
-    fn frame_encode_decode_large_payload() {
-        let large_data: Vec<i32> = (0..1000).collect();
-        let envelope = EventEnvelope::new(events::CALL_RESPONDED, "req-big", json!(large_data));
-        let frame = encode(&envelope);
-        let decoded = decode(&frame).unwrap();
-        assert_eq!(decoded, envelope);
-    }
-
-    #[test]
-    fn frame_decode_with_remainder_too_short() {
-        let data = [0u8; 1];
-        let result = decode_with_remainder(&data);
-        assert!(result.is_err());
-    }
-}

crates/alknet-core/src/call/mod.rs

@@ -1,28 +0,0 @@
-//! Call protocol layer (Layer 3) of the three-layer model.
-//!
-//! See [ADR-024](docs/architecture/decisions/024-call-protocol.md) and
-//! [ADR-033](docs/architecture/decisions/033-call-protocol-extensions.md).
-
-pub mod context;
-pub mod env;
-pub mod envelope;
-pub mod events;
-pub mod frame;
-pub mod pending;
-pub mod registry;
-pub mod response;
-pub mod services;
-pub mod spec;
-
-pub use context::OperationContext;
-pub use env::OperationEnv;
-pub use envelope::EventEnvelope;
-pub use events::{CALL_ABORTED, CALL_COMPLETED, CALL_ERROR, CALL_REQUESTED, CALL_RESPONDED};
-pub use frame::{
-    decode, decode_with_remainder, encode, FrameDecodeError, FrameFramedReader, FrameFramedWriter,
-};
-pub use pending::PendingRequestMap;
-pub use registry::{Handler, OperationRegistry, OperationRegistryBuilder};
-pub use response::{CallError, ResponseEnvelope};
-pub use services::{register_default_operations, services_list_spec, services_schema_spec};
-pub use spec::{AccessControl, OperationSpec, OperationType};

crates/alknet-core/src/call/pending.rs

@@ -1,265 +0,0 @@
-use std::collections::HashMap;
-use std::time::Instant;
-
-use serde_json::Value;
-use tokio::sync::{mpsc, oneshot};
-
-use crate::call::response::CallError;
-
-enum PendingEntry {
-    Call {
-        tx: oneshot::Sender<Result<Value, CallError>>,
-        timeout: Instant,
-    },
-    Subscribe {
-        tx: mpsc::Sender<Result<Value, CallError>>,
-        timeout: Option<Instant>,
-    },
-}
-
-pub struct PendingRequestMap {
-    pending: HashMap<String, PendingEntry>,
-}
-
-impl PendingRequestMap {
-    pub fn new() -> Self {
-        Self {
-            pending: HashMap::new(),
-        }
-    }
-
-    pub fn insert_call(
-        &mut self,
-        request_id: impl Into<String>,
-        tx: oneshot::Sender<Result<Value, CallError>>,
-        timeout: Instant,
-    ) {
-        self.pending
-            .insert(request_id.into(), PendingEntry::Call { tx, timeout });
-    }
-
-    pub fn insert_subscribe(
-        &mut self,
-        request_id: impl Into<String>,
-        tx: mpsc::Sender<Result<Value, CallError>>,
-        timeout: Option<Instant>,
-    ) {
-        self.pending
-            .insert(request_id.into(), PendingEntry::Subscribe { tx, timeout });
-    }
-
-    pub fn resolve_call(&mut self, request_id: &str, value: Result<Value, CallError>) -> bool {
-        if let Some(PendingEntry::Call { tx, .. }) = self.pending.remove(request_id) {
-            let _ = tx.send(value);
-            true
-        } else {
-            false
-        }
-    }
-
-    pub fn push_subscribe(&mut self, request_id: &str, value: Result<Value, CallError>) -> bool {
-        match self.pending.get_mut(request_id) {
-            Some(PendingEntry::Subscribe { tx, .. }) => tx.try_send(value).is_ok(),
-            _ => false,
-        }
-    }
-
-    pub fn complete_subscribe(&mut self, request_id: &str) -> bool {
-        self.pending.remove(request_id).is_some()
-    }
-
-    pub fn abort(&mut self, request_id: &str) -> bool {
-        self.pending.remove(request_id).is_some()
-    }
-
-    pub fn contains(&self, request_id: &str) -> bool {
-        self.pending.contains_key(request_id)
-    }
-
-    pub fn len(&self) -> usize {
-        self.pending.len()
-    }
-
-    pub fn is_empty(&self) -> bool {
-        self.pending.is_empty()
-    }
-
-    pub fn sweep_expired(&mut self, now: Instant) -> usize {
-        let expired: Vec<String> = self
-            .pending
-            .iter()
-            .filter(|(_, entry)| match entry {
-                PendingEntry::Call { timeout, .. } => *timeout <= now,
-                PendingEntry::Subscribe { timeout, .. } => timeout.is_some_and(|t| t <= now),
-            })
-            .map(|(id, _)| id.clone())
-            .collect();
-        let count = expired.len();
-        for id in &expired {
-            self.pending.remove(id);
-        }
-        count
-    }
-}
-
-impl Default for PendingRequestMap {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::time::Duration;
-
-    #[tokio::test]
-    async fn pending_request_map_insert_and_resolve_call() {
-        let mut map = PendingRequestMap::new();
-        let (tx, rx) = oneshot::channel();
-        let timeout = Instant::now() + Duration::from_secs(30);
-        map.insert_call("req-1", tx, timeout);
-        assert!(map.contains("req-1"));
-        assert_eq!(map.len(), 1);
-
-        let result = map.resolve_call("req-1", Ok(serde_json::json!({"status": "ok"})));
-        assert!(result);
-        assert!(map.is_empty());
-
-        let response = rx.await.unwrap();
-        assert!(response.is_ok());
-        assert_eq!(response.unwrap(), serde_json::json!({"status": "ok"}));
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_resolve_unknown_call() {
-        let mut map = PendingRequestMap::new();
-        let result = map.resolve_call("unknown", Ok(serde_json::json!(null)));
-        assert!(!result);
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_insert_and_push_subscribe() {
-        let mut map = PendingRequestMap::new();
-        let (tx, mut rx) = mpsc::channel(16);
-        map.insert_subscribe("sub-1", tx, None);
-        assert!(map.contains("sub-1"));
-
-        let pushed = map.push_subscribe("sub-1", Ok(serde_json::json!({"item": 1})));
-        assert!(pushed);
-
-        let response = rx.recv().await.unwrap();
-        assert!(response.is_ok());
-        assert_eq!(response.unwrap(), serde_json::json!({"item": 1}));
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_complete_subscribe() {
-        let mut map = PendingRequestMap::new();
-        let (tx, mut rx) = mpsc::channel(16);
-        map.insert_subscribe("sub-1", tx, None);
-
-        map.push_subscribe("sub-1", Ok(serde_json::json!({"item": 1})));
-        let completed = map.complete_subscribe("sub-1");
-        assert!(completed);
-        assert!(map.is_empty());
-
-        let _ = rx.recv().await;
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_abort_call() {
-        let mut map = PendingRequestMap::new();
-        let (tx, _rx) = oneshot::channel();
-        let timeout = Instant::now() + Duration::from_secs(30);
-        map.insert_call("req-1", tx, timeout);
-
-        let aborted = map.abort("req-1");
-        assert!(aborted);
-        assert!(map.is_empty());
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_abort_unknown() {
-        let mut map = PendingRequestMap::new();
-        let aborted = map.abort("unknown");
-        assert!(!aborted);
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_sweep_expired() {
-        let mut map = PendingRequestMap::new();
-        let (tx1, _rx1) = oneshot::channel();
-        let (tx2, _rx2) = oneshot::channel();
-        let past = Instant::now() - Duration::from_secs(1);
-        let future = Instant::now() + Duration::from_secs(30);
-
-        map.insert_call("expired-1", tx1, past);
-        map.insert_call("active-1", tx2, future);
-
-        let swept = map.sweep_expired(Instant::now());
-        assert_eq!(swept, 1);
-        assert!(!map.contains("expired-1"));
-        assert!(map.contains("active-1"));
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_sweep_subscribe_with_timeout() {
-        let mut map = PendingRequestMap::new();
-        let (tx1, _rx1) = mpsc::channel(16);
-        let (tx2, _rx2) = mpsc::channel(16);
-        let past = Some(Instant::now() - Duration::from_secs(1));
-        let future = Some(Instant::now() + Duration::from_secs(30));
-
-        map.insert_subscribe("expired-sub", tx1, past);
-        map.insert_subscribe("active-sub", tx2, future);
-
-        let swept = map.sweep_expired(Instant::now());
-        assert_eq!(swept, 1);
-        assert!(!map.contains("expired-sub"));
-        assert!(map.contains("active-sub"));
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_subscribe_no_timeout_not_swept() {
-        let mut map = PendingRequestMap::new();
-        let (tx, _rx) = mpsc::channel(16);
-        map.insert_subscribe("sub-no-timeout", tx, None);
-
-        let swept = map.sweep_expired(Instant::now());
-        assert_eq!(swept, 0);
-        assert!(map.contains("sub-no-timeout"));
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_push_unknown_subscribe() {
-        let mut map = PendingRequestMap::new();
-        let pushed = map.push_subscribe("unknown", Ok(serde_json::json!(null)));
-        assert!(!pushed);
-    }
-
-    #[tokio::test]
-    async fn pending_request_map_call_error_response() {
-        let mut map = PendingRequestMap::new();
-        let (tx, rx) = oneshot::channel();
-        let timeout = Instant::now() + Duration::from_secs(30);
-        map.insert_call("req-err", tx, timeout);
-
-        let result = map.resolve_call(
-            "req-err",
-            Err(CallError {
-                code: "TIMEOUT".to_string(),
-                message: "request timed out".to_string(),
-                retryable: true,
-            }),
-        );
-        assert!(result);
-        assert!(map.is_empty());
-
-        let response = rx.await.unwrap();
-        assert!(response.is_err());
-        let err = response.unwrap_err();
-        assert_eq!(err.code, "TIMEOUT");
-        assert!(err.retryable);
-    }
-}

crates/alknet-core/src/call/registry.rs

@@ -1,337 +0,0 @@
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use serde_json::Value;
-
-use crate::call::context::OperationContext;
-use crate::call::response::ResponseEnvelope;
-use crate::call::spec::OperationSpec;
-
-pub type Handler = Arc<dyn Fn(Value, OperationContext) -> ResponseEnvelope + Send + Sync>;
-
-pub struct OperationRegistry {
-    operations: HashMap<String, (OperationSpec, Handler)>,
-}
-
-impl std::fmt::Debug for OperationRegistry {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("OperationRegistry")
-            .field("operation_count", &self.operations.len())
-            .finish()
-    }
-}
-
-impl OperationRegistry {
-    pub fn new() -> Self {
-        Self {
-            operations: HashMap::new(),
-        }
-    }
-
-    pub fn register(&mut self, spec: OperationSpec, handler: Handler) {
-        self.operations.insert(spec.name.clone(), (spec, handler));
-    }
-
-    pub fn lookup(&self, name: &str) -> Option<(&OperationSpec, &Handler)> {
-        self.operations
-            .get(name)
-            .map(|(spec, handler)| (spec, handler))
-    }
-
-    pub fn invoke(&self, name: &str, input: Value, context: OperationContext) -> ResponseEnvelope {
-        match self.lookup(name) {
-            Some((spec, handler)) => {
-                if !context.trusted {
-                    if let Some(ref identity) = context.identity {
-                        if !spec.access_control.check(identity) {
-                            return ResponseEnvelope::err(
-                                &context.request_id,
-                                "FORBIDDEN",
-                                "access denied",
-                                false,
-                            );
-                        }
-                    } else if spec.access_control.has_restrictions() {
-                        return ResponseEnvelope::err(
-                            &context.request_id,
-                            "FORBIDDEN",
-                            "authentication required",
-                            false,
-                        );
-                    }
-                }
-                handler(input, context)
-            }
-            None => ResponseEnvelope::err(
-                &context.request_id,
-                "NOT_FOUND",
-                format!("operation not found: {name}"),
-                false,
-            ),
-        }
-    }
-
-    pub fn list_operations(&self) -> Vec<&OperationSpec> {
-        self.operations.values().map(|(spec, _)| spec).collect()
-    }
-}
-
-impl Default for OperationRegistry {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-pub struct OperationRegistryBuilder {
-    registry: OperationRegistry,
-}
-
-impl OperationRegistryBuilder {
-    pub fn new() -> Self {
-        Self {
-            registry: OperationRegistry::new(),
-        }
-    }
-
-    pub fn with(mut self, spec: OperationSpec, handler: Handler) -> Self {
-        self.registry.register(spec, handler);
-        self
-    }
-
-    pub fn build(self) -> OperationRegistry {
-        self.registry
-    }
-}
-
-impl Default for OperationRegistryBuilder {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::Identity;
-    use crate::call::env::OperationEnv;
-    use crate::call::spec::{AccessControl, OperationType};
-    use std::collections::HashMap;
-
-    fn make_spec(name: &str, namespace: &str) -> OperationSpec {
-        OperationSpec {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            op_type: OperationType::Query,
-            input_schema: serde_json::json!({}),
-            output_schema: serde_json::json!({}),
-            access_control: AccessControl {
-                required_scopes: vec![],
-                required_scopes_any: None,
-                resource_type: None,
-                resource_action: None,
-            },
-        }
-    }
-
-    fn make_spec_with_acl(name: &str, namespace: &str, acl: AccessControl) -> OperationSpec {
-        OperationSpec {
-            name: name.to_string(),
-            namespace: namespace.to_string(),
-            op_type: OperationType::Mutation,
-            input_schema: serde_json::json!({}),
-            output_schema: serde_json::json!({}),
-            access_control: acl,
-        }
-    }
-
-    fn make_context(request_id: &str, identity: Option<Identity>) -> OperationContext {
-        let registry = OperationRegistry::new();
-        OperationContext {
-            request_id: request_id.to_string(),
-            parent_request_id: None,
-            identity,
-            metadata: HashMap::new(),
-            env: OperationEnv::local(registry),
-            trusted: false,
-        }
-    }
-
-    #[test]
-    fn register_and_lookup() {
-        let mut registry = OperationRegistry::new();
-        let spec = make_spec("fs/readFile", "fs");
-        let handler: Handler = Arc::new(|input, _ctx| ResponseEnvelope::ok("req-1", input));
-        registry.register(spec, handler);
-        let found = registry.lookup("fs/readFile");
-        assert!(found.is_some());
-        let (spec, _) = found.unwrap();
-        assert_eq!(spec.name, "fs/readFile");
-        assert_eq!(spec.namespace, "fs");
-    }
-
-    #[test]
-    fn lookup_missing_returns_none() {
-        let registry = OperationRegistry::new();
-        assert!(registry.lookup("missing").is_none());
-    }
-
-    #[test]
-    fn invoke_operation() {
-        let mut registry = OperationRegistry::new();
-        let spec = make_spec("fs/readFile", "fs");
-        let handler: Handler = Arc::new(|input, ctx| ResponseEnvelope::ok(&ctx.request_id, input));
-        registry.register(spec, handler);
-        let context = make_context("req-1", None);
-        let result = registry.invoke("fs/readFile", serde_json::json!({"path": "/tmp"}), context);
-        assert!(result.result.is_ok());
-        assert_eq!(result.result.unwrap(), serde_json::json!({"path": "/tmp"}));
-    }
-
-    #[test]
-    fn invoke_missing_operation() {
-        let registry = OperationRegistry::new();
-        let context = make_context("req-1", None);
-        let result = registry.invoke("missing", serde_json::json!(null), context);
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "NOT_FOUND");
-    }
-
-    #[test]
-    fn invoke_with_acl_check_allowed() {
-        let mut registry = OperationRegistry::new();
-        let acl = AccessControl {
-            required_scopes: vec!["read".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let spec = make_spec_with_acl("bash/exec", "bash", acl);
-        let handler: Handler = Arc::new(|_input, ctx| {
-            ResponseEnvelope::ok(&ctx.request_id, serde_json::json!("done"))
-        });
-        registry.register(spec, handler);
-
-        let identity = Identity {
-            id: "user-1".to_string(),
-            scopes: vec!["read".to_string()],
-            resources: HashMap::new(),
-        };
-        let context = make_context("req-1", Some(identity));
-        let result = registry.invoke("bash/exec", serde_json::json!(null), context);
-        assert!(result.result.is_ok());
-    }
-
-    #[test]
-    fn invoke_with_acl_check_denied() {
-        let mut registry = OperationRegistry::new();
-        let acl = AccessControl {
-            required_scopes: vec!["admin".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let spec = make_spec_with_acl("bash/exec", "bash", acl);
-        let handler: Handler = Arc::new(|_input, ctx| {
-            ResponseEnvelope::ok(&ctx.request_id, serde_json::json!("done"))
-        });
-        registry.register(spec, handler);
-
-        let identity = Identity {
-            id: "user-1".to_string(),
-            scopes: vec!["read".to_string()],
-            resources: HashMap::new(),
-        };
-        let context = make_context("req-1", Some(identity));
-        let result = registry.invoke("bash/exec", serde_json::json!(null), context);
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "FORBIDDEN");
-    }
-
-    #[test]
-    fn invoke_trusted_skips_acl() {
-        let mut registry = OperationRegistry::new();
-        let acl = AccessControl {
-            required_scopes: vec!["admin".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let spec = make_spec_with_acl("bash/exec", "bash", acl);
-        let handler: Handler = Arc::new(|_input, ctx| {
-            ResponseEnvelope::ok(&ctx.request_id, serde_json::json!("done"))
-        });
-        registry.register(spec, handler);
-
-        let identity = Identity {
-            id: "user-1".to_string(),
-            scopes: vec!["read".to_string()],
-            resources: HashMap::new(),
-        };
-        let mut registry2 = OperationRegistry::new();
-        let context = OperationContext {
-            request_id: "req-1".to_string(),
-            parent_request_id: None,
-            identity: Some(identity),
-            metadata: HashMap::new(),
-            env: OperationEnv::local(registry2),
-            trusted: true,
-        };
-        let result = registry.invoke("bash/exec", serde_json::json!(null), context);
-        assert!(result.result.is_ok());
-    }
-
-    #[test]
-    fn invoke_no_identity_with_acl_denied() {
-        let mut registry = OperationRegistry::new();
-        let acl = AccessControl {
-            required_scopes: vec!["read".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let spec = make_spec_with_acl("bash/exec", "bash", acl);
-        let handler: Handler = Arc::new(|_input, ctx| {
-            ResponseEnvelope::ok(&ctx.request_id, serde_json::json!("done"))
-        });
-        registry.register(spec, handler);
-
-        let context = make_context("req-1", None);
-        let result = registry.invoke("bash/exec", serde_json::json!(null), context);
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "FORBIDDEN");
-    }
-
-    #[test]
-    fn list_operations() {
-        let mut registry = OperationRegistry::new();
-        registry.register(
-            make_spec("fs/readFile", "fs"),
-            Arc::new(|_, ctx| ResponseEnvelope::ok(&ctx.request_id, serde_json::json!(null))),
-        );
-        registry.register(
-            make_spec("bash/exec", "bash"),
-            Arc::new(|_, ctx| ResponseEnvelope::ok(&ctx.request_id, serde_json::json!(null))),
-        );
-        let ops = registry.list_operations();
-        assert_eq!(ops.len(), 2);
-    }
-
-    #[test]
-    fn registry_builder() {
-        let registry = OperationRegistryBuilder::new()
-            .with(
-                make_spec("fs/readFile", "fs"),
-                Arc::new(|input, ctx| ResponseEnvelope::ok(&ctx.request_id, input)),
-            )
-            .with(
-                make_spec("bash/exec", "bash"),
-                Arc::new(|input, ctx| ResponseEnvelope::ok(&ctx.request_id, input)),
-            )
-            .build();
-        assert!(registry.lookup("fs/readFile").is_some());
-        assert!(registry.lookup("bash/exec").is_some());
-    }
-}

crates/alknet-core/src/call/response.rs

@@ -1,108 +0,0 @@
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-#[non_exhaustive]
-pub struct CallError {
-    pub code: String,
-    pub message: String,
-    pub retryable: bool,
-}
-
-impl CallError {
-    pub fn new(code: impl Into<String>, message: impl Into<String>, retryable: bool) -> Self {
-        Self {
-            code: code.into(),
-            message: message.into(),
-            retryable,
-        }
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct ResponseEnvelope {
-    pub request_id: String,
-    pub result: Result<Value, CallError>,
-}
-
-impl ResponseEnvelope {
-    pub fn ok(request_id: impl Into<String>, value: Value) -> Self {
-        Self {
-            request_id: request_id.into(),
-            result: Ok(value),
-        }
-    }
-
-    pub fn err(
-        request_id: impl Into<String>,
-        code: impl Into<String>,
-        message: impl Into<String>,
-        retryable: bool,
-    ) -> Self {
-        Self {
-            request_id: request_id.into(),
-            result: Err(CallError {
-                code: code.into(),
-                message: message.into(),
-                retryable,
-            }),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    #[test]
-    fn call_error_fields() {
-        let err = CallError {
-            code: "NOT_FOUND".to_string(),
-            message: "operation not found".to_string(),
-            retryable: false,
-        };
-        assert_eq!(err.code, "NOT_FOUND");
-        assert_eq!(err.message, "operation not found");
-        assert!(!err.retryable);
-    }
-
-    #[test]
-    fn response_envelope_ok() {
-        let env = ResponseEnvelope::ok("req-1", json!({"status": "ok"}));
-        assert_eq!(env.request_id, "req-1");
-        assert!(env.result.is_ok());
-        assert_eq!(env.result.unwrap(), json!({"status": "ok"}));
-    }
-
-    #[test]
-    fn response_envelope_err() {
-        let env = ResponseEnvelope::err("req-1", "NOT_FOUND", "operation not found", false);
-        assert_eq!(env.request_id, "req-1");
-        assert!(env.result.is_err());
-        let err = env.result.unwrap_err();
-        assert_eq!(err.code, "NOT_FOUND");
-        assert_eq!(err.message, "operation not found");
-        assert!(!err.retryable);
-    }
-
-    #[test]
-    fn response_envelope_serialization() {
-        let env = ResponseEnvelope::ok("req-1", json!({"key": "value"}));
-        let serialized = serde_json::to_string(&env).unwrap();
-        let deserialized: ResponseEnvelope = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.request_id, "req-1");
-        assert!(deserialized.result.is_ok());
-    }
-
-    #[test]
-    fn response_envelope_err_serialization() {
-        let env = ResponseEnvelope::err("req-2", "TIMEOUT", "timed out", true);
-        let serialized = serde_json::to_string(&env).unwrap();
-        let deserialized: ResponseEnvelope = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.request_id, "req-2");
-        let err = deserialized.result.unwrap_err();
-        assert_eq!(err.code, "TIMEOUT");
-        assert!(err.retryable);
-    }
-}

crates/alknet-core/src/call/services.rs

@@ -1,207 +0,0 @@
-use std::sync::Arc;
-
-use serde_json::Value;
-
-use crate::call::context::OperationContext;
-use crate::call::response::ResponseEnvelope;
-use crate::call::spec::{AccessControl, OperationSpec, OperationType};
-
-pub fn services_list_spec() -> OperationSpec {
-    OperationSpec {
-        name: super::events::SERVICE_LIST.to_string(),
-        namespace: "services".to_string(),
-        op_type: OperationType::Query,
-        input_schema: serde_json::json!({
-            "type": "object",
-            "properties": {},
-        }),
-        output_schema: serde_json::json!({
-            "type": "array",
-            "items": {
-                "type": "object",
-                "properties": {
-                    "name": { "type": "string" },
-                    "namespace": { "type": "string" },
-                    "op_type": { "type": "string" },
-                },
-            },
-        }),
-        access_control: AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        },
-    }
-}
-
-pub fn services_schema_spec() -> OperationSpec {
-    OperationSpec {
-        name: super::events::SERVICE_SCHEMA.to_string(),
-        namespace: "services".to_string(),
-        op_type: OperationType::Query,
-        input_schema: serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" },
-            },
-            "required": ["name"],
-        }),
-        output_schema: serde_json::json!({
-            "type": "object",
-            "properties": {
-                "name": { "type": "string" },
-                "namespace": { "type": "string" },
-                "op_type": { "type": "string" },
-                "input_schema": { "type": "object" },
-                "output_schema": { "type": "object" },
-            },
-        }),
-        access_control: AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        },
-    }
-}
-
-pub fn register_default_operations(registry: &mut crate::call::OperationRegistry) {
-    registry.register(services_list_spec(), Arc::new(services_list_handler));
-    registry.register(services_schema_spec(), Arc::new(services_schema_handler));
-}
-
-fn services_list_handler(_input: Value, ctx: OperationContext) -> ResponseEnvelope {
-    let registry = &ctx.env.registry_ref();
-    let specs = registry.list_operations();
-    let ops: Vec<Value> = specs
-        .iter()
-        .map(|spec| {
-            serde_json::json!({
-                "name": spec.name,
-                "namespace": spec.namespace,
-                "op_type": format!("{:?}", spec.op_type).to_lowercase(),
-            })
-        })
-        .collect();
-    ResponseEnvelope::ok(&ctx.request_id, serde_json::json!({ "operations": ops }))
-}
-
-fn services_schema_handler(input: Value, ctx: OperationContext) -> ResponseEnvelope {
-    let name = match input.get("name").and_then(|v| v.as_str()) {
-        Some(n) => n.to_string(),
-        None => {
-            return ResponseEnvelope::err(
-                &ctx.request_id,
-                "INVALID_INPUT",
-                "missing required field: name",
-                false,
-            );
-        }
-    };
-    let registry = &ctx.env.registry_ref();
-    match registry.lookup(&name) {
-        Some((spec, _)) => ResponseEnvelope::ok(
-            &ctx.request_id,
-            serde_json::json!({
-                "name": spec.name,
-                "namespace": spec.namespace,
-                "op_type": format!("{:?}", spec.op_type).to_lowercase(),
-                "input_schema": spec.input_schema,
-                "output_schema": spec.output_schema,
-            }),
-        ),
-        None => ResponseEnvelope::err(
-            &ctx.request_id,
-            "NOT_FOUND",
-            format!("operation not found: {name}"),
-            false,
-        ),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::call::env::OperationEnv;
-
-    fn make_env() -> OperationEnv {
-        let mut registry = crate::call::OperationRegistry::new();
-        registry.register(services_list_spec(), Arc::new(services_list_handler));
-        registry.register(services_schema_spec(), Arc::new(services_schema_handler));
-        OperationEnv::local(registry)
-    }
-
-    #[test]
-    fn services_list_returns_operations() {
-        let env = make_env();
-        let result = env.invoke("services", "list", serde_json::json!({}));
-        assert!(result.result.is_ok());
-        let value = result.result.unwrap();
-        let ops = value.get("operations").unwrap().as_array().unwrap();
-        assert_eq!(ops.len(), 2);
-    }
-
-    #[test]
-    fn services_schema_returns_spec() {
-        let env = make_env();
-        let result = env.invoke(
-            "services",
-            "schema",
-            serde_json::json!({"name": "/services/list"}),
-        );
-        assert!(result.result.is_ok());
-        let value = result.result.unwrap();
-        assert_eq!(value["name"], "/services/list");
-        assert_eq!(value["namespace"], "services");
-    }
-
-    #[test]
-    fn services_schema_missing_name() {
-        let env = make_env();
-        let result = env.invoke("services", "schema", serde_json::json!({}));
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "INVALID_INPUT");
-    }
-
-    #[test]
-    fn services_schema_not_found() {
-        let env = make_env();
-        let result = env.invoke(
-            "services",
-            "schema",
-            serde_json::json!({"name": "/nonexistent/op"}),
-        );
-        assert!(result.result.is_err());
-        let err = result.result.unwrap_err();
-        assert_eq!(err.code, "NOT_FOUND");
-    }
-
-    #[test]
-    fn services_list_spec_fields() {
-        let spec = services_list_spec();
-        assert_eq!(spec.name, "/services/list");
-        assert_eq!(spec.namespace, "services");
-        assert_eq!(spec.op_type, OperationType::Query);
-        assert!(!spec.access_control.has_restrictions());
-    }
-
-    #[test]
-    fn services_schema_spec_fields() {
-        let spec = services_schema_spec();
-        assert_eq!(spec.name, "/services/schema");
-        assert_eq!(spec.namespace, "services");
-        assert_eq!(spec.op_type, OperationType::Query);
-        assert!(!spec.access_control.has_restrictions());
-    }
-
-    #[test]
-    fn register_default_operations_adds_both() {
-        let mut registry = crate::call::OperationRegistry::new();
-        register_default_operations(&mut registry);
-        assert!(registry.lookup("/services/list").is_some());
-        assert!(registry.lookup("/services/schema").is_some());
-        assert_eq!(registry.list_operations().len(), 2);
-    }
-}

crates/alknet-core/src/call/spec.rs

@@ -1,239 +0,0 @@
-//! Operation specifications (type, access control) for the call protocol.
-//!
-//! See [ADR-025](docs/architecture/decisions/025-operation-spec.md) and
-//! [ADR-033](docs/architecture/decisions/033-call-protocol-extensions.md).
-
-use serde::{Deserialize, Serialize};
-use serde_json::Value;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize)]
-#[non_exhaustive]
-pub enum OperationType {
-    Query,
-    Mutation,
-    Subscription,
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct AccessControl {
-    pub required_scopes: Vec<String>,
-    pub required_scopes_any: Option<Vec<String>>,
-    pub resource_type: Option<String>,
-    pub resource_action: Option<String>,
-}
-
-impl AccessControl {
-    pub fn check(&self, identity: &crate::auth::Identity) -> bool {
-        for scope in &self.required_scopes {
-            if !identity.scopes.contains(scope) {
-                return false;
-            }
-        }
-        if let Some(any) = &self.required_scopes_any {
-            if !any.iter().any(|s| identity.scopes.contains(s)) {
-                return false;
-            }
-        }
-        if let Some(res_type) = &self.resource_type {
-            if let Some(actions) = identity.resources.get(res_type) {
-                if let Some(action) = &self.resource_action {
-                    if !actions.contains(action) {
-                        return false;
-                    }
-                }
-            } else {
-                return false;
-            }
-        }
-        true
-    }
-
-    pub fn has_restrictions(&self) -> bool {
-        !self.required_scopes.is_empty()
-            || self.required_scopes_any.is_some()
-            || self.resource_type.is_some()
-    }
-}
-
-#[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct OperationSpec {
-    pub name: String,
-    pub namespace: String,
-    pub op_type: OperationType,
-    pub input_schema: Value,
-    pub output_schema: Value,
-    pub access_control: AccessControl,
-}
-
-impl OperationSpec {
-    pub fn path(&self) -> String {
-        format!("/{}", self.name)
-    }
-
-    pub fn namespace_from_name(name: &str) -> String {
-        let trimmed = name.trim_start_matches('/');
-        let parts: Vec<&str> = trimmed.split('/').collect();
-        match parts.len() {
-            n if n >= 3 => parts[1].to_string(),
-            n if n >= 2 => parts[0].to_string(),
-            _ => String::new(),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-
-    fn make_identity(
-        scopes: Vec<String>,
-        resources: HashMap<String, Vec<String>>,
-    ) -> crate::auth::Identity {
-        crate::auth::Identity {
-            id: "test".to_string(),
-            scopes,
-            resources,
-        }
-    }
-
-    #[test]
-    fn access_control_allows_matching_scopes() {
-        let ac = AccessControl {
-            required_scopes: vec!["read".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let id = make_identity(vec!["read".to_string()], HashMap::new());
-        assert!(ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_rejects_missing_scopes() {
-        let ac = AccessControl {
-            required_scopes: vec!["admin".to_string()],
-            required_scopes_any: None,
-            resource_type: None,
-            resource_action: None,
-        };
-        let id = make_identity(vec!["read".to_string()], HashMap::new());
-        assert!(!ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_required_scopes_any_matches() {
-        let ac = AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: Some(vec!["admin".to_string(), "read".to_string()]),
-            resource_type: None,
-            resource_action: None,
-        };
-        let id = make_identity(vec!["read".to_string()], HashMap::new());
-        assert!(ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_required_scopes_any_rejects() {
-        let ac = AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: Some(vec!["admin".to_string()]),
-            resource_type: None,
-            resource_action: None,
-        };
-        let id = make_identity(vec!["read".to_string()], HashMap::new());
-        assert!(!ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_resource_check_matches() {
-        let mut resources = HashMap::new();
-        resources.insert("service".to_string(), vec!["read".to_string()]);
-        let ac = AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: None,
-            resource_type: Some("service".to_string()),
-            resource_action: Some("read".to_string()),
-        };
-        let id = make_identity(vec![], resources);
-        assert!(ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_resource_check_missing_resource_type() {
-        let ac = AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: None,
-            resource_type: Some("service".to_string()),
-            resource_action: Some("read".to_string()),
-        };
-        let id = make_identity(vec![], HashMap::new());
-        assert!(!ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_resource_check_missing_action() {
-        let mut resources = HashMap::new();
-        resources.insert("service".to_string(), vec!["write".to_string()]);
-        let ac = AccessControl {
-            required_scopes: vec![],
-            required_scopes_any: None,
-            resource_type: Some("service".to_string()),
-            resource_action: Some("read".to_string()),
-        };
-        let id = make_identity(vec![], resources);
-        assert!(!ac.check(&id));
-    }
-
-    #[test]
-    fn access_control_combined_scopes_and_resources() {
-        let mut resources = HashMap::new();
-        resources.insert("service".to_string(), vec!["read".to_string()]);
-        let ac = AccessControl {
-            required_scopes: vec!["relay:connect".to_string()],
-            required_scopes_any: Some(vec!["admin".to_string()]),
-            resource_type: Some("service".to_string()),
-            resource_action: Some("read".to_string()),
-        };
-        let id = make_identity(
-            vec!["relay:connect".to_string(), "admin".to_string()],
-            resources,
-        );
-        assert!(ac.check(&id));
-    }
-
-    #[test]
-    fn operation_type_variants() {
-        assert_eq!(OperationType::Query, OperationType::Query);
-        assert_ne!(OperationType::Query, OperationType::Mutation);
-        assert_ne!(OperationType::Mutation, OperationType::Subscription);
-    }
-
-    #[test]
-    fn operation_spec_namespace_from_name() {
-        assert_eq!(OperationSpec::namespace_from_name("/auth/verify"), "auth");
-        assert_eq!(OperationSpec::namespace_from_name("/fs/readFile"), "fs");
-        assert_eq!(
-            OperationSpec::namespace_from_name("/head/agent/chat"),
-            "agent"
-        );
-    }
-
-    #[test]
-    fn operation_spec_path() {
-        let spec = OperationSpec {
-            name: "auth/verify".to_string(),
-            namespace: "auth".to_string(),
-            op_type: OperationType::Query,
-            input_schema: serde_json::json!({}),
-            output_schema: serde_json::json!({}),
-            access_control: AccessControl {
-                required_scopes: vec![],
-                required_scopes_any: None,
-                resource_type: None,
-                resource_action: None,
-            },
-        };
-        assert_eq!(spec.path(), "/auth/verify");
-    }
-}

crates/alknet-core/src/client/channel_manager.rs

@@ -1,468 +0,0 @@
-//! Channel manager with automatic reconnection.
-//!
-//! Owns the SSH session handle and provides `open_direct_tcpip()`,
-//! `request_tcpip_forward()`, and `cancel_tcpip_forward()`. Monitors
-//! the session for disconnect and attempts reconnection with exponential
-//! backoff (1s, 2s, 4s, ..., 30s cap). Re-registers remote forwards
-//! after successful reconnection.
-
-use std::collections::HashSet;
-use std::sync::Arc;
-use std::time::Duration;
-
-use russh::client;
-use tokio::sync::RwLock;
-use tokio::time;
-use tracing::{debug, error, info, warn};
-
-use crate::auth::client_auth::{ClientAuthConfig, ClientHandler};
-use crate::error::ChannelError;
-use crate::transport::Transport;
-
-#[derive(Debug, Clone, Hash, Eq, PartialEq)]
-pub struct ForwardRequest {
-    pub addr: String,
-    pub port: u32,
-}
-
-struct ChannelManagerInner<T: Transport> {
-    transport: Arc<T>,
-    auth_config: Arc<ClientAuthConfig>,
-    handle: Arc<RwLock<client::Handle<ClientHandler>>>,
-    username: String,
-    forwards: RwLock<HashSet<ForwardRequest>>,
-    reconnect_attempts: RwLock<u32>,
-}
-
-pub struct ChannelManager<T: Transport> {
-    inner: Arc<ChannelManagerInner<T>>,
-    reconnect_handle: Arc<RwLock<Option<tokio::task::JoinHandle<()>>>>,
-}
-
-impl<T: Transport> ChannelManager<T> {
-    pub async fn new(
-        transport: Arc<T>,
-        auth_config: Arc<ClientAuthConfig>,
-        username: String,
-    ) -> Result<Self, ChannelError> {
-        let handler = ClientHandler::from_config(&auth_config);
-        let handle = Self::establish_session(&*transport, handler, &auth_config, &username)
-            .await
-            .map_err(|_| ChannelError::TargetUnreachable)?;
-
-        let inner = Arc::new(ChannelManagerInner {
-            transport,
-            auth_config,
-            handle: Arc::new(RwLock::new(handle)),
-            username,
-            forwards: RwLock::new(HashSet::new()),
-            reconnect_attempts: RwLock::new(0),
-        });
-
-        let reconnect_handle = Arc::new(RwLock::new(None));
-        let manager = Self {
-            inner,
-            reconnect_handle,
-        };
-
-        manager.start_reconnect_monitor();
-        Ok(manager)
-    }
-
-    async fn establish_session(
-        transport: &T,
-        handler: ClientHandler,
-        auth_config: &ClientAuthConfig,
-        username: &str,
-    ) -> Result<client::Handle<ClientHandler>, russh::Error> {
-        let stream = transport.connect().await.map_err(|e| {
-            error!("transport connect failed: {e}");
-            russh::Error::SendError
-        })?;
-
-        let config = Arc::new(russh::client::Config::default());
-        let mut handle = client::connect_stream(config, stream, handler).await?;
-
-        let auth_ok = auth_config.authenticate(&mut handle, username).await?;
-        if !auth_ok {
-            return Err(russh::Error::SendError);
-        }
-
-        Ok(handle)
-    }
-
-    pub async fn open_direct_tcpip(
-        &self,
-        host: &str,
-        port: u32,
-    ) -> Result<russh::Channel<russh::client::Msg>, ChannelError> {
-        let handle = self.inner.handle.read().await;
-        handle
-            .channel_open_direct_tcpip(host, port, "127.0.0.1", 0)
-            .await
-            .map_err(|e| {
-                debug!("channel open failed: {e}");
-                ChannelError::ChannelClosed
-            })
-    }
-
-    pub async fn request_tcpip_forward(&self, addr: &str, port: u32) -> Result<u32, ChannelError> {
-        let mut handle = self.inner.handle.write().await;
-        let result = handle
-            .tcpip_forward(addr, port)
-            .await
-            .map_err(|_| ChannelError::ChannelClosed)?;
-
-        self.inner.forwards.write().await.insert(ForwardRequest {
-            addr: addr.to_string(),
-            port,
-        });
-
-        Ok(result)
-    }
-
-    pub async fn cancel_tcpip_forward(&self, addr: &str, port: u32) -> Result<(), ChannelError> {
-        let handle = self.inner.handle.read().await;
-        handle
-            .cancel_tcpip_forward(addr, port)
-            .await
-            .map_err(|_| ChannelError::ChannelClosed)?;
-
-        self.inner.forwards.write().await.remove(&ForwardRequest {
-            addr: addr.to_string(),
-            port,
-        });
-
-        Ok(())
-    }
-
-    pub async fn is_connected(&self) -> bool {
-        let handle = self.inner.handle.read().await;
-        !handle.is_closed()
-    }
-
-    fn start_reconnect_monitor(&self) {
-        let inner = Arc::clone(&self.inner);
-        let handle_arc = Arc::clone(&self.inner.handle);
-
-        let join_handle = tokio::spawn(async move {
-            loop {
-                time::sleep(Duration::from_secs(1)).await;
-                let handle = handle_arc.read().await;
-                if handle.is_closed() {
-                    drop(handle);
-                    info!("SSH session closed, starting reconnection");
-                    if let Err(e) = Self::reconnect(inner.clone()).await {
-                        error!("reconnection failed: {e}");
-                    }
-                }
-            }
-        });
-
-        let reconnect_handle = Arc::clone(&self.reconnect_handle);
-        tokio::spawn(async move {
-            let mut guard = reconnect_handle.write().await;
-            *guard = Some(join_handle);
-        });
-    }
-
-    async fn reconnect(inner: Arc<ChannelManagerInner<T>>) -> Result<(), ChannelError> {
-        let mut attempts = inner.reconnect_attempts.write().await;
-        let attempt_num = *attempts;
-        let backoff = backoff_duration(attempt_num);
-        *attempts += 1;
-        drop(attempts);
-
-        warn!(
-            "reconnect attempt #{}, waiting {:?}",
-            attempt_num + 1,
-            backoff
-        );
-        time::sleep(backoff).await;
-
-        let handler = ClientHandler::from_config(&inner.auth_config);
-        match Self::establish_session(
-            &*inner.transport,
-            handler,
-            &inner.auth_config,
-            &inner.username,
-        )
-        .await
-        {
-            Ok(new_handle) => {
-                info!("reconnection successful");
-                {
-                    let mut handle_guard = inner.handle.write().await;
-                    *handle_guard = new_handle;
-                }
-                {
-                    let mut attempts = inner.reconnect_attempts.write().await;
-                    *attempts = 0;
-                }
-                Self::re_register_forwards(&inner).await;
-                Ok(())
-            }
-            Err(e) => {
-                warn!("reconnection attempt failed: {e}");
-                Err(ChannelError::ChannelClosed)
-            }
-        }
-    }
-
-    async fn re_register_forwards(inner: &ChannelManagerInner<T>) {
-        let forwards = inner.forwards.read().await;
-        if forwards.is_empty() {
-            return;
-        }
-        let mut handle = inner.handle.write().await;
-        for fwd in forwards.iter() {
-            match handle.tcpip_forward(&fwd.addr, fwd.port).await {
-                Ok(_) => {
-                    debug!("re-registered tcpip_forward: {}:{}", fwd.addr, fwd.port);
-                }
-                Err(e) => {
-                    warn!(
-                        "failed to re-register tcpip_forward {}:{}: {e}",
-                        fwd.addr, fwd.port
-                    );
-                }
-            }
-        }
-    }
-}
-
-/// Exponential backoff: 1s, 2s, 4s, 8s, 16s, 30s (cap), continues indefinitely.
-fn backoff_duration(attempt: u32) -> Duration {
-    let secs: u64 = match attempt {
-        0 => 1,
-        1 => 2,
-        2 => 4,
-        3 => 8,
-        4 => 16,
-        _ => 30,
-    };
-    Duration::from_secs(secs)
-}
-
-impl<T: Transport> Drop for ChannelManager<T> {
-    fn drop(&mut self) {
-        if let Ok(mut guard) = self.reconnect_handle.try_write() {
-            if let Some(handle) = guard.take() {
-                handle.abort();
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use tokio::io::duplex;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    fn make_auth_config() -> Arc<ClientAuthConfig> {
-        let source = crate::auth::keys::KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec());
-        Arc::new(ClientAuthConfig::from_key_source(source).unwrap())
-    }
-
-    struct AlwaysFailTransport;
-
-    #[async_trait::async_trait]
-    impl Transport for AlwaysFailTransport {
-        type Stream = tokio::io::DuplexStream;
-
-        async fn connect(&self) -> anyhow::Result<Self::Stream> {
-            Err(anyhow::anyhow!("always fails"))
-        }
-
-        fn describe(&self) -> String {
-            "always-fail".to_string()
-        }
-    }
-
-    struct TrackConnectTransport {
-        connect_count: Arc<AtomicUsize>,
-    }
-
-    impl TrackConnectTransport {
-        fn new() -> Self {
-            Self {
-                connect_count: Arc::new(AtomicUsize::new(0)),
-            }
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl Transport for TrackConnectTransport {
-        type Stream = tokio::io::DuplexStream;
-
-        async fn connect(&self) -> anyhow::Result<Self::Stream> {
-            self.connect_count.fetch_add(1, Ordering::SeqCst);
-            let (client, _) = duplex(4096);
-            Ok(client)
-        }
-
-        fn describe(&self) -> String {
-            "track-connect".to_string()
-        }
-    }
-
-    struct CountingFailTransport {
-        fail_count: Arc<AtomicUsize>,
-        succeed_after: usize,
-    }
-
-    impl CountingFailTransport {
-        fn new(succeed_after: usize) -> Self {
-            Self {
-                fail_count: Arc::new(AtomicUsize::new(0)),
-                succeed_after,
-            }
-        }
-    }
-
-    #[async_trait::async_trait]
-    impl Transport for CountingFailTransport {
-        type Stream = tokio::io::DuplexStream;
-
-        async fn connect(&self) -> anyhow::Result<Self::Stream> {
-            let count = self.fail_count.fetch_add(1, Ordering::SeqCst);
-            if count < self.succeed_after {
-                return Err(anyhow::anyhow!("connection failed (attempt {})", count));
-            }
-            let (client, _) = duplex(4096);
-            Ok(client)
-        }
-
-        fn describe(&self) -> String {
-            "counting-fail".to_string()
-        }
-    }
-
-    #[test]
-    fn test_backoff_durations() {
-        assert_eq!(backoff_duration(0), Duration::from_secs(1));
-        assert_eq!(backoff_duration(1), Duration::from_secs(2));
-        assert_eq!(backoff_duration(2), Duration::from_secs(4));
-        assert_eq!(backoff_duration(3), Duration::from_secs(8));
-        assert_eq!(backoff_duration(4), Duration::from_secs(16));
-        assert_eq!(backoff_duration(5), Duration::from_secs(30));
-        assert_eq!(backoff_duration(6), Duration::from_secs(30));
-        assert_eq!(backoff_duration(100), Duration::from_secs(30));
-    }
-
-    #[test]
-    fn test_backoff_sequence_matches_spec() {
-        let sequence: Vec<Duration> = (0..6).map(backoff_duration).collect();
-        assert_eq!(
-            sequence,
-            vec![
-                Duration::from_secs(1),
-                Duration::from_secs(2),
-                Duration::from_secs(4),
-                Duration::from_secs(8),
-                Duration::from_secs(16),
-                Duration::from_secs(30),
-            ]
-        );
-    }
-
-    #[test]
-    fn test_forward_request_hash_eq() {
-        let fwd1 = ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 8080,
-        };
-        let fwd2 = ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 8080,
-        };
-        let fwd3 = ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 9090,
-        };
-        assert_eq!(fwd1, fwd2);
-        assert_ne!(fwd1, fwd3);
-        let mut set = HashSet::new();
-        set.insert(fwd1.clone());
-        assert!(set.contains(&fwd2));
-        assert!(!set.contains(&fwd3));
-    }
-
-    #[tokio::test]
-    async fn test_channel_manager_new_transport_fails() {
-        let auth = make_auth_config();
-        let transport = Arc::new(AlwaysFailTransport);
-        let result = ChannelManager::new(transport, auth, "testuser".to_string()).await;
-        assert!(result.is_err());
-        match result {
-            Err(ChannelError::TargetUnreachable) => {}
-            other => panic!("expected TargetUnreachable, got {:?}", other.as_ref().err()),
-        }
-    }
-
-    #[tokio::test]
-    async fn test_transport_connect_called_on_new() {
-        let transport = Arc::new(TrackConnectTransport::new());
-        let connect_before = transport.connect_count.load(Ordering::SeqCst);
-        assert_eq!(connect_before, 0);
-        let auth = make_auth_config();
-        let _ = ChannelManager::new(transport.clone(), auth, "testuser".to_string()).await;
-        let connect_after = transport.connect_count.load(Ordering::SeqCst);
-        assert!(connect_after > 0);
-    }
-
-    #[tokio::test]
-    async fn test_reconnect_monitor_detects_closed_handle() {
-        let auth = make_auth_config();
-        let transport = Arc::new(TrackConnectTransport::new());
-        let handler = ClientHandler::from_config(&auth);
-        let config = Arc::new(russh::client::Config::default());
-        let stream = transport.connect().await.unwrap();
-        let handle = client::connect_stream(config, stream, handler).await;
-        match handle {
-            Ok(h) => {
-                assert!(!h.is_closed());
-                drop(h);
-            }
-            Err(_) => {
-                // connect_stream fails without a real SSH server,
-                // but the concept is verified: dropped handle => is_closed
-            }
-        }
-    }
-
-    #[tokio::test]
-    async fn test_forward_set_tracks_requests() {
-        let mut set: HashSet<ForwardRequest> = HashSet::new();
-        set.insert(ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 8080,
-        });
-        set.insert(ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 9090,
-        });
-        assert_eq!(set.len(), 2);
-        set.remove(&ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 8080,
-        });
-        assert_eq!(set.len(), 1);
-        assert!(set.contains(&ForwardRequest {
-            addr: "0.0.0.0".to_string(),
-            port: 9090,
-        }));
-    }
-
-    #[test]
-    fn test_backoff_indefinitely_beyond_cap() {
-        for attempt in 0..50 {
-            let duration = backoff_duration(attempt);
-            assert!(duration <= Duration::from_secs(30));
-            assert!(duration >= Duration::from_secs(1));
-        }
-    }
-}

crates/alknet-core/src/client/connect.rs

@@ -1,877 +0,0 @@
-//! Client session management and connection logic.
-//!
-//! `ClientSession` establishes an SSH connection over a transport, authenticates,
-//! starts a SOCKS5 proxy, sets up port forwards, and monitors for reconnection.
-//! `ConnectOptions` provides a builder-pattern API for programmatic configuration.
-
-use std::net::SocketAddr;
-use std::sync::Arc;
-use std::time::Duration;
-
-use russh::client;
-use russh::keys::PrivateKey;
-use tokio::sync::Mutex;
-use tracing::{debug, error, info, warn};
-
-use crate::auth::client_auth::{ClientAuthConfig, ClientHandler};
-use crate::auth::keys::KeySource;
-use crate::client::forward::{LocalForwarder, PortForwardSpec, RemoteForwarder};
-use crate::error::ConfigError;
-use crate::socks5::{HandleChannelOpener, Socks5Server};
-use crate::transport::Transport;
-
-const DEFAULT_SOCKS5_ADDR: &str = "127.0.0.1:1080";
-const DRAIN_TIMEOUT: Duration = Duration::from_secs(2);
-
-/// Transport mode for the client connection.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TransportMode {
-    Tcp,
-    Tls,
-    Iroh,
-}
-
-impl std::fmt::Display for TransportMode {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            TransportMode::Tcp => write!(f, "tcp"),
-            TransportMode::Tls => write!(f, "tls"),
-            TransportMode::Iroh => write!(f, "iroh"),
-        }
-    }
-}
-
-/// Programmatic configuration for an alknet client session.
-///
-/// Construct with `ConnectOptions::new(key_source)` and chain builder methods.
-/// Call `validate()` before passing to `ClientSession::new()`.
-///
-/// ```
-/// use alknet_core::client::{ConnectOptions, TransportMode};
-/// use alknet_core::auth::keys::KeySource;
-///
-/// let opts = ConnectOptions::new(KeySource::File("/path/to/key".into()))
-///     .server("example.com:22")
-///     .transport_mode(TransportMode::Tcp)
-///     .socks5_addr("127.0.0.1:1080")
-///     .forward("5432:db.internal:5432");
-/// opts.validate().unwrap();
-/// ```
-#[derive(Clone)]
-pub struct ConnectOptions {
-    pub server: Option<String>,
-    pub peer: Option<String>,
-    pub transport_mode: TransportMode,
-    pub identity: KeySource,
-    pub socks5_addr: String,
-    pub forwards: Vec<String>,
-    pub remote_forwards: Vec<String>,
-    pub proxy: Option<String>,
-    pub iroh_relay: Option<String>,
-    pub tls_server_name: Option<String>,
-    pub insecure: bool,
-}
-
-impl ConnectOptions {
-    pub fn new(identity: KeySource) -> Self {
-        Self {
-            server: None,
-            peer: None,
-            transport_mode: TransportMode::Tcp,
-            identity,
-            socks5_addr: DEFAULT_SOCKS5_ADDR.to_string(),
-            forwards: Vec::new(),
-            remote_forwards: Vec::new(),
-            proxy: None,
-            iroh_relay: None,
-            tls_server_name: None,
-            insecure: false,
-        }
-    }
-
-    pub fn server(mut self, addr: impl Into<String>) -> Self {
-        self.server = Some(addr.into());
-        self
-    }
-
-    pub fn peer(mut self, endpoint_id: impl Into<String>) -> Self {
-        self.peer = Some(endpoint_id.into());
-        self
-    }
-
-    pub fn transport_mode(mut self, mode: TransportMode) -> Self {
-        self.transport_mode = mode;
-        self
-    }
-
-    pub fn socks5_addr(mut self, addr: impl Into<String>) -> Self {
-        self.socks5_addr = addr.into();
-        self
-    }
-
-    pub fn forward(mut self, spec: impl Into<String>) -> Self {
-        self.forwards.push(spec.into());
-        self
-    }
-
-    pub fn remote_forward(mut self, spec: impl Into<String>) -> Self {
-        self.remote_forwards.push(spec.into());
-        self
-    }
-
-    pub fn proxy(mut self, url: impl Into<String>) -> Self {
-        self.proxy = Some(url.into());
-        self
-    }
-
-    pub fn iroh_relay(mut self, url: impl Into<String>) -> Self {
-        self.iroh_relay = Some(url.into());
-        self
-    }
-
-    pub fn tls_server_name(mut self, name: impl Into<String>) -> Self {
-        self.tls_server_name = Some(name.into());
-        self
-    }
-
-    pub fn insecure(mut self, insecure: bool) -> Self {
-        self.insecure = insecure;
-        self
-    }
-
-    pub fn validate(&self) -> Result<(), ConfigError> {
-        match self.transport_mode {
-            TransportMode::Tcp | TransportMode::Tls => {
-                if self.server.is_none() {
-                    return Err(ConfigError::InvalidFlag {
-                        name: "--server is required for tcp/tls transport".to_string(),
-                    });
-                }
-            }
-            TransportMode::Iroh => {
-                if self.peer.is_none() {
-                    return Err(ConfigError::InvalidFlag {
-                        name: "--peer is required for iroh transport".to_string(),
-                    });
-                }
-            }
-        }
-        Ok(())
-    }
-}
-
-impl std::fmt::Debug for ConnectOptions {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ConnectOptions")
-            .field("server", &self.server)
-            .field("peer", &self.peer)
-            .field("transport_mode", &self.transport_mode)
-            .field("identity", &"<KeySource>")
-            .field("socks5_addr", &self.socks5_addr)
-            .field("forwards", &self.forwards)
-            .field("remote_forwards", &self.remote_forwards)
-            .field("proxy", &self.proxy)
-            .field("iroh_relay", &self.iroh_relay)
-            .field("tls_server_name", &self.tls_server_name)
-            .field("insecure", &self.insecure)
-            .finish()
-    }
-}
-
-/// An active SSH client session over a transport.
-///
-/// Establishes the connection, authenticates, and runs a SOCKS5 proxy plus
-/// port forwards until shutdown or transport failure. On transport failure,
-/// attempts reconnection with exponential backoff (1s, 2s, 4s, ..., 30s cap).
-pub struct ClientSession<T: Transport> {
-    opts: ConnectOptions,
-    transport: Arc<T>,
-    handle: Arc<Mutex<client::Handle<ClientHandler>>>,
-    auth_config: Arc<ClientAuthConfig>,
-    #[allow(dead_code)]
-    private_key: Arc<PrivateKey>,
-    #[allow(dead_code)]
-    username: String,
-    shutdown_tx: tokio::sync::watch::Sender<bool>,
-    shutdown_rx: tokio::sync::watch::Receiver<bool>,
-}
-
-impl<T: Transport> ClientSession<T> {
-    pub async fn new(opts: ConnectOptions, transport: Arc<T>) -> Result<Self, ConnectError> {
-        opts.validate().map_err(ConnectError::Config)?;
-
-        let auth_config = Arc::new(
-            ClientAuthConfig::from_key_source(opts.identity.clone())
-                .map_err(ConnectError::Config)?,
-        );
-        let private_key = auth_config.private_key();
-
-        let username = derive_username();
-        let handler = ClientHandler::from_config(&auth_config);
-
-        let stream = transport.connect().await.map_err(|e| {
-            error!("transport connect failed: {e}");
-            ConnectError::ConnectionFailed
-        })?;
-
-        let config = Arc::new(client::Config::default());
-        let mut handle = client::connect_stream(config, stream, handler)
-            .await
-            .map_err(|e| {
-                error!("SSH connect failed: {e}");
-                ConnectError::ConnectionFailed
-            })?;
-
-        let auth_ok = auth_config
-            .authenticate(&mut handle, &username)
-            .await
-            .map_err(|_| ConnectError::AuthFailed)?;
-        if !auth_ok {
-            return Err(ConnectError::AuthFailed);
-        }
-
-        let handle = Arc::new(Mutex::new(handle));
-        let (shutdown_tx, shutdown_rx) = tokio::sync::watch::channel(false);
-
-        Ok(Self {
-            opts,
-            transport,
-            handle,
-            auth_config,
-            private_key,
-            username,
-            shutdown_tx,
-            shutdown_rx,
-        })
-    }
-
-    pub fn handle(&self) -> Arc<Mutex<client::Handle<ClientHandler>>> {
-        Arc::clone(&self.handle)
-    }
-
-    pub fn auth_config(&self) -> &Arc<ClientAuthConfig> {
-        &self.auth_config
-    }
-
-    pub fn transport(&self) -> &Arc<T> {
-        &self.transport
-    }
-
-    pub fn options(&self) -> &ConnectOptions {
-        &self.opts
-    }
-
-    pub fn shutdown_sender(&self) -> tokio::sync::watch::Sender<bool> {
-        self.shutdown_tx.clone()
-    }
-
-    pub async fn run(self) -> Result<(), ConnectError> {
-        let socks5_addr: SocketAddr = self.opts.socks5_addr.parse().map_err(|_| {
-            ConnectError::Config(ConfigError::InvalidFlag {
-                name: format!("invalid SOCKS5 address: {}", self.opts.socks5_addr),
-            })
-        })?;
-
-        let channel_opener = HandleChannelOpener::from_arc(Arc::clone(&self.handle));
-        let socks5_server = Socks5Server::with_addr(channel_opener, &socks5_addr.to_string());
-        let socks5_listen = socks5_server.listen_addr();
-
-        let local_forwarders = build_local_forwarders(&self.opts)?;
-        let remote_specs = build_remote_specs(&self.opts)?;
-
-        for spec in &remote_specs {
-            let remote_forwarder =
-                RemoteForwarder::new(spec.clone()).map_err(|_| ConnectError::ForwardFailed)?;
-            let mut h = self.handle.lock().await;
-            remote_forwarder.register(&mut h).await.map_err(|_| {
-                warn!("failed to register remote forward {}", spec);
-                ConnectError::ForwardFailed
-            })?;
-            info!("registered remote forward: {}", spec);
-        }
-
-        let socks5_task = tokio::spawn(async move {
-            debug!("SOCKS5 server starting on {}", socks5_listen);
-            if let Err(e) = socks5_server.run().await {
-                error!("SOCKS5 server error: {e}");
-            }
-        });
-
-        let fwd_handle = Arc::clone(&self.handle);
-        let fwd_shutdown = self.shutdown_rx.clone();
-        let forward_task = tokio::spawn(async move {
-            crate::client::forward::run_local_forwarders(
-                local_forwarders,
-                fwd_handle,
-                fwd_shutdown,
-            )
-            .await;
-        });
-
-        info!("alknet client running: SOCKS5 on {}", socks5_listen);
-
-        #[cfg(unix)]
-        let signal_done = {
-            let sig_tx = self.shutdown_tx.clone();
-            tokio::spawn(async move {
-                let mut sigterm_stream =
-                    tokio::signal::unix::signal(tokio::signal::unix::SignalKind::terminate())
-                        .expect("failed to install SIGTERM handler");
-                tokio::select! {
-                    _ = sigterm_stream.recv() => {
-                        info!("received SIGTERM");
-                    }
-                    _ = tokio::signal::ctrl_c() => {
-                        info!("received SIGINT (Ctrl+C)");
-                    }
-                }
-                let _ = sig_tx.send(true);
-            })
-        };
-
-        let mut wait_shutdown = self.shutdown_rx.clone();
-        let reconnect_handle = Arc::clone(&self.handle);
-        let reconnect_transport = Arc::clone(&self.transport);
-        let reconnect_auth = Arc::clone(&self.auth_config);
-        let reconnect_username = self.username.clone();
-        let reconnect_shutdown = self.shutdown_rx.clone();
-        let reconnect_remote_specs = remote_specs.clone();
-
-        let reconnect_monitor = tokio::spawn(async move {
-            let mut attempts: u32 = 0;
-            loop {
-                tokio::time::sleep(Duration::from_secs(1)).await;
-                if *reconnect_shutdown.borrow() {
-                    break;
-                }
-                let h = reconnect_handle.lock().await;
-                if h.is_closed() {
-                    drop(h);
-                    info!("SSH session closed, starting reconnection");
-                    let backoff = backoff_duration(attempts);
-                    warn!("reconnect attempt #{}, waiting {:?}", attempts + 1, backoff);
-                    tokio::time::sleep(backoff).await;
-
-                    let handler = ClientHandler::from_config(&reconnect_auth);
-                    let username = reconnect_username.clone();
-                    match establish_session(
-                        &*reconnect_transport,
-                        handler,
-                        &reconnect_auth,
-                        &username,
-                    )
-                    .await
-                    {
-                        Ok(new_handle) => {
-                            info!("reconnection successful");
-                            {
-                                let mut guard = reconnect_handle.lock().await;
-                                *guard = new_handle;
-                            }
-                            for spec in &reconnect_remote_specs {
-                                match RemoteForwarder::new(spec.clone()) {
-                                    Ok(rf) => {
-                                        let mut h = reconnect_handle.lock().await;
-                                        match rf.register(&mut h).await {
-                                            Ok(_) => {
-                                                debug!("re-registered remote forward: {}", spec)
-                                            }
-                                            Err(e) => warn!(
-                                                "failed to re-register remote forward {}: {e}",
-                                                spec
-                                            ),
-                                        }
-                                    }
-                                    Err(e) => warn!("failed to create remote forwarder: {e}"),
-                                }
-                            }
-                            attempts = 0;
-                        }
-                        Err(e) => {
-                            warn!("reconnection attempt failed: {e}");
-                            attempts += 1;
-                        }
-                    }
-                }
-            }
-        });
-
-        tokio::select! {
-            _ = wait_shutdown.changed() => {
-                if *wait_shutdown.borrow() {
-                    info!("shutdown signal received");
-                }
-            }
-            _ = socks5_task => {
-                warn!("SOCKS5 server exited unexpectedly");
-            }
-        }
-
-        reconnect_monitor.abort();
-
-        #[cfg(unix)]
-        signal_done.abort();
-
-        self.shutdown().await?;
-
-        forward_task.abort();
-        let _ = forward_task.await;
-
-        Ok(())
-    }
-
-    pub async fn shutdown(&self) -> Result<(), ConnectError> {
-        info!("initiating graceful shutdown");
-
-        let _ = self.shutdown_tx.send(true);
-
-        {
-            let handle = self.handle.lock().await;
-            if !handle.is_closed() {
-                if let Err(e) = handle
-                    .disconnect(russh::Disconnect::ByApplication, "shutdown", "")
-                    .await
-                {
-                    warn!("failed to send SSH disconnect: {e}");
-                }
-            }
-        }
-
-        tokio::time::sleep(DRAIN_TIMEOUT).await;
-
-        info!("graceful shutdown complete");
-        Ok(())
-    }
-}
-
-fn derive_username() -> String {
-    std::env::var("USER")
-        .or_else(|_| std::env::var("USERNAME"))
-        .unwrap_or_else(|_| "alknet".to_string())
-}
-
-async fn establish_session<T: Transport>(
-    transport: &T,
-    handler: ClientHandler,
-    auth_config: &ClientAuthConfig,
-    username: &str,
-) -> Result<client::Handle<ClientHandler>, ConnectError> {
-    let stream = transport.connect().await.map_err(|e| {
-        error!("transport connect failed: {e}");
-        ConnectError::ConnectionFailed
-    })?;
-
-    let config = Arc::new(client::Config::default());
-    let mut handle = client::connect_stream(config, stream, handler)
-        .await
-        .map_err(|e| {
-            error!("SSH connect failed: {e}");
-            ConnectError::ConnectionFailed
-        })?;
-
-    let auth_ok = auth_config
-        .authenticate(&mut handle, username)
-        .await
-        .map_err(|_| ConnectError::AuthFailed)?;
-    if !auth_ok {
-        return Err(ConnectError::AuthFailed);
-    }
-
-    Ok(handle)
-}
-
-fn backoff_duration(attempt: u32) -> Duration {
-    let secs: u64 = match attempt {
-        0 => 1,
-        1 => 2,
-        2 => 4,
-        3 => 8,
-        4 => 16,
-        _ => 30,
-    };
-    Duration::from_secs(secs)
-}
-
-fn build_local_forwarders(opts: &ConnectOptions) -> Result<Vec<LocalForwarder>, ConnectError> {
-    let mut forwarders = Vec::new();
-    for spec_str in &opts.forwards {
-        let spec = PortForwardSpec::local(spec_str).map_err(|e| {
-            warn!("invalid local forward spec '{}': {}", spec_str, e);
-            ConnectError::Config(ConfigError::InvalidFlag {
-                name: format!("invalid forward spec: {}", spec_str),
-            })
-        })?;
-        forwarders.push(LocalForwarder::new(spec).map_err(|e| {
-            warn!("failed to create local forwarder: {}", e);
-            ConnectError::ForwardFailed
-        })?);
-    }
-    Ok(forwarders)
-}
-
-fn build_remote_specs(opts: &ConnectOptions) -> Result<Vec<PortForwardSpec>, ConnectError> {
-    let mut specs = Vec::new();
-    for spec_str in &opts.remote_forwards {
-        let spec = PortForwardSpec::remote(spec_str).map_err(|e| {
-            warn!("invalid remote forward spec '{}': {}", spec_str, e);
-            ConnectError::Config(ConfigError::InvalidFlag {
-                name: format!("invalid remote forward spec: {}", spec_str),
-            })
-        })?;
-        specs.push(spec);
-    }
-    Ok(specs)
-}
-
-/// Errors that can occur during client connection setup and operation.
-#[derive(Debug, thiserror::Error)]
-pub enum ConnectError {
-    #[error("connection failed")]
-    ConnectionFailed,
-    #[error("authentication failed")]
-    AuthFailed,
-    #[error("forward setup failed")]
-    ForwardFailed,
-    #[error("config error: {0}")]
-    Config(#[from] ConfigError),
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::sync::atomic::{AtomicUsize, Ordering};
-    use tokio::io::duplex;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    fn make_identity() -> KeySource {
-        KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec())
-    }
-
-    #[test]
-    fn connect_options_default_fields() {
-        let opts = ConnectOptions::new(make_identity());
-        assert!(opts.server.is_none());
-        assert!(opts.peer.is_none());
-        assert_eq!(opts.transport_mode, TransportMode::Tcp);
-        assert_eq!(opts.socks5_addr, "127.0.0.1:1080");
-        assert!(opts.forwards.is_empty());
-        assert!(opts.remote_forwards.is_empty());
-        assert!(opts.proxy.is_none());
-        assert!(opts.iroh_relay.is_none());
-        assert!(opts.tls_server_name.is_none());
-        assert!(!opts.insecure);
-    }
-
-    #[test]
-    fn connect_options_builder_pattern() {
-        let opts = ConnectOptions::new(make_identity())
-            .server("example.com:22")
-            .transport_mode(TransportMode::Tls)
-            .socks5_addr("127.0.0.1:9050")
-            .forward("127.0.0.1:5432:db:5432")
-            .remote_forward("0.0.0.0:8080:127.0.0.1:3000")
-            .proxy("socks5://127.0.0.1:1080")
-            .iroh_relay("https://relay.example.com")
-            .tls_server_name("alknet.test")
-            .insecure(true);
-
-        assert_eq!(opts.server.as_deref(), Some("example.com:22"));
-        assert_eq!(opts.transport_mode, TransportMode::Tls);
-        assert_eq!(opts.socks5_addr, "127.0.0.1:9050");
-        assert_eq!(opts.forwards.len(), 1);
-        assert_eq!(opts.remote_forwards.len(), 1);
-        assert_eq!(opts.proxy.as_deref(), Some("socks5://127.0.0.1:1080"));
-        assert_eq!(
-            opts.iroh_relay.as_deref(),
-            Some("https://relay.example.com")
-        );
-        assert_eq!(opts.tls_server_name.as_deref(), Some("alknet.test"));
-        assert!(opts.insecure);
-    }
-
-    #[test]
-    fn connect_options_validate_tcp_requires_server() {
-        let opts = ConnectOptions::new(make_identity()).transport_mode(TransportMode::Tcp);
-        assert!(opts.validate().is_err());
-    }
-
-    #[test]
-    fn connect_options_validate_tcp_with_server_ok() {
-        let opts = ConnectOptions::new(make_identity()).server("example.com:22");
-        assert!(opts.validate().is_ok());
-    }
-
-    #[test]
-    fn connect_options_validate_tls_requires_server() {
-        let opts = ConnectOptions::new(make_identity()).transport_mode(TransportMode::Tls);
-        assert!(opts.validate().is_err());
-    }
-
-    #[test]
-    fn connect_options_validate_tls_with_server_ok() {
-        let opts = ConnectOptions::new(make_identity())
-            .transport_mode(TransportMode::Tls)
-            .server("example.com:443");
-        assert!(opts.validate().is_ok());
-    }
-
-    #[test]
-    fn connect_options_validate_iroh_requires_peer() {
-        let opts = ConnectOptions::new(make_identity()).transport_mode(TransportMode::Iroh);
-        assert!(opts.validate().is_err());
-    }
-
-    #[test]
-    fn connect_options_validate_iroh_with_peer_ok() {
-        let opts = ConnectOptions::new(make_identity())
-            .transport_mode(TransportMode::Iroh)
-            .peer("some-endpoint-id");
-        assert!(opts.validate().is_ok());
-    }
-
-    #[test]
-    fn identity_accepts_key_source_file() {
-        let file_source = KeySource::File(std::path::PathBuf::from("/path/to/key"));
-        let opts = ConnectOptions::new(file_source);
-        match &opts.identity {
-            KeySource::File(p) => assert_eq!(p, &std::path::PathBuf::from("/path/to/key")),
-            _ => panic!("expected File variant"),
-        }
-    }
-
-    #[test]
-    fn identity_accepts_key_source_memory() {
-        let mem_source = KeySource::Memory(b"key-data".to_vec());
-        let opts = ConnectOptions::new(mem_source);
-        match &opts.identity {
-            KeySource::Memory(d) => assert_eq!(d, b"key-data"),
-            _ => panic!("expected Memory variant"),
-        }
-    }
-
-    #[test]
-    fn transport_mode_display() {
-        assert_eq!(TransportMode::Tcp.to_string(), "tcp");
-        assert_eq!(TransportMode::Tls.to_string(), "tls");
-        assert_eq!(TransportMode::Iroh.to_string(), "iroh");
-    }
-
-    #[test]
-    fn connect_error_variants() {
-        assert_eq!(
-            ConnectError::ConnectionFailed.to_string(),
-            "connection failed"
-        );
-        assert_eq!(
-            ConnectError::AuthFailed.to_string(),
-            "authentication failed"
-        );
-        assert_eq!(
-            ConnectError::ForwardFailed.to_string(),
-            "forward setup failed"
-        );
-    }
-
-    #[test]
-    fn connect_options_debug_redacts_identity() {
-        let opts = ConnectOptions::new(make_identity());
-        let debug_str = format!("{:?}", opts);
-        assert!(debug_str.contains("<KeySource>"));
-        assert!(!debug_str.contains("OPENSSH"));
-    }
-
-    struct FailTransport;
-
-    #[async_trait::async_trait]
-    impl Transport for FailTransport {
-        type Stream = tokio::io::DuplexStream;
-
-        async fn connect(&self) -> anyhow::Result<Self::Stream> {
-            Err(anyhow::anyhow!("always fails"))
-        }
-
-        fn describe(&self) -> String {
-            "fail".to_string()
-        }
-    }
-
-    struct DuplexTransport {
-        connect_count: Arc<AtomicUsize>,
-    }
-
-    #[async_trait::async_trait]
-    impl Transport for DuplexTransport {
-        type Stream = tokio::io::DuplexStream;
-
-        async fn connect(&self) -> anyhow::Result<Self::Stream> {
-            self.connect_count.fetch_add(1, Ordering::SeqCst);
-            let (client, _) = duplex(4096);
-            Ok(client)
-        }
-
-        fn describe(&self) -> String {
-            "duplex".to_string()
-        }
-    }
-
-    #[tokio::test]
-    async fn client_session_new_transport_fails() {
-        let opts = ConnectOptions::new(make_identity()).server("example.com:22");
-        let transport = Arc::new(FailTransport);
-        let result = ClientSession::new(opts, transport).await;
-        assert!(result.is_err());
-        assert!(matches!(
-            result.err().unwrap(),
-            ConnectError::ConnectionFailed
-        ));
-    }
-
-    #[tokio::test]
-    async fn client_session_new_ssh_handshake_fails() {
-        let transport = Arc::new(DuplexTransport {
-            connect_count: Arc::new(AtomicUsize::new(0)),
-        });
-        let opts = ConnectOptions::new(make_identity()).server("example.com:22");
-        let result = ClientSession::new(opts, transport).await;
-        assert!(result.is_err());
-        assert!(matches!(
-            result.err().unwrap(),
-            ConnectError::ConnectionFailed
-        ));
-    }
-
-    #[test]
-    fn build_local_forwarders_empty() {
-        let opts = ConnectOptions::new(make_identity());
-        let result = build_local_forwarders(&opts);
-        assert!(result.is_ok());
-        assert!(result.unwrap().is_empty());
-    }
-
-    #[test]
-    fn build_local_forwarders_valid() {
-        let opts = ConnectOptions::new(make_identity()).forward("127.0.0.1:5432:db:5432");
-        let result = build_local_forwarders(&opts);
-        assert!(result.is_ok());
-        assert_eq!(result.unwrap().len(), 1);
-    }
-
-    #[test]
-    fn build_local_forwarders_invalid_spec() {
-        let opts = ConnectOptions::new(make_identity()).forward("bad-spec");
-        let result = build_local_forwarders(&opts);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn build_remote_specs_empty() {
-        let opts = ConnectOptions::new(make_identity());
-        let result = build_remote_specs(&opts);
-        assert!(result.is_ok());
-        assert!(result.unwrap().is_empty());
-    }
-
-    #[test]
-    fn build_remote_specs_valid() {
-        let opts =
-            ConnectOptions::new(make_identity()).remote_forward("0.0.0.0:8080:127.0.0.1:3000");
-        let result = build_remote_specs(&opts);
-        assert!(result.is_ok());
-        assert_eq!(result.unwrap().len(), 1);
-    }
-
-    #[test]
-    fn build_remote_specs_invalid() {
-        let opts = ConnectOptions::new(make_identity()).remote_forward("bad");
-        let result = build_remote_specs(&opts);
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn default_socks5_addr() {
-        assert_eq!(DEFAULT_SOCKS5_ADDR, "127.0.0.1:1080");
-    }
-
-    #[test]
-    fn drain_timeout_is_two_seconds() {
-        assert_eq!(DRAIN_TIMEOUT, Duration::from_secs(2));
-    }
-
-    #[test]
-    fn transport_mode_equality() {
-        assert_eq!(TransportMode::Tcp, TransportMode::Tcp);
-        assert_ne!(TransportMode::Tcp, TransportMode::Tls);
-        assert_ne!(TransportMode::Tls, TransportMode::Iroh);
-    }
-
-    #[tokio::test]
-    async fn shutdown_sends_disconnect_and_drains() {
-        let transport = Arc::new(DuplexTransport {
-            connect_count: Arc::new(AtomicUsize::new(0)),
-        });
-        let opts = ConnectOptions::new(make_identity()).server("example.com:22");
-        let result = ClientSession::new(opts, transport).await;
-        assert!(result.is_err());
-    }
-
-    #[test]
-    fn socks5_is_always_enabled_by_default() {
-        let opts = ConnectOptions::new(make_identity());
-        assert!(!opts.socks5_addr.is_empty());
-    }
-
-    #[tokio::test]
-    async fn integration_mock_transport_session() {
-        use crate::socks5::{ChannelOpenError, ChannelOpener};
-        use tokio::io::{duplex, AsyncReadExt, AsyncWriteExt};
-        use tokio::net::{TcpListener, TcpStream};
-
-        struct MockOpener;
-
-        impl ChannelOpener for MockOpener {
-            type Stream = tokio::io::DuplexStream;
-
-            async fn open_channel(
-                &self,
-                _host: String,
-                _port: u16,
-            ) -> Result<Self::Stream, ChannelOpenError> {
-                let (client, _server) = duplex(4096);
-                Ok(client)
-            }
-        }
-
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let bound_addr = listener.local_addr().unwrap();
-        drop(listener);
-
-        let opener = MockOpener;
-        let server = Socks5Server::with_addr(opener, &bound_addr.to_string());
-
-        let _server_task = tokio::spawn(async move {
-            let _ = server.run().await;
-        });
-
-        tokio::time::sleep(Duration::from_millis(50)).await;
-
-        let mut conn = TcpStream::connect(bound_addr).await.unwrap();
-
-        let greeting = [0x05, 0x01, 0x00];
-        conn.write_all(&greeting).await.unwrap();
-
-        let mut auth_resp = [0u8; 2];
-        conn.read_exact(&mut auth_resp).await.unwrap();
-        assert_eq!(auth_resp, [0x05, 0x00]);
-
-        let connect_req = [0x05, 0x01, 0x00, 0x01, 127, 0, 0, 1, 0, 80];
-        conn.write_all(&connect_req).await.unwrap();
-
-        let mut reply = [0u8; 10];
-        conn.read_exact(&mut reply).await.unwrap();
-        assert_eq!(reply[1], 0x00);
-
-        conn.write_all(b"test data").await.unwrap();
-        conn.shutdown().await.unwrap();
-    }
-}

crates/alknet-core/src/client/forward.rs

@@ -1,529 +0,0 @@
-//! Local and remote port forwarding.
-//!
-//! `LocalForwarder` binds a local TCP listener and forwards each connection through
-//! an SSH `direct-tcpip` channel. `RemoteForwarder` requests `tcpip-forward` from
-//! the server and handles `forwarded-tcpip` channels. Specs follow the
-//! `bind_addr:bind_port:target_host:target_port` format.
-
-use std::net::SocketAddr;
-use std::sync::Arc;
-
-use russh::client;
-use tokio::io;
-use tokio::net::{TcpListener, TcpStream};
-use tokio::sync::Mutex;
-use tracing::{debug, error, info};
-
-use crate::error::ForwardError;
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum PortForwardSpecKind {
-    Local,
-    Remote,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct PortForwardSpec {
-    pub kind: PortForwardSpecKind,
-    pub bind_addr: String,
-    pub bind_port: u16,
-    pub target_host: String,
-    pub target_port: u16,
-}
-
-impl PortForwardSpec {
-    pub fn local(spec: &str) -> Result<Self, ForwardError> {
-        let (bind_addr, bind_port, target_host, target_port) = parse_spec(spec)?;
-        Ok(Self {
-            kind: PortForwardSpecKind::Local,
-            bind_addr,
-            bind_port,
-            target_host,
-            target_port,
-        })
-    }
-
-    pub fn remote(spec: &str) -> Result<Self, ForwardError> {
-        let (bind_addr, bind_port, target_host, target_port) = parse_spec(spec)?;
-        Ok(Self {
-            kind: PortForwardSpecKind::Remote,
-            bind_addr,
-            bind_port,
-            target_host,
-            target_port,
-        })
-    }
-
-    pub fn listen_addr(&self) -> Result<SocketAddr, ForwardError> {
-        format!("{}:{}", self.bind_addr, self.bind_port)
-            .parse()
-            .map_err(|_| ForwardError::InvalidSpec {
-                spec: format!("{}:{}", self.bind_addr, self.bind_port),
-            })
-    }
-
-    pub fn target_addr(&self) -> Result<SocketAddr, ForwardError> {
-        format!("{}:{}", self.target_host, self.target_port)
-            .parse()
-            .map_err(|_| ForwardError::InvalidSpec {
-                spec: format!("{}:{}", self.target_host, self.target_port),
-            })
-    }
-}
-
-impl std::fmt::Display for PortForwardSpec {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        let prefix = match self.kind {
-            PortForwardSpecKind::Local => "-L",
-            PortForwardSpecKind::Remote => "-R",
-        };
-        write!(
-            f,
-            "{} {}:{}:{}:{}",
-            prefix, self.bind_addr, self.bind_port, self.target_host, self.target_port
-        )
-    }
-}
-
-fn parse_spec(spec: &str) -> Result<(String, u16, String, u16), ForwardError> {
-    let parts: Vec<&str> = spec.split(':').collect();
-    if parts.len() != 4 {
-        return Err(ForwardError::InvalidSpec {
-            spec: spec.to_string(),
-        });
-    }
-
-    let bind_addr = parts[0].to_string();
-    let bind_port: u16 = parts[1].parse().map_err(|_| ForwardError::InvalidSpec {
-        spec: spec.to_string(),
-    })?;
-    let target_host = parts[2].to_string();
-    let target_port: u16 = parts[3].parse().map_err(|_| ForwardError::InvalidSpec {
-        spec: spec.to_string(),
-    })?;
-
-    Ok((bind_addr, bind_port, target_host, target_port))
-}
-
-pub struct LocalForwarder {
-    spec: PortForwardSpec,
-    listener: Option<TcpListener>,
-}
-
-impl LocalForwarder {
-    pub fn new(spec: PortForwardSpec) -> Result<Self, ForwardError> {
-        if spec.kind != PortForwardSpecKind::Local {
-            return Err(ForwardError::InvalidSpec {
-                spec: format!("expected local spec, got {:?}", spec.kind),
-            });
-        }
-        Ok(Self {
-            spec,
-            listener: None,
-        })
-    }
-
-    pub fn spec(&self) -> &PortForwardSpec {
-        &self.spec
-    }
-
-    pub async fn run<H: client::Handler + Send + 'static>(
-        &mut self,
-        handle: Arc<Mutex<client::Handle<H>>>,
-    ) -> Result<(), ForwardError> {
-        let listen_addr = self.spec.listen_addr()?;
-        let listener: TcpListener = TcpListener::bind(listen_addr)
-            .await
-            .map_err(|e| ForwardError::BindFailed { source: e })?;
-        self.listener = Some(listener);
-        let remote_host = self.spec.target_host.clone();
-        let remote_port = self.spec.target_port;
-
-        info!(
-            "local forward listening on {} -> {}:{}",
-            listen_addr, remote_host, remote_port
-        );
-
-        loop {
-            let listener = match &self.listener {
-                Some(l) => l,
-                None => return Ok(()),
-            };
-            let accept_result = listener.accept().await;
-            let (local_stream, local_addr) = match accept_result {
-                Ok(conn) => conn,
-                Err(e) => {
-                    let handle = handle.lock().await;
-                    if handle.is_closed() {
-                        debug!("local forward accept loop ending: ssh session closed");
-                        return Ok(());
-                    }
-                    drop(handle);
-                    error!("local forward accept error: {}", e);
-                    continue;
-                }
-            };
-
-            debug!(
-                "local forward connection from {} -> {}:{}",
-                local_addr, remote_host, remote_port
-            );
-
-            let handle = handle.clone();
-            let remote_host = remote_host.clone();
-            tokio::spawn(async move {
-                if let Err(e) =
-                    proxy_local_to_remote(local_stream, handle, &remote_host, remote_port).await
-                {
-                    debug!("local forward proxy error: {}", e);
-                }
-            });
-        }
-    }
-
-    pub async fn stop(&mut self) {
-        if let Some(listener) = self.listener.take() {
-            drop(listener);
-        }
-    }
-
-    pub fn local_port(&self) -> u16 {
-        self.spec.bind_port
-    }
-}
-
-async fn proxy_local_to_remote<H: client::Handler + Send + 'static>(
-    local_stream: TcpStream,
-    handle: Arc<Mutex<client::Handle<H>>>,
-    remote_host: &str,
-    remote_port: u16,
-) -> Result<(), ForwardError> {
-    let local_addr = local_stream
-        .peer_addr()
-        .map(|a| a.to_string())
-        .unwrap_or_default();
-
-    let handle_guard = handle.lock().await;
-    let channel = handle_guard
-        .channel_open_direct_tcpip(remote_host, remote_port as u32, &local_addr, 0)
-        .await
-        .map_err(|e| ForwardError::ChannelOpenFailed {
-            source: Box::new(e) as _,
-        })?;
-    drop(handle_guard);
-
-    let ssh_stream = channel.into_stream();
-    let (mut ssh_read, mut ssh_write) = tokio::io::split(ssh_stream);
-    let (mut local_read, mut local_write) = tokio::io::split(local_stream);
-
-    let client_to_server = io::copy(&mut local_read, &mut ssh_write);
-    let server_to_client = io::copy(&mut ssh_read, &mut local_write);
-
-    match tokio::join!(client_to_server, server_to_client) {
-        (Err(e), _) | (_, Err(e)) => {
-            debug!("local forward bidirectional copy error: {}", e);
-        }
-        _ => {}
-    }
-
-    Ok(())
-}
-
-pub struct RemoteForwarder {
-    spec: PortForwardSpec,
-    cancel: Option<tokio::sync::oneshot::Sender<()>>,
-}
-
-impl RemoteForwarder {
-    pub fn new(spec: PortForwardSpec) -> Result<Self, ForwardError> {
-        if spec.kind != PortForwardSpecKind::Remote {
-            return Err(ForwardError::InvalidSpec {
-                spec: format!("expected remote spec, got {:?}", spec.kind),
-            });
-        }
-        Ok(Self { spec, cancel: None })
-    }
-
-    pub fn spec(&self) -> &PortForwardSpec {
-        &self.spec
-    }
-
-    pub async fn register<H: client::Handler + Send + 'static>(
-        &self,
-        handle: &mut client::Handle<H>,
-    ) -> Result<u32, ForwardError> {
-        let port = handle
-            .tcpip_forward(&self.spec.bind_addr, self.spec.bind_port as u32)
-            .await
-            .map_err(|e| ForwardError::ChannelOpenFailed {
-                source: Box::new(e) as _,
-            })?;
-        Ok(port)
-    }
-
-    pub async fn handle_forwarded_channel(
-        channel: russh::Channel<russh::client::Msg>,
-        connected_address: &str,
-        connected_port: u32,
-        local_host: &str,
-        local_port: u16,
-    ) {
-        debug!(
-            "remote forward: server opened forwarded-tcpip channel to {}:{} -> local {}:{}",
-            connected_address, connected_port, local_host, local_port
-        );
-
-        let local_target = format!("{}:{}", local_host, local_port);
-        let local_stream = match TcpStream::connect(&local_target).await {
-            Ok(s) => s,
-            Err(e) => {
-                error!(
-                    "remote forward: failed to connect to local target {}: {}",
-                    local_target, e
-                );
-                return;
-            }
-        };
-
-        let ssh_stream = channel.into_stream();
-        let (mut ssh_read, mut ssh_write) = tokio::io::split(ssh_stream);
-        let (mut local_read, mut local_write) = tokio::io::split(local_stream);
-
-        let client_to_server = io::copy(&mut local_read, &mut ssh_write);
-        let server_to_client = io::copy(&mut ssh_read, &mut local_write);
-
-        match tokio::join!(client_to_server, server_to_client) {
-            (Err(e), _) | (_, Err(e)) => {
-                debug!("remote forward bidirectional copy error: {}", e);
-            }
-            _ => {}
-        }
-    }
-
-    pub async fn unregister<H: client::Handler + Send + 'static>(
-        &self,
-        handle: &client::Handle<H>,
-    ) -> Result<(), ForwardError> {
-        handle
-            .cancel_tcpip_forward(&self.spec.bind_addr, self.spec.bind_port as u32)
-            .await
-            .map_err(|e| ForwardError::ChannelOpenFailed {
-                source: Box::new(e) as _,
-            })?;
-        Ok(())
-    }
-
-    pub async fn stop(&mut self) {
-        if let Some(cancel) = self.cancel.take() {
-            let _ = cancel.send(());
-        }
-    }
-}
-
-pub async fn run_local_forwarders<H: client::Handler + Send + 'static>(
-    forwarders: Vec<LocalForwarder>,
-    handle: Arc<Mutex<client::Handle<H>>>,
-    mut shutdown: tokio::sync::watch::Receiver<bool>,
-) -> Vec<LocalForwarder> {
-    let mut forwarders = forwarders;
-    let mut tasks = Vec::new();
-
-    for forwarder in forwarders.drain(..) {
-        let handle = handle.clone();
-        let spec = forwarder.spec().clone();
-        let (_cancel_tx, cancel_rx) = tokio::sync::oneshot::channel::<()>();
-        tasks.push(tokio::spawn(async move {
-            let mut fwd = forwarder;
-            tokio::select! {
-                result = fwd.run(handle) => {
-                    if let Err(e) = result {
-                        error!("local forward {} failed: {}", spec, e);
-                    }
-                }
-                _ = cancel_rx => {
-                    fwd.stop().await;
-                }
-            }
-            fwd
-        }));
-    }
-
-    let _ = shutdown.changed().await;
-
-    for task in &tasks {
-        task.abort();
-    }
-
-    let mut results = Vec::new();
-    for task in tasks {
-        match task.await {
-            Ok(fwd) => results.push(fwd),
-            Err(e) => {
-                if !e.is_cancelled() {
-                    error!("local forwarder task panicked: {}", e);
-                }
-            }
-        }
-    }
-    results
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn parse_local_spec() {
-        let spec = PortForwardSpec::local("127.0.0.1:5432:db.internal:5432").unwrap();
-        assert_eq!(spec.kind, PortForwardSpecKind::Local);
-        assert_eq!(spec.bind_addr, "127.0.0.1");
-        assert_eq!(spec.bind_port, 5432);
-        assert_eq!(spec.target_host, "db.internal");
-        assert_eq!(spec.target_port, 5432);
-    }
-
-    #[test]
-    fn parse_remote_spec() {
-        let spec = PortForwardSpec::remote("0.0.0.0:8080:127.0.0.1:3000").unwrap();
-        assert_eq!(spec.kind, PortForwardSpecKind::Remote);
-        assert_eq!(spec.bind_addr, "0.0.0.0");
-        assert_eq!(spec.bind_port, 8080);
-        assert_eq!(spec.target_host, "127.0.0.1");
-        assert_eq!(spec.target_port, 3000);
-    }
-
-    #[test]
-    fn parse_spec_invalid_few_parts() {
-        assert!(PortForwardSpec::local("127.0.0.1:5432:db").is_err());
-    }
-
-    #[test]
-    fn parse_spec_invalid_many_parts() {
-        assert!(PortForwardSpec::local("a:b:c:d:e").is_err());
-    }
-
-    #[test]
-    fn parse_spec_invalid_port() {
-        assert!(PortForwardSpec::local("127.0.0.1:abc:db:5432").is_err());
-    }
-
-    #[test]
-    fn parse_spec_invalid_target_port() {
-        assert!(PortForwardSpec::local("127.0.0.1:5432:db:abc").is_err());
-    }
-
-    #[test]
-    fn spec_display() {
-        let spec = PortForwardSpec::local("127.0.0.1:5432:db.internal:5432").unwrap();
-        assert_eq!(spec.to_string(), "-L 127.0.0.1:5432:db.internal:5432");
-    }
-
-    #[test]
-    fn spec_display_remote() {
-        let spec = PortForwardSpec::remote("0.0.0.0:8080:127.0.0.1:3000").unwrap();
-        assert_eq!(spec.to_string(), "-R 0.0.0.0:8080:127.0.0.1:3000");
-    }
-
-    #[test]
-    fn local_forwarder_rejects_remote_spec() {
-        let spec = PortForwardSpec::remote("0.0.0.0:8080:127.0.0.1:3000").unwrap();
-        assert!(LocalForwarder::new(spec).is_err());
-    }
-
-    #[test]
-    fn remote_forwarder_rejects_local_spec() {
-        let spec = PortForwardSpec::local("127.0.0.1:5432:db.internal:5432").unwrap();
-        assert!(RemoteForwarder::new(spec).is_err());
-    }
-
-    #[test]
-    fn listen_addr_valid() {
-        let spec = PortForwardSpec::local("127.0.0.1:5432:db.internal:5432").unwrap();
-        let addr = spec.listen_addr().unwrap();
-        assert_eq!(addr.port(), 5432);
-    }
-
-    #[test]
-    fn listen_addr_invalid_host() {
-        let spec = PortForwardSpec {
-            kind: PortForwardSpecKind::Local,
-            bind_addr: "!!!invalid".to_string(),
-            bind_port: 5432,
-            target_host: "db".to_string(),
-            target_port: 5432,
-        };
-        assert!(spec.listen_addr().is_err());
-    }
-
-    #[tokio::test]
-    async fn local_forward_bind_and_accept() {
-        let spec = PortForwardSpec::local(&format!("127.0.0.1:0:remote:5432")).unwrap();
-        let forwarder = LocalForwarder::new(spec).unwrap();
-
-        let listen_addr = forwarder.spec.listen_addr().unwrap();
-        let listener = TcpListener::bind(listen_addr).await.unwrap();
-        let bound_addr = listener.local_addr().unwrap();
-        drop(listener);
-
-        let spec = PortForwardSpec::local(&format!("127.0.0.1:{}:remote:5432", bound_addr.port()))
-            .unwrap();
-        let forwarder = LocalForwarder::new(spec).unwrap();
-        assert_eq!(forwarder.local_port(), bound_addr.port());
-    }
-
-    #[tokio::test]
-    async fn remote_forward_proxy_bidirectional() {
-        use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-        let echo_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let _echo_addr = echo_listener.local_addr().unwrap();
-
-        let echo_server = tokio::spawn(async move {
-            let (mut stream, _) = echo_listener.accept().await.unwrap();
-            let mut buf = [0u8; 64];
-            loop {
-                let n = match stream.read(&mut buf).await {
-                    Ok(0) => break,
-                    Ok(n) => n,
-                    Err(_) => break,
-                };
-                if stream.write_all(&buf[..n]).await.is_err() {
-                    break;
-                }
-            }
-        });
-
-        let local_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let local_addr = local_listener.local_addr().unwrap();
-
-        let proxy_task = tokio::spawn(async move {
-            let (stream, _) = local_listener.accept().await.unwrap();
-            let (mut read, mut write) = tokio::io::split(stream);
-            let _ = io::copy(&mut read, &mut write).await;
-        });
-
-        let mut local_conn = TcpStream::connect(local_addr).await.unwrap();
-        local_conn.write_all(b"hello").await.unwrap();
-        let mut buf = [0u8; 64];
-        let n = local_conn.read(&mut buf).await.unwrap();
-        assert_eq!(&buf[..n], b"hello");
-
-        echo_server.abort();
-        proxy_task.abort();
-    }
-
-    #[test]
-    fn forwarder_spec_access() {
-        let spec = PortForwardSpec::local("127.0.0.1:5432:db.internal:5432").unwrap();
-        let forwarder = LocalForwarder::new(spec.clone()).unwrap();
-        assert_eq!(forwarder.spec(), &spec);
-        assert_eq!(forwarder.local_port(), 5432);
-    }
-
-    #[test]
-    fn remote_forwarder_spec_access() {
-        let spec = PortForwardSpec::remote("0.0.0.0:8080:127.0.0.1:3000").unwrap();
-        let forwarder = RemoteForwarder::new(spec.clone()).unwrap();
-        assert_eq!(forwarder.spec(), &spec);
-    }
-}

crates/alknet-core/src/client/mod.rs

@@ -1,17 +0,0 @@
-//! Client-side SSH session management.
-//!
-//! Provides `ClientSession` for establishing an SSH connection over any transport,
-//! running a local SOCKS5 proxy, and managing port forwards. Also provides
-//! `ChannelManager` for programmatic channel management with automatic reconnection.
-//!
-//! The client always starts a SOCKS5 proxy (default `127.0.0.1:1080`) when running
-//! via `ClientSession::run()`. For VPN-like "route all traffic" behavior, use
-//! [tun2proxy](https://github.com/tun2proxy/tun2proxy) alongside the SOCKS5 proxy.
-
-pub mod channel_manager;
-pub mod connect;
-pub mod forward;
-
-pub use channel_manager::{ChannelManager, ForwardRequest};
-pub use connect::{ClientSession, ConnectError, ConnectOptions, TransportMode};
-pub use forward::{LocalForwarder, PortForwardSpec, PortForwardSpecKind, RemoteForwarder};

crates/alknet-core/src/config.rs

@@ -0,0 +1,714 @@
+//! Configuration: `DynamicConfig`, `AuthPolicy`, `ApiKeyEntry`,
+//! `RateLimitConfig`, `ConfigReloadHandle`.
+//!
+//! See `docs/architecture/crates/core/config.md` for the full specification.
+//!
+//! This module provides the dynamic-config types required by
+//! `auth::ConfigIdentityProvider`. The remaining types (`StaticConfig`,
+//! `TlsIdentity`, `ConfigError`) are filled in by the core/config task.
+
+use std::collections::HashMap;
+use std::io;
+use std::net::SocketAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use std::time::Duration;
+
+use arc_swap::ArcSwap;
+
+use crate::auth::Identity;
+
+pub const API_KEY_PREFIX: &str = "alk_";
+
+#[derive(Debug, Clone)]
+pub struct StaticConfig {
+    pub listen_addr: Option<SocketAddr>,
+    pub tls_identity: Option<TlsIdentity>,
+    #[cfg(feature = "iroh")]
+    pub iroh_relay: Option<iroh::RelayUrl>,
+    pub drain_timeout: Duration,
+}
+
+#[derive(Clone)]
+pub struct Ed25519SecretKey(ed25519_dalek::SigningKey);
+
+impl Ed25519SecretKey {
+    pub fn generate() -> Self {
+        let mut csprng = rand::rngs::OsRng;
+        Self(ed25519_dalek::SigningKey::generate(&mut csprng))
+    }
+
+    pub fn from_bytes(bytes: &[u8; 32]) -> Self {
+        Self(ed25519_dalek::SigningKey::from_bytes(bytes))
+    }
+
+    pub fn as_bytes(&self) -> [u8; 32] {
+        self.0.to_bytes()
+    }
+
+    pub fn public(&self) -> ed25519_dalek::VerifyingKey {
+        self.0.verifying_key()
+    }
+
+    pub fn sign(&self, message: &[u8]) -> ed25519_dalek::Signature {
+        use ed25519_dalek::Signer;
+        self.0.sign(message)
+    }
+}
+
+impl std::fmt::Debug for Ed25519SecretKey {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("Ed25519SecretKey").finish_non_exhaustive()
+    }
+}
+
+impl zeroize::ZeroizeOnDrop for Ed25519SecretKey {}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum AcmeDirectory {
+    Production,
+    Staging,
+    Custom(String),
+}
+
+impl AcmeDirectory {
+    pub fn url(&self) -> &str {
+        match self {
+            AcmeDirectory::Production => "https://acme-v02.api.letsencrypt.org/directory",
+            AcmeDirectory::Staging => "https://acme-staging-v02.api.letsencrypt.org/directory",
+            AcmeDirectory::Custom(url) => url,
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub enum TlsIdentity {
+    X509 {
+        cert: PathBuf,
+        key: PathBuf,
+    },
+    RawKey(Ed25519SecretKey),
+    SelfSigned,
+    Acme {
+        domains: Vec<String>,
+        cache_dir: PathBuf,
+        directory: AcmeDirectory,
+        contact: Vec<String>,
+    },
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct DynamicConfig {
+    pub auth: AuthPolicy,
+    pub rate_limits: RateLimitConfig,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct PeerEntry {
+    pub peer_id: String,
+    pub fingerprints: Vec<String>,
+    pub auth_token_hash: Option<String>,
+    pub scopes: Vec<String>,
+    pub resources: HashMap<String, Vec<String>>,
+    pub display_name: Option<String>,
+    pub enabled: bool,
+}
+
+#[derive(Debug, Clone, Default)]
+pub struct AuthPolicy {
+    pub peers: Vec<PeerEntry>,
+    pub api_keys: Vec<ApiKeyEntry>,
+}
+
+#[derive(Debug, Clone)]
+pub struct ApiKeyEntry {
+    pub prefix: String,
+    pub hash: String,
+    pub scopes: Vec<String>,
+    pub description: String,
+    pub expires_at: Option<u64>,
+}
+
+impl AuthPolicy {
+    pub fn empty() -> Self {
+        Self::default()
+    }
+
+    pub fn resolve_identity_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
+        self.peers
+            .iter()
+            .find(|p| p.enabled && p.fingerprints.iter().any(|f| f == fingerprint))
+            .map(|p| Identity {
+                id: p.peer_id.clone(),
+                scopes: p.scopes.clone(),
+                resources: p.resources.clone(),
+            })
+    }
+
+    pub fn resolve_identity_from_token(&self, token: &str) -> Option<Identity> {
+        let token_hash = sha256_hex(token);
+        self.peers
+            .iter()
+            .find(|p| p.enabled && p.auth_token_hash.as_deref() == Some(&token_hash))
+            .map(|p| Identity {
+                id: p.peer_id.clone(),
+                scopes: p.scopes.clone(),
+                resources: p.resources.clone(),
+            })
+            .or_else(|| self.resolve_api_key(token))
+    }
+
+    pub fn validate_peer_ids(&self) -> Result<(), DuplicatePeerId> {
+        let mut seen = std::collections::HashSet::new();
+        for peer in &self.peers {
+            if !seen.insert(peer.peer_id.as_str()) {
+                return Err(DuplicatePeerId {
+                    peer_id: peer.peer_id.clone(),
+                });
+            }
+        }
+        Ok(())
+    }
+
+    pub fn resolve_api_key(&self, token: &str) -> Option<Identity> {
+        if !token.starts_with(API_KEY_PREFIX) {
+            return None;
+        }
+
+        let prefix_part = &token[..token.len().min(8)];
+
+        let entry = self
+            .api_keys
+            .iter()
+            .find(|e| prefix_part.starts_with(&e.prefix))?;
+
+        let expected_hash = sha256_hex(token);
+
+        if entry.hash != expected_hash {
+            return None;
+        }
+
+        if let Some(expires_at) = entry.expires_at {
+            let now_secs = std::time::SystemTime::now()
+                .duration_since(std::time::SystemTime::UNIX_EPOCH)
+                .map(|d| d.as_secs())
+                .unwrap_or(0);
+            if now_secs >= expires_at {
+                return None;
+            }
+        }
+
+        Some(Identity {
+            id: entry.prefix.clone(),
+            scopes: entry.scopes.clone(),
+            resources: std::collections::HashMap::new(),
+        })
+    }
+}
+
+fn sha256_hex(input: &str) -> String {
+    use sha2::{Digest, Sha256};
+    let mut hasher = Sha256::new();
+    hasher.update(input.as_bytes());
+    let result = hasher.finalize();
+    format!("sha256:{}", hex::encode(result))
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, thiserror::Error)]
+#[error("duplicate peer_id: {peer_id}")]
+pub struct DuplicatePeerId {
+    pub peer_id: String,
+}
+
+#[derive(Debug, Clone)]
+pub struct RateLimitConfig {
+    pub max_connections_per_ip: usize,
+    pub max_auth_attempts: usize,
+}
+
+impl Default for RateLimitConfig {
+    fn default() -> Self {
+        Self {
+            max_connections_per_ip: 100,
+            max_auth_attempts: 5,
+        }
+    }
+}
+
+pub struct ConfigReloadHandle {
+    dynamic: Arc<ArcSwap<DynamicConfig>>,
+}
+
+impl ConfigReloadHandle {
+    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
+        Self { dynamic }
+    }
+
+    pub fn reload(&self, new_config: DynamicConfig) {
+        self.dynamic.store(Arc::new(new_config));
+    }
+
+    pub fn dynamic(&self) -> Arc<DynamicConfig> {
+        self.dynamic.load_full()
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum ConfigError {
+    #[error("invalid flag: {name}")]
+    InvalidFlag { name: String },
+    #[error("key file not found: {path}")]
+    KeyFileNotFound { path: String },
+    #[error("bind failed: {0}")]
+    BindFailed(#[from] io::Error),
+    #[error("tls config error: {0}")]
+    TlsConfig(io::Error),
+    #[error("incompatible options")]
+    IncompatibleOptions,
+}
+
+impl Default for StaticConfig {
+    fn default() -> Self {
+        Self {
+            listen_addr: None,
+            tls_identity: None,
+            #[cfg(feature = "iroh")]
+            iroh_relay: None,
+            drain_timeout: Duration::from_secs(2),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn static_config_default() {
+        let cfg = StaticConfig::default();
+        assert!(cfg.listen_addr.is_none());
+        assert!(cfg.tls_identity.is_none());
+        assert_eq!(cfg.drain_timeout, Duration::from_secs(2));
+    }
+
+    #[test]
+    fn dynamic_config_default() {
+        let cfg = DynamicConfig::default();
+        assert!(cfg.auth.peers.is_empty());
+        assert!(cfg.auth.api_keys.is_empty());
+        assert_eq!(cfg.rate_limits.max_connections_per_ip, 100);
+        assert_eq!(cfg.rate_limits.max_auth_attempts, 5);
+    }
+
+    #[test]
+    fn auth_policy_default() {
+        let policy = AuthPolicy::default();
+        assert!(policy.peers.is_empty());
+        assert!(policy.api_keys.is_empty());
+    }
+
+    #[test]
+    fn rate_limit_config_default() {
+        let rl = RateLimitConfig::default();
+        assert!(rl.max_connections_per_ip > 0);
+        assert!(rl.max_auth_attempts > 0);
+    }
+
+    #[test]
+    fn api_key_entry_construct() {
+        let entry = ApiKeyEntry {
+            prefix: "alk12345".to_string(),
+            hash: "deadbeef".to_string(),
+            scopes: vec!["admin".to_string()],
+            description: "test key".to_string(),
+            expires_at: Some(1_700_000_000),
+        };
+        assert_eq!(entry.prefix, "alk12345");
+        assert_eq!(entry.scopes, vec!["admin"]);
+        assert_eq!(entry.expires_at, Some(1_700_000_000));
+    }
+
+    #[test]
+    fn tls_identity_x509_construct() {
+        let id = TlsIdentity::X509 {
+            cert: PathBuf::from("/etc/cert.pem"),
+            key: PathBuf::from("/etc/key.pem"),
+        };
+        match id {
+            TlsIdentity::X509 { cert, key } => {
+                assert_eq!(cert, PathBuf::from("/etc/cert.pem"));
+                assert_eq!(key, PathBuf::from("/etc/key.pem"));
+            }
+            _ => panic!("expected X509"),
+        }
+    }
+
+    #[test]
+    fn tls_identity_self_signed() {
+        let id = TlsIdentity::SelfSigned;
+        let s = format!("{id:?}");
+        assert!(s.contains("SelfSigned"));
+    }
+
+    #[test]
+    fn config_reload_handle_swaps_atomically() {
+        let dynamic = Arc::new(ArcSwap::from_pointee(DynamicConfig::default()));
+        let handle = ConfigReloadHandle::new(dynamic.clone());
+
+        let initial = handle.dynamic();
+        assert!(initial.auth.peers.is_empty());
+
+        let new_auth = AuthPolicy {
+            peers: vec![PeerEntry {
+                peer_id: "worker-a".to_string(),
+                fingerprints: vec!["aa:bb:cc".to_string()],
+                auth_token_hash: None,
+                scopes: vec!["relay:connect".to_string()],
+                resources: HashMap::new(),
+                display_name: None,
+                enabled: true,
+            }],
+            api_keys: Vec::new(),
+        };
+        let new_config = DynamicConfig {
+            auth: new_auth,
+            rate_limits: RateLimitConfig::default(),
+        };
+        handle.reload(new_config);
+
+        let after = handle.dynamic();
+        assert_eq!(after.auth.peers.len(), 1);
+        assert_eq!(after.auth.peers[0].peer_id, "worker-a");
+        assert!(initial.auth.peers.is_empty());
+    }
+
+    #[test]
+    fn config_reload_handle_dynamic_returns_current() {
+        let dynamic = Arc::new(ArcSwap::from_pointee(DynamicConfig::default()));
+        let handle = ConfigReloadHandle::new(dynamic);
+        let a = handle.dynamic();
+        let b = handle.dynamic();
+        assert_eq!(
+            a.rate_limits.max_auth_attempts,
+            b.rate_limits.max_auth_attempts
+        );
+    }
+
+    #[test]
+    fn config_error_invalid_flag_display() {
+        let e = ConfigError::InvalidFlag {
+            name: "foo".to_string(),
+        };
+        assert_eq!(format!("{e}"), "invalid flag: foo");
+    }
+
+    #[test]
+    fn config_error_key_file_not_found_display() {
+        let e = ConfigError::KeyFileNotFound {
+            path: "/x".to_string(),
+        };
+        assert_eq!(format!("{e}"), "key file not found: /x");
+    }
+
+    #[test]
+    fn config_error_incompatible_options_display() {
+        let e = ConfigError::IncompatibleOptions;
+        assert_eq!(format!("{e}"), "incompatible options");
+    }
+
+    #[test]
+    fn config_error_bind_failed_from_io() {
+        let io_err = io::Error::new(io::ErrorKind::AddrInUse, "busy");
+        let e: ConfigError = io_err.into();
+        assert!(matches!(e, ConfigError::BindFailed(_)));
+    }
+
+    #[test]
+    fn config_error_tls_config_display() {
+        let e = ConfigError::TlsConfig(io::Error::new(io::ErrorKind::InvalidData, "bad"));
+        let s = format!("{e}");
+        assert!(s.starts_with("tls config error:"));
+    }
+
+    #[test]
+    fn resolve_api_key_returns_empty_resources() {
+        let token = "alk_test_secret";
+        let hash = sha256_hex(token);
+
+        let entry = ApiKeyEntry {
+            prefix: "alk_tes".to_string(),
+            hash,
+            scopes: vec!["admin".to_string()],
+            description: "test key".to_string(),
+            expires_at: None,
+        };
+        let policy = AuthPolicy {
+            peers: Vec::new(),
+            api_keys: vec![entry],
+        };
+
+        let identity = policy.resolve_api_key(token);
+        assert!(
+            identity.is_some(),
+            "api key with matching prefix and hash should resolve"
+        );
+        let identity = identity.unwrap();
+        assert_eq!(identity.id, "alk_tes");
+        assert_eq!(identity.scopes, vec!["admin"]);
+        assert!(
+            identity.resources.is_empty(),
+            "token-resolved identities must have empty resources (Option B — scopes only)"
+        );
+    }
+
+    #[test]
+    fn resolve_identity_from_fingerprint_uses_peer_id() {
+        let policy = AuthPolicy {
+            peers: vec![PeerEntry {
+                peer_id: "worker-a".to_string(),
+                fingerprints: vec!["SHA256:known".to_string()],
+                auth_token_hash: None,
+                scopes: vec!["relay:connect".to_string()],
+                resources: HashMap::new(),
+                display_name: None,
+                enabled: true,
+            }],
+            api_keys: vec![],
+        };
+
+        let identity = policy
+            .resolve_identity_from_fingerprint("SHA256:known")
+            .expect("known fingerprint should resolve");
+        assert_eq!(identity.id, "worker-a");
+        assert_eq!(identity.scopes, vec!["relay:connect"]);
+    }
+
+    // --- PeerEntry model (ADR-030) ---------------------------------------
+
+    fn peer_entry(peer_id: &str, fingerprints: &[&str]) -> PeerEntry {
+        PeerEntry {
+            peer_id: peer_id.to_string(),
+            fingerprints: fingerprints.iter().map(|s| s.to_string()).collect(),
+            auth_token_hash: None,
+            scopes: vec!["relay:connect".to_string()],
+            resources: HashMap::new(),
+            display_name: None,
+            enabled: true,
+        }
+    }
+
+    #[test]
+    fn fingerprint_resolution_known_returns_some_with_peer_id() {
+        let policy = AuthPolicy {
+            peers: vec![peer_entry("worker-a", &["ed25519:abc"])],
+            api_keys: vec![],
+        };
+        let identity = policy
+            .resolve_identity_from_fingerprint("ed25519:abc")
+            .expect("known fingerprint resolves");
+        assert_eq!(identity.id, "worker-a");
+        assert_eq!(identity.scopes, vec!["relay:connect"]);
+    }
+
+    #[test]
+    fn fingerprint_resolution_unknown_returns_none() {
+        let policy = AuthPolicy {
+            peers: vec![peer_entry("worker-a", &["ed25519:abc"])],
+            api_keys: vec![],
+        };
+        assert!(policy
+            .resolve_identity_from_fingerprint("ed25519:unknown")
+            .is_none());
+    }
+
+    #[test]
+    fn fingerprint_resolution_disabled_returns_none() {
+        let mut entry = peer_entry("worker-a", &["ed25519:abc"]);
+        entry.enabled = false;
+        let policy = AuthPolicy {
+            peers: vec![entry],
+            api_keys: vec![],
+        };
+        assert!(policy
+            .resolve_identity_from_fingerprint("ed25519:abc")
+            .is_none());
+    }
+
+    #[test]
+    fn token_resolution_matching_peer_returns_some_with_peer_id() {
+        let token = "bearer-secret";
+        let mut entry = peer_entry("worker-a", &["ed25519:abc"]);
+        entry.auth_token_hash = Some(sha256_hex(token));
+        let policy = AuthPolicy {
+            peers: vec![entry],
+            api_keys: vec![],
+        };
+        let identity = policy
+            .resolve_identity_from_token(token)
+            .expect("matching auth_token_hash resolves");
+        assert_eq!(identity.id, "worker-a");
+    }
+
+    #[test]
+    fn token_resolution_non_matching_falls_through_to_api_key() {
+        let api_token = "alk_test_secret";
+        let mut entry = peer_entry("worker-a", &["ed25519:abc"]);
+        entry.auth_token_hash = Some(sha256_hex("different-token"));
+        let api_entry = ApiKeyEntry {
+            prefix: "alk_tes".to_string(),
+            hash: sha256_hex(api_token),
+            scopes: vec!["admin".to_string()],
+            description: "test key".to_string(),
+            expires_at: None,
+        };
+        let policy = AuthPolicy {
+            peers: vec![entry],
+            api_keys: vec![api_entry],
+        };
+        let identity = policy
+            .resolve_identity_from_token(api_token)
+            .expect("api key fall-through resolves");
+        assert_eq!(identity.id, "alk_tes");
+        assert_eq!(identity.scopes, vec!["admin"]);
+    }
+
+    #[test]
+    fn token_resolution_no_match_returns_none() {
+        let policy = AuthPolicy {
+            peers: vec![peer_entry("worker-a", &["ed25519:abc"])],
+            api_keys: vec![],
+        };
+        assert!(policy.resolve_identity_from_token("unknown").is_none());
+    }
+
+    #[test]
+    fn multi_fingerprint_peer_any_resolves_to_same_peer_id() {
+        let policy = AuthPolicy {
+            peers: vec![peer_entry("worker-a", &["ed25519:abc", "SHA256:def"])],
+            api_keys: vec![],
+        };
+        let id1 = policy
+            .resolve_identity_from_fingerprint("ed25519:abc")
+            .expect("first fingerprint resolves");
+        let id2 = policy
+            .resolve_identity_from_fingerprint("SHA256:def")
+            .expect("second fingerprint resolves");
+        assert_eq!(id1.id, "worker-a");
+        assert_eq!(id2.id, "worker-a");
+    }
+
+    #[test]
+    fn resources_populated_on_fingerprint_path() {
+        let mut resources = HashMap::new();
+        resources.insert("service".to_string(), vec!["gitea".to_string()]);
+        let mut entry = peer_entry("worker-a", &["ed25519:abc"]);
+        entry.resources = resources.clone();
+        let policy = AuthPolicy {
+            peers: vec![entry],
+            api_keys: vec![],
+        };
+        let identity = policy
+            .resolve_identity_from_fingerprint("ed25519:abc")
+            .expect("known fingerprint resolves");
+        assert_eq!(identity.resources, resources);
+    }
+
+    #[test]
+    fn resources_populated_on_token_path() {
+        let token = "bearer-secret";
+        let mut resources = HashMap::new();
+        resources.insert("service".to_string(), vec!["gitea".to_string()]);
+        let mut entry = peer_entry("worker-a", &["ed25519:abc"]);
+        entry.auth_token_hash = Some(sha256_hex(token));
+        entry.resources = resources.clone();
+        let policy = AuthPolicy {
+            peers: vec![entry],
+            api_keys: vec![],
+        };
+        let identity = policy
+            .resolve_identity_from_token(token)
+            .expect("matching token resolves");
+        assert_eq!(identity.resources, resources);
+    }
+
+    #[test]
+    fn duplicate_peer_id_validation_rejects() {
+        let policy = AuthPolicy {
+            peers: vec![
+                peer_entry("worker-a", &["ed25519:abc"]),
+                peer_entry("worker-a", &["ed25519:def"]),
+            ],
+            api_keys: vec![],
+        };
+        let err = policy.validate_peer_ids().expect_err("duplicate detected");
+        assert_eq!(err.peer_id, "worker-a");
+    }
+
+    #[test]
+    fn unique_peer_ids_validate_ok() {
+        let policy = AuthPolicy {
+            peers: vec![
+                peer_entry("worker-a", &["ed25519:abc"]),
+                peer_entry("worker-b", &["ed25519:def"]),
+            ],
+            api_keys: vec![],
+        };
+        assert!(policy.validate_peer_ids().is_ok());
+    }
+
+    // --- Ed25519SecretKey -------------------------------------------------
+
+    #[test]
+    fn ed25519_secret_key_round_trips_bytes() {
+        let key = Ed25519SecretKey::generate();
+        let bytes = key.as_bytes();
+        let restored = Ed25519SecretKey::from_bytes(&bytes);
+        assert_eq!(restored.as_bytes(), bytes);
+    }
+
+    #[test]
+    fn ed25519_secret_key_sign_verifies_against_public_key() {
+        use ed25519_dalek::{Signature, Verifier};
+        let key = Ed25519SecretKey::generate();
+        let public = key.public();
+        let message = b"alknet coverage check";
+        let signature: Signature = key.sign(message);
+        assert_eq!(signature.to_bytes().len(), 64);
+        assert!(
+            public.verify(message, &signature).is_ok(),
+            "signature produced by Ed25519SecretKey::sign must verify under its public key"
+        );
+    }
+
+    #[test]
+    fn ed25519_secret_key_sign_rejects_tampered_message() {
+        use ed25519_dalek::{Signature, Verifier};
+        let key = Ed25519SecretKey::generate();
+        let public = key.public();
+        let signature: Signature = key.sign(b"original message");
+        assert!(
+            public.verify(b"tampered message", &signature).is_err(),
+            "signature must not verify against a different message"
+        );
+    }
+
+    #[test]
+    fn ed25519_secret_key_debug_does_not_leak_material() {
+        let key = Ed25519SecretKey::generate();
+        let dbg = format!("{key:?}");
+        assert!(dbg.contains("Ed25519SecretKey"));
+        assert!(!dbg.contains("SigningKey"));
+        let raw = hex::encode(key.as_bytes());
+        assert!(
+            !dbg.contains(&raw),
+            "Debug output must not contain the raw key bytes"
+        );
+    }
+
+    #[test]
+    fn ed25519_secret_key_public_matches_underlying_signing_key() {
+        let key = Ed25519SecretKey::generate();
+        let public = key.public();
+        assert_eq!(public.to_bytes().len(), 32);
+    }
+}

crates/alknet-core/src/config/config_service.rs

@@ -1,99 +0,0 @@
-//! Configuration service for runtime config reload.
-//!
-//! See [ADR-030](docs/architecture/decisions/030-dynamic-config.md).
-
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-
-use super::{DynamicConfig, ForwardingPolicy, RateLimitConfig};
-
-pub struct ConfigServiceImpl {
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-}
-
-impl ConfigServiceImpl {
-    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
-        Self { dynamic }
-    }
-
-    pub fn forwarding_policy(&self) -> Arc<ForwardingPolicy> {
-        Arc::new(self.dynamic.load().forwarding.clone())
-    }
-
-    pub fn rate_limits(&self) -> Arc<RateLimitConfig> {
-        Arc::new(self.dynamic.load().rate_limits.clone())
-    }
-
-    pub fn reload(&self, new_config: DynamicConfig) {
-        self.dynamic.store(Arc::new(new_config));
-    }
-}
-
-impl std::fmt::Debug for ConfigServiceImpl {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ConfigServiceImpl").finish()
-    }
-}
-
-#[cfg(feature = "irpc")]
-#[allow(dead_code)]
-pub enum ConfigProtocol {
-    GetForwardingPolicy,
-    GetRateLimits,
-    ReloadForwarding { policy: ForwardingPolicy },
-    ReloadRateLimits { limits: RateLimitConfig },
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::config::AuthPolicy;
-
-    #[test]
-    fn config_service_impl_forwarding_policy() {
-        let (arc_swap, _) = super::super::new_dynamic_config();
-        let service = ConfigServiceImpl::new(Arc::clone(&arc_swap));
-        let policy = service.forwarding_policy();
-        assert_eq!(policy.default, ForwardingPolicy::allow_all().default);
-    }
-
-    #[test]
-    fn config_service_impl_rate_limits() {
-        let (arc_swap, _) = super::super::new_dynamic_config();
-        let service = ConfigServiceImpl::new(Arc::clone(&arc_swap));
-        let limits = service.rate_limits();
-        assert_eq!(limits.max_auth_attempts, 10);
-    }
-
-    #[test]
-    fn config_service_impl_reload() {
-        let (arc_swap, _) = super::super::new_dynamic_config();
-        let service = ConfigServiceImpl::new(Arc::clone(&arc_swap));
-        assert_eq!(
-            service.forwarding_policy().default,
-            ForwardingPolicy::allow_all().default
-        );
-
-        let new_config = DynamicConfig {
-            auth: AuthPolicy::empty(),
-            forwarding: ForwardingPolicy::deny_all(),
-            rate_limits: RateLimitConfig::default(),
-            credentials: std::collections::HashMap::new(),
-        };
-        service.reload(new_config);
-
-        assert_eq!(
-            service.forwarding_policy().default,
-            ForwardingPolicy::deny_all().default
-        );
-    }
-
-    #[test]
-    fn config_service_impl_debug() {
-        let (arc_swap, _) = super::super::new_dynamic_config();
-        let service = ConfigServiceImpl::new(Arc::clone(&arc_swap));
-        let debug_str = format!("{:?}", service);
-        assert!(debug_str.contains("ConfigServiceImpl"));
-    }
-}

crates/alknet-core/src/config/dynamic_config.rs

@@ -1,603 +0,0 @@
-//! Runtime-reloadable dynamic configuration (auth policy, forwarding policy, rate limits).
-//!
-//! See [ADR-030](docs/architecture/decisions/030-dynamic-config.md).
-
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-use russh::keys::ssh_key::HashAlg;
-
-use crate::auth::identity::Identity;
-use crate::auth::ServerAuthConfig;
-use crate::config::forwarding::ForwardingPolicy;
-use crate::credentials::CredentialSet;
-
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct ApiKeyEntry {
-    pub prefix: String,
-    pub hash: String,
-    pub scopes: Vec<String>,
-    pub description: String,
-    pub expires_at: Option<u64>,
-}
-
-pub const API_KEY_PREFIX: &str = "alk_";
-
-pub struct AuthPolicy {
-    pub authorized_keys: std::collections::HashSet<russh::keys::PublicKey>,
-    pub cert_authorities: Vec<crate::auth::keys::CertAuthorityEntry>,
-    pub api_keys: Vec<ApiKeyEntry>,
-    encoded_keys: std::collections::HashSet<Vec<u8>>,
-    fingerprint_to_key: HashMap<String, russh::keys::PublicKey>,
-}
-
-fn encode_key_data(key: &russh::keys::PublicKey) -> Vec<u8> {
-    use russh::keys::helpers::EncodedExt;
-    key.key_data().encoded().unwrap_or_default()
-}
-
-impl AuthPolicy {
-    pub fn new(
-        authorized_keys: std::collections::HashSet<russh::keys::PublicKey>,
-        cert_authorities: Vec<crate::auth::keys::CertAuthorityEntry>,
-    ) -> Self {
-        Self::with_api_keys(authorized_keys, cert_authorities, Vec::new())
-    }
-
-    pub fn with_api_keys(
-        authorized_keys: std::collections::HashSet<russh::keys::PublicKey>,
-        cert_authorities: Vec<crate::auth::keys::CertAuthorityEntry>,
-        api_keys: Vec<ApiKeyEntry>,
-    ) -> Self {
-        let encoded_keys = authorized_keys.iter().map(encode_key_data).collect();
-        let fingerprint_to_key = authorized_keys
-            .iter()
-            .map(|k| (format!("{}", k.fingerprint(HashAlg::Sha256)), k.clone()))
-            .collect();
-
-        Self {
-            authorized_keys,
-            cert_authorities,
-            api_keys,
-            encoded_keys,
-            fingerprint_to_key,
-        }
-    }
-
-    pub fn from_server_auth_config(config: ServerAuthConfig) -> Self {
-        Self::new(config.authorized_keys, config.cert_authorities)
-    }
-
-    pub fn empty() -> Self {
-        Self::new(std::collections::HashSet::new(), Vec::new())
-    }
-
-    pub fn resolve_identity_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
-        if self.fingerprint_to_key.contains_key(fingerprint) {
-            Some(Identity {
-                id: fingerprint.to_string(),
-                scopes: vec!["relay:connect".to_string()],
-                resources: HashMap::new(),
-            })
-        } else {
-            None
-        }
-    }
-
-    pub fn resolve_api_key(&self, token: &str) -> Option<Identity> {
-        if !token.starts_with(API_KEY_PREFIX) {
-            return None;
-        }
-
-        let prefix_part = &token[..token.len().min(8)];
-
-        let entry = self
-            .api_keys
-            .iter()
-            .find(|e| prefix_part.starts_with(&e.prefix))?;
-
-        use sha2::{Digest, Sha256};
-        let mut hasher = Sha256::new();
-        hasher.update(token.as_bytes());
-        let result = hasher.finalize();
-        let expected_hash = format!("sha256:{}", hex::encode(result));
-
-        if entry.hash != expected_hash {
-            return None;
-        }
-
-        if let Some(expires_at) = entry.expires_at {
-            let now_secs = std::time::SystemTime::now()
-                .duration_since(std::time::SystemTime::UNIX_EPOCH)
-                .map(|d| d.as_secs())
-                .unwrap_or(0);
-            if now_secs >= expires_at {
-                return None;
-            }
-        }
-
-        Some(Identity {
-            id: entry.prefix.clone(),
-            scopes: entry.scopes.clone(),
-            resources: HashMap::new(),
-        })
-    }
-
-    pub fn authenticate_publickey(
-        &self,
-        key: &russh::keys::PublicKey,
-    ) -> Result<(), crate::error::AuthError> {
-        let encoded = encode_key_data(key);
-        if self.encoded_keys.contains(&encoded) {
-            return Ok(());
-        }
-        Err(crate::error::AuthError::KeyRejected)
-    }
-
-    pub fn authenticate_certificate(
-        &self,
-        cert: &russh::keys::Certificate,
-        user: &str,
-        client_ip: Option<std::net::IpAddr>,
-    ) -> Result<(), crate::error::AuthError> {
-        use std::time::SystemTime;
-
-        let matching_ca = self
-            .cert_authorities
-            .iter()
-            .find(|ca| cert.signature_key() == ca.public_key.key_data());
-
-        let ca_entry = match matching_ca {
-            Some(entry) => entry,
-            None => return Err(crate::error::AuthError::CertInvalid),
-        };
-
-        if cert.verify_signature().is_err() {
-            return Err(crate::error::AuthError::CertInvalid);
-        }
-
-        let now = SystemTime::now();
-        let now_secs = now
-            .duration_since(SystemTime::UNIX_EPOCH)
-            .map(|d| d.as_secs())
-            .unwrap_or(0);
-
-        if now_secs < cert.valid_after() || now_secs >= cert.valid_before() {
-            return Err(crate::error::AuthError::CertExpired);
-        }
-
-        let principals = cert.valid_principals();
-        if !principals.is_empty() && !principals.iter().any(|p| p == user) {
-            return Err(crate::error::AuthError::CertPrincipalMismatch);
-        }
-
-        check_critical_options(cert, ca_entry, client_ip)?;
-        check_extensions(cert, ca_entry)?;
-
-        Ok(())
-    }
-}
-
-fn check_critical_options(
-    cert: &russh::keys::Certificate,
-    ca_entry: &crate::auth::keys::CertAuthorityEntry,
-    client_ip: Option<std::net::IpAddr>,
-) -> Result<(), crate::error::AuthError> {
-    let ca_has_no_pty = ca_entry.options.iter().any(|o| o == "no-pty");
-
-    for (name, data) in cert.critical_options().iter() {
-        match name.as_str() {
-            "source-address" => {
-                if !check_source_address(data, client_ip) {
-                    return Err(crate::error::AuthError::CertInvalid);
-                }
-            }
-            "force-command" => {}
-            "no-pty" => {}
-            _ => {
-                let _ = ca_has_no_pty;
-                return Err(crate::error::AuthError::CertInvalid);
-            }
-        }
-    }
-
-    Ok(())
-}
-
-fn check_extensions(
-    cert: &russh::keys::Certificate,
-    ca_entry: &crate::auth::keys::CertAuthorityEntry,
-) -> Result<(), crate::error::AuthError> {
-    let ca_permit_port_forwarding = ca_entry
-        .options
-        .iter()
-        .any(|o| o == "permit-port-forwarding");
-
-    if ca_permit_port_forwarding {
-        let cert_allows = cert
-            .extensions()
-            .iter()
-            .any(|(n, _)| n == "permit-port-forwarding");
-        if !cert_allows {
-            return Err(crate::error::AuthError::CertInvalid);
-        }
-    }
-
-    Ok(())
-}
-
-fn check_source_address(allowed: &str, client_ip: Option<std::net::IpAddr>) -> bool {
-    use ipnetwork::IpNetwork;
-    use std::net::IpAddr;
-    use std::str::FromStr;
-
-    let Some(ip) = client_ip else {
-        return false;
-    };
-
-    for pattern in allowed.split(',') {
-        let pattern = pattern.trim();
-        if pattern.is_empty() {
-            continue;
-        }
-
-        if let Ok(cidr) = IpNetwork::from_str(pattern) {
-            if cidr.contains(ip) {
-                return true;
-            }
-        }
-
-        if let Ok(net_ip) = IpAddr::from_str(pattern) {
-            if net_ip == ip {
-                return true;
-            }
-        }
-    }
-
-    false
-}
-
-impl std::fmt::Debug for AuthPolicy {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AuthPolicy")
-            .field("authorized_keys_count", &self.authorized_keys.len())
-            .field("cert_authorities_count", &self.cert_authorities.len())
-            .field("api_keys_count", &self.api_keys.len())
-            .finish()
-    }
-}
-
-impl Clone for AuthPolicy {
-    fn clone(&self) -> Self {
-        Self {
-            authorized_keys: self.authorized_keys.clone(),
-            cert_authorities: self.cert_authorities.clone(),
-            api_keys: self.api_keys.clone(),
-            encoded_keys: self.encoded_keys.clone(),
-            fingerprint_to_key: self.fingerprint_to_key.clone(),
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct RateLimitConfig {
-    pub max_connections_per_ip: usize,
-    pub max_auth_attempts: usize,
-}
-
-impl Default for RateLimitConfig {
-    fn default() -> Self {
-        Self {
-            max_connections_per_ip: 0,
-            max_auth_attempts: 10,
-        }
-    }
-}
-
-#[derive(Debug, Clone)]
-#[non_exhaustive]
-pub struct DynamicConfig {
-    pub auth: AuthPolicy,
-    pub forwarding: ForwardingPolicy,
-    pub rate_limits: RateLimitConfig,
-    pub credentials: HashMap<String, CredentialSet>,
-}
-
-impl DynamicConfig {
-    pub fn new(auth: AuthPolicy) -> Self {
-        Self {
-            auth,
-            forwarding: ForwardingPolicy::allow_all(),
-            rate_limits: RateLimitConfig::default(),
-            credentials: HashMap::new(),
-        }
-    }
-
-    pub fn from_parts(
-        auth: AuthPolicy,
-        forwarding: ForwardingPolicy,
-        rate_limits: RateLimitConfig,
-    ) -> Self {
-        Self {
-            auth,
-            forwarding,
-            rate_limits,
-            credentials: HashMap::new(),
-        }
-    }
-
-    pub fn with_forwarding_policy(mut self, policy: ForwardingPolicy) -> Self {
-        self.forwarding = policy;
-        self
-    }
-
-    pub fn with_rate_limits(mut self, limits: RateLimitConfig) -> Self {
-        self.rate_limits = limits;
-        self
-    }
-
-    pub fn with_credentials(mut self, credentials: HashMap<String, CredentialSet>) -> Self {
-        self.credentials = credentials;
-        self
-    }
-}
-
-impl Default for DynamicConfig {
-    fn default() -> Self {
-        Self {
-            auth: AuthPolicy::empty(),
-            forwarding: ForwardingPolicy::allow_all(),
-            rate_limits: RateLimitConfig::default(),
-            credentials: HashMap::new(),
-        }
-    }
-}
-
-pub struct ConfigReloadHandle {
-    pub(crate) dynamic: Arc<ArcSwap<DynamicConfig>>,
-}
-
-impl ConfigReloadHandle {
-    pub fn reload(&self, new_config: DynamicConfig) {
-        self.dynamic.store(Arc::new(new_config));
-    }
-
-    pub fn dynamic(&self) -> Arc<DynamicConfig> {
-        self.dynamic.load_full()
-    }
-
-    pub fn dynamic_arc(&self) -> Arc<ArcSwap<DynamicConfig>> {
-        Arc::clone(&self.dynamic)
-    }
-}
-
-impl std::fmt::Debug for ConfigReloadHandle {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("ConfigReloadHandle").finish()
-    }
-}
-
-pub fn new_dynamic_config() -> (Arc<ArcSwap<DynamicConfig>>, ConfigReloadHandle) {
-    let inner = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-    let handle = ConfigReloadHandle {
-        dynamic: Arc::clone(&inner),
-    };
-    (inner, handle)
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::config::forwarding::ForwardingAction;
-
-    #[test]
-    fn forwarding_policy_allow_all_default() {
-        let policy = ForwardingPolicy::allow_all();
-        assert_eq!(policy.default, ForwardingAction::Allow);
-        assert!(policy.rules.is_empty());
-    }
-
-    #[test]
-    fn forwarding_policy_deny_all() {
-        let policy = ForwardingPolicy::deny_all();
-        assert_eq!(policy.default, ForwardingAction::Deny);
-        assert!(policy.rules.is_empty());
-    }
-
-    #[test]
-    fn dynamic_config_default() {
-        let config = DynamicConfig::default();
-        assert_eq!(config.forwarding.default, ForwardingAction::Allow);
-        assert_eq!(config.rate_limits.max_connections_per_ip, 0);
-        assert_eq!(config.rate_limits.max_auth_attempts, 10);
-    }
-
-    #[test]
-    fn config_reload_handle_updates_dynamic() {
-        let (arc_swap, handle) = new_dynamic_config();
-        let initial = arc_swap.load();
-        assert_eq!(initial.forwarding.default, ForwardingAction::Allow);
-
-        let new_config = DynamicConfig {
-            auth: AuthPolicy::empty(),
-            forwarding: ForwardingPolicy::deny_all(),
-            rate_limits: RateLimitConfig::default(),
-            credentials: HashMap::new(),
-        };
-        handle.reload(new_config);
-
-        let updated = arc_swap.load();
-        assert_eq!(updated.forwarding.default, ForwardingAction::Deny);
-    }
-
-    #[test]
-    fn dynamic_config_with_forwarding_policy_builder() {
-        let config = DynamicConfig::new(AuthPolicy::empty())
-            .with_forwarding_policy(ForwardingPolicy::deny_all());
-        assert_eq!(config.forwarding.default, ForwardingAction::Deny);
-    }
-
-    #[test]
-    fn rate_limit_config_custom() {
-        let limits = RateLimitConfig {
-            max_connections_per_ip: 5,
-            max_auth_attempts: 3,
-        };
-        assert_eq!(limits.max_connections_per_ip, 5);
-        assert_eq!(limits.max_auth_attempts, 3);
-    }
-
-    #[test]
-    fn forwarding_action_equality() {
-        assert_eq!(ForwardingAction::Allow, ForwardingAction::Allow);
-        assert_eq!(ForwardingAction::Deny, ForwardingAction::Deny);
-        assert_ne!(ForwardingAction::Allow, ForwardingAction::Deny);
-    }
-
-    #[test]
-    fn auth_policy_empty_rejects_all() {
-        let policy = AuthPolicy::empty();
-        let key_text = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeLC1lWiCYrXsf/85O/pkbUFZ6OGIt49PX3nw8iRoXE other@host";
-        let other_ssh_key =
-            russh::keys::parse_public_key_base64(key_text.split_whitespace().nth(1).unwrap())
-                .unwrap();
-        assert_eq!(
-            policy.authenticate_publickey(&other_ssh_key),
-            Err(crate::error::AuthError::KeyRejected)
-        );
-    }
-
-    #[test]
-    fn auth_policy_debug_redacts_keys() {
-        let policy = AuthPolicy::empty();
-        let debug_str = format!("{:?}", policy);
-        assert!(debug_str.contains("authorized_keys_count"));
-        assert!(debug_str.contains("cert_authorities_count"));
-        assert!(debug_str.contains("api_keys_count"));
-    }
-
-    fn compute_api_key_hash(token: &str) -> String {
-        use sha2::{Digest, Sha256};
-        let mut hasher = Sha256::new();
-        hasher.update(token.as_bytes());
-        let result = hasher.finalize();
-        format!("sha256:{}", hex::encode(result))
-    }
-
-    #[test]
-    fn api_key_valid_authenticates() {
-        let token = "alk_testsecret123";
-        let hash = compute_api_key_hash(token);
-        let entry = ApiKeyEntry {
-            prefix: "alk_test".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "test key".to_string(),
-            expires_at: None,
-        };
-        let policy =
-            AuthPolicy::with_api_keys(std::collections::HashSet::new(), Vec::new(), vec![entry]);
-        let identity = policy.resolve_api_key(token);
-        assert!(identity.is_some());
-        let identity = identity.unwrap();
-        assert_eq!(identity.id, "alk_test");
-        assert_eq!(identity.scopes, vec!["relay:connect"]);
-    }
-
-    #[test]
-    fn api_key_expired_rejected() {
-        let token = "alk_expiredkey1";
-        let hash = compute_api_key_hash(token);
-        let entry = ApiKeyEntry {
-            prefix: "alk_expi".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "expired key".to_string(),
-            expires_at: Some(1),
-        };
-        let policy =
-            AuthPolicy::with_api_keys(std::collections::HashSet::new(), Vec::new(), vec![entry]);
-        assert!(policy.resolve_api_key(token).is_none());
-    }
-
-    #[test]
-    fn api_key_wrong_hash_rejected() {
-        let entry = ApiKeyEntry {
-            prefix: "alk_test".to_string(),
-            hash: "sha256:0000000000000000000000000000000000000000000000000000000000000000"
-                .to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            description: "bad hash".to_string(),
-            expires_at: None,
-        };
-        let policy =
-            AuthPolicy::with_api_keys(std::collections::HashSet::new(), Vec::new(), vec![entry]);
-        assert!(policy.resolve_api_key("alk_testsecret123").is_none());
-    }
-
-    #[test]
-    fn api_key_unknown_prefix_falls_through() {
-        let token = "alk_testsecret123";
-        let hash = compute_api_key_hash(token);
-        let entry = ApiKeyEntry {
-            prefix: "alk_other".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string()],
-            description: "other key".to_string(),
-            expires_at: None,
-        };
-        let policy =
-            AuthPolicy::with_api_keys(std::collections::HashSet::new(), Vec::new(), vec![entry]);
-        assert!(policy.resolve_api_key(token).is_none());
-    }
-
-    #[test]
-    fn api_key_scopes_propagate() {
-        let token = "alk_scopesecret";
-        let hash = compute_api_key_hash(token);
-        let entry = ApiKeyEntry {
-            prefix: "alk_sco".to_string(),
-            hash,
-            scopes: vec!["relay:connect".to_string(), "secrets:derive".to_string()],
-            description: "scoped key".to_string(),
-            expires_at: None,
-        };
-        let policy =
-            AuthPolicy::with_api_keys(std::collections::HashSet::new(), Vec::new(), vec![entry]);
-        let identity = policy.resolve_api_key(token).unwrap();
-        assert_eq!(identity.scopes, vec!["relay:connect", "secrets:derive"]);
-    }
-
-    #[test]
-    fn non_api_key_prefix_returns_none() {
-        let policy = AuthPolicy::empty();
-        assert!(policy.resolve_api_key("bearer-some-token").is_none());
-        assert!(policy.resolve_api_key("regular-token").is_none());
-    }
-
-    #[test]
-    fn api_key_entry_default_empty() {
-        let config = DynamicConfig::default();
-        assert!(config.auth.api_keys.is_empty());
-    }
-
-    #[test]
-    fn auth_policy_with_api_keys_preserves_entries() {
-        let entry = ApiKeyEntry {
-            prefix: "alk_abc".to_string(),
-            hash: "sha256:abcdef".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            description: "test".to_string(),
-            expires_at: None,
-        };
-        let policy = AuthPolicy::with_api_keys(
-            std::collections::HashSet::new(),
-            Vec::new(),
-            vec![entry.clone()],
-        );
-        assert_eq!(policy.api_keys.len(), 1);
-        assert_eq!(policy.api_keys[0], entry);
-    }
-}

crates/alknet-core/src/config/forwarding.rs

@@ -1,534 +0,0 @@
-//! Forwarding policy engine for per-identity and per-transport access control.
-//!
-//! See [ADR-031](docs/architecture/decisions/031-forwarding-policy.md).
-
-use std::net::IpAddr;
-use std::ops::Range;
-use std::str::FromStr;
-
-use ipnetwork::IpNetwork;
-
-use crate::auth::identity::Identity;
-use crate::transport::TransportKind;
-
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum ForwardingAction {
-    Allow,
-    Deny,
-}
-
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub enum TargetPattern {
-    Any,
-    Host(String),
-    Cidr(IpNetwork),
-    PortRange(String, Range<u16>),
-    AlknetPrefix,
-}
-
-impl TargetPattern {
-    pub fn matches(&self, target: &str, port: u16) -> bool {
-        match self {
-            TargetPattern::Any => true,
-            TargetPattern::Host(pattern) => match_host_pattern(pattern, target),
-            TargetPattern::Cidr(network) => match_cidr(network, target),
-            TargetPattern::PortRange(host_pattern, port_range) => {
-                match_host_pattern(host_pattern, target) && port_range.contains(&port)
-            }
-            TargetPattern::AlknetPrefix => {
-                target.starts_with(crate::server::control_channel::ALKNET_PREFIX)
-            }
-        }
-    }
-}
-
-fn match_host_pattern(pattern: &str, target: &str) -> bool {
-    if pattern == target {
-        return true;
-    }
-    if pattern.contains('*') {
-        if let Some(pos) = pattern.find('*') {
-            let prefix = &pattern[..pos];
-            let suffix = &pattern[pos + 1..];
-            return target.starts_with(prefix)
-                && target.ends_with(suffix)
-                && target.len() >= prefix.len() + suffix.len();
-        }
-    }
-    false
-}
-
-fn match_cidr(network: &IpNetwork, target: &str) -> bool {
-    let Ok(addr) = IpAddr::from_str(target) else {
-        return false;
-    };
-    network.contains(addr)
-}
-
-#[derive(Debug, Clone, PartialEq)]
-#[non_exhaustive]
-pub struct ForwardingRule {
-    pub target: TargetPattern,
-    pub action: ForwardingAction,
-    pub principals: Vec<String>,
-    pub transports: Vec<TransportKind>,
-}
-
-impl ForwardingRule {
-    pub fn new(
-        target: TargetPattern,
-        action: ForwardingAction,
-        principals: Vec<String>,
-        transports: Vec<TransportKind>,
-    ) -> Self {
-        Self {
-            target,
-            action,
-            principals,
-            transports,
-        }
-    }
-}
-
-impl ForwardingRule {
-    fn matches_principal(&self, identity: &Identity) -> bool {
-        if self.principals.is_empty() {
-            return true;
-        }
-        self.principals
-            .iter()
-            .any(|p| p == &identity.id || identity.scopes.contains(p))
-    }
-
-    fn matches_transport(&self, transport: &TransportKind) -> bool {
-        if self.transports.is_empty() {
-            return true;
-        }
-        self.transports.contains(transport)
-    }
-}
-
-#[derive(Debug, Clone, PartialEq)]
-pub struct ForwardingPolicy {
-    pub default: ForwardingAction,
-    pub rules: Vec<ForwardingRule>,
-}
-
-impl ForwardingPolicy {
-    pub fn allow_all() -> Self {
-        Self {
-            default: ForwardingAction::Allow,
-            rules: Vec::new(),
-        }
-    }
-
-    pub fn deny_all() -> Self {
-        Self {
-            default: ForwardingAction::Deny,
-            rules: Vec::new(),
-        }
-    }
-
-    pub fn check(
-        &self,
-        target: &str,
-        port: u16,
-        identity: &Identity,
-        transport: TransportKind,
-    ) -> bool {
-        for rule in &self.rules {
-            if rule.target.matches(target, port)
-                && rule.matches_principal(identity)
-                && rule.matches_transport(&transport)
-            {
-                return rule.action == ForwardingAction::Allow;
-            }
-        }
-        self.default == ForwardingAction::Allow
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-
-    fn make_identity(id: &str, scopes: Vec<&str>) -> Identity {
-        Identity {
-            id: id.to_string(),
-            scopes: scopes.into_iter().map(|s| s.to_string()).collect(),
-            resources: HashMap::new(),
-        }
-    }
-
-    #[test]
-    fn forwarding_action_equality() {
-        assert_eq!(ForwardingAction::Allow, ForwardingAction::Allow);
-        assert_eq!(ForwardingAction::Deny, ForwardingAction::Deny);
-        assert_ne!(ForwardingAction::Allow, ForwardingAction::Deny);
-    }
-
-    #[test]
-    fn allow_all_allows_everything() {
-        let policy = ForwardingPolicy::allow_all();
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check("example.com", 80, &identity, TransportKind::Tcp));
-        assert!(policy.check(
-            "10.0.0.1",
-            22,
-            &identity,
-            TransportKind::Tls { server_name: None }
-        ));
-    }
-
-    #[test]
-    fn deny_all_denies_everything() {
-        let policy = ForwardingPolicy::deny_all();
-        let identity = make_identity("user1", vec![]);
-        assert!(!policy.check("example.com", 80, &identity, TransportKind::Tcp));
-        assert!(!policy.check(
-            "10.0.0.1",
-            22,
-            &identity,
-            TransportKind::Tls { server_name: None }
-        ));
-    }
-
-    #[test]
-    fn first_match_wins_allowlist() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Host("allowed.example.com".to_string()),
-                action: ForwardingAction::Allow,
-                principals: vec![],
-                transports: vec![],
-            }],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check("allowed.example.com", 80, &identity, TransportKind::Tcp));
-        assert!(!policy.check("denied.example.com", 80, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn first_match_wins_blocklist() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Allow,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Host("blocked.example.com".to_string()),
-                action: ForwardingAction::Deny,
-                principals: vec![],
-                transports: vec![],
-            }],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(!policy.check("blocked.example.com", 80, &identity, TransportKind::Tcp));
-        assert!(policy.check("allowed.example.com", 80, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn first_match_wins_ordering() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![
-                ForwardingRule {
-                    target: TargetPattern::Any,
-                    action: ForwardingAction::Allow,
-                    principals: vec![],
-                    transports: vec![],
-                },
-                ForwardingRule {
-                    target: TargetPattern::Host("blocked.example.com".to_string()),
-                    action: ForwardingAction::Deny,
-                    principals: vec![],
-                    transports: vec![],
-                },
-            ],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check("blocked.example.com", 80, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn empty_principals_matches_all() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Any,
-                action: ForwardingAction::Allow,
-                principals: vec![],
-                transports: vec![],
-            }],
-        };
-        let identity1 = make_identity("user1", vec![]);
-        let identity2 = make_identity("user2", vec![]);
-        assert!(policy.check("example.com", 80, &identity1, TransportKind::Tcp));
-        assert!(policy.check("example.com", 80, &identity2, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn principal_matching_by_id() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Any,
-                action: ForwardingAction::Allow,
-                principals: vec!["SHA256:abc123".to_string()],
-                transports: vec![],
-            }],
-        };
-        let allowed = make_identity("SHA256:abc123", vec![]);
-        let denied = make_identity("SHA256:other", vec![]);
-        assert!(policy.check("example.com", 80, &allowed, TransportKind::Tcp));
-        assert!(!policy.check("example.com", 80, &denied, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn principal_matching_by_scope() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Any,
-                action: ForwardingAction::Allow,
-                principals: vec!["admin".to_string()],
-                transports: vec![],
-            }],
-        };
-        let allowed = make_identity("user1", vec!["admin"]);
-        let denied = make_identity("user2", vec!["viewer"]);
-        assert!(policy.check("example.com", 80, &allowed, TransportKind::Tcp));
-        assert!(!policy.check("example.com", 80, &denied, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn empty_transports_matches_all() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Any,
-                action: ForwardingAction::Allow,
-                principals: vec![],
-                transports: vec![],
-            }],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check("example.com", 80, &identity, TransportKind::Tcp));
-        assert!(policy.check(
-            "example.com",
-            80,
-            &identity,
-            TransportKind::Tls { server_name: None }
-        ));
-        assert!(policy.check(
-            "example.com",
-            80,
-            &identity,
-            TransportKind::Iroh {
-                endpoint_id: String::new()
-            }
-        ));
-    }
-
-    #[test]
-    fn transport_matching() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Any,
-                action: ForwardingAction::Allow,
-                principals: vec![],
-                transports: vec![TransportKind::Tls { server_name: None }],
-            }],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(!policy.check("example.com", 443, &identity, TransportKind::Tcp));
-        assert!(policy.check(
-            "example.com",
-            443,
-            &identity,
-            TransportKind::Tls { server_name: None }
-        ));
-    }
-
-    #[test]
-    fn target_pattern_any_matches_all() {
-        let pattern = TargetPattern::Any;
-        assert!(pattern.matches("example.com", 80));
-        assert!(pattern.matches("10.0.0.1", 22));
-        assert!(pattern.matches("alknet-control", 0));
-    }
-
-    #[test]
-    fn target_pattern_host_exact_match() {
-        let pattern = TargetPattern::Host("example.com".to_string());
-        assert!(pattern.matches("example.com", 80));
-        assert!(!pattern.matches("other.com", 80));
-        assert!(!pattern.matches("sub.example.com", 80));
-    }
-
-    #[test]
-    fn target_pattern_host_glob_match() {
-        let pattern = TargetPattern::Host("*.example.com".to_string());
-        assert!(pattern.matches("sub.example.com", 80));
-        assert!(pattern.matches("a.example.com", 443));
-        assert!(!pattern.matches("example.com", 80));
-        assert!(!pattern.matches("xsub.example.com.org", 80));
-    }
-
-    #[test]
-    fn target_pattern_host_glob_prefix() {
-        let pattern = TargetPattern::Host("db-*".to_string());
-        assert!(pattern.matches("db-primary", 5432));
-        assert!(pattern.matches("db-replica", 5432));
-        assert!(!pattern.matches("web-primary", 5432));
-    }
-
-    #[test]
-    fn target_pattern_host_glob_suffix() {
-        let pattern = TargetPattern::Host("*.internal".to_string());
-        assert!(pattern.matches("app.internal", 8080));
-        assert!(pattern.matches("db.internal", 5432));
-        assert!(!pattern.matches("app.external", 80));
-    }
-
-    #[test]
-    fn target_pattern_cidr_matches_ip() {
-        let network: IpNetwork = "10.0.0.0/8".parse().unwrap();
-        let pattern = TargetPattern::Cidr(network);
-        assert!(pattern.matches("10.0.0.1", 22));
-        assert!(pattern.matches("10.255.255.255", 22));
-        assert!(!pattern.matches("192.168.1.1", 22));
-        assert!(!pattern.matches("not-an-ip", 22));
-    }
-
-    #[test]
-    fn target_pattern_cidr_ipv6() {
-        let network: IpNetwork = "fd00::/8".parse().unwrap();
-        let pattern = TargetPattern::Cidr(network);
-        assert!(pattern.matches("fd00::1", 22));
-        assert!(!pattern.matches("10.0.0.1", 22));
-    }
-
-    #[test]
-    fn target_pattern_port_range_matches() {
-        let pattern = TargetPattern::PortRange("localhost".to_string(), 8080..8090);
-        assert!(pattern.matches("localhost", 8080));
-        assert!(pattern.matches("localhost", 8085));
-        assert!(pattern.matches("localhost", 8089));
-        assert!(!pattern.matches("localhost", 8079));
-        assert!(!pattern.matches("localhost", 8090));
-        assert!(!pattern.matches("otherhost", 8080));
-    }
-
-    #[test]
-    fn target_pattern_port_range_with_glob() {
-        let pattern = TargetPattern::PortRange("*.internal".to_string(), 3000..4000);
-        assert!(pattern.matches("app.internal", 3000));
-        assert!(pattern.matches("app.internal", 3999));
-        assert!(!pattern.matches("app.internal", 2999));
-        assert!(!pattern.matches("app.internal", 4000));
-        assert!(!pattern.matches("app.external", 3000));
-    }
-
-    #[test]
-    fn target_pattern_alknet_prefix() {
-        let pattern = TargetPattern::AlknetPrefix;
-        assert!(pattern.matches("alknet-control", 0));
-        assert!(pattern.matches("alknet-status", 0));
-        assert!(pattern.matches("alknet-", 0));
-        assert!(!pattern.matches("example.com", 0));
-        assert!(!pattern.matches("alknet.example.com", 0));
-    }
-
-    #[test]
-    fn default_fallthrough_allow() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Allow,
-            rules: vec![],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check("anything", 80, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn default_fallthrough_deny() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(!policy.check("anything", 80, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn combined_principal_and_transport_matching() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Host("restricted.example.com".to_string()),
-                action: ForwardingAction::Allow,
-                principals: vec!["admin".to_string()],
-                transports: vec![TransportKind::Tls { server_name: None }],
-            }],
-        };
-        let admin = make_identity("admin-user", vec!["admin"]);
-        let viewer = make_identity("viewer-user", vec!["viewer"]);
-        assert!(policy.check(
-            "restricted.example.com",
-            443,
-            &admin,
-            TransportKind::Tls { server_name: None }
-        ));
-        assert!(!policy.check("restricted.example.com", 443, &admin, TransportKind::Tcp));
-        assert!(!policy.check(
-            "restricted.example.com",
-            443,
-            &viewer,
-            TransportKind::Tls { server_name: None }
-        ));
-    }
-
-    #[test]
-    fn webtransport_restricted_to_alknet() {
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Allow,
-            rules: vec![
-                ForwardingRule {
-                    target: TargetPattern::AlknetPrefix,
-                    action: ForwardingAction::Allow,
-                    principals: vec![],
-                    transports: vec![TransportKind::WebTransport { server_name: None }],
-                },
-                ForwardingRule {
-                    target: TargetPattern::Any,
-                    action: ForwardingAction::Deny,
-                    principals: vec![],
-                    transports: vec![TransportKind::WebTransport { server_name: None }],
-                },
-            ],
-        };
-        let identity = make_identity("user1", vec![]);
-        assert!(policy.check(
-            "alknet-control",
-            0,
-            &identity,
-            TransportKind::WebTransport { server_name: None }
-        ));
-        assert!(!policy.check(
-            "example.com",
-            443,
-            &identity,
-            TransportKind::WebTransport { server_name: None }
-        ));
-        assert!(policy.check("example.com", 443, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn cidr_does_not_match_hostname() {
-        let network: IpNetwork = "10.0.0.0/8".parse().unwrap();
-        let pattern = TargetPattern::Cidr(network);
-        assert!(!pattern.matches("example.com", 22));
-    }
-}

crates/alknet-core/src/config/mod.rs

@@ -1,12 +0,0 @@
-pub mod config_service;
-pub mod dynamic_config;
-pub mod forwarding;
-pub mod static_config;
-
-pub use config_service::ConfigServiceImpl;
-pub use dynamic_config::{
-    new_dynamic_config, ApiKeyEntry, AuthPolicy, ConfigReloadHandle, DynamicConfig,
-    RateLimitConfig, API_KEY_PREFIX,
-};
-pub use forwarding::{ForwardingAction, ForwardingPolicy, ForwardingRule, TargetPattern};
-pub use static_config::StaticConfig;

crates/alknet-core/src/config/static_config.rs

@@ -1,281 +0,0 @@
-//! Static (immutable) server configuration resolved at startup.
-//!
-//! See [ADR-030](docs/architecture/decisions/030-dynamic-config.md).
-
-use crate::interface::StreamInterfaceKind;
-use crate::server::handler::{ProxyConfig, ProxyMode};
-use crate::server::serve::{ListenerConfig, ServeTransportMode, StreamListenerConfig};
-use crate::transport::TransportKind;
-use std::net::SocketAddr;
-
-pub struct StaticConfig {
-    pub transport_mode: ServeTransportMode,
-    pub listen_addr: String,
-    pub tls_cert: Option<String>,
-    pub tls_key: Option<String>,
-    pub acme_domain: Option<String>,
-    pub stealth: bool,
-    pub host_key: russh::keys::PrivateKey,
-    pub host_key_algorithm: russh::keys::Algorithm,
-    pub max_auth_attempts: usize,
-    pub max_connections_per_ip: usize,
-    pub proxy_config: Option<ProxyConfig>,
-    pub iroh_relay: Option<String>,
-    pub listeners: Vec<ListenerConfig>,
-}
-
-impl std::fmt::Debug for StaticConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("StaticConfig")
-            .field("transport_mode", &self.transport_mode)
-            .field("listen_addr", &self.listen_addr)
-            .field("tls_cert", &self.tls_cert.as_ref().map(|_| "<redacted>"))
-            .field("tls_key", &self.tls_key.as_ref().map(|_| "<redacted>"))
-            .field("acme_domain", &self.acme_domain)
-            .field("stealth", &self.stealth)
-            .field("host_key_algorithm", &self.host_key_algorithm)
-            .field("max_auth_attempts", &self.max_auth_attempts)
-            .field("max_connections_per_ip", &self.max_connections_per_ip)
-            .field("proxy_config", &self.proxy_config)
-            .field("iroh_relay", &self.iroh_relay)
-            .field("listeners", &self.listeners)
-            .finish()
-    }
-}
-
-impl StaticConfig {
-    pub fn from_serve_options(
-        opts: crate::server::serve::ServeOptions,
-    ) -> Result<(Self, crate::config::DynamicConfig), crate::error::ConfigError> {
-        opts.validate()?;
-
-        let host_key = crate::auth::keys::load_private_key(opts.key.clone())?;
-        let host_key_algorithm = host_key.algorithm();
-
-        let auth_config = crate::auth::ServerAuthConfig::from_keys_and_ca(
-            opts.authorized_keys.clone(),
-            opts.cert_authority.clone(),
-        )?;
-
-        let auth_policy = crate::config::AuthPolicy::from_server_auth_config(auth_config);
-
-        let dynamic = crate::config::DynamicConfig::new(auth_policy);
-
-        let proxy_config = parse_proxy_config(opts.proxy.as_deref())?;
-
-        let listeners = if let Some(listeners) = opts.listeners {
-            listeners
-        } else {
-            vec![ListenerConfig::Stream {
-                config: StreamListenerConfig {
-                    transport_kind: match opts.transport_mode {
-                        ServeTransportMode::Tcp => TransportKind::Tcp,
-                        ServeTransportMode::Tls => TransportKind::Tls { server_name: None },
-                        ServeTransportMode::Iroh => TransportKind::Iroh {
-                            endpoint_id: String::new(),
-                        },
-                    },
-                    interface: StreamInterfaceKind::Ssh,
-                    listen_addr: opts.listen_addr.clone(),
-                    tls_cert: opts.tls_cert.clone(),
-                    tls_key: opts.tls_key.clone(),
-                    acme_domain: opts.acme_domain.clone(),
-                    stealth: opts.stealth,
-                    iroh_relay: opts.iroh_relay.clone(),
-                },
-            }]
-        };
-
-        let static_config = StaticConfig {
-            transport_mode: opts.transport_mode,
-            listen_addr: opts.listen_addr,
-            tls_cert: opts.tls_cert,
-            tls_key: opts.tls_key,
-            acme_domain: opts.acme_domain,
-            stealth: opts.stealth,
-            host_key,
-            host_key_algorithm,
-            max_auth_attempts: opts.max_auth_attempts,
-            max_connections_per_ip: opts.max_connections_per_ip,
-            proxy_config,
-            iroh_relay: opts.iroh_relay,
-            listeners,
-        };
-
-        Ok((static_config, dynamic))
-    }
-}
-
-fn parse_proxy_config(
-    proxy: Option<&str>,
-) -> Result<Option<ProxyConfig>, crate::error::ConfigError> {
-    match proxy {
-        None => Ok(None),
-        Some(url) => {
-            if let Some(rest) = url.strip_prefix("socks5://") {
-                let addr: SocketAddr =
-                    rest.parse()
-                        .map_err(|e| crate::error::ConfigError::ProxyConfigInvalid {
-                            message: format!("invalid socks5 proxy address '{}': {}", rest, e),
-                        })?;
-                Ok(Some(ProxyConfig {
-                    mode: ProxyMode::Socks5(addr),
-                }))
-            } else if let Some(rest) = url.strip_prefix("http://") {
-                let addr: SocketAddr =
-                    rest.parse()
-                        .map_err(|e| crate::error::ConfigError::ProxyConfigInvalid {
-                            message: format!(
-                                "invalid http connect proxy address '{}': {}",
-                                rest, e
-                            ),
-                        })?;
-                Ok(Some(ProxyConfig {
-                    mode: ProxyMode::HttpConnect(addr),
-                }))
-            } else {
-                Err(crate::error::ConfigError::ProxyConfigInvalid {
-                    message: format!("unsupported proxy URL scheme: {}", url),
-                })
-            }
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::keys::KeySource;
-    use crate::server::serve::ServeOptions;
-    use crate::transport::TransportKind;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const ED25519_PUBLIC_KEY: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV ubuntu@ns528096";
-
-    fn make_key_source() -> KeySource {
-        KeySource::Memory(ED25519_PRIVATE_KEY.as_bytes().to_vec())
-    }
-
-    fn make_authorized_keys_source() -> KeySource {
-        KeySource::Memory(ED25519_PUBLIC_KEY.as_bytes().to_vec())
-    }
-
-    #[test]
-    fn parse_proxy_config_socks5() {
-        let config = parse_proxy_config(Some("socks5://127.0.0.1:9050")).unwrap();
-        assert!(config.is_some());
-        match config.unwrap().mode {
-            ProxyMode::Socks5(addr) => {
-                assert_eq!(addr, "127.0.0.1:9050".parse().unwrap());
-            }
-            _ => panic!("expected Socks5"),
-        }
-    }
-
-    #[test]
-    fn parse_proxy_config_http() {
-        let config = parse_proxy_config(Some("http://127.0.0.1:8080")).unwrap();
-        assert!(config.is_some());
-        match config.unwrap().mode {
-            ProxyMode::HttpConnect(addr) => {
-                assert_eq!(addr, "127.0.0.1:8080".parse().unwrap());
-            }
-            _ => panic!("expected HttpConnect"),
-        }
-    }
-
-    #[test]
-    fn parse_proxy_config_none() {
-        assert!(parse_proxy_config(None).unwrap().is_none());
-    }
-
-    #[test]
-    fn parse_proxy_config_invalid_scheme() {
-        let result = parse_proxy_config(Some("ftp://127.0.0.1:9050"));
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            crate::error::ConfigError::ProxyConfigInvalid { message } => {
-                assert!(message.contains("unsupported proxy URL scheme"));
-            }
-            e => panic!("expected ProxyConfigInvalid, got {:?}", e),
-        }
-    }
-
-    #[test]
-    fn parse_proxy_config_invalid_address() {
-        let result = parse_proxy_config(Some("socks5://not-an-address"));
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            crate::error::ConfigError::ProxyConfigInvalid { message } => {
-                assert!(message.contains("invalid socks5 proxy address"));
-            }
-            e => panic!("expected ProxyConfigInvalid, got {:?}", e),
-        }
-    }
-
-    #[test]
-    fn static_config_from_serve_options_basic() {
-        let opts =
-            ServeOptions::new(make_key_source()).authorized_keys(make_authorized_keys_source());
-        let (static_config, dynamic) = StaticConfig::from_serve_options(opts).unwrap();
-        assert_eq!(static_config.listen_addr, "0.0.0.0:22");
-        assert_eq!(static_config.max_auth_attempts, 10);
-        assert!(dynamic.auth.authorized_keys.len() > 0);
-    }
-
-    #[test]
-    fn static_config_from_serve_options_with_proxy() {
-        let opts = ServeOptions::new(make_key_source())
-            .authorized_keys(make_authorized_keys_source())
-            .proxy("socks5://127.0.0.1:9050");
-        let (static_config, _) = StaticConfig::from_serve_options(opts).unwrap();
-        assert!(static_config.proxy_config.is_some());
-    }
-
-    #[test]
-    fn static_config_from_serve_options_with_listeners() {
-        let listeners = vec![ListenerConfig::tcp("0.0.0.0:22")];
-        let opts = ServeOptions::new(make_key_source())
-            .authorized_keys(make_authorized_keys_source())
-            .listeners(listeners);
-        let (static_config, _) = StaticConfig::from_serve_options(opts).unwrap();
-        assert_eq!(static_config.listeners.len(), 1);
-        match &static_config.listeners[0] {
-            ListenerConfig::Stream { config } => {
-                assert_eq!(config.transport_kind, TransportKind::Tcp);
-            }
-            _ => panic!("expected Stream variant"),
-        }
-    }
-
-    #[test]
-    fn static_config_from_serve_options_invalid_proxy_returns_err() {
-        let opts = ServeOptions::new(make_key_source())
-            .authorized_keys(make_authorized_keys_source())
-            .proxy("ftp://bad-scheme");
-        let result = StaticConfig::from_serve_options(opts);
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            crate::error::ConfigError::ProxyConfigInvalid { message } => {
-                assert!(message.contains("unsupported proxy URL scheme"));
-            }
-            e => panic!("expected ProxyConfigInvalid, got {:?}", e),
-        }
-    }
-
-    #[test]
-    fn static_config_from_serve_options_malformed_proxy_address_returns_err() {
-        let opts = ServeOptions::new(make_key_source())
-            .authorized_keys(make_authorized_keys_source())
-            .proxy("socks5://not-a-valid-addr");
-        let result = StaticConfig::from_serve_options(opts);
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            crate::error::ConfigError::ProxyConfigInvalid { message } => {
-                assert!(message.contains("invalid socks5 proxy address"));
-            }
-            e => panic!("expected ProxyConfigInvalid, got {:?}", e),
-        }
-    }
-}

crates/alknet-core/src/credentials.rs

@@ -0,0 +1,91 @@
+//! Transport-level credential bundle for outbound connections (ADR-091).
+//!
+//! `ConnectionCredentials` carries the two dimensions the dial consumes:
+//! the local node's identity and the expected remote identity.
+//! It is transport-agnostic — consumed by `alknet-tls` (TLS setup) and
+//! `alknet-client` (dial).
+
+use crate::config::TlsIdentity;
+
+/// Expected identity of the remote node (ADR-017 §7, extended by ADR-034 §2).
+///
+/// Carries a fingerprint string the assembly layer derives from `Capabilities`
+/// when the local node has a `PeerEntry` for the remote (the known-peer case →
+/// fingerprint pin).
+///
+/// `remote_identity: None` is the **public X.509 endpoint** case: the local
+/// node has no `PeerEntry` for the remote, so there is no fingerprint to pin.
+/// Combined with an X.509 transport, `None` selects CA verification
+/// (`WebPkiServerVerifier`) per the verifier-selection rule in ADR-034 §3.
+/// Combined with an Ed25519 raw-key transport, `None` fails closed (raw-key
+/// remotes are always known peers — no CA to fall back to).
+///
+/// The `Option` is therefore load-bearing, not cosmetic: `Some(fingerprint)`
+/// means "pin this" (known peer), `None` means "trust the CA or fail"
+/// (unknown remote). An implementer must not default `remote_identity` to a
+/// placeholder value to "satisfy" the field — `None` is a real state that
+/// drives verifier selection.
+#[derive(Debug, Clone)]
+pub struct RemoteIdentity {
+    pub fingerprint: String,
+}
+
+/// Credentials for an outbound connection (ADR-091). All dimensions come from
+/// `Capabilities` (ADR-014), never from environment variables — see the
+/// No-Env-Vars Invariant in
+/// `docs/architecture/crates/call/client-and-adapters.md`.
+#[derive(Debug, Clone, Default)]
+pub struct ConnectionCredentials {
+    /// The local node's identity (RFC 7250 raw key or X.509), derived
+    /// from the vault at startup.
+    pub local_identity: Option<TlsIdentity>,
+    /// Expected fingerprint/cert of the remote node, stored as a capability.
+    /// `Some` → fingerprint pin (known peer with a `PeerEntry`); `None` → CA
+    /// verification for X.509 remotes, fail-closed for Ed25519 raw-key remotes
+    /// (ADR-034 §2/§3). `None` is the public-X.509-endpoint state, not a
+    /// missing field — must not be defaulted to a placeholder.
+    pub remote_identity: Option<RemoteIdentity>,
+}
+
+impl ConnectionCredentials {
+    pub fn new() -> Self {
+        Self::default()
+    }
+
+    pub fn with_local_identity(mut self, local_identity: TlsIdentity) -> Self {
+        self.local_identity = Some(local_identity);
+        self
+    }
+
+    pub fn with_remote_identity(mut self, remote: RemoteIdentity) -> Self {
+        self.remote_identity = Some(remote);
+        self
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn connection_credentials_builder_methods() {
+        let creds = ConnectionCredentials::new().with_remote_identity(RemoteIdentity {
+            fingerprint: "SHA256:abc".to_string(),
+        });
+        assert_eq!(
+            creds.remote_identity.as_ref().unwrap().fingerprint,
+            "SHA256:abc"
+        );
+        assert!(creds.local_identity.is_none());
+    }
+
+    #[test]
+    fn connection_credentials_none_is_load_bearing_not_defaulted() {
+        let creds = ConnectionCredentials::new();
+        assert!(
+            creds.remote_identity.is_none(),
+            "ConnectionCredentials::new() must keep remote_identity as None (the load-bearing \
+             public-X.509-endpoint state), not default it to a placeholder"
+        );
+    }
+}

crates/alknet-core/src/credentials/mod.rs

@@ -1,241 +0,0 @@
-use std::collections::HashMap;
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-use serde::{Deserialize, Serialize};
-
-use crate::config::DynamicConfig;
-
-#[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
-#[non_exhaustive]
-pub enum CredentialSet {
-    ApiKey {
-        header_name: String,
-        token: String,
-    },
-    Basic {
-        username: String,
-        password: String,
-    },
-    Bearer {
-        token: String,
-    },
-    S3AccessKey {
-        access_key: String,
-        secret_key: String,
-        session_token: Option<String>,
-    },
-    OidcToken {
-        access_token: String,
-        refresh_token: Option<String>,
-        expires_at: Option<u64>,
-    },
-    Custom {
-        scheme: String,
-        params: HashMap<String, String>,
-    },
-}
-
-pub trait CredentialProvider: Send + Sync + 'static {
-    fn get_credentials(&self, service: &str) -> Option<CredentialSet>;
-    fn refresh_credentials(&self, service: &str) -> Option<CredentialSet>;
-}
-
-pub struct ConfigCredentialProvider {
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-}
-
-impl ConfigCredentialProvider {
-    pub fn new(dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
-        Self { dynamic }
-    }
-}
-
-impl CredentialProvider for ConfigCredentialProvider {
-    fn get_credentials(&self, service: &str) -> Option<CredentialSet> {
-        let config = self.dynamic.load();
-        config.credentials.get(service).cloned()
-    }
-
-    fn refresh_credentials(&self, service: &str) -> Option<CredentialSet> {
-        self.get_credentials(service)
-    }
-}
-
-pub struct SecretStoreCredentialProvider;
-
-impl SecretStoreCredentialProvider {
-    pub fn new() -> Self {
-        Self
-    }
-}
-
-impl Default for SecretStoreCredentialProvider {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-impl CredentialProvider for SecretStoreCredentialProvider {
-    fn get_credentials(&self, _service: &str) -> Option<CredentialSet> {
-        None
-    }
-
-    fn refresh_credentials(&self, _service: &str) -> Option<CredentialSet> {
-        None
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::config::AuthPolicy;
-
-    fn make_dynamic_with_credentials() -> Arc<ArcSwap<DynamicConfig>> {
-        let mut credentials = HashMap::new();
-        credentials.insert(
-            "vast-ai".to_string(),
-            CredentialSet::Bearer {
-                token: "secret-token".to_string(),
-            },
-        );
-        credentials.insert(
-            "custom-service".to_string(),
-            CredentialSet::ApiKey {
-                header_name: "X-API-Key".to_string(),
-                token: "api-key-123".to_string(),
-            },
-        );
-        let config = DynamicConfig::new(AuthPolicy::empty()).with_credentials(credentials);
-        Arc::new(ArcSwap::new(Arc::new(config)))
-    }
-
-    fn make_dynamic_empty() -> Arc<ArcSwap<DynamicConfig>> {
-        let config = DynamicConfig::default();
-        Arc::new(ArcSwap::new(Arc::new(config)))
-    }
-
-    #[test]
-    fn config_credential_provider_returns_configured_credentials() {
-        let dynamic = make_dynamic_with_credentials();
-        let provider = ConfigCredentialProvider::new(dynamic);
-        let creds = provider.get_credentials("vast-ai");
-        assert!(creds.is_some());
-        match creds.unwrap() {
-            CredentialSet::Bearer { token } => assert_eq!(token, "secret-token"),
-            _ => panic!("expected Bearer variant"),
-        }
-    }
-
-    #[test]
-    fn config_credential_provider_returns_api_key_variant() {
-        let dynamic = make_dynamic_with_credentials();
-        let provider = ConfigCredentialProvider::new(dynamic);
-        let creds = provider.get_credentials("custom-service");
-        assert!(creds.is_some());
-        match creds.unwrap() {
-            CredentialSet::ApiKey { header_name, token } => {
-                assert_eq!(header_name, "X-API-Key");
-                assert_eq!(token, "api-key-123");
-            }
-            _ => panic!("expected ApiKey variant"),
-        }
-    }
-
-    #[test]
-    fn config_credential_provider_returns_none_for_unknown_service() {
-        let dynamic = make_dynamic_with_credentials();
-        let provider = ConfigCredentialProvider::new(dynamic);
-        let creds = provider.get_credentials("nonexistent");
-        assert!(creds.is_none());
-    }
-
-    #[test]
-    fn config_credential_provider_empty_config_returns_none() {
-        let dynamic = make_dynamic_empty();
-        let provider = ConfigCredentialProvider::new(dynamic);
-        let creds = provider.get_credentials("vast-ai");
-        assert!(creds.is_none());
-    }
-
-    #[test]
-    fn secret_store_credential_provider_returns_none() {
-        let provider = SecretStoreCredentialProvider::new();
-        assert!(provider.get_credentials("vast-ai").is_none());
-        assert!(provider.get_credentials("rustfs").is_none());
-        assert!(provider.get_credentials("gitea").is_none());
-    }
-
-    #[test]
-    fn secret_store_credential_provider_refresh_returns_none() {
-        let provider = SecretStoreCredentialProvider::new();
-        assert!(provider.refresh_credentials("vast-ai").is_none());
-    }
-
-    #[test]
-    fn credential_set_bearer_serialization() {
-        let creds = CredentialSet::Bearer {
-            token: "tok".to_string(),
-        };
-        let json = serde_json::to_string(&creds).unwrap();
-        let deserialized: CredentialSet = serde_json::from_str(&json).unwrap();
-        assert_eq!(creds, deserialized);
-    }
-
-    #[test]
-    fn credential_set_s3_access_key_serialization() {
-        let creds = CredentialSet::S3AccessKey {
-            access_key: "AKIA123".to_string(),
-            secret_key: "secret".to_string(),
-            session_token: Some("session".to_string()),
-        };
-        let json = serde_json::to_string(&creds).unwrap();
-        let deserialized: CredentialSet = serde_json::from_str(&json).unwrap();
-        assert_eq!(creds, deserialized);
-    }
-
-    #[test]
-    fn credential_set_oidc_token_serialization() {
-        let creds = CredentialSet::OidcToken {
-            access_token: "access".to_string(),
-            refresh_token: Some("refresh".to_string()),
-            expires_at: Some(1234567890),
-        };
-        let json = serde_json::to_string(&creds).unwrap();
-        let deserialized: CredentialSet = serde_json::from_str(&json).unwrap();
-        assert_eq!(creds, deserialized);
-    }
-
-    #[test]
-    fn credential_set_custom_serialization() {
-        let mut params = HashMap::new();
-        params.insert("key1".to_string(), "val1".to_string());
-        let creds = CredentialSet::Custom {
-            scheme: "X-Custom".to_string(),
-            params,
-        };
-        let json = serde_json::to_string(&creds).unwrap();
-        let deserialized: CredentialSet = serde_json::from_str(&json).unwrap();
-        assert_eq!(creds, deserialized);
-    }
-
-    #[test]
-    fn credential_set_basic_serialization() {
-        let creds = CredentialSet::Basic {
-            username: "user".to_string(),
-            password: "pass".to_string(),
-        };
-        let json = serde_json::to_string(&creds).unwrap();
-        let deserialized: CredentialSet = serde_json::from_str(&json).unwrap();
-        assert_eq!(creds, deserialized);
-    }
-
-    #[test]
-    fn credential_set_clone() {
-        let creds = CredentialSet::Bearer {
-            token: "tok".to_string(),
-        };
-        let cloned = creds.clone();
-        assert_eq!(creds, cloned);
-    }
-}

crates/alknet-core/src/error.rs

@@ -1,241 +0,0 @@
-//! Error types for alknet-core.
-//!
-//! Layered error hierarchy:
-//! - `TransportError` — connection/handshake/timeout errors (trigger reconnection on client)
-//! - `AuthError` — key rejection, certificate validation failures
-//! - `ChannelError` — per-channel failures (target unreachable, channel closed)
-//! - `ConfigError` — invalid configuration (flags, key files, bind failures)
-//! - `ForwardError` — port forward setup and connection failures
-
-use std::io;
-
-#[derive(Debug, thiserror::Error)]
-pub enum TransportError {
-    #[error("connection failed")]
-    ConnectionFailed,
-    #[error("handshake failed")]
-    HandshakeFailed {
-        #[source]
-        source: io::Error,
-    },
-    #[error("transport timeout")]
-    Timeout,
-    #[error("proxy failed")]
-    ProxyFailed {
-        #[source]
-        source: io::Error,
-    },
-}
-
-#[derive(Debug, PartialEq, thiserror::Error)]
-pub enum AuthError {
-    #[error("key rejected")]
-    KeyRejected,
-    #[error("certificate invalid")]
-    CertInvalid,
-    #[error("certificate expired")]
-    CertExpired,
-    #[error("certificate principal mismatch")]
-    CertPrincipalMismatch,
-    #[error("no matching key")]
-    NoMatchingKey,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum ChannelError {
-    #[error("target unreachable")]
-    TargetUnreachable,
-    #[error("proxy connect failed")]
-    ProxyConnectFailed {
-        #[source]
-        source: io::Error,
-    },
-    #[error("channel closed")]
-    ChannelClosed,
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum ConfigError {
-    #[error("invalid flag: {name}")]
-    InvalidFlag { name: String },
-    #[error("key file not found: {path}")]
-    KeyFileNotFound { path: String },
-    #[error("bind failed")]
-    BindFailed {
-        #[source]
-        source: io::Error,
-    },
-    #[error("incompatible options")]
-    IncompatibleOptions,
-    #[error("invalid proxy config: {message}")]
-    ProxyConfigInvalid { message: String },
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum ForwardError {
-    #[error("invalid port forward spec: {spec}")]
-    InvalidSpec { spec: String },
-    #[error("bind failed")]
-    BindFailed {
-        #[source]
-        source: io::Error,
-    },
-    #[error("channel open failed")]
-    ChannelOpenFailed {
-        #[source]
-        source: Box<dyn std::error::Error + Send + Sync>,
-    },
-    #[error("connect to local target failed")]
-    LocalConnectFailed {
-        #[source]
-        source: io::Error,
-    },
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::error::Error;
-
-    #[test]
-    fn transport_error_display() {
-        assert_eq!(
-            TransportError::ConnectionFailed.to_string(),
-            "connection failed"
-        );
-        assert_eq!(
-            TransportError::HandshakeFailed {
-                source: io::Error::new(io::ErrorKind::ConnectionRefused, "tls failed")
-            }
-            .to_string(),
-            "handshake failed"
-        );
-        assert_eq!(TransportError::Timeout.to_string(), "transport timeout");
-        assert_eq!(
-            TransportError::ProxyFailed {
-                source: io::Error::new(io::ErrorKind::ConnectionRefused, "proxy err")
-            }
-            .to_string(),
-            "proxy failed"
-        );
-    }
-
-    #[test]
-    fn auth_error_display() {
-        assert_eq!(AuthError::KeyRejected.to_string(), "key rejected");
-        assert_eq!(AuthError::CertInvalid.to_string(), "certificate invalid");
-        assert_eq!(AuthError::CertExpired.to_string(), "certificate expired");
-        assert_eq!(
-            AuthError::CertPrincipalMismatch.to_string(),
-            "certificate principal mismatch"
-        );
-        assert_eq!(AuthError::NoMatchingKey.to_string(), "no matching key");
-    }
-
-    #[test]
-    fn channel_error_display() {
-        assert_eq!(
-            ChannelError::TargetUnreachable.to_string(),
-            "target unreachable"
-        );
-        assert_eq!(
-            ChannelError::ProxyConnectFailed {
-                source: io::Error::new(io::ErrorKind::ConnectionRefused, "refused")
-            }
-            .to_string(),
-            "proxy connect failed"
-        );
-        assert_eq!(ChannelError::ChannelClosed.to_string(), "channel closed");
-    }
-
-    #[test]
-    fn config_error_display() {
-        assert_eq!(
-            ConfigError::InvalidFlag {
-                name: "--bad".to_string()
-            }
-            .to_string(),
-            "invalid flag: --bad"
-        );
-        assert_eq!(
-            ConfigError::KeyFileNotFound {
-                path: "/missing".to_string()
-            }
-            .to_string(),
-            "key file not found: /missing"
-        );
-        assert_eq!(
-            ConfigError::BindFailed {
-                source: io::Error::new(io::ErrorKind::AddrInUse, "in use")
-            }
-            .to_string(),
-            "bind failed"
-        );
-        assert_eq!(
-            ConfigError::IncompatibleOptions.to_string(),
-            "incompatible options"
-        );
-        assert_eq!(
-            ConfigError::ProxyConfigInvalid {
-                message: "bad proxy".to_string()
-            }
-            .to_string(),
-            "invalid proxy config: bad proxy"
-        );
-    }
-
-    #[test]
-    fn error_source_chaining() {
-        let io_err = io::Error::new(io::ErrorKind::ConnectionRefused, "refused");
-        let transport_err = TransportError::HandshakeFailed { source: io_err };
-        assert!(transport_err.source().is_some());
-
-        let io_err = io::Error::new(io::ErrorKind::ConnectionRefused, "proxy");
-        let channel_err = ChannelError::ProxyConnectFailed { source: io_err };
-        assert!(channel_err.source().is_some());
-
-        let io_err = io::Error::new(io::ErrorKind::AddrInUse, "addr");
-        let config_err = ConfigError::BindFailed { source: io_err };
-        assert!(config_err.source().is_some());
-
-        let plain = AuthError::KeyRejected;
-        assert!(plain.source().is_none());
-    }
-
-    #[test]
-    fn forward_error_display() {
-        assert_eq!(
-            ForwardError::InvalidSpec {
-                spec: "bad".to_string()
-            }
-            .to_string(),
-            "invalid port forward spec: bad"
-        );
-        assert_eq!(
-            ForwardError::BindFailed {
-                source: io::Error::new(io::ErrorKind::AddrInUse, "in use")
-            }
-            .to_string(),
-            "bind failed"
-        );
-        assert_eq!(
-            ForwardError::LocalConnectFailed {
-                source: io::Error::new(io::ErrorKind::ConnectionRefused, "refused")
-            }
-            .to_string(),
-            "connect to local target failed"
-        );
-    }
-
-    #[test]
-    fn forward_error_source_chaining() {
-        let io_err = io::Error::new(io::ErrorKind::AddrInUse, "in use");
-        let forward_err = ForwardError::BindFailed { source: io_err };
-        assert!(forward_err.source().is_some());
-
-        let plain = ForwardError::InvalidSpec {
-            spec: "bad".to_string(),
-        };
-        assert!(plain.source().is_none());
-    }
-}

crates/alknet-core/src/fingerprint.rs

@@ -0,0 +1,264 @@
+//! TLS certificate fingerprint extraction (ADR-030 §6, ADR-034 §3).
+//!
+//! Fingerprint formats:
+//! - **Ed25519 raw key** (RFC 7250 SPKI): `ed25519:<hex of 32-byte pub key>`.
+//!   The fingerprint IS the trust anchor — raw-key remotes have no CA, so the
+//!   fingerprint is the identity (ADR-034 §2 assumption 1). Normalized to
+//!   `ed25519:<hex>` across quinn and iroh (ADR-030 §6).
+//! - **X.509 cert**: `SHA256:<hex of DER>`. Used by the hub X.509 path
+//!   (ADR-034 §3 — fingerprint pinning for known hubs with a prior P2P trust
+//!   relationship). Not used for arbitrary public APIs (those use CA
+//!   verification via `WebPkiServerVerifier`, not fingerprint pinning).
+//!
+//! Shared by the server-side endpoint (`alknet-endpoint`, which extracts
+//! the fingerprint from the presented client cert for `PeerEntry` resolution)
+//! and the client-side `FingerprintPinVerifier` in `alknet-tls`
+//! (which matches the server's presented cert against a pinned fingerprint).
+
+use sha2::{Digest, Sha256};
+
+/// Compute the fingerprint of a TLS certificate DER (RFC 7250 raw public key
+/// SPKI or X.509 cert). Returns `ed25519:<hex>` when `cert_der` is an Ed25519
+/// SPKI, otherwise `SHA256:<hex of full DER>`. Returns `None` only when the
+/// input is empty (a non-Ed25519 SPKI or a malformed DER still hashes to a
+/// `SHA256:` fingerprint — the hash is the fallback).
+pub fn fingerprint_from_cert_der(cert_der: &[u8]) -> Option<String> {
+    if let Some(raw_key) = extract_ed25519_raw_key_from_spki(cert_der) {
+        return Some(format!("ed25519:{}", hex::encode(raw_key)));
+    }
+    let mut hasher = Sha256::new();
+    hasher.update(cert_der);
+    let digest = hasher.finalize();
+    Some(format!("SHA256:{}", hex::encode(digest)))
+}
+
+/// `SubjectPublicKeyInfo ::= SEQUENCE { algorithm AlgorithmIdentifier, subjectPublicKey BIT STRING }`
+/// `AlgorithmIdentifier ::= SEQUENCE { algorithm OBJECT IDENTIFIER, parameters ANY OPTIONAL }`
+/// For Ed25519 the algorithm OID is `1.3.101.112` (DER bytes `2b 65 70`), with
+/// no parameters, and `subjectPublicKey` is a BIT STRING containing one
+/// unused-bits byte (`0x00`) followed by the 32-byte raw Ed25519 public key.
+/// Returns the 32 raw key bytes when `cert_der` is an RFC 7250 raw public key
+/// (SPKI) with the Ed25519 algorithm identifier; returns `None` otherwise
+/// (X.509 cert, non-Ed25519 SPKI, or malformed DER), in which case callers
+/// should fall back to hashing the full DER.
+pub fn extract_ed25519_raw_key_from_spki(cert_der: &[u8]) -> Option<[u8; 32]> {
+    const ED25519_OID_BYTES: [u8; 3] = [0x2b, 0x65, 0x70];
+
+    let mut parser = DerParser::new(cert_der);
+    let spki_contents = parser.expect_sequence()?;
+    let mut spki_parser = DerParser::new(spki_contents);
+
+    let alg_id_contents = spki_parser.expect_sequence()?;
+    let mut alg_id_parser = DerParser::new(alg_id_contents);
+    let oid_bytes = alg_id_parser.expect_oid()?;
+    if oid_bytes != ED25519_OID_BYTES {
+        return None;
+    }
+
+    let bit_string_contents = spki_parser.expect_bit_string()?;
+    if bit_string_contents.len() != 33 || bit_string_contents[0] != 0x00 {
+        return None;
+    }
+    let mut raw_key = [0u8; 32];
+    raw_key.copy_from_slice(&bit_string_contents[1..33]);
+    Some(raw_key)
+}
+
+struct DerParser<'a> {
+    bytes: &'a [u8],
+}
+
+impl<'a> DerParser<'a> {
+    fn new(bytes: &'a [u8]) -> Self {
+        Self { bytes }
+    }
+
+    fn read_tlv(&mut self) -> Option<(u8, &'a [u8])> {
+        let (tag, len_size, header_len) = self.decode_header()?;
+        let total = header_len.checked_add(len_size)?;
+        if total > self.bytes.len() {
+            return None;
+        }
+        let content = &self.bytes[header_len..total];
+        self.bytes = &self.bytes[total..];
+        Some((tag, content))
+    }
+
+    fn decode_header(&self) -> Option<(u8, usize, usize)> {
+        if self.bytes.is_empty() {
+            return None;
+        }
+        let tag = self.bytes[0];
+        if self.bytes.len() < 2 {
+            return None;
+        }
+        let first_len = self.bytes[1];
+        if first_len < 0x80 {
+            return Some((tag, first_len as usize, 2));
+        }
+        let num_bytes = (first_len & 0x7f) as usize;
+        if num_bytes == 0 || num_bytes > 4 {
+            return None;
+        }
+        if self.bytes.len() < 2 + num_bytes {
+            return None;
+        }
+        let mut len: usize = 0;
+        for i in 0..num_bytes {
+            len = (len << 8) | (self.bytes[2 + i] as usize);
+        }
+        Some((tag, len, 2 + num_bytes))
+    }
+
+    fn expect_sequence(&mut self) -> Option<&'a [u8]> {
+        let (tag, content) = self.read_tlv()?;
+        if tag == 0x30 {
+            Some(content)
+        } else {
+            None
+        }
+    }
+
+    fn expect_oid(&mut self) -> Option<&'a [u8]> {
+        let (tag, content) = self.read_tlv()?;
+        if tag == 0x06 {
+            Some(content)
+        } else {
+            None
+        }
+    }
+
+    fn expect_bit_string(&mut self) -> Option<&'a [u8]> {
+        let (tag, content) = self.read_tlv()?;
+        if tag == 0x03 {
+            Some(content)
+        } else {
+            None
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn build_ed25519_spki_der(raw_key: &[u8; 32]) -> Vec<u8> {
+        let spki = rustls::sign::public_key_to_spki(&rustls::pki_types::alg_id::ED25519, raw_key);
+        spki.to_vec()
+    }
+
+    #[test]
+    fn fingerprint_from_cert_der_produces_sha256_hex_format() {
+        let cert_der = b"fake-leaf-cert-der-bytes";
+        let fp = fingerprint_from_cert_der(cert_der).expect("non-empty cert produces fingerprint");
+        assert!(
+            fp.starts_with("SHA256:"),
+            "fingerprint must be SHA256-prefixed, got: {fp}"
+        );
+        let hex_part = &fp["SHA256:".len()..];
+        assert_eq!(
+            hex_part.len(),
+            64,
+            "hex digest must be 64 chars (32 bytes), got: {fp}"
+        );
+        assert!(
+            hex_part.chars().all(|c| c.is_ascii_hexdigit()),
+            "hex part must be lowercase hex, got: {fp}"
+        );
+        let mut hasher = Sha256::new();
+        hasher.update(cert_der);
+        let expected = format!("SHA256:{}", hex::encode(hasher.finalize()));
+        assert_eq!(fp, expected, "fingerprint must match SHA-256 of cert DER");
+    }
+
+    #[test]
+    fn fingerprint_from_cert_der_deterministic() {
+        let cert = b"some-cert";
+        let a = fingerprint_from_cert_der(cert).unwrap();
+        let b = fingerprint_from_cert_der(cert).unwrap();
+        assert_eq!(a, b, "same cert DER must produce same fingerprint");
+    }
+
+    #[test]
+    fn fingerprint_from_ed25519_spki_produces_ed25519_prefix() {
+        let sk = crate::config::Ed25519SecretKey::generate();
+        let raw_key = sk.public().to_bytes();
+        let spki_der = build_ed25519_spki_der(&raw_key);
+        let fp = fingerprint_from_cert_der(&spki_der).expect("spki produces fingerprint");
+        assert!(
+            fp.starts_with("ed25519:"),
+            "Ed25519 raw key SPKI must produce ed25519: fingerprint, got: {fp}"
+        );
+    }
+
+    #[test]
+    fn fingerprint_from_ed25519_spki_is_lowercase_hex_of_32_byte_key() {
+        let sk = crate::config::Ed25519SecretKey::generate();
+        let raw_key = sk.public().to_bytes();
+        let spki_der = build_ed25519_spki_der(&raw_key);
+        let fp = fingerprint_from_cert_der(&spki_der).expect("spki produces fingerprint");
+        let hex_part = &fp["ed25519:".len()..];
+        assert_eq!(
+            hex_part.len(),
+            64,
+            "ed25519 hex part must be 64 chars (32 bytes), got: {fp}"
+        );
+        assert!(
+            hex_part
+                .chars()
+                .all(|c| c.is_ascii_hexdigit() && !c.is_ascii_uppercase()),
+            "ed25519 hex part must be lowercase hex, got: {fp}"
+        );
+        assert_eq!(
+            hex_part,
+            hex::encode(raw_key),
+            "ed25519 fingerprint must be hex of the raw 32-byte key, not the DER wrapper"
+        );
+    }
+
+    #[test]
+    fn fingerprint_from_ed25519_spki_matches_iroh_format() {
+        let sk = crate::config::Ed25519SecretKey::generate();
+        let raw_key = sk.public().to_bytes();
+        let spki_der = build_ed25519_spki_der(&raw_key);
+        let quinn_fp = fingerprint_from_cert_der(&spki_der).expect("spki produces fingerprint");
+        let iroh_fp = format!("ed25519:{}", hex::encode(raw_key));
+        assert_eq!(
+            quinn_fp, iroh_fp,
+            "same Ed25519 key must produce the same fingerprint via quinn SPKI and iroh NodeId paths"
+        );
+    }
+
+    #[test]
+    fn fingerprint_from_x509_cert_stays_sha256_of_der() {
+        let cert_der = b"fake-x509-cert-der-bytes-not-an-spki";
+        let fp = fingerprint_from_cert_der(cert_der).expect("x509 produces fingerprint");
+        assert!(
+            fp.starts_with("SHA256:"),
+            "X.509 cert must keep SHA256: format, got: {fp}"
+        );
+        let mut hasher = Sha256::new();
+        hasher.update(cert_der);
+        assert_eq!(
+            fp,
+            format!("SHA256:{}", hex::encode(hasher.finalize())),
+            "X.509 fingerprint must be SHA-256 of cert DER"
+        );
+    }
+
+    #[test]
+    fn fingerprint_from_non_ed25519_spki_falls_back_to_sha256() {
+        let raw_key = [0u8; 32];
+        let fake_non_ed25519_spki: Vec<u8> = vec![
+            0x30, 0x1c, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x06, 0x01, 0x03, 0x15, 0x00, 0x20,
+        ]
+        .into_iter()
+        .chain(raw_key.iter().copied())
+        .collect();
+        let fp = fingerprint_from_cert_der(&fake_non_ed25519_spki).expect("fallback fingerprint");
+        assert!(
+            fp.starts_with("SHA256:"),
+            "non-Ed25519 SPKI must fall back to SHA256, got: {fp}"
+        );
+    }
+}

crates/alknet-core/src/http/auth.rs

@@ -1,182 +0,0 @@
-use axum::extract::Request;
-use axum::middleware::Next;
-use axum::response::{IntoResponse, Response};
-
-use crate::auth::{AuthToken, Identity, IdentityProvider};
-
-#[derive(Clone)]
-pub struct IdentityExt(pub Identity);
-
-pub async fn auth_middleware(
-    axum::extract::State(identity_provider): axum::extract::State<
-        std::sync::Arc<dyn IdentityProvider>,
-    >,
-    mut request: Request,
-    next: Next,
-) -> Response {
-    let auth_header = request
-        .headers()
-        .get(axum::http::header::AUTHORIZATION)
-        .and_then(|v| v.to_str().ok());
-
-    let token_str = match auth_header {
-        Some(h) if h.starts_with("Bearer ") => &h[7..],
-        _ => {
-            return axum::http::StatusCode::UNAUTHORIZED.into_response();
-        }
-    };
-
-    let token = AuthToken {
-        raw: token_str.as_bytes().to_vec(),
-    };
-
-    match identity_provider.resolve_from_token(&token) {
-        Some(identity) => {
-            request.extensions_mut().insert(IdentityExt(identity));
-            next.run(request).await
-        }
-        None => axum::http::StatusCode::UNAUTHORIZED.into_response(),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use axum::body::Body;
-    use axum::http::{Request as HttpRequest, StatusCode};
-    use axum::routing::get;
-    use axum::Router;
-    use std::collections::HashMap;
-    use std::sync::Arc;
-    use tower::ServiceExt;
-
-    struct MockIdentityProvider {
-        valid_token: String,
-        identity: Identity,
-    }
-
-    impl IdentityProvider for MockIdentityProvider {
-        fn resolve_from_fingerprint(&self, _fingerprint: &str) -> Option<Identity> {
-            None
-        }
-
-        fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
-            let token_str = String::from_utf8_lossy(&token.raw);
-            if token_str == self.valid_token {
-                Some(self.identity.clone())
-            } else {
-                None
-            }
-        }
-    }
-
-    fn make_provider(valid_token: &str) -> Arc<dyn IdentityProvider> {
-        let identity = Identity {
-            id: "test-user".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        Arc::new(MockIdentityProvider {
-            valid_token: valid_token.to_string(),
-            identity,
-        })
-    }
-
-    #[tokio::test]
-    async fn auth_middleware_extracts_bearer_token() {
-        let provider = make_provider("alk_validtoken1");
-        let app = Router::new()
-            .route(
-                "/test",
-                get(|request: Request| async move {
-                    let has_identity = request.extensions().get::<IdentityExt>().is_some();
-                    if has_identity {
-                        StatusCode::OK.into_response()
-                    } else {
-                        StatusCode::INTERNAL_SERVER_ERROR.into_response()
-                    }
-                }),
-            )
-            .layer(axum::middleware::from_fn_with_state(
-                provider,
-                auth_middleware,
-            ));
-
-        let req = HttpRequest::builder()
-            .uri("/test")
-            .header("authorization", "Bearer alk_validtoken1")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-    }
-
-    #[tokio::test]
-    async fn auth_middleware_returns_401_for_missing_token() {
-        let provider = make_provider("alk_validtoken1");
-        let app = Router::new()
-            .route("/test", get(|| async { StatusCode::OK.into_response() }))
-            .layer(axum::middleware::from_fn_with_state(
-                provider,
-                auth_middleware,
-            ));
-
-        let req = HttpRequest::builder()
-            .uri("/test")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    #[tokio::test]
-    async fn auth_middleware_returns_401_for_invalid_token() {
-        let provider = make_provider("alk_validtoken1");
-        let app = Router::new()
-            .route("/test", get(|| async { StatusCode::OK.into_response() }))
-            .layer(axum::middleware::from_fn_with_state(
-                provider,
-                auth_middleware,
-            ));
-
-        let req = HttpRequest::builder()
-            .uri("/test")
-            .header("authorization", "Bearer alk_wrongtoken1")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    #[tokio::test]
-    async fn auth_middleware_attaches_identity_to_extensions() {
-        let provider = make_provider("alk_testidentity1");
-        let app = Router::new()
-            .route(
-                "/test",
-                get(|request: Request| async move {
-                    let identity = request.extensions().get::<IdentityExt>().unwrap();
-                    identity.0.id.clone()
-                }),
-            )
-            .layer(axum::middleware::from_fn_with_state(
-                provider,
-                auth_middleware,
-            ));
-
-        let req = HttpRequest::builder()
-            .uri("/test")
-            .header("authorization", "Bearer alk_testidentity1")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::OK);
-
-        let body = axum::body::to_bytes(resp.into_body(), 1024).await.unwrap();
-        assert_eq!(&body[..], b"test-user");
-    }
-}

crates/alknet-core/src/http/mod.rs

@@ -1,5 +0,0 @@
-pub mod auth;
-pub mod router;
-
-pub use auth::IdentityExt;
-pub use router::{build_router, serve_connection};

crates/alknet-core/src/http/router.rs

@@ -1,150 +0,0 @@
-use std::sync::Arc;
-
-use axum::response::IntoResponse;
-use axum::Router;
-use hyper_util::rt::{TokioExecutor, TokioIo};
-use hyper_util::server::conn::auto::Builder;
-use hyper_util::service::TowerToHyperService;
-use tokio::io::{AsyncRead, AsyncWrite, BufReader};
-
-use crate::auth::IdentityProvider;
-use crate::http::auth::auth_middleware;
-
-async fn default_404() -> impl IntoResponse {
-    axum::http::StatusCode::NOT_FOUND
-}
-
-pub fn build_router(identity_provider: Arc<dyn IdentityProvider>) -> Router {
-    Router::new()
-        .fallback(default_404)
-        .layer(axum::middleware::from_fn_with_state(
-            identity_provider,
-            auth_middleware,
-        ))
-}
-
-pub async fn serve_connection<S>(stream: S, identity_provider: Arc<dyn IdentityProvider>)
-where
-    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
-{
-    let app = build_router(identity_provider);
-    let io = TokioIo::new(stream);
-
-    let hyper_service = TowerToHyperService::new(app.into_service::<hyper::body::Incoming>());
-
-    let result = Builder::new(TokioExecutor::new())
-        .serve_connection_with_upgrades(io, hyper_service)
-        .await;
-
-    if let Err(e) = result {
-        tracing::debug!("http connection error: {e}");
-    }
-}
-
-pub async fn serve_connection_from_reader<S>(
-    reader: BufReader<S>,
-    identity_provider: Arc<dyn IdentityProvider>,
-) where
-    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
-{
-    serve_connection(reader, identity_provider).await
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::{AuthToken, Identity};
-    use axum::body::Body;
-    use axum::http::{Request as HttpRequest, StatusCode};
-    use axum::response::IntoResponse;
-    use std::collections::HashMap;
-    use std::sync::Arc;
-    use tower::ServiceExt;
-
-    struct NullIdentityProvider;
-
-    impl IdentityProvider for NullIdentityProvider {
-        fn resolve_from_fingerprint(&self, _fingerprint: &str) -> Option<Identity> {
-            None
-        }
-
-        fn resolve_from_token(&self, _token: &AuthToken) -> Option<Identity> {
-            None
-        }
-    }
-
-    #[tokio::test]
-    async fn default_404_handler_returns_not_found() {
-        let provider: Arc<dyn IdentityProvider> = Arc::new(MockValidProvider);
-        let app = build_router(provider);
-
-        let req = HttpRequest::builder()
-            .uri("/anything")
-            .header("authorization", "Bearer alk_sometoken1")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::NOT_FOUND);
-    }
-
-    #[tokio::test]
-    async fn missing_auth_returns_401_before_404() {
-        let provider: Arc<dyn IdentityProvider> = Arc::new(MockValidProvider);
-        let app = build_router(provider);
-
-        let req = HttpRequest::builder()
-            .uri("/anything")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    #[tokio::test]
-    async fn invalid_auth_returns_401_before_404() {
-        let provider: Arc<dyn IdentityProvider> = Arc::new(NullIdentityProvider);
-        let app = build_router(provider);
-
-        let req = HttpRequest::builder()
-            .uri("/anything")
-            .header("authorization", "Bearer alk_sometoken1")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
-    }
-
-    #[tokio::test]
-    async fn unmatched_route_returns_404_with_valid_auth() {
-        let provider: Arc<dyn IdentityProvider> = Arc::new(MockValidProvider);
-        let app = build_router(provider);
-
-        let req = HttpRequest::builder()
-            .uri("/v1/unknown/op")
-            .header("authorization", "Bearer alk_valid")
-            .body(Body::empty())
-            .unwrap();
-
-        let resp = app.oneshot(req).await.unwrap();
-        assert_eq!(resp.status(), StatusCode::NOT_FOUND);
-    }
-
-    struct MockValidProvider;
-
-    impl IdentityProvider for MockValidProvider {
-        fn resolve_from_fingerprint(&self, _fingerprint: &str) -> Option<Identity> {
-            None
-        }
-
-        fn resolve_from_token(&self, _token: &AuthToken) -> Option<Identity> {
-            Some(Identity {
-                id: "test".to_string(),
-                scopes: vec![],
-                resources: HashMap::new(),
-            })
-        }
-    }
-}

crates/alknet-core/src/interface/config.rs

@@ -1,270 +0,0 @@
-use std::sync::Arc;
-
-use arc_swap::ArcSwap;
-use russh::keys::PrivateKey;
-use serde::{Deserialize, Serialize};
-
-use crate::auth::IdentityProvider;
-use crate::config::DynamicConfig;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum StreamInterfaceKind {
-    Ssh,
-    RawFraming,
-}
-
-impl std::fmt::Display for StreamInterfaceKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            StreamInterfaceKind::Ssh => write!(f, "ssh"),
-            StreamInterfaceKind::RawFraming => write!(f, "raw-framing"),
-        }
-    }
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum MessageInterfaceKind {
-    Http,
-    Dns,
-}
-
-impl std::fmt::Display for MessageInterfaceKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            MessageInterfaceKind::Http => write!(f, "http"),
-            MessageInterfaceKind::Dns => write!(f, "dns"),
-        }
-    }
-}
-
-#[non_exhaustive]
-pub enum InterfaceConfig {
-    Ssh(SshInterfaceConfig),
-    RawFraming(RawFramingConfig),
-}
-
-impl InterfaceConfig {
-    pub fn kind(&self) -> StreamInterfaceKind {
-        #[allow(unreachable_patterns)]
-        match self {
-            InterfaceConfig::Ssh(_) => StreamInterfaceKind::Ssh,
-            InterfaceConfig::RawFraming(_) => StreamInterfaceKind::RawFraming,
-            _ => StreamInterfaceKind::Ssh,
-        }
-    }
-}
-
-#[non_exhaustive]
-pub enum StreamInterfaceConfig {
-    Ssh(SshInterfaceConfig),
-    RawFraming(RawFramingConfig),
-}
-
-impl StreamInterfaceConfig {
-    pub fn kind(&self) -> StreamInterfaceKind {
-        match self {
-            StreamInterfaceConfig::Ssh(_) => StreamInterfaceKind::Ssh,
-            StreamInterfaceConfig::RawFraming(_) => StreamInterfaceKind::RawFraming,
-        }
-    }
-}
-
-impl std::fmt::Display for StreamInterfaceConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            StreamInterfaceConfig::Ssh(_) => write!(f, "ssh"),
-            StreamInterfaceConfig::RawFraming(_) => write!(f, "raw-framing"),
-        }
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[non_exhaustive]
-pub enum MessageInterfaceConfig {
-    Http(HttpInterfaceConfig),
-    Dns(DnsInterfaceConfig),
-}
-
-impl MessageInterfaceConfig {
-    pub fn kind(&self) -> MessageInterfaceKind {
-        match self {
-            MessageInterfaceConfig::Http(_) => MessageInterfaceKind::Http,
-            MessageInterfaceConfig::Dns(_) => MessageInterfaceKind::Dns,
-        }
-    }
-}
-
-impl std::fmt::Display for MessageInterfaceConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            MessageInterfaceConfig::Http(_) => write!(f, "http"),
-            MessageInterfaceConfig::Dns(_) => write!(f, "dns"),
-        }
-    }
-}
-
-pub struct SshInterfaceConfig {
-    pub auth: Arc<dyn IdentityProvider>,
-    pub forwarding: Arc<ArcSwap<DynamicConfig>>,
-    pub host_key: Arc<PrivateKey>,
-}
-
-pub struct RawFramingConfig {
-    pub auth: Arc<dyn IdentityProvider>,
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct HttpInterfaceConfig {
-    pub bind_addr: std::net::SocketAddr,
-    pub tls: bool,
-    pub stealth: bool,
-}
-
-impl std::fmt::Display for HttpInterfaceConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "http {}", self.bind_addr)
-    }
-}
-
-#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
-pub struct DnsInterfaceConfig {
-    pub bind_addr: std::net::SocketAddr,
-    pub tls: bool,
-}
-
-impl std::fmt::Display for DnsInterfaceConfig {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        write!(f, "dns {}", self.bind_addr)
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::ConfigIdentityProvider;
-
-    #[test]
-    fn stream_interface_kind_display() {
-        assert_eq!(StreamInterfaceKind::Ssh.to_string(), "ssh");
-        assert_eq!(StreamInterfaceKind::RawFraming.to_string(), "raw-framing");
-    }
-
-    #[test]
-    fn message_interface_kind_display() {
-        assert_eq!(MessageInterfaceKind::Http.to_string(), "http");
-        assert_eq!(MessageInterfaceKind::Dns.to_string(), "dns");
-    }
-
-    #[test]
-    fn stream_interface_config_kind() {
-        let auth = Arc::new(crate::auth::ConfigIdentityProvider::new(Arc::new(
-            ArcSwap::new(Arc::new(DynamicConfig::default())),
-        )));
-        let ssh_config = StreamInterfaceConfig::Ssh(SshInterfaceConfig {
-            auth,
-            forwarding: Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default()))),
-            host_key: Arc::new(
-                russh::keys::PrivateKey::random(
-                    &mut rand_core::OsRng,
-                    russh::keys::Algorithm::Ed25519,
-                )
-                .unwrap(),
-            ),
-        });
-        assert_eq!(ssh_config.kind(), StreamInterfaceKind::Ssh);
-
-        let raw_config = StreamInterfaceConfig::RawFraming(RawFramingConfig {
-            auth: Arc::new(ConfigIdentityProvider::new(Arc::new(ArcSwap::new(
-                Arc::new(DynamicConfig::default()),
-            )))),
-        });
-        assert_eq!(raw_config.kind(), StreamInterfaceKind::RawFraming);
-    }
-
-    #[test]
-    fn message_interface_config_kind() {
-        let http_config = MessageInterfaceConfig::Http(HttpInterfaceConfig {
-            bind_addr: "127.0.0.1:8080".parse().unwrap(),
-            tls: false,
-            stealth: false,
-        });
-        assert_eq!(http_config.kind(), MessageInterfaceKind::Http);
-
-        let dns_config = MessageInterfaceConfig::Dns(DnsInterfaceConfig {
-            bind_addr: "127.0.0.1:53".parse().unwrap(),
-            tls: false,
-        });
-        assert_eq!(dns_config.kind(), MessageInterfaceKind::Dns);
-    }
-
-    #[test]
-    fn stream_interface_kind_equality() {
-        assert_eq!(StreamInterfaceKind::Ssh, StreamInterfaceKind::Ssh);
-        assert_eq!(
-            StreamInterfaceKind::RawFraming,
-            StreamInterfaceKind::RawFraming
-        );
-        assert_ne!(StreamInterfaceKind::Ssh, StreamInterfaceKind::RawFraming);
-    }
-
-    #[test]
-    fn message_interface_kind_equality() {
-        assert_eq!(MessageInterfaceKind::Http, MessageInterfaceKind::Http);
-        assert_eq!(MessageInterfaceKind::Dns, MessageInterfaceKind::Dns);
-        assert_ne!(MessageInterfaceKind::Http, MessageInterfaceKind::Dns);
-    }
-
-    #[test]
-    fn raw_framing_config_minimal() {
-        let auth: Arc<dyn IdentityProvider> = Arc::new(ConfigIdentityProvider::new(Arc::new(
-            ArcSwap::new(Arc::new(DynamicConfig::default())),
-        )));
-        let _config = RawFramingConfig { auth };
-    }
-
-    #[test]
-    fn http_interface_config_display() {
-        let config = HttpInterfaceConfig {
-            bind_addr: "127.0.0.1:8080".parse().unwrap(),
-            tls: true,
-            stealth: true,
-        };
-        assert_eq!(config.to_string(), "http 127.0.0.1:8080");
-    }
-
-    #[test]
-    fn dns_interface_config_display() {
-        let config = DnsInterfaceConfig {
-            bind_addr: "127.0.0.1:53".parse().unwrap(),
-            tls: false,
-        };
-        assert_eq!(config.to_string(), "dns 127.0.0.1:53");
-    }
-
-    #[test]
-    fn http_interface_config_serialization() {
-        let config = HttpInterfaceConfig {
-            bind_addr: "127.0.0.1:8080".parse().unwrap(),
-            tls: true,
-            stealth: false,
-        };
-        let serialized = serde_json::to_string(&config).unwrap();
-        let deserialized: HttpInterfaceConfig = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.bind_addr, config.bind_addr);
-        assert_eq!(deserialized.tls, config.tls);
-    }
-
-    #[test]
-    fn dns_interface_config_serialization() {
-        let config = DnsInterfaceConfig {
-            bind_addr: "0.0.0.0:53".parse().unwrap(),
-            tls: true,
-        };
-        let serialized = serde_json::to_string(&config).unwrap();
-        let deserialized: DnsInterfaceConfig = serde_json::from_str(&serialized).unwrap();
-        assert_eq!(deserialized.bind_addr, config.bind_addr);
-        assert_eq!(deserialized.tls, config.tls);
-    }
-}

crates/alknet-core/src/interface/dns.rs

@@ -1,47 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::Result;
-use async_trait::async_trait;
-
-use crate::call::OperationEnv;
-use crate::interface::{InterfaceRequest, InterfaceResponse, MessageInterface};
-
-pub struct DnsInterface {
-    pub domain: String,
-    pub identity_provider: Arc<dyn crate::auth::IdentityProvider>,
-    pub registry: Arc<crate::call::OperationRegistry>,
-    pub env: OperationEnv,
-}
-
-#[async_trait]
-impl MessageInterface for DnsInterface {
-    async fn handle_request(&self, _request: InterfaceRequest) -> Result<InterfaceResponse> {
-        Ok(InterfaceResponse {
-            result: Err(crate::call::CallError::new(
-                "NOT_IMPLEMENTED",
-                "DnsInterface is not yet implemented",
-                false,
-            )),
-            status: 501,
-            headers: std::collections::HashMap::new(),
-        })
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn dns_interface_type_exists() {
-        let registry = Arc::new(crate::call::OperationRegistry::new());
-        let _iface = DnsInterface {
-            domain: "alk.dev".to_string(),
-            identity_provider: Arc::new(crate::auth::ConfigIdentityProvider::new(Arc::new(
-                arc_swap::ArcSwap::new(Arc::new(crate::config::DynamicConfig::default())),
-            ))),
-            env: OperationEnv::local(crate::call::OperationRegistry::new()),
-            registry,
-        };
-    }
-}

crates/alknet-core/src/interface/http.rs

@@ -1,66 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::Result;
-use async_trait::async_trait;
-
-use crate::call::OperationEnv;
-use crate::interface::{InterfaceRequest, InterfaceResponse, MessageInterface};
-
-pub struct HttpInterface {
-    pub identity_provider: Arc<dyn crate::auth::IdentityProvider>,
-    pub registry: Arc<crate::call::OperationRegistry>,
-    pub env: OperationEnv,
-}
-
-#[async_trait]
-impl MessageInterface for HttpInterface {
-    async fn handle_request(&self, _request: InterfaceRequest) -> Result<InterfaceResponse> {
-        Ok(InterfaceResponse {
-            result: Err(crate::call::CallError::new(
-                "NOT_IMPLEMENTED",
-                "HttpInterface is not yet implemented",
-                false,
-            )),
-            status: 501,
-            headers: std::collections::HashMap::new(),
-        })
-    }
-}
-
-#[cfg(feature = "http")]
-impl HttpInterface {
-    pub fn build_router(&self) -> axum::Router {
-        crate::http::router::build_router(Arc::clone(&self.identity_provider))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn http_interface_type_exists() {
-        let registry = Arc::new(crate::call::OperationRegistry::new());
-        let _iface = HttpInterface {
-            identity_provider: Arc::new(crate::auth::ConfigIdentityProvider::new(Arc::new(
-                arc_swap::ArcSwap::new(Arc::new(crate::config::DynamicConfig::default())),
-            ))),
-            env: OperationEnv::local(crate::call::OperationRegistry::new()),
-            registry,
-        };
-    }
-
-    #[cfg(feature = "http")]
-    #[test]
-    fn http_interface_builds_router() {
-        let registry = Arc::new(crate::call::OperationRegistry::new());
-        let iface = HttpInterface {
-            identity_provider: Arc::new(crate::auth::ConfigIdentityProvider::new(Arc::new(
-                arc_swap::ArcSwap::new(Arc::new(crate::config::DynamicConfig::default())),
-            ))),
-            env: OperationEnv::local(crate::call::OperationRegistry::new()),
-            registry,
-        };
-        let _router = iface.build_router();
-    }
-}

crates/alknet-core/src/interface/mod.rs

@@ -1,140 +0,0 @@
-//! Interface layer (Layer 2) of the three-layer model (ADR-026, ADR-035).
-//!
-//! The Interface layer sits between Transport (Layer 1) and Protocol (Layer 3).
-//! It has two distinct patterns:
-//!
-//! - **StreamInterface** — consumes a `TransportStream`, produces a long-lived
-//!   `Session` that yields `InterfaceEvent` frames. SSH and raw framing are
-//!   `StreamInterface` implementations.
-//!
-//! - **MessageInterface** — handles individual `InterfaceRequest` →
-//!   `InterfaceResponse` pairs. Manages its own transport (HTTP server, DNS
-//!   server). HTTP and DNS are `MessageInterface` implementations.
-
-pub mod config;
-pub mod dns;
-pub mod http;
-pub mod pairs;
-pub mod raw_framing;
-pub mod session;
-pub mod ssh;
-
-use std::collections::HashMap;
-
-use anyhow::Result;
-use async_trait::async_trait;
-use tokio::io::{AsyncRead, AsyncWrite};
-
-pub use config::{
-    DnsInterfaceConfig, HttpInterfaceConfig, InterfaceConfig, MessageInterfaceConfig,
-    MessageInterfaceKind, RawFramingConfig, SshInterfaceConfig, StreamInterfaceConfig,
-    StreamInterfaceKind,
-};
-pub use dns::DnsInterface;
-pub use http::HttpInterface;
-pub use pairs::{is_valid_pair, TransportKindBase, VALID_TRANSPORT_INTERFACE_PAIRS};
-pub use raw_framing::{RawFramingInterface, RawFramingSession};
-pub use session::{InterfaceEvent, InterfaceSession};
-pub use ssh::{ControlChannelBridge, SshInterface, SshSession};
-
-pub trait TransportStream: AsyncRead + AsyncWrite + Unpin + Send + 'static {}
-
-impl<T: AsyncRead + AsyncWrite + Unpin + Send + 'static> TransportStream for T {}
-
-#[async_trait]
-pub trait StreamInterface: Send + Sync + 'static {
-    type Session: InterfaceSession;
-
-    async fn accept(
-        &self,
-        stream: Box<dyn TransportStream>,
-        config: &StreamInterfaceConfig,
-    ) -> Result<Self::Session>;
-}
-
-#[async_trait]
-pub trait MessageInterface: Send + Sync + 'static {
-    async fn handle_request(&self, request: InterfaceRequest) -> Result<InterfaceResponse>;
-}
-
-#[derive(Debug, Clone)]
-pub struct InterfaceRequest {
-    pub operation_path: String,
-    pub input: serde_json::Value,
-    pub auth_token: Option<crate::auth::AuthToken>,
-    pub metadata: HashMap<String, String>,
-}
-
-#[derive(Debug, Clone)]
-pub struct InterfaceResponse {
-    pub result: Result<serde_json::Value, crate::call::CallError>,
-    pub status: u16,
-    pub headers: HashMap<String, String>,
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::duplex;
-
-    #[test]
-    fn transport_stream_trait_bounds() {
-        fn assert_transport_stream<S: TransportStream>() {}
-        assert_transport_stream::<tokio::io::DuplexStream>();
-    }
-
-    #[tokio::test]
-    async fn transport_stream_from_duplex() {
-        let (client, server) = duplex(1024);
-        let _boxed: Box<dyn TransportStream> = Box::new(server);
-        let _: Box<dyn TransportStream> = Box::new(client);
-    }
-
-    #[test]
-    fn interface_request_fields() {
-        let req = InterfaceRequest {
-            operation_path: "/v1/head/auth/verify".to_string(),
-            input: serde_json::json!({"key": "value"}),
-            auth_token: None,
-            metadata: HashMap::new(),
-        };
-        assert_eq!(req.operation_path, "/v1/head/auth/verify");
-        assert!(req.auth_token.is_none());
-    }
-
-    #[test]
-    fn interface_response_fields() {
-        let resp = InterfaceResponse {
-            result: Ok(serde_json::json!({"status": "ok"})),
-            status: 200,
-            headers: HashMap::new(),
-        };
-        assert_eq!(resp.status, 200);
-    }
-
-    struct MockMessageInterface;
-
-    #[async_trait]
-    impl MessageInterface for MockMessageInterface {
-        async fn handle_request(&self, _request: InterfaceRequest) -> Result<InterfaceResponse> {
-            Ok(InterfaceResponse {
-                result: Ok(serde_json::json!({})),
-                status: 200,
-                headers: HashMap::new(),
-            })
-        }
-    }
-
-    #[tokio::test]
-    async fn message_interface_trait_compiles() {
-        let iface = MockMessageInterface;
-        let req = InterfaceRequest {
-            operation_path: "/test".to_string(),
-            input: serde_json::json!({}),
-            auth_token: None,
-            metadata: HashMap::new(),
-        };
-        let resp = iface.handle_request(req).await.unwrap();
-        assert_eq!(resp.status, 200);
-    }
-}

crates/alknet-core/src/interface/pairs.rs

@@ -1,122 +0,0 @@
-use crate::transport::TransportKind;
-
-use super::config::StreamInterfaceKind;
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum TransportKindBase {
-    Tcp,
-    Tls,
-    Iroh,
-    WebTransport,
-}
-
-fn transport_base(kind: &TransportKind) -> TransportKindBase {
-    match kind {
-        TransportKind::Tcp => TransportKindBase::Tcp,
-        TransportKind::Tls { .. } => TransportKindBase::Tls,
-        TransportKind::Iroh { .. } => TransportKindBase::Iroh,
-        TransportKind::WebTransport { .. } => TransportKindBase::WebTransport,
-    }
-}
-
-pub fn is_valid_pair(transport: &TransportKind, interface: StreamInterfaceKind) -> bool {
-    let base = transport_base(transport);
-    matches!(
-        (base, interface),
-        (TransportKindBase::Tcp, StreamInterfaceKind::Ssh)
-            | (TransportKindBase::Tls, StreamInterfaceKind::Ssh)
-            | (TransportKindBase::Iroh, StreamInterfaceKind::Ssh)
-            | (TransportKindBase::WebTransport, StreamInterfaceKind::Ssh)
-            | (
-                TransportKindBase::WebTransport,
-                StreamInterfaceKind::RawFraming
-            )
-            | (TransportKindBase::Tcp, StreamInterfaceKind::RawFraming)
-    )
-}
-
-pub const VALID_TRANSPORT_INTERFACE_PAIRS: &[(TransportKindBase, StreamInterfaceKind)] = &[
-    (TransportKindBase::Tcp, StreamInterfaceKind::Ssh),
-    (TransportKindBase::Tls, StreamInterfaceKind::Ssh),
-    (TransportKindBase::Iroh, StreamInterfaceKind::Ssh),
-    (TransportKindBase::WebTransport, StreamInterfaceKind::Ssh),
-    (
-        TransportKindBase::WebTransport,
-        StreamInterfaceKind::RawFraming,
-    ),
-    (TransportKindBase::Tcp, StreamInterfaceKind::RawFraming),
-];
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn valid_ssh_pairs() {
-        assert!(is_valid_pair(&TransportKind::Tcp, StreamInterfaceKind::Ssh));
-        assert!(is_valid_pair(
-            &TransportKind::Tls { server_name: None },
-            StreamInterfaceKind::Ssh
-        ));
-        assert!(is_valid_pair(
-            &TransportKind::Iroh {
-                endpoint_id: String::new()
-            },
-            StreamInterfaceKind::Ssh
-        ));
-        assert!(is_valid_pair(
-            &TransportKind::WebTransport { server_name: None },
-            StreamInterfaceKind::Ssh
-        ));
-    }
-
-    #[test]
-    fn valid_raw_framing_pairs() {
-        assert!(is_valid_pair(
-            &TransportKind::Tcp,
-            StreamInterfaceKind::RawFraming
-        ));
-        assert!(is_valid_pair(
-            &TransportKind::WebTransport { server_name: None },
-            StreamInterfaceKind::RawFraming
-        ));
-    }
-
-    #[test]
-    fn invalid_pairs() {
-        assert!(!is_valid_pair(
-            &TransportKind::Iroh {
-                endpoint_id: String::new()
-            },
-            StreamInterfaceKind::RawFraming
-        ));
-    }
-
-    #[test]
-    fn transport_kind_base_classification() {
-        assert_eq!(transport_base(&TransportKind::Tcp), TransportKindBase::Tcp);
-        assert_eq!(
-            transport_base(&TransportKind::Tls {
-                server_name: Some("example.com".to_string())
-            }),
-            TransportKindBase::Tls
-        );
-        assert_eq!(
-            transport_base(&TransportKind::Iroh {
-                endpoint_id: "abc".to_string()
-            }),
-            TransportKindBase::Iroh
-        );
-        assert_eq!(
-            transport_base(&TransportKind::WebTransport {
-                server_name: Some("example.com".to_string())
-            }),
-            TransportKindBase::WebTransport
-        );
-    }
-
-    #[test]
-    fn valid_pairs_table_complete() {
-        assert_eq!(VALID_TRANSPORT_INTERFACE_PAIRS.len(), 6);
-    }
-}

crates/alknet-core/src/interface/raw_framing.rs

@@ -1,399 +0,0 @@
-use std::sync::Arc;
-
-use anyhow::Result;
-use async_trait::async_trait;
-use tokio::io::{AsyncReadExt, AsyncWriteExt, BufReader, BufWriter};
-
-use crate::auth::{AuthToken, Identity, IdentityProvider};
-use crate::call::frame::{decode_with_remainder, encode};
-use crate::call::EventEnvelope;
-use crate::interface::session::{InterfaceEvent, InterfaceSession};
-use crate::interface::{StreamInterface, StreamInterfaceConfig, TransportStream};
-
-const READ_BUF_SIZE: usize = 8192;
-
-pub struct RawFramingInterface;
-
-#[async_trait]
-impl StreamInterface for RawFramingInterface {
-    type Session = RawFramingSession;
-
-    async fn accept(
-        &self,
-        stream: Box<dyn TransportStream>,
-        config: &StreamInterfaceConfig,
-    ) -> Result<Self::Session> {
-        let raw_config = match config {
-            StreamInterfaceConfig::RawFraming(c) => c,
-            StreamInterfaceConfig::Ssh(_) => {
-                return Err(anyhow::anyhow!(
-                    "RawFramingInterface received SshInterfaceConfig"
-                ));
-            }
-        };
-
-        Ok(RawFramingSession::new(stream, Arc::clone(&raw_config.auth)))
-    }
-}
-
-enum AuthState {
-    Pending,
-    Authenticated(Identity),
-    Failed,
-}
-
-pub struct RawFramingSession {
-    reader: BufReader<tokio::io::ReadHalf<Box<dyn TransportStream>>>,
-    writer: BufWriter<tokio::io::WriteHalf<Box<dyn TransportStream>>>,
-    auth_state: AuthState,
-    identity_provider: Arc<dyn IdentityProvider>,
-    read_buf: Vec<u8>,
-}
-
-impl RawFramingSession {
-    pub fn new(
-        stream: Box<dyn TransportStream>,
-        identity_provider: Arc<dyn IdentityProvider>,
-    ) -> Self {
-        let (read_half, write_half) = tokio::io::split(stream);
-        Self {
-            reader: BufReader::new(read_half),
-            writer: BufWriter::new(write_half),
-            auth_state: AuthState::Pending,
-            identity_provider,
-            read_buf: Vec::new(),
-        }
-    }
-
-    async fn read_frame(&mut self) -> Result<EventEnvelope> {
-        loop {
-            match decode_with_remainder(&self.read_buf) {
-                Ok((envelope, consumed)) => {
-                    self.read_buf.drain(..consumed);
-                    return Ok(envelope);
-                }
-                Err(crate::call::frame::FrameDecodeError::TooShort { .. })
-                | Err(crate::call::frame::FrameDecodeError::Incomplete { .. }) => {
-                    let mut tmp = [0u8; READ_BUF_SIZE];
-                    let n = self.reader.read(&mut tmp).await?;
-                    if n == 0 {
-                        return Err(anyhow::anyhow!("stream closed while reading frame"));
-                    }
-                    self.read_buf.extend_from_slice(&tmp[..n]);
-                }
-                Err(crate::call::frame::FrameDecodeError::Json(e)) => {
-                    return Err(anyhow::anyhow!("frame JSON decode error: {e}"));
-                }
-            }
-        }
-    }
-
-    async fn write_frame(&mut self, envelope: &EventEnvelope) -> Result<()> {
-        let frame = encode(envelope);
-        self.writer.write_all(&frame).await?;
-        self.writer.flush().await?;
-        Ok(())
-    }
-}
-
-#[async_trait]
-impl InterfaceSession for RawFramingSession {
-    async fn recv(&mut self) -> Option<InterfaceEvent> {
-        match &self.auth_state {
-            AuthState::Failed => return None,
-            AuthState::Authenticated(_) => {
-                let identity = match &self.auth_state {
-                    AuthState::Authenticated(id) => id.clone(),
-                    _ => unreachable!(),
-                };
-                let envelope = match self.read_frame().await {
-                    Ok(e) => e,
-                    Err(_) => return None,
-                };
-                return Some(InterfaceEvent::with_identity(envelope, identity));
-            }
-            AuthState::Pending => {}
-        }
-
-        let envelope = match self.read_frame().await {
-            Ok(e) => e,
-            Err(_) => {
-                self.auth_state = AuthState::Failed;
-                return None;
-            }
-        };
-
-        let token_raw = envelope.payload.as_str().unwrap_or("").as_bytes().to_vec();
-        let token = AuthToken { raw: token_raw };
-
-        match self.identity_provider.resolve_from_token(&token) {
-            Some(identity) => {
-                self.auth_state = AuthState::Authenticated(identity.clone());
-                Some(InterfaceEvent::with_identity(envelope, identity))
-            }
-            None => {
-                self.auth_state = AuthState::Failed;
-                None
-            }
-        }
-    }
-
-    async fn send(&mut self, envelope: EventEnvelope) -> Result<()> {
-        match self.auth_state {
-            AuthState::Failed => Err(anyhow::anyhow!("session authentication failed")),
-            _ => self.write_frame(&envelope).await,
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::ConfigIdentityProvider;
-    use crate::config::DynamicConfig;
-    use crate::interface::RawFramingConfig;
-    use arc_swap::ArcSwap;
-    use std::collections::HashMap;
-
-    fn make_provider() -> Arc<dyn IdentityProvider> {
-        Arc::new(ConfigIdentityProvider::new(Arc::new(ArcSwap::new(
-            Arc::new(DynamicConfig::default()),
-        ))))
-    }
-
-    fn make_provider_with_identity(
-        identity: Identity,
-        valid_token: &str,
-    ) -> (Arc<dyn IdentityProvider>, String) {
-        struct MockProvider {
-            identity: Identity,
-            valid_token: String,
-        }
-        impl IdentityProvider for MockProvider {
-            fn resolve_from_fingerprint(&self, _fp: &str) -> Option<Identity> {
-                None
-            }
-            fn resolve_from_token(&self, token: &AuthToken) -> Option<Identity> {
-                if token.raw == self.valid_token.as_bytes() {
-                    Some(self.identity.clone())
-                } else {
-                    None
-                }
-            }
-        }
-        let provider = Arc::new(MockProvider {
-            identity,
-            valid_token: valid_token.to_string(),
-        });
-        (provider, valid_token.to_string())
-    }
-
-    #[tokio::test]
-    async fn raw_framing_interface_accept_succeeds() {
-        let iface = RawFramingInterface;
-        let (_client, server) = tokio::io::duplex(1024);
-        let stream: Box<dyn TransportStream> = Box::new(server);
-        let config = StreamInterfaceConfig::RawFraming(RawFramingConfig {
-            auth: make_provider(),
-        });
-        let result = iface.accept(stream, &config).await;
-        assert!(result.is_ok());
-    }
-
-    #[tokio::test]
-    async fn raw_framing_interface_rejects_ssh_config() {
-        let iface = RawFramingInterface;
-        let (_client, server) = tokio::io::duplex(1024);
-        let stream: Box<dyn TransportStream> = Box::new(server);
-        let config = StreamInterfaceConfig::Ssh(crate::interface::SshInterfaceConfig {
-            auth: make_provider(),
-            forwarding: Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default()))),
-            host_key: Arc::new(
-                russh::keys::PrivateKey::random(
-                    &mut rand_core::OsRng,
-                    russh::keys::Algorithm::Ed25519,
-                )
-                .unwrap(),
-            ),
-        });
-        let result = iface.accept(stream, &config).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn raw_framing_session_round_trip() {
-        let identity = Identity {
-            id: "test-id".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        let (provider, token_str) =
-            make_provider_with_identity(identity.clone(), "valid-test-token");
-
-        let (client, server) = tokio::io::duplex(4096);
-        let server_stream: Box<dyn TransportStream> = Box::new(server);
-        let client_stream: Box<dyn TransportStream> = Box::new(client);
-
-        let mut server_session = RawFramingSession::new(server_stream, provider);
-
-        let auth_envelope = EventEnvelope::new("auth", "auth-1", serde_json::json!(token_str));
-        let auth_frame = encode(&auth_envelope);
-
-        let mut client_writer = tokio::io::BufWriter::new(client_stream);
-        client_writer.write_all(&auth_frame).await.unwrap();
-        client_writer.flush().await.unwrap();
-
-        let event = server_session.recv().await;
-        assert!(event.is_some());
-        let event = event.unwrap();
-        assert!(event.identity.is_some());
-        assert_eq!(event.identity.as_ref().unwrap().id, "test-id");
-
-        let data_envelope =
-            EventEnvelope::call_requested("req-2", serde_json::json!({"op": "test"}));
-        let data_frame = encode(&data_envelope);
-        client_writer.write_all(&data_frame).await.unwrap();
-        client_writer.flush().await.unwrap();
-
-        let event = server_session.recv().await;
-        assert!(event.is_some());
-        let event = event.unwrap();
-        assert_eq!(event.envelope.r#type, "call.requested");
-        assert_eq!(event.envelope.id, "req-2");
-        assert!(event.identity.is_some());
-    }
-
-    #[tokio::test]
-    async fn first_frame_auth_valid_token() {
-        let identity = Identity {
-            id: "auth-user".to_string(),
-            scopes: vec!["admin".to_string()],
-            resources: HashMap::new(),
-        };
-        let (provider, token_str) = make_provider_with_identity(identity, "my-valid-token");
-
-        let (client, server) = tokio::io::duplex(4096);
-        let server_stream: Box<dyn TransportStream> = Box::new(server);
-        let client_stream: Box<dyn TransportStream> = Box::new(client);
-
-        let mut session = RawFramingSession::new(server_stream, provider);
-
-        let auth_envelope = EventEnvelope::new("auth", "auth-1", serde_json::json!(token_str));
-        let frame = encode(&auth_envelope);
-        let mut writer = tokio::io::BufWriter::new(client_stream);
-        writer.write_all(&frame).await.unwrap();
-        writer.flush().await.unwrap();
-
-        let event = session.recv().await;
-        assert!(event.is_some());
-        let event = event.unwrap();
-        assert!(event.identity.is_some());
-        assert_eq!(event.identity.as_ref().unwrap().id, "auth-user");
-        assert_eq!(event.identity.as_ref().unwrap().scopes, vec!["admin"]);
-    }
-
-    #[tokio::test]
-    async fn first_frame_auth_invalid_token() {
-        let identity = Identity {
-            id: "auth-user".to_string(),
-            scopes: vec![],
-            resources: HashMap::new(),
-        };
-        let (provider, _) = make_provider_with_identity(identity, "correct-token");
-
-        let (client, server) = tokio::io::duplex(4096);
-        let server_stream: Box<dyn TransportStream> = Box::new(server);
-        let client_stream: Box<dyn TransportStream> = Box::new(client);
-
-        let mut session = RawFramingSession::new(server_stream, provider);
-
-        let bad_envelope =
-            EventEnvelope::new("auth", "auth-1", serde_json::json!("bad-token-value"));
-        let frame = encode(&bad_envelope);
-        let mut writer = tokio::io::BufWriter::new(client_stream);
-        writer.write_all(&frame).await.unwrap();
-        writer.flush().await.unwrap();
-
-        let event = session.recv().await;
-        assert!(event.is_none());
-
-        let data_envelope = EventEnvelope::call_requested("req-2", serde_json::json!({}));
-        let result = session.send(data_envelope).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn raw_framing_session_send() {
-        let identity = Identity {
-            id: "send-user".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        let (provider, token_str) = make_provider_with_identity(identity, "send-token");
-
-        let (client, server) = tokio::io::duplex(4096);
-        let server_stream: Box<dyn TransportStream> = Box::new(server);
-        let client_stream: Box<dyn TransportStream> = Box::new(client);
-
-        let mut server_session = RawFramingSession::new(server_stream, provider);
-
-        let auth_envelope = EventEnvelope::new("auth", "auth-1", serde_json::json!(token_str));
-        let auth_frame = encode(&auth_envelope);
-        let mut client_writer = tokio::io::BufWriter::new(client_stream);
-        client_writer.write_all(&auth_frame).await.unwrap();
-        client_writer.flush().await.unwrap();
-
-        let _ = server_session.recv().await;
-
-        let response = EventEnvelope::call_responded("req-1", serde_json::json!({"result": "ok"}));
-        let send_result = server_session.send(response).await;
-        assert!(send_result.is_ok());
-    }
-
-    #[tokio::test]
-    async fn raw_framing_multiple_frames_over_duplex() {
-        let identity = Identity {
-            id: "multi-user".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        let (provider, token_str) = make_provider_with_identity(identity, "multi-token");
-
-        let (client, server) = tokio::io::duplex(8192);
-        let server_stream: Box<dyn TransportStream> = Box::new(server);
-        let client_stream: Box<dyn TransportStream> = Box::new(client);
-
-        let mut session = RawFramingSession::new(server_stream, provider);
-        let mut client_writer = tokio::io::BufWriter::new(client_stream);
-
-        let auth_envelope = EventEnvelope::new("auth", "auth-0", serde_json::json!(token_str));
-        client_writer
-            .write_all(&encode(&auth_envelope))
-            .await
-            .unwrap();
-
-        for i in 1..=5 {
-            let envelope =
-                EventEnvelope::call_requested(format!("req-{i}"), serde_json::json!({"seq": i}));
-            client_writer.write_all(&encode(&envelope)).await.unwrap();
-        }
-        client_writer.flush().await.unwrap();
-
-        let auth_event = session.recv().await;
-        assert!(auth_event.is_some());
-        assert!(auth_event.unwrap().identity.is_some());
-
-        for i in 1..=5 {
-            let event = session.recv().await;
-            assert!(event.is_some());
-            let event = event.unwrap();
-            assert_eq!(event.envelope.id, format!("req-{i}"));
-            assert!(event.identity.is_some());
-        }
-    }
-
-    #[test]
-    fn raw_framing_interface_type_exists() {
-        let _iface = RawFramingInterface;
-    }
-}

crates/alknet-core/src/interface/session.rs

@@ -1,62 +0,0 @@
-use anyhow::Result;
-use async_trait::async_trait;
-
-use crate::auth::Identity;
-use crate::call::EventEnvelope;
-
-#[derive(Debug, Clone)]
-pub struct InterfaceEvent {
-    pub envelope: EventEnvelope,
-    pub identity: Option<Identity>,
-}
-
-impl InterfaceEvent {
-    pub fn new(envelope: EventEnvelope) -> Self {
-        Self {
-            envelope,
-            identity: None,
-        }
-    }
-
-    pub fn with_identity(envelope: EventEnvelope, identity: Identity) -> Self {
-        Self {
-            envelope,
-            identity: Some(identity),
-        }
-    }
-}
-
-#[async_trait]
-pub trait InterfaceSession: Send {
-    async fn recv(&mut self) -> Option<InterfaceEvent>;
-
-    async fn send(&mut self, envelope: EventEnvelope) -> Result<()>;
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::collections::HashMap;
-
-    #[test]
-    fn interface_event_new() {
-        let envelope = EventEnvelope::call_requested("req-1", serde_json::json!({"op": "test"}));
-        let event = InterfaceEvent::new(envelope.clone());
-        assert_eq!(event.envelope, envelope);
-        assert!(event.identity.is_none());
-    }
-
-    #[test]
-    fn interface_event_with_identity() {
-        let envelope = EventEnvelope::call_requested("req-1", serde_json::json!({"op": "test"}));
-        let identity = Identity {
-            id: "SHA256:abc123".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources: HashMap::new(),
-        };
-        let event = InterfaceEvent::with_identity(envelope.clone(), identity.clone());
-        assert_eq!(event.envelope, envelope);
-        assert!(event.identity.is_some());
-        assert_eq!(event.identity.as_ref().unwrap().id, "SHA256:abc123");
-    }
-}

crates/alknet-core/src/interface/ssh.rs

@@ -1,982 +0,0 @@
-use std::net::SocketAddr;
-use std::sync::Arc;
-use std::time::Instant;
-
-use anyhow::Result;
-use arc_swap::ArcSwap;
-use async_trait::async_trait;
-use russh::keys::ssh_key::HashAlg;
-use russh::server::{self, Config};
-use russh::Channel;
-use russh::ChannelId;
-use tokio::sync::mpsc;
-
-use crate::auth::identity::{Identity, IdentityProvider};
-use crate::call::frame::{FrameFramedReader, FrameFramedWriter};
-use crate::call::EventEnvelope;
-use crate::config::DynamicConfig;
-use crate::interface::session::{InterfaceEvent, InterfaceSession};
-use crate::interface::{StreamInterface, StreamInterfaceConfig, TransportStream};
-use crate::server::control_channel::{
-    ControlChannelHandler, ControlChannelRouter, DuplexStream, ALKNET_CONTROL_DESTINATION,
-    ALKNET_PREFIX,
-};
-use crate::server::rate_limit::{AuthAttemptLimiter, ConnectionRateLimiter};
-use crate::transport::TransportKind;
-
-struct SshHandler {
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-    identity_provider: Arc<dyn IdentityProvider>,
-    outbound_proxy: Option<crate::server::handler::ProxyConfig>,
-    remote_addr: Option<SocketAddr>,
-    transport: TransportKind,
-    connection_limiter: Arc<ConnectionRateLimiter>,
-    connection_allowed: bool,
-    auth_limiter: AuthAttemptLimiter,
-    authenticated_identity: Option<Identity>,
-    control_channel_router: ControlChannelRouter,
-    bridge_event_tx: Option<mpsc::Sender<InterfaceEvent>>,
-    bridge_envelope_rx: Option<mpsc::Receiver<EventEnvelope>>,
-    connected_at: Instant,
-}
-
-impl SshHandler {
-    fn new(
-        dynamic: Arc<ArcSwap<DynamicConfig>>,
-        identity_provider: Arc<dyn IdentityProvider>,
-        outbound_proxy: Option<crate::server::handler::ProxyConfig>,
-        remote_addr: Option<SocketAddr>,
-        transport: TransportKind,
-        connection_limiter: Arc<ConnectionRateLimiter>,
-        max_auth_attempts: usize,
-    ) -> Self {
-        let allowed = if let Some(addr) = remote_addr {
-            let ip = addr.ip();
-            if connection_limiter.check(ip) {
-                connection_limiter.on_connect(ip);
-                tracing::info!(
-                    remote_addr = %addr,
-                    transport = %transport,
-                    "connection opened"
-                );
-                true
-            } else {
-                tracing::info!(
-                    remote_addr = %addr,
-                    transport = %transport,
-                    "connection rejected"
-                );
-                false
-            }
-        } else {
-            true
-        };
-
-        Self {
-            dynamic,
-            identity_provider,
-            outbound_proxy,
-            remote_addr,
-            transport,
-            connection_limiter,
-            connection_allowed: allowed,
-            auth_limiter: AuthAttemptLimiter::new(max_auth_attempts),
-            authenticated_identity: None,
-            control_channel_router: ControlChannelRouter::without_handler(),
-            bridge_event_tx: None,
-            bridge_envelope_rx: None,
-            connected_at: Instant::now(),
-        }
-    }
-
-    #[allow(dead_code)]
-    fn with_control_channel_router(mut self, router: ControlChannelRouter) -> Self {
-        self.control_channel_router = router;
-        self
-    }
-
-    fn with_bridge_channels(
-        mut self,
-        event_tx: mpsc::Sender<InterfaceEvent>,
-        envelope_rx: mpsc::Receiver<EventEnvelope>,
-    ) -> Self {
-        self.bridge_event_tx = Some(event_tx);
-        self.bridge_envelope_rx = Some(envelope_rx);
-        self
-    }
-
-    fn has_control_channel_bridge(&self) -> bool {
-        self.bridge_event_tx.is_some() && self.bridge_envelope_rx.is_some()
-    }
-}
-
-impl Drop for SshHandler {
-    fn drop(&mut self) {
-        if let Some(addr) = self.remote_addr {
-            if self.connection_allowed {
-                self.connection_limiter.on_disconnect(addr.ip());
-                let duration = self.connected_at.elapsed();
-                tracing::info!(
-                    remote_addr = %addr,
-                    duration_secs = duration.as_secs_f64(),
-                    "connection closed"
-                );
-            }
-        }
-    }
-}
-
-#[async_trait]
-impl server::Handler for SshHandler {
-    type Error = russh::Error;
-
-    async fn auth_publickey(
-        &mut self,
-        user: &str,
-        public_key: &russh::keys::ssh_key::PublicKey,
-    ) -> Result<server::Auth, Self::Error> {
-        if !self.auth_limiter.check() {
-            let remote_addr_display = self
-                .remote_addr
-                .map_or("unknown".to_string(), |a| a.to_string());
-            let fingerprint = format!("{}", public_key.fingerprint(HashAlg::Sha256));
-            tracing::info!(
-                remote_addr = %remote_addr_display,
-                user = user,
-                key_fingerprint = %fingerprint,
-                result = "reject",
-                "auth attempt"
-            );
-            return Ok(server::Auth::Reject {
-                proceed_with_methods: None,
-            });
-        }
-
-        let fingerprint = format!("{}", public_key.fingerprint(HashAlg::Sha256));
-        let remote_addr_display = self
-            .remote_addr
-            .map_or("unknown".to_string(), |a| a.to_string());
-
-        let identity = self
-            .identity_provider
-            .resolve_from_fingerprint(&fingerprint);
-
-        match identity {
-            Some(id) => {
-                self.authenticated_identity = Some(id);
-                tracing::info!(
-                    remote_addr = %remote_addr_display,
-                    user = user,
-                    key_fingerprint = %fingerprint,
-                    result = "accept",
-                    "auth attempt"
-                );
-                Ok(server::Auth::Accept)
-            }
-            None => {
-                self.auth_limiter.on_failure();
-                tracing::info!(
-                    remote_addr = %remote_addr_display,
-                    user = user,
-                    key_fingerprint = %fingerprint,
-                    result = "reject",
-                    "auth attempt"
-                );
-                Ok(server::Auth::Reject {
-                    proceed_with_methods: None,
-                })
-            }
-        }
-    }
-
-    async fn channel_open_direct_tcpip(
-        &mut self,
-        channel: Channel<server::Msg>,
-        host_to_connect: &str,
-        port_to_connect: u32,
-        originator_address: &str,
-        originator_port: u32,
-        _session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        if host_to_connect.starts_with(ALKNET_PREFIX) {
-            if host_to_connect == ALKNET_CONTROL_DESTINATION && self.has_control_channel_bridge() {
-                let event_tx = self.bridge_event_tx.take().unwrap();
-                let envelope_rx = self.bridge_envelope_rx.take().unwrap();
-                let identity = self.authenticated_identity.clone();
-                tokio::spawn(async move {
-                    let stream = channel.into_stream();
-                    let (read_half, write_half) = tokio::io::split(stream);
-                    run_control_channel_bridge(
-                        read_half,
-                        write_half,
-                        identity,
-                        event_tx,
-                        envelope_rx,
-                    )
-                    .await;
-                });
-                let _ = (originator_address, originator_port);
-                return Ok(true);
-            }
-            if self.control_channel_router.has_handler() {
-                if let Some(handler) = self.control_channel_router.take_handler() {
-                    let stream: Box<dyn DuplexStream> = Box::new(channel.into_stream());
-                    tokio::spawn(async move {
-                        handler.handle_channel(stream).await;
-                    });
-                }
-                let _ = (originator_address, originator_port);
-                return Ok(true);
-            }
-            return Ok(false);
-        }
-
-        let identity = self
-            .authenticated_identity
-            .clone()
-            .unwrap_or_else(|| Identity {
-                id: String::new(),
-                scopes: vec![],
-                resources: std::collections::HashMap::new(),
-            });
-
-        let policy = self.dynamic.load();
-        let allowed = policy.forwarding.check(
-            host_to_connect,
-            port_to_connect as u16,
-            &identity,
-            self.transport.clone(),
-        );
-
-        if !allowed {
-            tracing::info!(
-                remote_addr = ?self.remote_addr,
-                target = %format!("{host_to_connect}:{port_to_connect}"),
-                identity = %identity.id,
-                transport = %self.transport,
-                "forwarding denied by policy"
-            );
-            return Ok(false);
-        }
-
-        let target_host = host_to_connect.to_string();
-        let target_port = port_to_connect;
-        let proxy_config =
-            self.outbound_proxy
-                .clone()
-                .unwrap_or(crate::server::handler::ProxyConfig {
-                    mode: crate::server::handler::ProxyMode::Direct,
-                });
-
-        tokio::spawn(async move {
-            let target = match format!("{target_host}:{target_port}")
-                .parse::<std::net::SocketAddr>()
-            {
-                Ok(addr) => addr,
-                Err(_) => {
-                    match tokio::net::lookup_host((&target_host[..], target_port as u16)).await {
-                        Ok(mut addrs) => match addrs.next() {
-                            Some(addr) => addr,
-                            None => return,
-                        },
-                        Err(_) => return,
-                    }
-                }
-            };
-            crate::server::channel_proxy::proxy_channel(
-                channel.into_stream(),
-                target,
-                &proxy_config,
-            )
-            .await;
-        });
-
-        let _ = (originator_address, originator_port);
-        Ok(true)
-    }
-
-    async fn channel_open_session(
-        &mut self,
-        _channel: Channel<server::Msg>,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            "rejected session channel (shell/exec not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn channel_open_x11(
-        &mut self,
-        _channel: Channel<server::Msg>,
-        _originator_address: &str,
-        _originator_port: u32,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            "rejected x11 channel"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn channel_open_forwarded_tcpip(
-        &mut self,
-        _channel: Channel<server::Msg>,
-        host_to_connect: &str,
-        port_to_connect: u32,
-        _originator_address: &str,
-        _originator_port: u32,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            target = %format!("{host_to_connect}:{port_to_connect}"),
-            "rejected forwarded-tcpip channel (remote port forwarding not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn exec_request(
-        &mut self,
-        channel: ChannelId,
-        data: &[u8],
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            data_len = data.len(),
-            "rejected exec request on channel (shell/exec not supported)"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn shell_request(
-        &mut self,
-        channel: ChannelId,
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected shell request on channel"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn subsystem_request(
-        &mut self,
-        channel: ChannelId,
-        name: &str,
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            subsystem = name,
-            "rejected subsystem request on channel"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn pty_request(
-        &mut self,
-        channel: ChannelId,
-        term: &str,
-        col_width: u32,
-        row_height: u32,
-        pix_width: u32,
-        pix_height: u32,
-        modes: &[(russh::Pty, u32)],
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            term = term,
-            "rejected pty request on channel"
-        );
-        let _ = (col_width, row_height, pix_width, pix_height, modes);
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn env_request(
-        &mut self,
-        channel: ChannelId,
-        variable_name: &str,
-        variable_value: &str,
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            variable = variable_name,
-            "rejected env request on channel"
-        );
-        let _ = variable_value;
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn x11_request(
-        &mut self,
-        channel: ChannelId,
-        single_connection: bool,
-        x11_auth_protocol: &str,
-        x11_auth_cookie: &str,
-        x11_screen_number: u32,
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected x11 request on channel"
-        );
-        let _ = (
-            single_connection,
-            x11_auth_protocol,
-            x11_auth_cookie,
-            x11_screen_number,
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn agent_request(
-        &mut self,
-        channel: ChannelId,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected agent forwarding request on channel"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn tcpip_forward(
-        &mut self,
-        address: &str,
-        port: &mut u32,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            address = address,
-            port = *port,
-            "rejected tcpip-forward request (remote port forwarding not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn cancel_tcpip_forward(
-        &mut self,
-        address: &str,
-        port: u32,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        let _ = (address, port, session);
-        Ok(false)
-    }
-
-    async fn streamlocal_forward(
-        &mut self,
-        socket_path: &str,
-        session: &mut server::Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            socket_path = socket_path,
-            "rejected streamlocal-forward request"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn signal(
-        &mut self,
-        channel: ChannelId,
-        signal: russh::Sig,
-        session: &mut server::Session,
-    ) -> Result<(), Self::Error> {
-        tracing::debug!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            signal = ?signal,
-            "received signal on channel (ignored)"
-        );
-        let _ = session;
-        Ok(())
-    }
-}
-
-pub struct SshInterface {
-    config: Arc<Config>,
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-    connection_limiter: Arc<ConnectionRateLimiter>,
-    outbound_proxy: Option<crate::server::handler::ProxyConfig>,
-    max_auth_attempts: usize,
-}
-
-impl SshInterface {
-    pub fn new(config: Arc<Config>, dynamic: Arc<ArcSwap<DynamicConfig>>) -> Self {
-        Self {
-            config,
-            dynamic,
-            connection_limiter: Arc::new(ConnectionRateLimiter::new(0)),
-            outbound_proxy: None,
-            max_auth_attempts: 10,
-        }
-    }
-
-    pub fn with_connection_limiter(mut self, limiter: Arc<ConnectionRateLimiter>) -> Self {
-        self.connection_limiter = limiter;
-        self
-    }
-
-    pub fn with_outbound_proxy(
-        mut self,
-        proxy: Option<crate::server::handler::ProxyConfig>,
-    ) -> Self {
-        self.outbound_proxy = proxy;
-        self
-    }
-
-    pub fn with_max_auth_attempts(mut self, max: usize) -> Self {
-        self.max_auth_attempts = max;
-        self
-    }
-
-    pub fn config(&self) -> &Arc<Config> {
-        &self.config
-    }
-
-    pub fn dynamic(&self) -> &Arc<ArcSwap<DynamicConfig>> {
-        &self.dynamic
-    }
-
-    async fn accept_inner(
-        &self,
-        stream: Box<dyn TransportStream>,
-        ssh_config: &crate::interface::SshInterfaceConfig,
-        remote_addr: Option<SocketAddr>,
-        transport: TransportKind,
-    ) -> Result<SshSession> {
-        let identity_provider = Arc::clone(&ssh_config.auth);
-        let _forwarding = Arc::clone(&ssh_config.forwarding);
-
-        let (event_tx, event_rx) = mpsc::channel::<InterfaceEvent>(256);
-        let (envelope_tx, envelope_rx) = mpsc::channel::<EventEnvelope>(256);
-
-        let handler = SshHandler::new(
-            Arc::clone(&self.dynamic),
-            identity_provider,
-            self.outbound_proxy.clone(),
-            remote_addr,
-            transport,
-            Arc::clone(&self.connection_limiter),
-            self.max_auth_attempts,
-        )
-        .with_bridge_channels(event_tx, envelope_rx);
-
-        let running = server::run_stream(Arc::clone(&self.config), stream, handler).await?;
-        let handle = running.handle();
-        let join = tokio::spawn(async {
-            let _ = running.await;
-        });
-
-        Ok(SshSession {
-            handle,
-            _join: join,
-            event_rx,
-            envelope_tx,
-        })
-    }
-}
-
-#[async_trait]
-impl StreamInterface for SshInterface {
-    type Session = SshSession;
-
-    async fn accept(
-        &self,
-        stream: Box<dyn TransportStream>,
-        config: &StreamInterfaceConfig,
-    ) -> Result<Self::Session> {
-        let ssh_config = match config {
-            StreamInterfaceConfig::Ssh(c) => c,
-            StreamInterfaceConfig::RawFraming(_) => {
-                return Err(anyhow::anyhow!("SshInterface received RawFramingConfig"));
-            }
-        };
-
-        self.accept_inner(stream, ssh_config, None, TransportKind::Tcp)
-            .await
-    }
-}
-
-pub struct SshSession {
-    handle: server::Handle,
-    _join: tokio::task::JoinHandle<()>,
-    event_rx: mpsc::Receiver<InterfaceEvent>,
-    envelope_tx: mpsc::Sender<EventEnvelope>,
-}
-
-impl SshSession {
-    pub fn handle(&self) -> &server::Handle {
-        &self.handle
-    }
-}
-
-#[async_trait]
-impl InterfaceSession for SshSession {
-    async fn recv(&mut self) -> Option<InterfaceEvent> {
-        self.event_rx.recv().await
-    }
-
-    async fn send(&mut self, envelope: EventEnvelope) -> Result<()> {
-        self.envelope_tx
-            .send(envelope)
-            .await
-            .map_err(|_| anyhow::anyhow!("control channel bridge closed"))
-    }
-}
-
-async fn run_control_channel_bridge<R, W>(
-    read_half: R,
-    write_half: W,
-    identity: Option<Identity>,
-    event_tx: mpsc::Sender<InterfaceEvent>,
-    mut envelope_rx: mpsc::Receiver<EventEnvelope>,
-) where
-    R: tokio::io::AsyncRead + Unpin,
-    W: tokio::io::AsyncWrite + Unpin,
-{
-    let mut reader = FrameFramedReader::new(read_half);
-    let mut writer = FrameFramedWriter::new(write_half);
-
-    loop {
-        tokio::select! {
-            frame = reader.read_frame() => {
-                match frame {
-                    Ok(Some(envelope)) => {
-                        let event = match &identity {
-                            Some(id) => InterfaceEvent::with_identity(envelope, id.clone()),
-                            None => InterfaceEvent::new(envelope),
-                        };
-                        if event_tx.send(event).await.is_err() {
-                            return;
-                        }
-                    }
-                    Ok(None) => return,
-                    Err(_) => return,
-                }
-            }
-            envelope = envelope_rx.recv() => {
-                match envelope {
-                    Some(envelope) => {
-                        if writer.write_frame(&envelope).await.is_err() {
-                            return;
-                        }
-                    }
-                    None => return,
-                }
-            }
-        }
-    }
-}
-
-pub struct ControlChannelBridge {
-    identity: Option<Identity>,
-}
-
-impl ControlChannelBridge {
-    pub fn new(identity: Option<Identity>) -> Self {
-        Self { identity }
-    }
-}
-
-#[async_trait]
-impl ControlChannelHandler for ControlChannelBridge {
-    async fn handle_channel(&self, stream: Box<dyn DuplexStream>) {
-        let (event_tx, _event_rx) = mpsc::channel::<InterfaceEvent>(256);
-        let (_envelope_tx, envelope_rx) = mpsc::channel::<EventEnvelope>(256);
-
-        let identity = self.identity.clone();
-        let (read_half, write_half) = tokio::io::split(stream);
-        tokio::spawn(run_control_channel_bridge(
-            read_half,
-            write_half,
-            identity,
-            event_tx,
-            envelope_rx,
-        ));
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::call::frame::{FrameFramedReader, FrameFramedWriter};
-    use tokio::io::duplex;
-
-    #[test]
-    fn ssh_interface_constructs_with_config() {
-        let config = Arc::new(Config {
-            keys: vec![russh::keys::PrivateKey::random(
-                &mut rand_core::OsRng,
-                russh::keys::Algorithm::Ed25519,
-            )
-            .unwrap()],
-            ..Default::default()
-        });
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-
-        let iface = SshInterface::new(config, dynamic);
-        assert!(iface.config().keys.len() >= 1);
-    }
-
-    #[test]
-    fn ssh_interface_builder_pattern() {
-        let config = Arc::new(Config {
-            keys: vec![russh::keys::PrivateKey::random(
-                &mut rand_core::OsRng,
-                russh::keys::Algorithm::Ed25519,
-            )
-            .unwrap()],
-            ..Default::default()
-        });
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-        let limiter = Arc::new(ConnectionRateLimiter::new(5));
-
-        let iface = SshInterface::new(config, dynamic)
-            .with_connection_limiter(limiter)
-            .with_max_auth_attempts(3);
-
-        assert!(iface.config().keys.len() >= 1);
-    }
-
-    #[test]
-    fn ssh_handler_auth_delegates_to_identity_provider() {
-        use std::collections::HashMap;
-
-        struct MockProvider {
-            identities: HashMap<String, Identity>,
-        }
-
-        impl IdentityProvider for MockProvider {
-            fn resolve_from_fingerprint(&self, fp: &str) -> Option<Identity> {
-                self.identities.get(fp).cloned()
-            }
-            fn resolve_from_token(&self, _t: &crate::auth::AuthToken) -> Option<Identity> {
-                None
-            }
-        }
-
-        let mut ids = HashMap::new();
-        ids.insert(
-            "SHA256:testkey".to_string(),
-            Identity {
-                id: "SHA256:testkey".to_string(),
-                scopes: vec!["admin".to_string()],
-                resources: HashMap::new(),
-            },
-        );
-
-        let provider: Arc<dyn IdentityProvider> = Arc::new(MockProvider { identities: ids });
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-        let limiter = Arc::new(ConnectionRateLimiter::new(0));
-
-        let handler = SshHandler::new(
-            dynamic,
-            provider,
-            None,
-            None,
-            TransportKind::Tcp,
-            limiter,
-            10,
-        );
-
-        assert!(handler.authenticated_identity.is_none());
-    }
-
-    #[test]
-    fn ssh_handler_connection_rate_limiting() {
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-        let provider: Arc<dyn IdentityProvider> = Arc::new(
-            crate::auth::identity::ConfigIdentityProvider::new(Arc::clone(&dynamic)),
-        );
-        let limiter = Arc::new(ConnectionRateLimiter::new(1));
-        let addr: SocketAddr = "10.0.0.1:22".parse().unwrap();
-
-        let h1 = SshHandler::new(
-            Arc::clone(&dynamic),
-            Arc::clone(&provider),
-            None,
-            Some(addr),
-            TransportKind::Tcp,
-            Arc::clone(&limiter),
-            10,
-        );
-        assert!(h1.connection_allowed);
-
-        let h2 = SshHandler::new(
-            dynamic,
-            provider,
-            None,
-            Some(addr),
-            TransportKind::Tcp,
-            limiter,
-            10,
-        );
-        assert!(!h2.connection_allowed);
-    }
-
-    #[tokio::test]
-    async fn ssh_interface_rejects_raw_framing_config() {
-        let config = Arc::new(Config {
-            keys: vec![russh::keys::PrivateKey::random(
-                &mut rand_core::OsRng,
-                russh::keys::Algorithm::Ed25519,
-            )
-            .unwrap()],
-            ..Default::default()
-        });
-        let dynamic = Arc::new(ArcSwap::new(Arc::new(DynamicConfig::default())));
-        let iface = SshInterface::new(config, dynamic);
-        let (_client, server) = tokio::io::duplex(1024);
-        let stream: Box<dyn TransportStream> = Box::new(server);
-
-        let raw_config = StreamInterfaceConfig::RawFraming(crate::interface::RawFramingConfig {
-            auth: Arc::new(crate::auth::ConfigIdentityProvider::new(Arc::new(
-                ArcSwap::new(Arc::new(DynamicConfig::default())),
-            ))),
-        });
-        let result = iface.accept(stream, &raw_config).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn ssh_session_round_trip_event_envelope() {
-        let (client, server) = duplex(4096);
-
-        let (event_tx, mut event_rx) = mpsc::channel::<InterfaceEvent>(256);
-        let (envelope_tx, envelope_rx) = mpsc::channel::<EventEnvelope>(256);
-
-        let identity = Identity {
-            id: "SHA256:test".to_string(),
-            scopes: vec![],
-            resources: std::collections::HashMap::new(),
-        };
-        let identity_clone = identity.clone();
-
-        let (server_read, server_write) = tokio::io::split(server);
-        tokio::spawn(run_control_channel_bridge(
-            server_read,
-            server_write,
-            Some(identity_clone),
-            event_tx,
-            envelope_rx,
-        ));
-
-        let (client_read, client_write) = tokio::io::split(client);
-        let mut client_reader = FrameFramedReader::new(client_read);
-        let mut client_writer = FrameFramedWriter::new(client_write);
-
-        let envelope = EventEnvelope::call_requested("req-1", serde_json::json!({"op": "test"}));
-        client_writer.write_frame(&envelope).await.unwrap();
-
-        let received_event =
-            tokio::time::timeout(std::time::Duration::from_secs(2), event_rx.recv())
-                .await
-                .unwrap()
-                .unwrap();
-        assert_eq!(received_event.envelope, envelope);
-        assert_eq!(received_event.identity.as_ref().unwrap().id, "SHA256:test");
-
-        let response = EventEnvelope::call_responded("req-1", serde_json::json!({"result": 42}));
-        envelope_tx.send(response.clone()).await.unwrap();
-
-        let read_back = tokio::time::timeout(
-            std::time::Duration::from_secs(2),
-            client_reader.read_frame(),
-        )
-        .await
-        .unwrap()
-        .unwrap()
-        .unwrap();
-        assert_eq!(read_back, response);
-    }
-
-    #[tokio::test]
-    async fn ssh_session_recv_without_identity() {
-        let (client, server) = duplex(4096);
-
-        let (event_tx, mut event_rx) = mpsc::channel::<InterfaceEvent>(256);
-        let (_envelope_tx, envelope_rx) = mpsc::channel::<EventEnvelope>(256);
-
-        let (server_read, server_write) = tokio::io::split(server);
-        tokio::spawn(run_control_channel_bridge(
-            server_read,
-            server_write,
-            None,
-            event_tx,
-            envelope_rx,
-        ));
-
-        let (client_read, client_write) = tokio::io::split(client);
-        let mut client_writer = FrameFramedWriter::new(client_write);
-        let _client_reader = FrameFramedReader::new(client_read);
-
-        let envelope = EventEnvelope::call_requested("req-2", serde_json::json!({"op": "no-id"}));
-        client_writer.write_frame(&envelope).await.unwrap();
-
-        let received_event =
-            tokio::time::timeout(std::time::Duration::from_secs(2), event_rx.recv())
-                .await
-                .unwrap()
-                .unwrap();
-        assert_eq!(received_event.envelope, envelope);
-        assert!(received_event.identity.is_none());
-    }
-
-    #[tokio::test]
-    async fn control_channel_router_with_handler_routes_data() {
-        let called = std::sync::Arc::new(std::sync::atomic::AtomicBool::new(false));
-        let called_clone = called.clone();
-
-        struct TrackingHandler {
-            called: std::sync::Arc<std::sync::atomic::AtomicBool>,
-        }
-
-        #[async_trait]
-        impl ControlChannelHandler for TrackingHandler {
-            async fn handle_channel(&self, _stream: Box<dyn DuplexStream>) {
-                self.called.store(true, std::sync::atomic::Ordering::SeqCst);
-            }
-        }
-
-        let router = ControlChannelRouter::with_handler(Box::new(TrackingHandler {
-            called: called_clone,
-        }));
-        assert!(router.has_handler());
-
-        let (_client, server) = duplex(64);
-        let stream: Box<dyn DuplexStream> = Box::new(server);
-        let result = router.route(stream).await;
-        assert!(result.is_ok());
-        assert!(called.load(std::sync::atomic::Ordering::SeqCst));
-    }
-}

crates/alknet-core/src/lib.rs

@@ -1,110 +1,21 @@
-//! # alknet-core
+//! alknet-core: Core library for ALPN-based protocol dispatch.
 //!
-//! Core library for [Alknet](https://git.alk.dev/alkdev/alknet), a self-hostable SSH-based
-//! tunnel tool. This crate provides the transport abstraction, SOCKS5 server, port forwarding,
-//! authentication, and server handler — everything needed to build an alknet client or server
-//! on top of pluggable transports.
-//!
-//! > **Alpha software.** This crate depends on solid libraries (russh, tokio, rustls, iroh)
-//! > for core functionality, but the integration layer has not been battle-tested. Use with
-//! > caution and report issues.
-//!
-//! # Key concepts
-//!
-//! - **Transport trait** — produces a duplex byte stream (`AsyncRead + AsyncWrite + Unpin + Send`)
-//!   that SSH consumes. Implementations: TCP, TLS, iroh (QUIC P2P).
-//! - **SOCKS5 server** — the primary client interface, listening on a local port and routing
-//!   traffic through SSH channels.
-//! - **Port forwarding** — `-L` local and `-R` remote port forwards over SSH channels.
-//! - **Authentication** — Ed25519 public key and OpenSSH certificate authority. No passwords.
-//! - **Server handler** — accepts SSH connections via a `TransportAcceptor` and proxies
-//!   `direct-tcpip` channel requests to targets (directly or via outbound proxy).
-//!
-//! # Feature flags
-//!
-//! | Feature | Default | Description |
-//! |---------|---------|-------------|
-//! | `tls` | yes | TLS transport via `tokio-rustls` |
-//! | `iroh` | yes | iroh QUIC P2P transport |
-//! | `acme` | no | ACME/Let's Encrypt auto-cert provisioning (implies `tls`) |
-//! | `irpc` | no | irpc service layer (AuthProtocol, AuthServiceImpl) |
-//! | `testutil` | no | Test utilities (for internal use) |
-//!
-//! # Quick example
-//!
-//! ```no_run
-//! use std::sync::Arc;
-//! use alknet_core::transport::TcpTransport;
-//! use alknet_core::client::{ClientSession, ConnectOptions, TransportMode};
-//! use alknet_core::auth::keys::KeySource;
-//! use alknet_core::Transport;
-//!
-//! #[tokio::main]
-//! async fn main() -> anyhow::Result<()> {
-//!     let opts = ConnectOptions::new(KeySource::File("/path/to/key".into()))
-//!         .server("example.com:22")
-//!         .transport_mode(TransportMode::Tcp);
-//!     let transport = Arc::new(TcpTransport::new("example.com:22".parse()?));
-//!     let session = ClientSession::new(opts, transport).await?;
-//!     session.run().await?;
-//!     Ok(())
-//! }
-//! ```
+//! Every handler crate depends on this crate. It provides the
+//! [`ProtocolHandler`][crate::types::ProtocolHandler] trait, the
+//! [`Connection`][crate::types::Connection] wrapper, auth primitives,
+//! hot-reloadable configuration, and transport-level credential types
+//! ([`ConnectionCredentials`][crate::credentials::ConnectionCredentials],
+//! [`RemoteIdentity`][crate::credentials::RemoteIdentity]).
 
 pub mod auth;
-pub mod call;
-pub mod client;
 pub mod config;
 pub mod credentials;
-pub mod error;
-pub mod interface;
-pub mod server;
-pub mod socks5;
-pub mod transport;
+pub mod fingerprint;
+pub mod ownership;
+pub mod store;
+pub mod types;
 
-#[cfg(feature = "http")]
-pub mod http;
-
-#[cfg(feature = "http")]
-pub use http::IdentityExt;
-
-#[cfg(feature = "testutil")]
-pub mod testutil;
-
-#[cfg(feature = "irpc")]
-pub use auth::{AuthProtocol, AuthResult, AuthServiceImpl};
-pub use auth::{AuthToken, ConfigIdentityProvider, Identity, IdentityProvider};
-pub use call::{
-    decode as decode_frame, decode_with_remainder as decode_frame_with_remainder,
-    encode as encode_frame,
-};
-pub use call::{
-    register_default_operations, services_list_spec, services_schema_spec, AccessControl,
-    CallError, EventEnvelope, FrameDecodeError, Handler, OperationContext, OperationEnv,
-    OperationRegistry, OperationRegistryBuilder, OperationSpec, OperationType, PendingRequestMap,
-    ResponseEnvelope,
-};
-pub use call::{CALL_ABORTED, CALL_COMPLETED, CALL_ERROR, CALL_REQUESTED, CALL_RESPONDED};
-pub use client::channel_manager::{ChannelManager, ForwardRequest};
-pub use client::connect::{ClientSession, ConnectError, ConnectOptions, TransportMode};
-pub use config::{
-    AuthPolicy, ConfigReloadHandle, ConfigServiceImpl, DynamicConfig, ForwardingAction,
-    ForwardingPolicy, ForwardingRule, RateLimitConfig, StaticConfig, TargetPattern,
-};
-pub use credentials::{
-    ConfigCredentialProvider, CredentialProvider, CredentialSet, SecretStoreCredentialProvider,
-};
-pub use error::{AuthError, ChannelError, ConfigError, ForwardError, TransportError};
-pub use interface::{
-    is_valid_pair, DnsInterface, DnsInterfaceConfig, HttpInterface, HttpInterfaceConfig,
-    InterfaceConfig, InterfaceEvent, InterfaceRequest, InterfaceResponse, InterfaceSession,
-    MessageInterface, MessageInterfaceConfig, MessageInterfaceKind, RawFramingConfig,
-    RawFramingInterface, RawFramingSession, SshInterface, SshInterfaceConfig, SshSession,
-    StreamInterface, StreamInterfaceConfig, StreamInterfaceKind, TransportKindBase,
-    TransportStream, VALID_TRANSPORT_INTERFACE_PAIRS,
-};
-pub use server::serve::{
-    DnsListenerConfig, HttpListenerConfig, ListenerConfig, ServeError, ServeOptions,
-    ServeTransportMode, Server, StreamListenerConfig,
-};
-pub use transport::{Transport, TransportAcceptor, TransportInfo, TransportKind};
+pub use auth::{IdentityProvider, IdentityStore};
+pub use credentials::{ConnectionCredentials, RemoteIdentity};
+pub use ownership::{InMemoryOwnershipStore, OwnershipError, OwnershipProvider, OwnershipStore};
+pub use store::{CredentialStore, EncryptedData, InMemoryCredentialStore, StoreError};

crates/alknet-core/src/ownership.rs

@@ -0,0 +1,280 @@
+//! Ownership store: `OwnershipProvider` (sync read trait), `OwnershipStore`
+//! (async write trait), `InMemoryOwnershipStore` default adapter, and
+//! `OwnershipError`.
+//!
+//! See `docs/architecture/crates/core/auth.md` and ADR-050 for the full
+//! specification. Runtime-spawned resources (containers, TTYs, workspace
+//! processes) have derived ownership — whoever spawned the resource owns it.
+//! The static `Identity.resources` model can't represent this (the resource
+//! didn't exist when the identity was resolved), so `AccessControl::check`
+//! (in alknet-call) consults `OwnershipProvider` at check time. This is the
+//! fourth instance of the repo/adapter pattern (ADR-033).
+
+use std::collections::HashMap;
+use std::sync::RwLock;
+
+use async_trait::async_trait;
+
+use crate::auth::Identity;
+
+#[non_exhaustive]
+#[derive(Debug, thiserror::Error)]
+pub enum OwnershipError {
+    #[error("backend error: {message}")]
+    Backend { message: String },
+    #[error("not found: {entity}")]
+    NotFound { entity: String },
+}
+
+/// Read side: consulted by `AccessControl::check` on the dispatch hot path.
+/// Sync — called in the dispatch loop, no `.await`.
+pub trait OwnershipProvider: Send + Sync + 'static {
+    /// Does `identity` own `resource_type/resource_id` with `action`?
+    /// The `action` parameter is accepted but not gated on — the base model
+    /// is "owner can do anything they own." Per-action grants are a future
+    /// extension; this preserves the door without building the mechanism.
+    fn owns(
+        &self,
+        identity: &Identity,
+        resource_type: &str,
+        resource_id: &str,
+        action: &str,
+    ) -> bool;
+
+    /// What resources of `resource_type` does `identity` own? Returns the
+    /// set of resource IDs the caller owns, for the handler to filter
+    /// against (the result-filter path, ADR-050 §4a).
+    fn owned_resources(&self, identity: &Identity, resource_type: &str) -> Vec<String>;
+
+    /// Does `identity` own *any* resource of `resource_type`? The scope-gate
+    /// path (ADR-050 §4a).
+    fn owns_any(&self, identity: &Identity, resource_type: &str) -> bool;
+}
+
+/// Write side: called by the handler that manages the resource lifecycle.
+/// Async — not on the dispatch hot path. The handler calls `record` on
+/// spawn and `revoke` on teardown (ADR-050 §4b — handler-driven, not a
+/// reaper). The trait takes `&self` so it can be shared as
+/// `Arc<dyn OwnershipStore>` (interior mutability via `RwLock`).
+#[async_trait]
+pub trait OwnershipStore: Send + Sync + 'static {
+    /// Record that `identity` spawned `resource_type/resource_id`.
+    async fn record(
+        &self,
+        identity: &Identity,
+        resource_type: &str,
+        resource_id: &str,
+    ) -> Result<(), OwnershipError>;
+
+    /// Revoke ownership of `resource_type/resource_id`. Called by the
+    /// handler on resource teardown (ADR-050 §4b).
+    async fn revoke(&self, resource_type: &str, resource_id: &str) -> Result<(), OwnershipError>;
+}
+
+pub struct InMemoryOwnershipStore {
+    inner: RwLock<HashMap<(String, String), Identity>>,
+}
+
+impl InMemoryOwnershipStore {
+    pub fn new() -> Self {
+        Self {
+            inner: RwLock::new(HashMap::new()),
+        }
+    }
+}
+
+impl Default for InMemoryOwnershipStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl OwnershipProvider for InMemoryOwnershipStore {
+    fn owns(
+        &self,
+        identity: &Identity,
+        resource_type: &str,
+        resource_id: &str,
+        _action: &str,
+    ) -> bool {
+        let inner = self.inner.read().unwrap_or_else(|e| e.into_inner());
+        inner
+            .get(&(resource_type.to_string(), resource_id.to_string()))
+            .map(|owner| owner.id == identity.id)
+            .unwrap_or(false)
+    }
+
+    fn owned_resources(&self, identity: &Identity, resource_type: &str) -> Vec<String> {
+        let inner = self.inner.read().unwrap_or_else(|e| e.into_inner());
+        inner
+            .iter()
+            .filter(|((rt, _), owner)| rt == resource_type && owner.id == identity.id)
+            .map(|((_, rid), _)| rid.clone())
+            .collect()
+    }
+
+    fn owns_any(&self, identity: &Identity, resource_type: &str) -> bool {
+        let inner = self.inner.read().unwrap_or_else(|e| e.into_inner());
+        inner
+            .iter()
+            .any(|((rt, _), owner)| rt == resource_type && owner.id == identity.id)
+    }
+}
+
+#[async_trait]
+impl OwnershipStore for InMemoryOwnershipStore {
+    async fn record(
+        &self,
+        identity: &Identity,
+        resource_type: &str,
+        resource_id: &str,
+    ) -> Result<(), OwnershipError> {
+        let mut inner = self.inner.write().unwrap_or_else(|e| e.into_inner());
+        inner.insert(
+            (resource_type.to_string(), resource_id.to_string()),
+            identity.clone(),
+        );
+        Ok(())
+    }
+
+    /// Revoking a non-existent resource is a no-op: returns `Ok(())`. This
+    /// mirrors `InMemoryCredentialStore::delete`, which treats a missing
+    /// entry as success. Teardown paths are idempotent — a handler may call
+    /// `revoke` on a resource that was already removed (e.g. crashed and
+    /// re-entered cleanup), and should not error in that case.
+    async fn revoke(&self, resource_type: &str, resource_id: &str) -> Result<(), OwnershipError> {
+        let mut inner = self.inner.write().unwrap_or_else(|e| e.into_inner());
+        inner.remove(&(resource_type.to_string(), resource_id.to_string()));
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn make_identity(id: &str) -> Identity {
+        Identity {
+            id: id.to_string(),
+            scopes: vec![],
+            resources: HashMap::new(),
+        }
+    }
+
+    #[tokio::test]
+    async fn record_owns_revoke_round_trip() {
+        let store = InMemoryOwnershipStore::new();
+        let owner = make_identity("worker-a");
+
+        assert!(!store.owns(&owner, "container", "c1", "exec"));
+        assert!(!store.owns_any(&owner, "container"));
+        assert!(store.owned_resources(&owner, "container").is_empty());
+
+        store.record(&owner, "container", "c1").await.unwrap();
+        assert!(store.owns(&owner, "container", "c1", "exec"));
+        assert!(store.owns(&owner, "container", "c1", "logs"));
+        assert!(store.owns_any(&owner, "container"));
+        assert_eq!(store.owned_resources(&owner, "container"), vec!["c1"]);
+
+        store.revoke("container", "c1").await.unwrap();
+        assert!(!store.owns(&owner, "container", "c1", "exec"));
+        assert!(!store.owns_any(&owner, "container"));
+        assert!(store.owned_resources(&owner, "container").is_empty());
+    }
+
+    #[tokio::test]
+    async fn owned_resources_returns_all_for_owner_with_multiple() {
+        let store = InMemoryOwnershipStore::new();
+        let owner = make_identity("worker-a");
+        store.record(&owner, "container", "c1").await.unwrap();
+        store.record(&owner, "container", "c2").await.unwrap();
+        store.record(&owner, "container", "c3").await.unwrap();
+
+        let mut owned = store.owned_resources(&owner, "container");
+        owned.sort();
+        assert_eq!(owned, vec!["c1", "c2", "c3"]);
+    }
+
+    #[tokio::test]
+    async fn owned_resources_filters_by_resource_type() {
+        let store = InMemoryOwnershipStore::new();
+        let owner = make_identity("worker-a");
+        store.record(&owner, "container", "c1").await.unwrap();
+        store.record(&owner, "tty", "t1").await.unwrap();
+
+        let owned_containers = store.owned_resources(&owner, "container");
+        assert_eq!(owned_containers, vec!["c1"]);
+        let owned_ttys = store.owned_resources(&owner, "tty");
+        assert_eq!(owned_ttys, vec!["t1"]);
+    }
+
+    #[tokio::test]
+    async fn owns_any_returns_false_for_owner_with_no_resources_of_type() {
+        let store = InMemoryOwnershipStore::new();
+        let owner = make_identity("worker-a");
+        store.record(&owner, "container", "c1").await.unwrap();
+
+        assert!(store.owns_any(&owner, "container"));
+        assert!(!store.owns_any(&owner, "tty"));
+    }
+
+    #[tokio::test]
+    async fn revoke_on_non_existent_resource_is_no_op() {
+        let store = InMemoryOwnershipStore::new();
+        store.revoke("container", "never-existed").await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn owns_returns_false_for_different_identity() {
+        let store = InMemoryOwnershipStore::new();
+        let owner = make_identity("worker-a");
+        let other = make_identity("worker-b");
+        store.record(&owner, "container", "c1").await.unwrap();
+
+        assert!(store.owns(&owner, "container", "c1", "exec"));
+        assert!(!store.owns(&other, "container", "c1", "exec"));
+        assert!(!store.owns_any(&other, "container"));
+        assert!(store.owned_resources(&other, "container").is_empty());
+    }
+
+    #[tokio::test]
+    async fn record_replaces_existing_owner() {
+        let store = InMemoryOwnershipStore::new();
+        let owner_a = make_identity("worker-a");
+        let owner_b = make_identity("worker-b");
+        store.record(&owner_a, "container", "c1").await.unwrap();
+        store.record(&owner_b, "container", "c1").await.unwrap();
+
+        assert!(!store.owns(&owner_a, "container", "c1", "exec"));
+        assert!(store.owns(&owner_b, "container", "c1", "exec"));
+    }
+
+    #[tokio::test]
+    async fn default_is_empty_store() {
+        let store = InMemoryOwnershipStore::default();
+        let owner = make_identity("worker-a");
+        assert!(store.owned_resources(&owner, "container").is_empty());
+        assert!(!store.owns_any(&owner, "container"));
+    }
+
+    #[test]
+    fn ownership_error_display_formatting() {
+        let backend = OwnershipError::Backend {
+            message: "disk full".to_string(),
+        };
+        assert_eq!(backend.to_string(), "backend error: disk full");
+
+        let not_found = OwnershipError::NotFound {
+            entity: "container:c1".to_string(),
+        };
+        assert_eq!(not_found.to_string(), "not found: container:c1");
+    }
+
+    #[test]
+    fn ownership_error_is_non_exhaustive() {
+        let err = OwnershipError::Backend {
+            message: "x".to_string(),
+        };
+        let _ = err.to_string();
+    }
+}

crates/alknet-core/src/server/channel_proxy.rs

@@ -1,555 +0,0 @@
-//! Outbound connection proxy for SSH channel targets.
-//!
-//! Connects to the requested `host:port` either directly, via SOCKS5 proxy, or
-//! via HTTP CONNECT proxy, then proxies bytes bidirectionally between the SSH
-//! channel and the outbound TCP stream.
-
-use std::net::SocketAddr;
-
-use tokio::io::{AsyncReadExt, AsyncWriteExt};
-use tokio::net::TcpStream;
-
-use super::handler::{ProxyConfig, ProxyMode};
-
-#[derive(Debug, thiserror::Error)]
-pub enum ChannelProxyError {
-    #[error("connection refused")]
-    ConnectionRefused,
-    #[error("target unreachable")]
-    TargetUnreachable,
-    #[error("socks5 proxy handshake failed")]
-    Socks5HandshakeFailed,
-    #[error("socks5 proxy rejected connection")]
-    Socks5ProxyRejected,
-    #[error("http connect proxy handshake failed")]
-    HttpConnectHandshakeFailed,
-    #[error("http connect proxy rejected: {0}")]
-    HttpConnectProxyRejected(String),
-    #[error("io error")]
-    Io(#[from] std::io::Error),
-}
-
-pub async fn connect_outbound(
-    target: SocketAddr,
-    proxy: &ProxyConfig,
-) -> Result<TcpStream, ChannelProxyError> {
-    match &proxy.mode {
-        ProxyMode::Direct => connect_direct(target).await,
-        ProxyMode::Socks5(addr) => connect_socks5(target, *addr).await,
-        ProxyMode::HttpConnect(addr) => connect_http_connect(target, *addr).await,
-    }
-}
-
-async fn connect_direct(target: SocketAddr) -> Result<TcpStream, ChannelProxyError> {
-    TcpStream::connect(target)
-        .await
-        .map_err(|e| map_connection_error(e, target))
-}
-
-async fn connect_socks5(
-    target: SocketAddr,
-    proxy_addr: SocketAddr,
-) -> Result<TcpStream, ChannelProxyError> {
-    let mut stream = TcpStream::connect(proxy_addr)
-        .await
-        .map_err(ChannelProxyError::from)?;
-
-    stream.write_all(&[0x05, 0x01, 0x00]).await?;
-    stream.flush().await?;
-
-    let mut resp = [0u8; 2];
-    stream.read_exact(&mut resp).await?;
-    if resp[0] != 0x05 || resp[1] != 0x00 {
-        return Err(ChannelProxyError::Socks5HandshakeFailed);
-    }
-
-    let ip_bytes = target.ip().to_string();
-    let mut connect_req = vec![0x05, 0x01, 0x00, 0x03];
-    connect_req.push(ip_bytes.len() as u8);
-    connect_req.extend_from_slice(ip_bytes.as_bytes());
-    connect_req.extend_from_slice(&target.port().to_be_bytes());
-    stream.write_all(&connect_req).await?;
-    stream.flush().await?;
-
-    let mut reply_header = [0u8; 4];
-    stream.read_exact(&mut reply_header).await?;
-    if reply_header[0] != 0x05 {
-        return Err(ChannelProxyError::Socks5HandshakeFailed);
-    }
-    if reply_header[1] != 0x00 {
-        return Err(ChannelProxyError::Socks5ProxyRejected);
-    }
-
-    let atyp = reply_header[3];
-    match atyp {
-        0x01 => {
-            let mut _addr = [0u8; 4];
-            stream.read_exact(&mut _addr).await?;
-        }
-        0x04 => {
-            let mut _addr = [0u8; 16];
-            stream.read_exact(&mut _addr).await?;
-        }
-        0x03 => {
-            let len = stream.read_u8().await?;
-            let mut _domain = vec![0u8; len as usize];
-            stream.read_exact(&mut _domain).await?;
-        }
-        _ => {
-            return Err(ChannelProxyError::Socks5HandshakeFailed);
-        }
-    }
-    let mut _port = [0u8; 2];
-    stream.read_exact(&mut _port).await?;
-
-    Ok(stream)
-}
-
-async fn connect_http_connect(
-    target: SocketAddr,
-    proxy_addr: SocketAddr,
-) -> Result<TcpStream, ChannelProxyError> {
-    let mut stream = TcpStream::connect(proxy_addr)
-        .await
-        .map_err(ChannelProxyError::from)?;
-
-    let connect_request = format!(
-        "CONNECT {}:{} HTTP/1.1\r\nHost: {}:{}\r\n\r\n",
-        target.ip(),
-        target.port(),
-        target.ip(),
-        target.port()
-    );
-    stream.write_all(connect_request.as_bytes()).await?;
-    stream.flush().await?;
-
-    let mut response = Vec::new();
-    let mut buf = [0u8; 1024];
-    loop {
-        let n = stream.read(&mut buf).await?;
-        if n == 0 {
-            return Err(ChannelProxyError::HttpConnectHandshakeFailed);
-        }
-        response.extend_from_slice(&buf[..n]);
-        if response.windows(4).any(|w| w == b"\r\n\r\n") {
-            break;
-        }
-    }
-
-    let response_str = String::from_utf8_lossy(&response);
-    let status_line = response_str.lines().next().unwrap_or("");
-
-    if status_line.contains("200") {
-        Ok(stream)
-    } else {
-        Err(ChannelProxyError::HttpConnectProxyRejected(
-            status_line.to_string(),
-        ))
-    }
-}
-
-fn map_connection_error(e: std::io::Error, _target: SocketAddr) -> ChannelProxyError {
-    match e.kind() {
-        std::io::ErrorKind::ConnectionRefused => ChannelProxyError::ConnectionRefused,
-        std::io::ErrorKind::AddrNotAvailable
-        | std::io::ErrorKind::NetworkUnreachable
-        | std::io::ErrorKind::HostUnreachable => ChannelProxyError::TargetUnreachable,
-        _ => ChannelProxyError::Io(e),
-    }
-}
-
-pub async fn proxy_channel<S>(channel: S, target: SocketAddr, proxy: &ProxyConfig)
-where
-    S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin + Send + 'static,
-{
-    if let Ok(outbound) = connect_outbound(target, proxy).await {
-        let (mut read_chan, mut write_chan) = tokio::io::split(channel);
-        let (mut read_out, mut write_out) = outbound.into_split();
-
-        let client_to_target = tokio::spawn(async move {
-            let _ = tokio::io::copy(&mut read_chan, &mut write_out).await;
-            let _ = write_out.shutdown().await;
-        });
-
-        let target_to_client = tokio::spawn(async move {
-            let _ = tokio::io::copy(&mut read_out, &mut write_chan).await;
-            let _ = write_chan.shutdown().await;
-        });
-
-        let _ = client_to_target.await;
-        let _ = target_to_client.await;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{duplex, AsyncReadExt, AsyncWriteExt, DuplexStream};
-    use tokio::net::TcpListener;
-
-    fn direct_config() -> ProxyConfig {
-        ProxyConfig {
-            mode: ProxyMode::Direct,
-        }
-    }
-
-    fn socks5_config(addr: SocketAddr) -> ProxyConfig {
-        ProxyConfig {
-            mode: ProxyMode::Socks5(addr),
-        }
-    }
-
-    fn http_connect_config(addr: SocketAddr) -> ProxyConfig {
-        ProxyConfig {
-            mode: ProxyMode::HttpConnect(addr),
-        }
-    }
-
-    #[tokio::test]
-    async fn direct_connection_to_echo_server() {
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let addr = listener.local_addr().unwrap();
-
-        let server = tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.unwrap();
-            let mut buf = [0u8; 64];
-            let n = sock.read(&mut buf).await.unwrap();
-            sock.write_all(&buf[..n]).await.unwrap();
-        });
-
-        let stream = connect_outbound(addr, &direct_config()).await.unwrap();
-        let (mut read, mut write) = stream.into_split();
-        write.write_all(b"hello").await.unwrap();
-        let mut buf = [0u8; 5];
-        read.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello");
-
-        let _ = server.await;
-    }
-
-    #[tokio::test]
-    async fn direct_connection_target_unreachable() {
-        let target: SocketAddr = "240.0.0.1:1".parse().unwrap();
-        let result = connect_outbound(target, &direct_config()).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn socks5_proxy_handshake() {
-        let proxy_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let proxy_addr = proxy_listener.local_addr().unwrap();
-
-        let target_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let target_addr = target_listener.local_addr().unwrap();
-
-        let target_server = tokio::spawn(async move {
-            let (mut sock, _) = target_listener.accept().await.unwrap();
-            let mut buf = [0u8; 64];
-            let n = sock.read(&mut buf).await.unwrap();
-            sock.write_all(&buf[..n]).await.unwrap();
-        });
-
-        let proxy_server = tokio::spawn(async move {
-            let (mut proxy_sock, _) = proxy_listener.accept().await.unwrap();
-
-            let mut greeting = [0u8; 3];
-            proxy_sock.read_exact(&mut greeting).await.unwrap();
-            assert_eq!(greeting[0], 0x05);
-            proxy_sock.write_all(&[0x05, 0x00]).await.unwrap();
-
-            let mut req_header = [0u8; 4];
-            proxy_sock.read_exact(&mut req_header).await.unwrap();
-            assert_eq!(req_header[0], 0x05);
-            assert_eq!(req_header[1], 0x01);
-
-            let atyp = req_header[3];
-            assert_eq!(atyp, 0x03);
-
-            let domain_len = proxy_sock.read_u8().await.unwrap() as usize;
-            let mut domain = vec![0u8; domain_len];
-            proxy_sock.read_exact(&mut domain).await.unwrap();
-            let mut port_bytes = [0u8; 2];
-            proxy_sock.read_exact(&mut port_bytes).await.unwrap();
-
-            let target: SocketAddr = format!(
-                "{}:{}",
-                String::from_utf8_lossy(&domain),
-                u16::from_be_bytes(port_bytes)
-            )
-            .parse()
-            .unwrap();
-
-            let reply = vec![0x05, 0x00, 0x00, 0x01, 0, 0, 0, 0, 0, 0];
-            proxy_sock.write_all(&reply).await.unwrap();
-
-            let mut target_stream = TcpStream::connect(target).await.unwrap();
-            let _ = tokio::io::copy_bidirectional(&mut proxy_sock, &mut target_stream).await;
-        });
-
-        let config = socks5_config(proxy_addr);
-        let mut stream = connect_outbound(target_addr, &config).await.unwrap();
-        stream.write_all(b"hello socks").await.unwrap();
-        let mut buf = [0u8; 11];
-        stream.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello socks");
-        drop(stream);
-
-        let _ = target_server.await;
-        let _ = proxy_server.await;
-    }
-
-    #[tokio::test]
-    async fn socks5_proxy_rejected() {
-        let proxy_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let proxy_addr = proxy_listener.local_addr().unwrap();
-
-        let proxy_server = tokio::spawn(async move {
-            let (mut proxy_sock, _) = proxy_listener.accept().await.unwrap();
-
-            let mut greeting = [0u8; 3];
-            proxy_sock.read_exact(&mut greeting).await.unwrap();
-            proxy_sock.write_all(&[0x05, 0x00]).await.unwrap();
-
-            let mut req_header = [0u8; 4];
-            proxy_sock.read_exact(&mut req_header).await.unwrap();
-
-            let domain_len = proxy_sock.read_u8().await.unwrap() as usize;
-            let mut domain = vec![0u8; domain_len];
-            proxy_sock.read_exact(&mut domain).await.unwrap();
-            let mut port_bytes = [0u8; 2];
-            proxy_sock.read_exact(&mut port_bytes).await.unwrap();
-
-            let reply = vec![0x05, 0x05, 0x00, 0x01, 0, 0, 0, 0, 0, 0];
-            proxy_sock.write_all(&reply).await.unwrap();
-        });
-
-        let target: SocketAddr = "127.0.0.1:9999".parse().unwrap();
-        let config = socks5_config(proxy_addr);
-        let result = connect_outbound(target, &config).await;
-        assert!(result.is_err());
-        assert!(matches!(
-            result.unwrap_err(),
-            ChannelProxyError::Socks5ProxyRejected
-        ));
-
-        let _ = proxy_server.await;
-    }
-
-    #[tokio::test]
-    async fn http_connect_proxy_handshake() {
-        let proxy_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let proxy_addr = proxy_listener.local_addr().unwrap();
-
-        let target_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let target_addr = target_listener.local_addr().unwrap();
-
-        let target_server = tokio::spawn(async move {
-            let (mut sock, _) = target_listener.accept().await.unwrap();
-            let mut buf = [0u8; 64];
-            let n = sock.read(&mut buf).await.unwrap();
-            sock.write_all(&buf[..n]).await.unwrap();
-        });
-
-        let proxy_server = tokio::spawn(async move {
-            let (mut proxy_sock, _) = proxy_listener.accept().await.unwrap();
-
-            let mut request = Vec::new();
-            let mut buf = [0u8; 1024];
-            loop {
-                let n = proxy_sock.read(&mut buf).await.unwrap();
-                request.extend_from_slice(&buf[..n]);
-                if request.windows(4).any(|w| w == b"\r\n\r\n") {
-                    break;
-                }
-            }
-
-            let response = "HTTP/1.1 200 Connection Established\r\n\r\n";
-            proxy_sock.write_all(response.as_bytes()).await.unwrap();
-
-            let target_str = extract_connect_target(&String::from_utf8_lossy(&request));
-            let mut target_stream = TcpStream::connect(target_str).await.unwrap();
-            let _ = tokio::io::copy_bidirectional(&mut proxy_sock, &mut target_stream).await;
-        });
-
-        let config = http_connect_config(proxy_addr);
-        let mut stream = connect_outbound(target_addr, &config).await.unwrap();
-        stream.write_all(b"hello http").await.unwrap();
-        let mut buf = [0u8; 10];
-        stream.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello http");
-        drop(stream);
-
-        let _ = target_server.await;
-        let _ = proxy_server.await;
-    }
-
-    fn extract_connect_target(request: &str) -> String {
-        let connect_line = request.lines().next().unwrap_or("");
-        let parts: Vec<&str> = connect_line.split_whitespace().collect();
-        if parts.len() >= 2 {
-            parts[1].to_string()
-        } else {
-            String::new()
-        }
-    }
-
-    #[tokio::test]
-    async fn http_connect_proxy_rejected() {
-        let proxy_listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let proxy_addr = proxy_listener.local_addr().unwrap();
-
-        let proxy_server = tokio::spawn(async move {
-            let (mut proxy_sock, _) = proxy_listener.accept().await.unwrap();
-
-            let mut request = Vec::new();
-            let mut buf = [0u8; 1024];
-            loop {
-                let n = proxy_sock.read(&mut buf).await.unwrap();
-                if n == 0 {
-                    break;
-                }
-                request.extend_from_slice(&buf[..n]);
-                if request.windows(4).any(|w| w == b"\r\n\r\n") {
-                    break;
-                }
-            }
-
-            let response = "HTTP/1.1 403 Forbidden\r\n\r\n";
-            proxy_sock.write_all(response.as_bytes()).await.unwrap();
-        });
-
-        let target: SocketAddr = "127.0.0.1:9999".parse().unwrap();
-        let config = http_connect_config(proxy_addr);
-        let result = connect_outbound(target, &config).await;
-        assert!(result.is_err());
-        match result.unwrap_err() {
-            ChannelProxyError::HttpConnectProxyRejected(msg) => {
-                assert!(msg.contains("403"));
-            }
-            other => panic!("expected HttpConnectProxyRejected, got {:?}", other),
-        }
-
-        let _ = proxy_server.await;
-    }
-
-    #[tokio::test]
-    async fn target_unreachable_returns_appropriate_error() {
-        let target: SocketAddr = "240.0.0.1:1".parse().unwrap();
-        let result = connect_outbound(target, &direct_config()).await;
-        match result.unwrap_err() {
-            ChannelProxyError::TargetUnreachable
-            | ChannelProxyError::ConnectionRefused
-            | ChannelProxyError::Io(_) => {}
-            other => panic!("unexpected error type: {:?}", other),
-        }
-    }
-
-    #[tokio::test]
-    async fn socks5_proxy_unreachable() {
-        let target: SocketAddr = "127.0.0.1:9999".parse().unwrap();
-        let bad_proxy: SocketAddr = "127.0.0.1:1".parse().unwrap();
-        let config = socks5_config(bad_proxy);
-        let result = connect_outbound(target, &config).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn http_connect_proxy_unreachable() {
-        let target: SocketAddr = "127.0.0.1:9999".parse().unwrap();
-        let bad_proxy: SocketAddr = "127.0.0.1:1".parse().unwrap();
-        let config = http_connect_config(bad_proxy);
-        let result = connect_outbound(target, &config).await;
-        assert!(result.is_err());
-    }
-
-    struct MockChannel {
-        read_half: tokio::io::ReadHalf<DuplexStream>,
-        write_half: tokio::io::WriteHalf<DuplexStream>,
-    }
-
-    impl tokio::io::AsyncRead for MockChannel {
-        fn poll_read(
-            self: std::pin::Pin<&mut Self>,
-            cx: &mut std::task::Context<'_>,
-            buf: &mut tokio::io::ReadBuf<'_>,
-        ) -> std::task::Poll<std::io::Result<()>> {
-            std::pin::Pin::new(&mut self.get_mut().read_half).poll_read(cx, buf)
-        }
-    }
-
-    impl tokio::io::AsyncWrite for MockChannel {
-        fn poll_write(
-            self: std::pin::Pin<&mut Self>,
-            cx: &mut std::task::Context<'_>,
-            buf: &[u8],
-        ) -> std::task::Poll<std::io::Result<usize>> {
-            std::pin::Pin::new(&mut self.get_mut().write_half).poll_write(cx, buf)
-        }
-
-        fn poll_flush(
-            self: std::pin::Pin<&mut Self>,
-            cx: &mut std::task::Context<'_>,
-        ) -> std::task::Poll<std::io::Result<()>> {
-            std::pin::Pin::new(&mut self.get_mut().write_half).poll_flush(cx)
-        }
-
-        fn poll_shutdown(
-            self: std::pin::Pin<&mut Self>,
-            cx: &mut std::task::Context<'_>,
-        ) -> std::task::Poll<std::io::Result<()>> {
-            std::pin::Pin::new(&mut self.get_mut().write_half).poll_shutdown(cx)
-        }
-    }
-
-    fn make_mock_channel() -> (MockChannel, DuplexStream) {
-        let (client, server) = duplex(4096);
-        let (read_half, write_half) = tokio::io::split(client);
-        (
-            MockChannel {
-                read_half,
-                write_half,
-            },
-            server,
-        )
-    }
-
-    #[tokio::test]
-    async fn proxy_channel_bidirectional_data_flow() {
-        let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
-        let target_addr = listener.local_addr().unwrap();
-
-        let echo_server = tokio::spawn(async move {
-            let (mut sock, _) = listener.accept().await.unwrap();
-            let mut buf = [0u8; 64];
-            let n = sock.read(&mut buf).await.unwrap();
-            sock.write_all(&buf[..n]).await.unwrap();
-        });
-
-        let (channel, mut channel_peer) = make_mock_channel();
-
-        let target = target_addr;
-        let proxy = direct_config();
-        tokio::spawn(async move {
-            proxy_channel(channel, target, &proxy).await;
-        });
-
-        channel_peer.write_all(b"ping").await.unwrap();
-        channel_peer.flush().await.unwrap();
-
-        let mut buf = [0u8; 4];
-        channel_peer.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"ping");
-
-        drop(channel_peer);
-        let _ = echo_server.await;
-    }
-
-    #[tokio::test]
-    async fn proxy_channel_target_unreachable_closes_cleanly() {
-        let target: SocketAddr = "240.0.0.1:1".parse().unwrap();
-        let (channel, _channel_peer) = make_mock_channel();
-
-        let proxy = direct_config();
-        proxy_channel(channel, target, &proxy).await;
-    }
-}

crates/alknet-core/src/server/control_channel.rs

@@ -1,196 +0,0 @@
-//! Control channel routing for reserved `alknet-*` destinations.
-//!
-//! SSH channels opened with a destination starting with `alknet-` are intercepted
-//! by the server and routed to a `ControlChannelHandler` instead of proxied to a
-//! TCP target. See ADR-018 for the design rationale.
-
-use std::io;
-
-use async_trait::async_trait;
-use tokio::io::{AsyncRead, AsyncWrite};
-
-pub const ALKNET_CONTROL_DESTINATION: &str = "alknet-control";
-pub const ALKNET_PREFIX: &str = "alknet-";
-
-pub fn is_reserved_destination(host: &str) -> bool {
-    host.starts_with(ALKNET_PREFIX)
-}
-
-pub trait DuplexStream: AsyncRead + AsyncWrite + Unpin + Send {}
-
-impl<T: AsyncRead + AsyncWrite + Unpin + Send> DuplexStream for T {}
-
-#[async_trait]
-pub trait ControlChannelHandler: Send + Sync {
-    async fn handle_channel(&self, stream: Box<dyn DuplexStream>);
-}
-
-pub struct ControlChannelRouter {
-    handler: Option<Box<dyn ControlChannelHandler>>,
-}
-
-impl ControlChannelRouter {
-    pub fn new(handler: Option<Box<dyn ControlChannelHandler>>) -> Self {
-        Self { handler }
-    }
-
-    pub fn without_handler() -> Self {
-        Self { handler: None }
-    }
-
-    pub fn with_handler(handler: Box<dyn ControlChannelHandler>) -> Self {
-        Self {
-            handler: Some(handler),
-        }
-    }
-
-    pub fn has_handler(&self) -> bool {
-        self.handler.is_some()
-    }
-
-    pub async fn route(&self, stream: Box<dyn DuplexStream>) -> io::Result<()> {
-        match &self.handler {
-            Some(handler) => {
-                handler.handle_channel(stream).await;
-                Ok(())
-            }
-            None => Err(io::Error::new(
-                io::ErrorKind::ConnectionRefused,
-                "no control channel handler configured",
-            )),
-        }
-    }
-
-    pub fn take_handler(&mut self) -> Option<Box<dyn ControlChannelHandler>> {
-        self.handler.take()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::duplex;
-
-    #[test]
-    fn alknet_control_destination_constant() {
-        assert_eq!(ALKNET_CONTROL_DESTINATION, "alknet-control");
-    }
-
-    #[test]
-    fn alknet_prefix_constant() {
-        assert_eq!(ALKNET_PREFIX, "alknet-");
-    }
-
-    #[test]
-    fn reserved_destination_detected() {
-        assert!(is_reserved_destination("alknet-control"));
-        assert!(is_reserved_destination("alknet-status"));
-        assert!(is_reserved_destination("alknet-events"));
-        assert!(is_reserved_destination("alknet-"));
-    }
-
-    #[test]
-    fn non_reserved_destination_passes_through() {
-        assert!(!is_reserved_destination("example.com"));
-        assert!(!is_reserved_destination("localhost"));
-        assert!(!is_reserved_destination("192.168.1.1"));
-        assert!(!is_reserved_destination("alknet.example.com"));
-        assert!(!is_reserved_destination(""));
-        assert!(!is_reserved_destination("alkne-control"));
-        assert!(!is_reserved_destination("ALKNET-control"));
-    }
-
-    #[test]
-    fn prefix_matching_case_sensitive() {
-        assert!(!is_reserved_destination("Alknet-control"));
-        assert!(!is_reserved_destination("ALKNET-control"));
-        assert!(is_reserved_destination("alknet-Control"));
-    }
-
-    #[test]
-    fn router_without_handler_has_no_handler() {
-        let router = ControlChannelRouter::without_handler();
-        assert!(!router.has_handler());
-    }
-
-    #[test]
-    fn router_with_handler_has_handler() {
-        struct DummyHandler;
-        #[async_trait]
-        impl ControlChannelHandler for DummyHandler {
-            async fn handle_channel(&self, _stream: Box<dyn DuplexStream>) {}
-        }
-        let router = ControlChannelRouter::with_handler(Box::new(DummyHandler));
-        assert!(router.has_handler());
-    }
-
-    #[tokio::test]
-    async fn route_without_handler_returns_error() {
-        let router = ControlChannelRouter::without_handler();
-        let (_client, server) = duplex(64);
-        let stream: Box<dyn DuplexStream> = Box::new(server);
-        let result = router.route(stream).await;
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert_eq!(err.kind(), io::ErrorKind::ConnectionRefused);
-    }
-
-    #[tokio::test]
-    async fn route_with_handler_succeeds() {
-        use std::sync::atomic::{AtomicBool, Ordering};
-        use std::sync::Arc;
-
-        struct TrackedHandler {
-            called: Arc<AtomicBool>,
-        }
-        #[async_trait]
-        impl ControlChannelHandler for TrackedHandler {
-            async fn handle_channel(&self, _stream: Box<dyn DuplexStream>) {
-                self.called.store(true, Ordering::SeqCst);
-            }
-        }
-
-        let called = Arc::new(AtomicBool::new(false));
-        let handler = TrackedHandler {
-            called: called.clone(),
-        };
-        let router = ControlChannelRouter::with_handler(Box::new(handler));
-        let (_client, server) = duplex(64);
-        let stream: Box<dyn DuplexStream> = Box::new(server);
-        let result = router.route(stream).await;
-        assert!(result.is_ok());
-        assert!(called.load(Ordering::SeqCst));
-    }
-
-    #[tokio::test]
-    async fn route_with_handler_can_read_write() {
-        struct EchoHandler;
-        #[async_trait]
-        impl ControlChannelHandler for EchoHandler {
-            async fn handle_channel(&self, mut stream: Box<dyn DuplexStream>) {
-                let mut buf = [0u8; 64];
-                let n = stream.read(&mut buf).await.unwrap();
-                stream.write_all(&buf[..n]).await.unwrap();
-            }
-        }
-
-        let router = ControlChannelRouter::with_handler(Box::new(EchoHandler));
-        let (client, server) = duplex(64);
-        let stream: Box<dyn DuplexStream> = Box::new(server);
-        tokio::spawn(async move {
-            router.route(stream).await.unwrap();
-        });
-
-        use tokio::io::{AsyncReadExt, AsyncWriteExt};
-        let mut client = client;
-        client.write_all(b"hello").await.unwrap();
-        let mut buf = [0u8; 5];
-        client.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello");
-    }
-
-    #[test]
-    fn control_channel_destination_matches_prefix() {
-        assert!(is_reserved_destination(ALKNET_CONTROL_DESTINATION));
-    }
-}

crates/alknet-core/src/server/handler.rs

@@ -1,974 +0,0 @@
-use std::net::{IpAddr, SocketAddr};
-use std::sync::Arc;
-use std::time::Instant;
-
-use arc_swap::ArcSwap;
-use async_trait::async_trait;
-use russh::keys::ssh_key::HashAlg;
-use russh::server::{Auth, Handler, Msg, Session};
-use russh::Channel;
-use russh::ChannelId;
-
-use crate::auth::identity::{ConfigIdentityProvider, Identity, IdentityProvider};
-use crate::config::DynamicConfig;
-use crate::server::control_channel::{ControlChannelHandler, ControlChannelRouter, ALKNET_PREFIX};
-use crate::server::rate_limit::{AuthAttemptLimiter, ConnectionRateLimiter};
-
-pub use crate::transport::TransportKind;
-
-#[derive(Debug, Clone)]
-pub enum ProxyMode {
-    Direct,
-    Socks5(SocketAddr),
-    HttpConnect(SocketAddr),
-}
-
-#[derive(Debug, Clone)]
-pub struct ProxyConfig {
-    pub mode: ProxyMode,
-}
-
-pub struct ServerHandler {
-    dynamic: Arc<ArcSwap<DynamicConfig>>,
-    identity_provider: Arc<dyn IdentityProvider>,
-    #[allow(dead_code)]
-    outbound_proxy: Option<ProxyConfig>,
-    remote_addr: Option<SocketAddr>,
-    control_channel_router: ControlChannelRouter,
-    #[allow(dead_code)]
-    transport: TransportKind,
-    connection_limiter: Arc<ConnectionRateLimiter>,
-    connection_allowed: bool,
-    auth_limiter: AuthAttemptLimiter,
-    connected_at: Instant,
-    authenticated_identity: Option<Identity>,
-}
-
-impl ServerHandler {
-    pub fn new(
-        dynamic: Arc<ArcSwap<DynamicConfig>>,
-        outbound_proxy: Option<ProxyConfig>,
-        remote_addr: Option<SocketAddr>,
-        transport: TransportKind,
-        connection_limiter: Arc<ConnectionRateLimiter>,
-        max_auth_attempts: usize,
-    ) -> Self {
-        let identity_provider: Arc<dyn IdentityProvider> =
-            Arc::new(ConfigIdentityProvider::new(Arc::clone(&dynamic)));
-
-        let allowed = if let Some(addr) = remote_addr {
-            let ip = addr.ip();
-            if connection_limiter.check(ip) {
-                connection_limiter.on_connect(ip);
-                tracing::info!(
-                    remote_addr = %addr,
-                    transport = %transport,
-                    "connection opened"
-                );
-                true
-            } else {
-                tracing::info!(
-                    remote_addr = %addr,
-                    transport = %transport,
-                    "connection rejected"
-                );
-                false
-            }
-        } else {
-            true
-        };
-
-        Self {
-            dynamic,
-            identity_provider,
-            outbound_proxy,
-            remote_addr,
-            control_channel_router: ControlChannelRouter::without_handler(),
-            transport,
-            connection_limiter,
-            connection_allowed: allowed,
-            auth_limiter: AuthAttemptLimiter::new(max_auth_attempts),
-            connected_at: Instant::now(),
-            authenticated_identity: None,
-        }
-    }
-
-    pub fn with_identity_provider(mut self, provider: Arc<dyn IdentityProvider>) -> Self {
-        self.identity_provider = provider;
-        self
-    }
-
-    pub fn authenticated_identity(&self) -> Option<&Identity> {
-        self.authenticated_identity.as_ref()
-    }
-
-    pub fn is_connection_allowed(&self) -> bool {
-        self.connection_allowed
-    }
-
-    pub fn remote_ip(&self) -> Option<IpAddr> {
-        self.remote_addr.map(|a| a.ip())
-    }
-}
-
-impl Drop for ServerHandler {
-    fn drop(&mut self) {
-        if let Some(addr) = self.remote_addr {
-            if self.connection_allowed {
-                self.connection_limiter.on_disconnect(addr.ip());
-            }
-            let duration = self.connected_at.elapsed();
-            tracing::info!(
-                remote_addr = %addr,
-                duration_secs = duration.as_secs_f64(),
-                "connection closed"
-            );
-        }
-    }
-}
-
-impl ServerHandler {
-    pub fn with_control_channel_handler(mut self, handler: Box<dyn ControlChannelHandler>) -> Self {
-        self.control_channel_router = ControlChannelRouter::with_handler(handler);
-        self
-    }
-
-    pub fn control_channel_router(&self) -> &ControlChannelRouter {
-        &self.control_channel_router
-    }
-}
-
-#[async_trait]
-impl Handler for ServerHandler {
-    type Error = russh::Error;
-
-    async fn auth_publickey(
-        &mut self,
-        user: &str,
-        public_key: &russh::keys::ssh_key::PublicKey,
-    ) -> Result<Auth, Self::Error> {
-        if !self.auth_limiter.check() {
-            let remote_addr_display = self
-                .remote_addr
-                .map_or("unknown".to_string(), |a| a.to_string());
-            let fingerprint = format!("{}", public_key.fingerprint(HashAlg::Sha256));
-            tracing::info!(
-                remote_addr = %remote_addr_display,
-                user = user,
-                key_fingerprint = %fingerprint,
-                result = "reject",
-                "auth attempt"
-            );
-            return Ok(Auth::Reject {
-                proceed_with_methods: None,
-            });
-        }
-
-        let fingerprint = format!("{}", public_key.fingerprint(HashAlg::Sha256));
-        let remote_addr_display = self
-            .remote_addr
-            .map_or("unknown".to_string(), |a| a.to_string());
-
-        let identity = self
-            .identity_provider
-            .resolve_from_fingerprint(&fingerprint);
-
-        match identity {
-            Some(id) => {
-                self.authenticated_identity = Some(id);
-                tracing::info!(
-                    remote_addr = %remote_addr_display,
-                    user = user,
-                    key_fingerprint = %fingerprint,
-                    result = "accept",
-                    "auth attempt"
-                );
-                Ok(Auth::Accept)
-            }
-            None => {
-                self.auth_limiter.on_failure();
-                tracing::info!(
-                    remote_addr = %remote_addr_display,
-                    user = user,
-                    key_fingerprint = %fingerprint,
-                    result = "reject",
-                    "auth attempt"
-                );
-                Ok(Auth::Reject {
-                    proceed_with_methods: None,
-                })
-            }
-        }
-    }
-
-    async fn channel_open_direct_tcpip(
-        &mut self,
-        channel: Channel<Msg>,
-        host_to_connect: &str,
-        port_to_connect: u32,
-        originator_address: &str,
-        originator_port: u32,
-        _session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        if host_to_connect.starts_with(ALKNET_PREFIX) {
-            if !self.control_channel_router.has_handler() {
-                return Ok(false);
-            }
-
-            let _ = channel;
-            return Ok(true);
-        }
-
-        let identity = self
-            .authenticated_identity
-            .clone()
-            .unwrap_or_else(|| Identity {
-                id: String::new(),
-                scopes: vec![],
-                resources: std::collections::HashMap::new(),
-            });
-
-        let policy = self.dynamic.load();
-        let allowed = policy.forwarding.check(
-            host_to_connect,
-            port_to_connect as u16,
-            &identity,
-            self.transport.clone(),
-        );
-
-        if !allowed {
-            tracing::info!(
-                remote_addr = ?self.remote_addr,
-                target = %format!("{host_to_connect}:{port_to_connect}"),
-                identity = %identity.id,
-                transport = %self.transport,
-                "forwarding denied by policy"
-            );
-            return Ok(false);
-        }
-
-        let target_host = host_to_connect.to_string();
-        let target_port = port_to_connect;
-        let proxy_config = self.outbound_proxy.clone().unwrap_or(ProxyConfig {
-            mode: ProxyMode::Direct,
-        });
-
-        tokio::spawn(async move {
-            let target =
-                match format!("{target_host}:{target_port}").parse::<std::net::SocketAddr>() {
-                    Ok(addr) => addr,
-                    Err(_) => match tokio::net::lookup_host((&target_host[..], target_port as u16))
-                        .await
-                    {
-                        Ok(mut addrs) => match addrs.next() {
-                            Some(addr) => addr,
-                            None => return,
-                        },
-                        Err(_) => return,
-                    },
-                };
-            crate::server::channel_proxy::proxy_channel(
-                channel.into_stream(),
-                target,
-                &proxy_config,
-            )
-            .await;
-        });
-
-        let _ = (originator_address, originator_port);
-        Ok(true)
-    }
-
-    async fn channel_open_session(
-        &mut self,
-        _channel: Channel<Msg>,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            "rejected session channel (shell/exec not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn channel_open_x11(
-        &mut self,
-        _channel: Channel<Msg>,
-        _originator_address: &str,
-        _originator_port: u32,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            "rejected x11 channel"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn channel_open_forwarded_tcpip(
-        &mut self,
-        _channel: Channel<Msg>,
-        host_to_connect: &str,
-        port_to_connect: u32,
-        _originator_address: &str,
-        _originator_port: u32,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            target = %format!("{host_to_connect}:{port_to_connect}"),
-            "rejected forwarded-tcpip channel (remote port forwarding not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn exec_request(
-        &mut self,
-        channel: ChannelId,
-        data: &[u8],
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            data_len = data.len(),
-            "rejected exec request on channel (shell/exec not supported)"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn shell_request(
-        &mut self,
-        channel: ChannelId,
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected shell request on channel"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn subsystem_request(
-        &mut self,
-        channel: ChannelId,
-        name: &str,
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            subsystem = name,
-            "rejected subsystem request on channel"
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn pty_request(
-        &mut self,
-        channel: ChannelId,
-        term: &str,
-        col_width: u32,
-        row_height: u32,
-        pix_width: u32,
-        pix_height: u32,
-        modes: &[(russh::Pty, u32)],
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            term = term,
-            "rejected pty request on channel"
-        );
-        let _ = (col_width, row_height, pix_width, pix_height, modes);
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn env_request(
-        &mut self,
-        channel: ChannelId,
-        variable_name: &str,
-        variable_value: &str,
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            variable = variable_name,
-            "rejected env request on channel"
-        );
-        let _ = variable_value;
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn x11_request(
-        &mut self,
-        channel: ChannelId,
-        single_connection: bool,
-        x11_auth_protocol: &str,
-        x11_auth_cookie: &str,
-        x11_screen_number: u32,
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected x11 request on channel"
-        );
-        let _ = (
-            single_connection,
-            x11_auth_protocol,
-            x11_auth_cookie,
-            x11_screen_number,
-        );
-        let _ = session.channel_failure(channel);
-        Ok(())
-    }
-
-    async fn agent_request(
-        &mut self,
-        channel: ChannelId,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            "rejected agent forwarding request on channel"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn tcpip_forward(
-        &mut self,
-        address: &str,
-        port: &mut u32,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            address = address,
-            port = *port,
-            "rejected tcpip-forward request (remote port forwarding not supported)"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn cancel_tcpip_forward(
-        &mut self,
-        address: &str,
-        port: u32,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        let _ = (address, port, session);
-        Ok(false)
-    }
-
-    async fn streamlocal_forward(
-        &mut self,
-        socket_path: &str,
-        session: &mut Session,
-    ) -> Result<bool, Self::Error> {
-        tracing::warn!(
-            remote_addr = ?self.remote_addr,
-            socket_path = socket_path,
-            "rejected streamlocal-forward request"
-        );
-        let _ = session;
-        Ok(false)
-    }
-
-    async fn signal(
-        &mut self,
-        channel: ChannelId,
-        signal: russh::Sig,
-        session: &mut Session,
-    ) -> Result<(), Self::Error> {
-        tracing::debug!(
-            remote_addr = ?self.remote_addr,
-            channel = %channel,
-            signal = ?signal,
-            "received signal on channel (ignored)"
-        );
-        let _ = session;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::auth::keys::KeySource;
-    use crate::auth::ServerAuthConfig;
-    use crate::config::AuthPolicy;
-    use russh::keys::{decode_secret_key, PrivateKey};
-    use std::io::Write;
-
-    const ED25519_PRIVATE_KEY: &str = "-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW\nQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01QAAAJiQ+NvMkPjb\nzAAAAAtzc2gtZWQyNTUxOQAAACBOfInDyRS33JEeDNT8xd10qRdwFN8z/QukCOgEIkv01Q\nAAAECIWwJf7+7MOuZAOOWmoQbE9i/5GxjKsFrtJHjZ34E/fk58icPJFLfckR4M1PzF3XSp\nF3AU3zP9C6QI6AQiS/TVAAAAD3VidW50dUBuczUyODA5NgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----\n";
-
-    const ED25519_PUBLIC_KEY: &str = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE58icPJFLfckR4M1PzF3XSpF3AU3zP9C6QI6AQiS/TV ubuntu@ns528096";
-
-    fn make_authorized_keys_file(keys_content: &str) -> tempfile::NamedTempFile {
-        let mut f = tempfile::NamedTempFile::new().unwrap();
-        f.write_all(keys_content.as_bytes()).unwrap();
-        f.flush().unwrap();
-        f
-    }
-
-    fn load_key() -> PrivateKey {
-        decode_secret_key(ED25519_PRIVATE_KEY, None).unwrap()
-    }
-
-    fn make_auth_config(keys_content: &str) -> Arc<ArcSwap<DynamicConfig>> {
-        let f = make_authorized_keys_file(keys_content);
-        let server_auth =
-            ServerAuthConfig::from_keys_and_ca(Some(KeySource::File(f.path().to_path_buf())), None)
-                .unwrap();
-        let auth_policy = AuthPolicy::from_server_auth_config(server_auth);
-        let dynamic = DynamicConfig::new(auth_policy);
-        Arc::new(ArcSwap::new(Arc::new(dynamic)))
-    }
-
-    fn make_empty_auth_config() -> Arc<ArcSwap<DynamicConfig>> {
-        let dynamic = DynamicConfig::default();
-        Arc::new(ArcSwap::new(Arc::new(dynamic)))
-    }
-
-    fn default_limiter() -> Arc<ConnectionRateLimiter> {
-        Arc::new(ConnectionRateLimiter::new(0))
-    }
-
-    fn make_handler(
-        dynamic: Arc<ArcSwap<DynamicConfig>>,
-        outbound_proxy: Option<ProxyConfig>,
-        remote_addr: Option<SocketAddr>,
-    ) -> ServerHandler {
-        ServerHandler::new(
-            dynamic,
-            outbound_proxy,
-            remote_addr,
-            TransportKind::Tcp,
-            default_limiter(),
-            10,
-        )
-    }
-
-    #[tokio::test]
-    async fn auth_delegation_accepts_known_key() {
-        let auth_config = make_auth_config(ED25519_PUBLIC_KEY);
-        let mut handler = make_handler(auth_config, None, None);
-
-        let ssh_key = load_key().public_key().clone();
-        let result = handler.auth_publickey("testuser", &ssh_key).await.unwrap();
-        assert_eq!(result, Auth::Accept);
-    }
-
-    #[tokio::test]
-    async fn auth_delegation_rejects_unknown_key() {
-        let auth_config = make_auth_config(ED25519_PUBLIC_KEY);
-        let mut handler = make_handler(auth_config, None, None);
-
-        let other_key_text = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHeLC1lWiCYrXsf/85O/pkbUFZ6OGIt49PX3nw8iRoXE other@host";
-        let other_ssh_key =
-            russh::keys::parse_public_key_base64(other_key_text.split_whitespace().nth(1).unwrap())
-                .unwrap();
-
-        let result = handler
-            .auth_publickey("testuser", &other_ssh_key)
-            .await
-            .unwrap();
-        assert_eq!(
-            result,
-            Auth::Reject {
-                proceed_with_methods: None
-            }
-        );
-    }
-
-    #[tokio::test]
-    async fn auth_delegation_empty_config_rejects_all() {
-        let auth_config = make_empty_auth_config();
-        let mut handler = make_handler(auth_config, None, None);
-
-        let ssh_key = load_key().public_key().clone();
-        let result = handler.auth_publickey("testuser", &ssh_key).await.unwrap();
-        assert_eq!(
-            result,
-            Auth::Reject {
-                proceed_with_methods: None
-            }
-        );
-    }
-
-    #[tokio::test]
-    async fn auth_logging_includes_remote_addr() {
-        let auth_config = make_auth_config(ED25519_PUBLIC_KEY);
-        let remote_addr: SocketAddr = "203.0.113.50:12345".parse().unwrap();
-        let mut handler = make_handler(auth_config, None, Some(remote_addr));
-
-        let ssh_key = load_key().public_key().clone();
-        let _ = handler.auth_publickey("root", &ssh_key).await.unwrap();
-    }
-
-    #[test]
-    fn reserved_alknet_destination_routing() {
-        use crate::server::control_channel::is_reserved_destination;
-        assert!(is_reserved_destination("alknet-control"));
-        assert!(is_reserved_destination("alknet-status"));
-        assert!(is_reserved_destination("alknet-events"));
-        assert!(!is_reserved_destination("example.com"));
-        assert!(!is_reserved_destination("localhost"));
-        assert!(!is_reserved_destination("alknet.example.com"));
-    }
-
-    #[test]
-    fn server_handler_without_control_handler_rejects_alknet_destinations() {
-        let auth_config = make_empty_auth_config();
-        let handler = make_handler(auth_config, None, None);
-        assert!(!handler.control_channel_router().has_handler());
-    }
-
-    #[test]
-    fn proxy_mode_variants() {
-        let direct = ProxyMode::Direct;
-        let socks5 = ProxyMode::Socks5("127.0.0.1:9050".parse().unwrap());
-        let http = ProxyMode::HttpConnect("127.0.0.1:8080".parse().unwrap());
-
-        match direct {
-            ProxyMode::Direct => {}
-            _ => panic!("expected Direct"),
-        }
-        match socks5 {
-            ProxyMode::Socks5(_) => {}
-            _ => panic!("expected Socks5"),
-        }
-        match http {
-            ProxyMode::HttpConnect(_) => {}
-            _ => panic!("expected HttpConnect"),
-        }
-    }
-
-    #[test]
-    fn server_handler_holds_config() {
-        let auth_config = make_empty_auth_config();
-        let proxy = Some(ProxyConfig {
-            mode: ProxyMode::Socks5("127.0.0.1:9050".parse().unwrap()),
-        });
-        let remote: Option<SocketAddr> = Some("10.0.0.1:22".parse().unwrap());
-
-        let handler = make_handler(auth_config, proxy.clone(), remote);
-        assert!(handler.outbound_proxy.is_some());
-        assert!(handler.remote_addr.is_some());
-    }
-
-    #[test]
-    fn one_handler_per_connection() {
-        let auth_config = make_empty_auth_config();
-        let handler1 = make_handler(
-            auth_config.clone(),
-            None,
-            Some("10.0.0.1:22".parse().unwrap()),
-        );
-        let handler2 = make_handler(
-            auth_config.clone(),
-            None,
-            Some("10.0.0.2:22".parse().unwrap()),
-        );
-
-        assert!(handler1.remote_addr != handler2.remote_addr);
-    }
-
-    #[tokio::test]
-    async fn auth_rate_limit_rejects_after_max_failures() {
-        let auth_config = make_empty_auth_config();
-        let limiter = Arc::new(ConnectionRateLimiter::new(0));
-        let mut handler = ServerHandler::new(
-            auth_config,
-            None,
-            Some("10.0.0.1:22".parse().unwrap()),
-            TransportKind::Tcp,
-            limiter,
-            2,
-        );
-
-        let ssh_key = load_key().public_key().clone();
-
-        let r1 = handler.auth_publickey("user", &ssh_key).await.unwrap();
-        assert_eq!(
-            r1,
-            Auth::Reject {
-                proceed_with_methods: None
-            }
-        );
-
-        let r2 = handler.auth_publickey("user", &ssh_key).await.unwrap();
-        assert_eq!(
-            r2,
-            Auth::Reject {
-                proceed_with_methods: None
-            }
-        );
-
-        assert!(!handler.auth_limiter.check());
-    }
-
-    #[test]
-    fn connection_rate_limit_blocks_over_limit() {
-        let limiter = Arc::new(ConnectionRateLimiter::new(1));
-        let auth_config = make_empty_auth_config();
-        let addr: SocketAddr = "10.0.0.1:22".parse().unwrap();
-
-        let h1 = ServerHandler::new(
-            auth_config.clone(),
-            None,
-            Some(addr),
-            TransportKind::Tcp,
-            limiter.clone(),
-            10,
-        );
-        assert!(h1.is_connection_allowed());
-
-        let h2 = ServerHandler::new(
-            auth_config.clone(),
-            None,
-            Some(addr),
-            TransportKind::Tcp,
-            limiter.clone(),
-            10,
-        );
-        assert!(!h2.is_connection_allowed());
-
-        drop(h1);
-
-        let h3 = ServerHandler::new(
-            auth_config,
-            None,
-            Some(addr),
-            TransportKind::Tcp,
-            limiter,
-            10,
-        );
-        assert!(h3.is_connection_allowed());
-    }
-
-    #[test]
-    fn transport_kind_display() {
-        assert_eq!(TransportKind::Tcp.to_string(), "tcp");
-        assert_eq!(TransportKind::Tls { server_name: None }.to_string(), "tls");
-        assert_eq!(
-            TransportKind::Iroh {
-                endpoint_id: String::new()
-            }
-            .to_string(),
-            "iroh"
-        );
-        assert_eq!(
-            TransportKind::WebTransport { server_name: None }.to_string(),
-            "webtransport"
-        );
-    }
-
-    #[tokio::test]
-    async fn auth_log_includes_user_field() {
-        let auth_config = make_empty_auth_config();
-        let mut handler = ServerHandler::new(
-            auth_config,
-            None,
-            Some("203.0.113.50:12345".parse().unwrap()),
-            TransportKind::Tls { server_name: None },
-            Arc::new(ConnectionRateLimiter::new(0)),
-            10,
-        );
-
-        let ssh_key = load_key().public_key().clone();
-        let _ = handler.auth_publickey("root", &ssh_key).await.unwrap();
-    }
-
-    #[test]
-    fn connection_closed_logs_duration_on_drop() {
-        let auth_config = make_empty_auth_config();
-        let _handler = ServerHandler::new(
-            auth_config,
-            None,
-            Some("203.0.113.50:12345".parse().unwrap()),
-            TransportKind::Tcp,
-            Arc::new(ConnectionRateLimiter::new(0)),
-            10,
-        );
-    }
-
-    #[tokio::test]
-    async fn config_reload_new_keys_take_effect() {
-        let auth_config = make_auth_config(ED25519_PUBLIC_KEY);
-        let mut handler = ServerHandler::new(
-            auth_config.clone(),
-            None,
-            None,
-            TransportKind::Tcp,
-            default_limiter(),
-            10,
-        );
-
-        let ssh_key = load_key().public_key().clone();
-        let result = handler.auth_publickey("testuser", &ssh_key).await.unwrap();
-        assert_eq!(result, Auth::Accept);
-        drop(handler);
-
-        let new_dynamic = DynamicConfig::default();
-        auth_config.store(Arc::new(new_dynamic));
-
-        let mut handler2 = ServerHandler::new(
-            auth_config.clone(),
-            None,
-            None,
-            TransportKind::Tcp,
-            default_limiter(),
-            10,
-        );
-
-        let result2 = handler2.auth_publickey("testuser", &ssh_key).await.unwrap();
-        assert_eq!(
-            result2,
-            Auth::Reject {
-                proceed_with_methods: None
-            }
-        );
-    }
-
-    #[tokio::test]
-    async fn forwarding_policy_deny_blocks_channel_open() {
-        use crate::config::forwarding::{
-            ForwardingAction, ForwardingPolicy, ForwardingRule, TargetPattern,
-        };
-
-        let deny_policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Host("blocked.example.com".to_string()),
-                action: ForwardingAction::Deny,
-                principals: vec![],
-                transports: vec![],
-            }],
-        };
-
-        let auth_config = make_auth_config(ED25519_PUBLIC_KEY);
-        {
-            let dynamic = auth_config.load();
-            let new_dynamic = DynamicConfig {
-                auth: dynamic.auth.clone(),
-                forwarding: deny_policy,
-                rate_limits: dynamic.rate_limits.clone(),
-                credentials: dynamic.credentials.clone(),
-            };
-            drop(dynamic);
-            auth_config.store(Arc::new(new_dynamic));
-        }
-
-        let mut handler = ServerHandler::new(
-            auth_config,
-            None,
-            Some("127.0.0.1:12345".parse().unwrap()),
-            TransportKind::Tcp,
-            default_limiter(),
-            10,
-        );
-
-        let ssh_key = load_key().public_key().clone();
-        let result = handler.auth_publickey("testuser", &ssh_key).await.unwrap();
-        assert_eq!(result, Auth::Accept);
-        assert!(handler.authenticated_identity().is_some());
-
-        let identity = handler.authenticated_identity().unwrap();
-        let dynamic = handler.dynamic.load();
-        assert!(!dynamic.forwarding.check(
-            "blocked.example.com",
-            443,
-            identity,
-            TransportKind::Tcp
-        ));
-    }
-
-    #[test]
-    fn forwarding_policy_deny_with_custom_identity() {
-        use crate::config::forwarding::{
-            ForwardingAction, ForwardingPolicy, ForwardingRule, TargetPattern,
-        };
-        use std::collections::HashMap;
-
-        let mut resources = HashMap::new();
-        resources.insert("service".to_string(), vec!["gitea".to_string()]);
-        let identity = Identity {
-            id: "SHA256:abc123".to_string(),
-            scopes: vec!["relay:connect".to_string()],
-            resources,
-        };
-
-        let policy = ForwardingPolicy {
-            default: ForwardingAction::Deny,
-            rules: vec![ForwardingRule {
-                target: TargetPattern::Host("allowed.example.com".to_string()),
-                action: ForwardingAction::Allow,
-                principals: vec!["SHA256:abc123".to_string()],
-                transports: vec![TransportKind::Tcp],
-            }],
-        };
-
-        assert!(policy.check("allowed.example.com", 443, &identity, TransportKind::Tcp));
-        assert!(!policy.check("denied.example.com", 443, &identity, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn server_handler_with_custom_identity_provider() {
-        use std::collections::HashMap;
-
-        struct MockIdentityProvider {
-            identities: HashMap<String, Identity>,
-        }
-
-        impl IdentityProvider for MockIdentityProvider {
-            fn resolve_from_fingerprint(&self, fingerprint: &str) -> Option<Identity> {
-                self.identities.get(fingerprint).cloned()
-            }
-
-            fn resolve_from_token(&self, _token: &crate::auth::AuthToken) -> Option<Identity> {
-                None
-            }
-        }
-
-        let mut identities = HashMap::new();
-        identities.insert(
-            "SHA256:testkey".to_string(),
-            Identity {
-                id: "SHA256:testkey".to_string(),
-                scopes: vec!["admin".to_string()],
-                resources: HashMap::new(),
-            },
-        );
-
-        let provider = Arc::new(MockIdentityProvider { identities }) as Arc<dyn IdentityProvider>;
-        let dynamic = make_empty_auth_config();
-
-        let handler = ServerHandler::new(
-            dynamic,
-            None,
-            Some("10.0.0.1:22".parse().unwrap()),
-            TransportKind::Tcp,
-            default_limiter(),
-            10,
-        )
-        .with_identity_provider(provider);
-
-        assert!(handler.authenticated_identity().is_none());
-    }
-}

crates/alknet-core/src/server/mod.rs

@@ -1,33 +0,0 @@
-//! Server-side SSH connection handling.
-//!
-//! Provides `Server` for accepting SSH connections over any transport and proxying
-//! `direct-tcpip` channel requests to targets. Supports Ed25519 and certificate-authority
-//! auth, connection rate limiting, auth attempt limiting, stealth mode (fake nginx 404),
-//! and outbound proxy routing (direct/SOCKS5/HTTP CONNECT).
-//!
-//! Destination hosts starting with `alknet-` are reserved for internal use (control channel, ADR-018).
-
-pub mod channel_proxy;
-pub mod control_channel;
-pub mod handler;
-pub mod rate_limit;
-pub mod serve;
-pub mod stealth;
-
-pub use channel_proxy::{connect_outbound, proxy_channel};
-pub use control_channel::{
-    is_reserved_destination, ControlChannelHandler, ControlChannelRouter, DuplexStream,
-    ALKNET_CONTROL_DESTINATION, ALKNET_PREFIX,
-};
-pub use handler::{ProxyConfig, ProxyMode, ServerHandler};
-pub use rate_limit::{AuthAttemptLimiter, ConnectionRateLimiter};
-pub use serve::{
-    DnsListenerConfig, HttpListenerConfig, ListenerConfig, ServeError, ServeOptions,
-    ServeTransportMode, Server, StreamListenerConfig,
-};
-
-pub use crate::transport::TransportKind;
-pub use stealth::{
-    detect_protocol, handle_http_stealth, send_fake_nginx_404, validate_stealth_config,
-    ProtocolDetection,
-};

crates/alknet-core/src/server/rate_limit.rs

@@ -1,200 +0,0 @@
-//! Connection rate limiting and auth attempt limiting.
-//!
-//! `ConnectionRateLimiter` tracks per-IP active connections (thread-safe).
-//! `AuthAttemptLimiter` caps failed auth attempts per connection.
-//! These complement fail2ban on Linux and provide abuse protection on all platforms.
-//! See ADR-013.
-
-use std::collections::HashMap;
-use std::net::IpAddr;
-use std::sync::Mutex;
-
-pub struct ConnectionRateLimiter {
-    max_per_ip: usize,
-    active: Mutex<HashMap<IpAddr, usize>>,
-}
-
-impl ConnectionRateLimiter {
-    pub fn new(max_per_ip: usize) -> Self {
-        Self {
-            max_per_ip,
-            active: Mutex::new(HashMap::new()),
-        }
-    }
-
-    pub fn check(&self, ip: IpAddr) -> bool {
-        if self.max_per_ip == 0 {
-            return true;
-        }
-        let active = self.active.lock().unwrap();
-        let count = active.get(&ip).copied().unwrap_or(0);
-        count < self.max_per_ip
-    }
-
-    pub fn on_connect(&self, ip: IpAddr) {
-        let mut active = self.active.lock().unwrap();
-        *active.entry(ip).or_insert(0) += 1;
-    }
-
-    pub fn on_disconnect(&self, ip: IpAddr) {
-        let mut active = self.active.lock().unwrap();
-        if let Some(count) = active.get_mut(&ip) {
-            if *count > 1 {
-                *count -= 1;
-            } else {
-                active.remove(&ip);
-            }
-        }
-    }
-}
-
-pub struct AuthAttemptLimiter {
-    max_attempts: usize,
-    failures: usize,
-}
-
-impl AuthAttemptLimiter {
-    pub fn new(max_attempts: usize) -> Self {
-        Self {
-            max_attempts,
-            failures: 0,
-        }
-    }
-
-    pub fn check(&self) -> bool {
-        if self.max_attempts == 0 {
-            return true;
-        }
-        self.failures < self.max_attempts
-    }
-
-    pub fn on_failure(&mut self) {
-        self.failures += 1;
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::net::{IpAddr, Ipv4Addr, Ipv6Addr};
-
-    fn ip(n: u8) -> IpAddr {
-        IpAddr::V4(Ipv4Addr::new(192, 168, 1, n))
-    }
-
-    #[test]
-    fn connection_limiter_allows_when_under_limit() {
-        let limiter = ConnectionRateLimiter::new(3);
-        assert!(limiter.check(ip(1)));
-    }
-
-    #[test]
-    fn connection_limiter_blocks_when_at_limit() {
-        let limiter = ConnectionRateLimiter::new(2);
-        limiter.on_connect(ip(1));
-        limiter.on_connect(ip(1));
-        assert!(!limiter.check(ip(1)));
-    }
-
-    #[test]
-    fn connection_limiter_allows_after_disconnect() {
-        let limiter = ConnectionRateLimiter::new(2);
-        limiter.on_connect(ip(1));
-        limiter.on_connect(ip(1));
-        assert!(!limiter.check(ip(1)));
-        limiter.on_disconnect(ip(1));
-        assert!(limiter.check(ip(1)));
-    }
-
-    #[test]
-    fn connection_limiter_unlimited_when_zero() {
-        let limiter = ConnectionRateLimiter::new(0);
-        for _ in 0..100 {
-            limiter.on_connect(ip(1));
-        }
-        assert!(limiter.check(ip(1)));
-    }
-
-    #[test]
-    fn connection_limiter_tracks_per_ip_independently() {
-        let limiter = ConnectionRateLimiter::new(1);
-        limiter.on_connect(ip(1));
-        assert!(!limiter.check(ip(1)));
-        assert!(limiter.check(ip(2)));
-    }
-
-    #[test]
-    fn connection_limiter_ipv6() {
-        let limiter = ConnectionRateLimiter::new(1);
-        let ip6 = IpAddr::V6(Ipv6Addr::LOCALHOST);
-        limiter.on_connect(ip6);
-        assert!(!limiter.check(ip6));
-    }
-
-    #[test]
-    fn connection_limiter_disconnect_removes_zero_entry() {
-        let limiter = ConnectionRateLimiter::new(3);
-        limiter.on_connect(ip(1));
-        limiter.on_disconnect(ip(1));
-        {
-            let active = limiter.active.lock().unwrap();
-            assert!(!active.contains_key(&ip(1)));
-        }
-    }
-
-    #[test]
-    fn auth_limiter_allows_when_under_limit() {
-        let limiter = AuthAttemptLimiter::new(3);
-        assert!(limiter.check());
-    }
-
-    #[test]
-    fn auth_limiter_blocks_after_max_failures() {
-        let mut limiter = AuthAttemptLimiter::new(2);
-        limiter.on_failure();
-        limiter.on_failure();
-        assert!(!limiter.check());
-    }
-
-    #[test]
-    fn auth_limiter_unlimited_when_zero() {
-        let mut limiter = AuthAttemptLimiter::new(0);
-        for _ in 0..100 {
-            limiter.on_failure();
-        }
-        assert!(limiter.check());
-    }
-
-    #[test]
-    fn auth_limiter_still_allows_at_one_below_limit() {
-        let mut limiter = AuthAttemptLimiter::new(3);
-        limiter.on_failure();
-        limiter.on_failure();
-        assert!(limiter.check());
-        limiter.on_failure();
-        assert!(!limiter.check());
-    }
-
-    #[test]
-    fn connection_limiter_thread_safety() {
-        use std::sync::Arc;
-        use std::thread;
-
-        let limiter = Arc::new(ConnectionRateLimiter::new(100));
-        let mut handles = vec![];
-
-        for i in 0..10 {
-            let lim = Arc::clone(&limiter);
-            handles.push(thread::spawn(move || {
-                let ip_addr = ip((i % 3) as u8 + 1);
-                lim.on_connect(ip_addr);
-                assert!(lim.check(ip_addr));
-                lim.on_disconnect(ip_addr);
-            }));
-        }
-
-        for h in handles {
-            h.join().unwrap();
-        }
-    }
-}

crates/alknet-core/src/server/stealth.rs

@@ -1,316 +0,0 @@
-//! Stealth mode: protocol detection on TLS connections.
-//!
-//! When stealth mode is enabled with TLS transport, the server peeks at the first
-//! bytes after the TLS handshake to determine whether the client is speaking SSH
-//! or HTTP. When the `http` feature is enabled, detected HTTP traffic is routed to
-//! the axum router. When `http` is disabled, non-SSH connections receive a fake
-//! nginx 404 response, making the server appear as an ordinary web server to port
-//! scanners and DPI systems. See ADR-017.
-
-use std::sync::Arc;
-
-use tokio::io::{AsyncBufReadExt, AsyncRead, AsyncWrite, AsyncWriteExt, BufReader};
-
-use crate::auth::IdentityProvider;
-
-const SSH_BANNER_PREFIX: &[u8] = b"SSH-2.0-";
-const FAKE_NGINX_404: &[u8] = b"HTTP/1.1 404 Not Found\r\nServer: nginx\r\n\r\n";
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ProtocolDetection {
-    Ssh,
-    Http,
-}
-
-pub async fn detect_protocol<S>(stream: S) -> (ProtocolDetection, BufReader<S>)
-where
-    S: AsyncRead + Unpin,
-{
-    let mut reader = BufReader::new(stream);
-
-    let detection = match reader.fill_buf().await {
-        Ok(buf) if buf.len() >= SSH_BANNER_PREFIX.len() => {
-            if &buf[..SSH_BANNER_PREFIX.len()] == SSH_BANNER_PREFIX {
-                ProtocolDetection::Ssh
-            } else {
-                ProtocolDetection::Http
-            }
-        }
-        Ok(buf) if !buf.is_empty() => {
-            if buf.starts_with(SSH_BANNER_PREFIX) {
-                ProtocolDetection::Ssh
-            } else {
-                ProtocolDetection::Http
-            }
-        }
-        _ => ProtocolDetection::Http,
-    };
-
-    (detection, reader)
-}
-
-pub async fn send_fake_nginx_404<S>(reader: &mut BufReader<S>)
-where
-    S: AsyncRead + AsyncWrite + Unpin,
-{
-    let _ = reader.get_mut().write_all(FAKE_NGINX_404).await;
-    let _ = reader.get_mut().shutdown().await;
-}
-
-#[cfg(feature = "http")]
-pub async fn handle_http_stealth<S>(
-    reader: BufReader<S>,
-    identity_provider: Arc<dyn IdentityProvider>,
-) where
-    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
-{
-    crate::http::router::serve_connection_from_reader(reader, identity_provider).await
-}
-
-#[cfg(not(feature = "http"))]
-pub async fn handle_http_stealth<S>(
-    mut reader: BufReader<S>,
-    _identity_provider: Arc<dyn IdentityProvider>,
-) where
-    S: AsyncRead + AsyncWrite + Unpin,
-{
-    send_fake_nginx_404(&mut reader).await
-}
-
-pub fn validate_stealth_config(stealth: bool, transport_is_tls: bool) -> Result<(), &'static str> {
-    if stealth && !transport_is_tls {
-        return Err("stealth mode requires TLS transport (--transport tls)");
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{duplex, AsyncReadExt, AsyncWriteExt};
-
-    async fn write_and_detect(data: &[u8]) -> ProtocolDetection {
-        let (client, server) = duplex(1024);
-        let mut client = client;
-
-        client.write_all(data).await.unwrap();
-        drop(client);
-
-        let (detection, _) = detect_protocol(server).await;
-        detection
-    }
-
-    #[tokio::test]
-    async fn ssh_banner_detected() {
-        let detection = write_and_detect(b"SSH-2.0-OpenSSH_9.0\r\n").await;
-        assert_eq!(detection, ProtocolDetection::Ssh);
-    }
-
-    #[tokio::test]
-    async fn ssh_banner_other_implementation() {
-        let detection = write_and_detect(b"SSH-2.0-russh_0.49\r\n").await;
-        assert_eq!(detection, ProtocolDetection::Ssh);
-    }
-
-    #[tokio::test]
-    async fn ssh_banner_minimal() {
-        let detection = write_and_detect(b"SSH-2.0-X\n").await;
-        assert_eq!(detection, ProtocolDetection::Ssh);
-    }
-
-    #[tokio::test]
-    async fn http_get_detected_as_http() {
-        let detection = write_and_detect(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n").await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn http_post_detected_as_http() {
-        let detection = write_and_detect(b"POST /api HTTP/1.1\r\nHost: example.com\r\n\r\n").await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn random_data_detected_as_http() {
-        let detection = write_and_detect(b"\x01\x02\x03\x04\x05\x06\x07\x08").await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn empty_stream_detected_as_http() {
-        let (client, server) = duplex(1024);
-        drop(client);
-        let (detection, _) = detect_protocol(server).await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn ssh_banner_bytes_preserved_by_bufreader() {
-        let (client, server) = duplex(1024);
-        let mut client = client;
-
-        let banner = b"SSH-2.0-OpenSSH_9.0\r\n";
-        client.write_all(banner).await.unwrap();
-        client.write_all(b"subsequent data").await.unwrap();
-        drop(client);
-
-        let (detection, mut reader) = detect_protocol(server).await;
-        assert_eq!(detection, ProtocolDetection::Ssh);
-
-        let mut all_data = Vec::new();
-        reader.read_to_end(&mut all_data).await.unwrap();
-        assert!(
-            all_data.starts_with(banner),
-            "banner bytes must be preserved after detection"
-        );
-    }
-
-    #[tokio::test]
-    async fn fake_nginx_404_response() {
-        let (client, server) = duplex(1024);
-        let (mut client_read, mut client_write) = tokio::io::split(client);
-
-        client_write
-            .write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
-            .await
-            .unwrap();
-        drop(client_write);
-
-        let (detection, mut reader) = detect_protocol(server).await;
-        assert_eq!(detection, ProtocolDetection::Http);
-
-        send_fake_nginx_404(&mut reader).await;
-
-        let mut buf = [0u8; 256];
-        let n = client_read.read(&mut buf).await.unwrap();
-        let response = String::from_utf8_lossy(&buf[..n]);
-        assert!(response.contains("HTTP/1.1 404 Not Found"));
-        assert!(response.contains("Server: nginx"));
-    }
-
-    #[tokio::test]
-    async fn protocol_detection_enum_equality() {
-        assert_eq!(ProtocolDetection::Ssh, ProtocolDetection::Ssh);
-        assert_eq!(ProtocolDetection::Http, ProtocolDetection::Http);
-        assert_ne!(ProtocolDetection::Ssh, ProtocolDetection::Http);
-    }
-
-    #[test]
-    fn validate_stealth_without_tls_rejected() {
-        let result = validate_stealth_config(true, false);
-        assert!(result.is_err());
-        assert!(result.unwrap_err().contains("TLS transport"));
-    }
-
-    #[test]
-    fn validate_stealth_with_tls_accepted() {
-        let result = validate_stealth_config(true, true);
-        assert!(result.is_ok());
-    }
-
-    #[test]
-    fn validate_no_stealth_with_tcp_accepted() {
-        let result = validate_stealth_config(false, false);
-        assert!(result.is_ok());
-    }
-
-    #[test]
-    fn validate_no_stealth_with_tls_accepted() {
-        let result = validate_stealth_config(false, true);
-        assert!(result.is_ok());
-    }
-
-    #[tokio::test]
-    async fn short_data_detected_as_http() {
-        let detection = write_and_detect(b"GE").await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn partial_ssh_prefix_detected_as_http() {
-        let detection = write_and_detect(b"SSH-1.").await;
-        assert_eq!(detection, ProtocolDetection::Http);
-    }
-
-    #[tokio::test]
-    async fn http_request_gets_404_then_closed() {
-        let (client, server) = duplex(1024);
-        let mut client = client;
-
-        client
-            .write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")
-            .await
-            .unwrap();
-
-        let (detection, mut reader) = detect_protocol(server).await;
-        assert_eq!(detection, ProtocolDetection::Http);
-
-        send_fake_nginx_404(&mut reader).await;
-
-        let mut buf = [0u8; 256];
-        let n = client.read(&mut buf).await.unwrap();
-        let response = String::from_utf8_lossy(&buf[..n]);
-        assert!(response.starts_with("HTTP/1.1 404 Not Found"));
-        assert!(response.contains("Server: nginx"));
-
-        let mut extra = [0u8; 16];
-        let result = client.read(&mut extra).await;
-        assert!(result.is_err() || result.unwrap() == 0);
-    }
-
-    #[cfg(feature = "http")]
-    #[tokio::test]
-    async fn stealth_handoff_routes_http_to_axum() {
-        use crate::auth::{AuthToken, IdentityProvider};
-        use std::sync::Arc;
-        use tokio::io::AsyncWriteExt;
-
-        struct NullProvider;
-
-        impl IdentityProvider for NullProvider {
-            fn resolve_from_fingerprint(
-                &self,
-                _fingerprint: &str,
-            ) -> Option<crate::auth::Identity> {
-                None
-            }
-
-            fn resolve_from_token(&self, _token: &AuthToken) -> Option<crate::auth::Identity> {
-                None
-            }
-        }
-
-        let (client, server) = duplex(4096);
-        let (mut client_read, mut client_write) = tokio::io::split(client);
-
-        client_write
-            .write_all(b"GET / HTTP/1.1\r\nHost: example.com\r\nConnection: close\r\n\r\n")
-            .await
-            .unwrap();
-        drop(client_write);
-
-        let (detection, reader) = detect_protocol(server).await;
-        assert_eq!(detection, ProtocolDetection::Http);
-
-        let provider: Arc<dyn IdentityProvider> = Arc::new(NullProvider);
-        let handle = tokio::spawn(async move {
-            handle_http_stealth(reader, provider).await;
-        });
-
-        let mut buf = Vec::new();
-        tokio::io::AsyncReadExt::read_to_end(&mut client_read, &mut buf)
-            .await
-            .unwrap();
-        let response = String::from_utf8_lossy(&buf);
-        assert!(
-            response.contains("401"),
-            "expected 401 from axum auth middleware, got: {response}"
-        );
-        assert!(
-            !response.contains("nginx"),
-            "should not contain fake nginx response when http feature is enabled"
-        );
-
-        let _ = handle.await;
-    }
-}

crates/alknet-core/src/socks5/mod.rs

@@ -1,490 +0,0 @@
-//! SOCKS5 proxy server.
-//!
-//! Listens on a local port and routes each SOCKS5 connection through an SSH
-//! `direct-tcpip` channel. Supports SOCKS5h (domain names resolved server-side)
-//! to prevent DNS leaks. Uses the `ChannelOpener` trait to abstract over the
-//! SSH channel mechanism, making it testable without a real SSH session.
-
-mod protocol;
-
-use std::net::SocketAddr;
-use std::sync::Arc;
-
-use tokio::io::{AsyncRead, AsyncWrite, AsyncWriteExt};
-use tokio::net::TcpListener;
-use tokio::sync::Mutex;
-use tracing::debug;
-
-use protocol::{Socks5Reply, Socks5Request, Socks5VersionMethod};
-
-pub use protocol::Socks5Address;
-
-const DEFAULT_SOCKS5_ADDR: &str = "127.0.0.1:1080";
-
-pub trait ChannelOpener: Send + Sync + 'static {
-    type Stream: AsyncRead + AsyncWrite + Unpin + Send + 'static;
-
-    fn open_channel(
-        &self,
-        host: String,
-        port: u16,
-    ) -> impl std::future::Future<Output = Result<Self::Stream, ChannelOpenError>> + Send;
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum ChannelOpenError {
-    #[error("session closed")]
-    SessionClosed,
-    #[error("channel open failed")]
-    ChannelOpenFailed,
-    #[error("connection refused")]
-    ConnectionRefused,
-}
-
-pub struct Socks5Server<C: ChannelOpener> {
-    listen_addr: SocketAddr,
-    channel_opener: Arc<C>,
-}
-
-impl<C: ChannelOpener> Socks5Server<C> {
-    pub fn new(channel_opener: C) -> Self {
-        Self::with_addr(channel_opener, DEFAULT_SOCKS5_ADDR)
-    }
-
-    pub fn with_addr(channel_opener: C, addr: &str) -> Self {
-        let listen_addr: SocketAddr = addr.parse().expect("invalid SOCKS5 listen address");
-        Self {
-            listen_addr,
-            channel_opener: Arc::new(channel_opener),
-        }
-    }
-
-    pub fn listen_addr(&self) -> SocketAddr {
-        self.listen_addr
-    }
-
-    pub async fn run(self) -> Result<(), std::io::Error> {
-        let listener = TcpListener::bind(self.listen_addr).await?;
-        debug!("socks5 server listening on {}", self.listen_addr);
-        loop {
-            let (socket, _peer) = listener.accept().await?;
-            let opener = Arc::clone(&self.channel_opener);
-            tokio::spawn(async move {
-                if let Err(e) = handle_socks5_connection(socket, opener).await {
-                    debug!("socks5 connection error: {e}");
-                }
-            });
-        }
-    }
-}
-
-async fn handle_socks5_connection<S, C>(mut socket: S, opener: Arc<C>) -> Result<(), Socks5Error>
-where
-    S: AsyncRead + AsyncWrite + Unpin,
-    C: ChannelOpener,
-{
-    let vm = Socks5VersionMethod::read_from(&mut socket).await?;
-    if vm.version != 0x05 {
-        return Err(Socks5Error::InvalidVersion(vm.version));
-    }
-    if !vm.methods.contains(&0x00) {
-        let reply = [0x05, 0xFF];
-        socket.write_all(&reply).await?;
-        socket.shutdown().await?;
-        return Err(Socks5Error::NoAcceptableAuth);
-    }
-    let reply = [0x05, 0x00];
-    socket.write_all(&reply).await?;
-
-    let request = Socks5Request::read_from(&mut socket).await?;
-    if request.version != 0x05 {
-        return Err(Socks5Error::InvalidVersion(request.version));
-    }
-    if request.command != 0x01 {
-        send_error_reply(&mut socket, Socks5Reply::command_not_supported()).await?;
-        return Err(Socks5Error::UnsupportedCommand(request.command));
-    }
-
-    let (host, port) = match &request.address {
-        Socks5Address::Ipv4(addr) => (addr.to_string(), request.port),
-        Socks5Address::Ipv6(addr) => (addr.to_string(), request.port),
-        Socks5Address::Domain(name) => (name.clone(), request.port),
-    };
-
-    match opener.open_channel(host, port).await {
-        Ok(mut ssh_stream) => {
-            let bind_addr = Socks5Address::Ipv4(std::net::Ipv4Addr::UNSPECIFIED);
-            let reply = Socks5Reply::success(bind_addr, 0);
-            reply.write_to(&mut socket).await?;
-            tokio::io::copy_bidirectional(&mut socket, &mut ssh_stream).await?;
-            Ok(())
-        }
-        Err(_) => {
-            send_error_reply(&mut socket, Socks5Reply::connection_refused()).await?;
-            Err(Socks5Error::ChannelOpenFailed)
-        }
-    }
-}
-
-async fn send_error_reply<S: AsyncRead + AsyncWrite + Unpin>(
-    socket: &mut S,
-    reply: Socks5Reply,
-) -> Result<(), Socks5Error> {
-    reply.write_to(socket).await?;
-    let _ = socket.shutdown().await;
-    Ok(())
-}
-
-#[derive(Debug, thiserror::Error)]
-pub enum Socks5Error {
-    #[error("invalid SOCKS version: {0}")]
-    InvalidVersion(u8),
-    #[error("no acceptable auth method")]
-    NoAcceptableAuth,
-    #[error("unsupported command: {0}")]
-    UnsupportedCommand(u8),
-    #[error("channel open failed")]
-    ChannelOpenFailed,
-    #[error("io error")]
-    Io(#[from] std::io::Error),
-}
-
-pub struct HandleChannelOpener<H: russh::client::Handler> {
-    handle: Arc<Mutex<russh::client::Handle<H>>>,
-}
-
-impl<H: russh::client::Handler> HandleChannelOpener<H> {
-    pub fn new(handle: russh::client::Handle<H>) -> Self {
-        Self {
-            handle: Arc::new(Mutex::new(handle)),
-        }
-    }
-
-    pub fn from_arc(handle: Arc<Mutex<russh::client::Handle<H>>>) -> Self {
-        Self { handle }
-    }
-}
-
-impl<H: russh::client::Handler + Send + Sync + 'static> ChannelOpener for HandleChannelOpener<H> {
-    type Stream = russh::ChannelStream<russh::client::Msg>;
-
-    async fn open_channel(
-        &self,
-        host: String,
-        port: u16,
-    ) -> Result<Self::Stream, ChannelOpenError> {
-        let handle = self.handle.lock().await;
-        if handle.is_closed() {
-            return Err(ChannelOpenError::SessionClosed);
-        }
-        let channel = handle
-            .channel_open_direct_tcpip(host, port as u32, "127.0.0.1", 0)
-            .await
-            .map_err(|_| ChannelOpenError::ChannelOpenFailed)?;
-        Ok(channel.into_stream())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{duplex, AsyncReadExt, AsyncWriteExt, DuplexStream};
-
-    struct MockChannelOpener {
-        fail: bool,
-    }
-
-    impl ChannelOpener for MockChannelOpener {
-        type Stream = DuplexStream;
-
-        async fn open_channel(
-            &self,
-            _host: String,
-            _port: u16,
-        ) -> Result<Self::Stream, ChannelOpenError> {
-            if self.fail {
-                Err(ChannelOpenError::ChannelOpenFailed)
-            } else {
-                let (client, _server) = duplex(4096);
-                Ok(client)
-            }
-        }
-    }
-
-    fn build_socks5_greeting(methods: &[u8]) -> Vec<u8> {
-        let mut buf = vec![0x05, methods.len() as u8];
-        buf.extend_from_slice(methods);
-        buf
-    }
-
-    fn build_socks5_connect_ipv4(addr: [u8; 4], port: u16) -> Vec<u8> {
-        let mut buf = vec![0x05, 0x01, 0x00, 0x01];
-        buf.extend_from_slice(&addr);
-        buf.extend_from_slice(&port.to_be_bytes());
-        buf
-    }
-
-    fn build_socks5_connect_domain(domain: &str, port: u16) -> Vec<u8> {
-        let mut buf = vec![0x05, 0x01, 0x00, 0x03];
-        buf.push(domain.len() as u8);
-        buf.extend_from_slice(domain.as_bytes());
-        buf.extend_from_slice(&port.to_be_bytes());
-        buf
-    }
-
-    fn build_socks5_connect_ipv6(addr: [u8; 16], port: u16) -> Vec<u8> {
-        let mut buf = vec![0x05, 0x01, 0x00, 0x04];
-        buf.extend_from_slice(&addr);
-        buf.extend_from_slice(&port.to_be_bytes());
-        buf
-    }
-
-    async fn do_handshake(client: &mut DuplexStream) -> [u8; 2] {
-        client
-            .write_all(&build_socks5_greeting(&[0x00]))
-            .await
-            .unwrap();
-        client.flush().await.unwrap();
-        let mut resp = [0u8; 2];
-        client.read_exact(&mut resp).await.unwrap();
-        resp
-    }
-
-    async fn do_connect_ipv4(client: &mut DuplexStream, addr: [u8; 4], port: u16) -> Vec<u8> {
-        client
-            .write_all(&build_socks5_connect_ipv4(addr, port))
-            .await
-            .unwrap();
-        client.flush().await.unwrap();
-        let mut reply_buf = [0u8; 10];
-        client.read_exact(&mut reply_buf).await.unwrap();
-        reply_buf.to_vec()
-    }
-
-    #[tokio::test]
-    async fn handshake_no_auth_method() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        let resp = do_handshake(&mut client).await;
-        assert_eq!(resp, [0x05, 0x00]);
-
-        let reply_buf = do_connect_ipv4(&mut client, [127, 0, 0, 1], 80).await;
-        assert_eq!(reply_buf[0], 0x05);
-        assert_eq!(reply_buf[1], 0x00);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn handshake_rejects_no_acceptable_method() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        client
-            .write_all(&build_socks5_greeting(&[0x02]))
-            .await
-            .unwrap();
-        client.flush().await.unwrap();
-
-        let mut resp = [0u8; 2];
-        client.read_exact(&mut resp).await.unwrap();
-        assert_eq!(resp, [0x05, 0xFF]);
-
-        drop(client);
-        let result = server_handle.await.unwrap();
-        assert!(result.is_err());
-        assert!(matches!(result.unwrap_err(), Socks5Error::NoAcceptableAuth));
-    }
-
-    #[tokio::test]
-    async fn address_type_ipv4() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        do_handshake(&mut client).await;
-        let reply_buf = do_connect_ipv4(&mut client, [10, 0, 0, 1], 443).await;
-        assert_eq!(reply_buf[1], 0x00);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn address_type_domain() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        do_handshake(&mut client).await;
-
-        client
-            .write_all(&build_socks5_connect_domain("example.com", 443))
-            .await
-            .unwrap();
-        client.flush().await.unwrap();
-
-        let mut reply_buf = [0u8; 10];
-        client.read_exact(&mut reply_buf).await.unwrap();
-        assert_eq!(reply_buf[1], 0x00);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn address_type_ipv6() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        do_handshake(&mut client).await;
-
-        let ipv6_addr = [0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1];
-        client
-            .write_all(&build_socks5_connect_ipv6(ipv6_addr, 443))
-            .await
-            .unwrap();
-        client.flush().await.unwrap();
-
-        let mut reply_buf = [0u8; 10];
-        client.read_exact(&mut reply_buf).await.unwrap();
-        assert_eq!(reply_buf[0], 0x05);
-        assert_eq!(reply_buf[1], 0x00);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn channel_open_failure_returns_socks5_error() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: true };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        do_handshake(&mut client).await;
-        let reply_buf = do_connect_ipv4(&mut client, [10, 0, 0, 1], 80).await;
-        assert_eq!(reply_buf[0], 0x05);
-        assert_eq!(reply_buf[1], 0x05);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn unsupported_command_returns_error() {
-        let (mut client, server) = duplex(4096);
-        let opener = MockChannelOpener { fail: false };
-
-        let server_handle =
-            tokio::spawn(async move { handle_socks5_connection(server, Arc::new(opener)).await });
-
-        do_handshake(&mut client).await;
-
-        let mut bind_req = vec![0x05, 0x02, 0x00, 0x01];
-        bind_req.extend_from_slice(&[127, 0, 0, 1]);
-        bind_req.extend_from_slice(&80u16.to_be_bytes());
-        client.write_all(&bind_req).await.unwrap();
-        client.flush().await.unwrap();
-
-        let mut reply_buf = [0u8; 10];
-        client.read_exact(&mut reply_buf).await.unwrap();
-        assert_eq!(reply_buf[1], 0x07);
-
-        drop(client);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn bidirectional_proxy_flow() {
-        let (mut client_sock, server_sock) = duplex(4096);
-        let (ssh_client, mut ssh_server) = duplex(4096);
-
-        let ssh_stream = Arc::new(Mutex::new(Some(ssh_client)));
-
-        struct ProxyOpener {
-            stream: Arc<Mutex<Option<DuplexStream>>>,
-        }
-
-        impl ChannelOpener for ProxyOpener {
-            type Stream = DuplexStream;
-
-            async fn open_channel(
-                &self,
-                _host: String,
-                _port: u16,
-            ) -> Result<Self::Stream, ChannelOpenError> {
-                self.stream
-                    .lock()
-                    .await
-                    .take()
-                    .ok_or(ChannelOpenError::ChannelOpenFailed)
-            }
-        }
-
-        let opener = ProxyOpener {
-            stream: Arc::clone(&ssh_stream),
-        };
-
-        let server_handle =
-            tokio::spawn(
-                async move { handle_socks5_connection(server_sock, Arc::new(opener)).await },
-            );
-
-        do_handshake(&mut client_sock).await;
-        let reply_buf = do_connect_ipv4(&mut client_sock, [127, 0, 0, 1], 80).await;
-        assert_eq!(reply_buf[1], 0x00);
-
-        let test_data = b"hello through tunnel";
-        client_sock.write_all(test_data).await.unwrap();
-        client_sock.flush().await.unwrap();
-
-        let mut received = vec![0u8; test_data.len()];
-        AsyncReadExt::read_exact(&mut ssh_server, &mut received)
-            .await
-            .unwrap();
-        assert_eq!(&received, test_data);
-
-        let echo_data = b"response from tunnel";
-        ssh_server.write_all(echo_data).await.unwrap();
-        ssh_server.flush().await.unwrap();
-
-        let mut received_back = vec![0u8; echo_data.len()];
-        client_sock.read_exact(&mut received_back).await.unwrap();
-        assert_eq!(&received_back, echo_data);
-
-        drop(client_sock);
-        drop(ssh_server);
-        let _ = server_handle.await;
-    }
-
-    #[tokio::test]
-    async fn default_listen_address() {
-        let opener = MockChannelOpener { fail: false };
-        let server = Socks5Server::new(opener);
-        assert_eq!(server.listen_addr(), "127.0.0.1:1080".parse().unwrap());
-    }
-
-    #[tokio::test]
-    async fn custom_listen_address() {
-        let opener = MockChannelOpener { fail: false };
-        let server = Socks5Server::with_addr(opener, "127.0.0.1:9050");
-        assert_eq!(server.listen_addr(), "127.0.0.1:9050".parse().unwrap());
-    }
-}

crates/alknet-core/src/socks5/protocol.rs

@@ -1,304 +0,0 @@
-use std::net::{Ipv4Addr, Ipv6Addr};
-
-use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
-
-#[derive(Debug, Clone, PartialEq)]
-pub enum Socks5Address {
-    Ipv4(Ipv4Addr),
-    Ipv6(Ipv6Addr),
-    Domain(String),
-}
-
-#[derive(Debug)]
-pub struct Socks5VersionMethod {
-    pub version: u8,
-    pub methods: Vec<u8>,
-}
-
-impl Socks5VersionMethod {
-    pub async fn read_from<R: AsyncRead + Unpin>(reader: &mut R) -> std::io::Result<Self> {
-        let version = reader.read_u8().await?;
-        let nmethods = reader.read_u8().await?;
-        let mut methods = vec![0u8; nmethods as usize];
-        reader.read_exact(&mut methods).await?;
-        Ok(Self { version, methods })
-    }
-}
-
-#[derive(Debug)]
-pub struct Socks5Request {
-    pub version: u8,
-    pub command: u8,
-    pub address: Socks5Address,
-    pub port: u16,
-}
-
-impl Socks5Request {
-    pub async fn read_from<R: AsyncRead + Unpin>(reader: &mut R) -> std::io::Result<Self> {
-        let version = reader.read_u8().await?;
-        let command = reader.read_u8().await?;
-        let _rsv = reader.read_u8().await?;
-        let atyp = reader.read_u8().await?;
-
-        let address = match atyp {
-            0x01 => {
-                let mut octets = [0u8; 4];
-                reader.read_exact(&mut octets).await?;
-                Socks5Address::Ipv4(Ipv4Addr::from(octets))
-            }
-            0x04 => {
-                let mut octets = [0u8; 16];
-                reader.read_exact(&mut octets).await?;
-                Socks5Address::Ipv6(Ipv6Addr::from(octets))
-            }
-            0x03 => {
-                let len = reader.read_u8().await?;
-                let mut domain = vec![0u8; len as usize];
-                reader.read_exact(&mut domain).await?;
-                Socks5Address::Domain(String::from_utf8_lossy(&domain).into_owned())
-            }
-            _ => {
-                return Err(std::io::Error::new(
-                    std::io::ErrorKind::InvalidData,
-                    format!("unsupported address type: {atyp}"),
-                ))
-            }
-        };
-
-        let port = reader.read_u16().await?;
-
-        Ok(Self {
-            version,
-            command,
-            address,
-            port,
-        })
-    }
-}
-
-#[derive(Debug)]
-pub struct Socks5Reply {
-    pub version: u8,
-    pub reply: u8,
-    pub address: Socks5Address,
-    pub port: u16,
-}
-
-impl Socks5Reply {
-    pub fn success(address: Socks5Address, port: u16) -> Self {
-        Self {
-            version: 0x05,
-            reply: 0x00,
-            address,
-            port,
-        }
-    }
-
-    pub fn connection_refused() -> Self {
-        Self {
-            version: 0x05,
-            reply: 0x05,
-            address: Socks5Address::Ipv4(Ipv4Addr::UNSPECIFIED),
-            port: 0,
-        }
-    }
-
-    pub fn command_not_supported() -> Self {
-        Self {
-            version: 0x05,
-            reply: 0x07,
-            address: Socks5Address::Ipv4(Ipv4Addr::UNSPECIFIED),
-            port: 0,
-        }
-    }
-
-    pub async fn write_to<W: AsyncWrite + Unpin>(&self, writer: &mut W) -> std::io::Result<()> {
-        writer.write_u8(self.version).await?;
-        writer.write_u8(self.reply).await?;
-        writer.write_u8(0x00).await?;
-        match &self.address {
-            Socks5Address::Ipv4(addr) => {
-                writer.write_u8(0x01).await?;
-                writer.write_all(&addr.octets()).await?;
-            }
-            Socks5Address::Ipv6(addr) => {
-                writer.write_u8(0x04).await?;
-                writer.write_all(&addr.octets()).await?;
-            }
-            Socks5Address::Domain(name) => {
-                writer.write_u8(0x03).await?;
-                writer.write_u8(name.len() as u8).await?;
-                writer.write_all(name.as_bytes()).await?;
-            }
-        }
-        writer.write_u16(self.port).await?;
-        writer.flush().await?;
-        Ok(())
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use std::io::Cursor;
-
-    #[tokio::test]
-    async fn parse_version_method_no_auth() {
-        let data = [0x05, 0x01, 0x00];
-        let mut cursor = Cursor::new(&data[..]);
-        let vm = Socks5VersionMethod::read_from(&mut cursor).await.unwrap();
-        assert_eq!(vm.version, 0x05);
-        assert_eq!(vm.methods, vec![0x00]);
-    }
-
-    #[tokio::test]
-    async fn parse_version_method_multiple() {
-        let data = [0x05, 0x02, 0x00, 0x02];
-        let mut cursor = Cursor::new(&data[..]);
-        let vm = Socks5VersionMethod::read_from(&mut cursor).await.unwrap();
-        assert_eq!(vm.version, 0x05);
-        assert_eq!(vm.methods, vec![0x00, 0x02]);
-    }
-
-    #[tokio::test]
-    async fn parse_request_ipv4() {
-        let mut data = vec![0x05, 0x01, 0x00, 0x01];
-        data.extend_from_slice(&[10, 0, 0, 1]);
-        data.extend_from_slice(&443u16.to_be_bytes());
-        let mut cursor = Cursor::new(&data[..]);
-        let req = Socks5Request::read_from(&mut cursor).await.unwrap();
-        assert_eq!(req.version, 0x05);
-        assert_eq!(req.command, 0x01);
-        assert_eq!(req.address, Socks5Address::Ipv4(Ipv4Addr::new(10, 0, 0, 1)));
-        assert_eq!(req.port, 443);
-    }
-
-    #[tokio::test]
-    async fn parse_request_ipv6() {
-        let mut data = vec![0x05, 0x01, 0x00, 0x04];
-        let octets: [u8; 16] = [0x20, 0x01, 0x0d, 0xb8, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1];
-        data.extend_from_slice(&octets);
-        data.extend_from_slice(&443u16.to_be_bytes());
-        let mut cursor = Cursor::new(&data[..]);
-        let req = Socks5Request::read_from(&mut cursor).await.unwrap();
-        assert_eq!(req.version, 0x05);
-        assert_eq!(req.command, 0x01);
-        assert!(matches!(req.address, Socks5Address::Ipv6(_)));
-        assert_eq!(req.port, 443);
-    }
-
-    #[tokio::test]
-    async fn parse_request_domain() {
-        let domain = "example.com";
-        let mut data = vec![0x05, 0x01, 0x00, 0x03];
-        data.push(domain.len() as u8);
-        data.extend_from_slice(domain.as_bytes());
-        data.extend_from_slice(&443u16.to_be_bytes());
-        let mut cursor = Cursor::new(&data[..]);
-        let req = Socks5Request::read_from(&mut cursor).await.unwrap();
-        assert_eq!(req.version, 0x05);
-        assert_eq!(req.command, 0x01);
-        assert_eq!(
-            req.address,
-            Socks5Address::Domain("example.com".to_string())
-        );
-        assert_eq!(req.port, 443);
-    }
-
-    #[tokio::test]
-    async fn parse_request_unsupported_address_type() {
-        let data = [0x05, 0x01, 0x00, 0x05];
-        let mut cursor = Cursor::new(&data[..]);
-        let result = Socks5Request::read_from(&mut cursor).await;
-        assert!(result.is_err());
-    }
-
-    #[tokio::test]
-    async fn reply_success_ipv4() {
-        let reply = Socks5Reply::success(Socks5Address::Ipv4(Ipv4Addr::UNSPECIFIED), 0);
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-        assert_eq!(buf[0], 0x05);
-        assert_eq!(buf[1], 0x00);
-        assert_eq!(buf[2], 0x00);
-        assert_eq!(buf[3], 0x01);
-    }
-
-    #[tokio::test]
-    async fn reply_connection_refused() {
-        let reply = Socks5Reply::connection_refused();
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-        assert_eq!(buf[0], 0x05);
-        assert_eq!(buf[1], 0x05);
-    }
-
-    #[tokio::test]
-    async fn reply_command_not_supported() {
-        let reply = Socks5Reply::command_not_supported();
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-        assert_eq!(buf[0], 0x05);
-        assert_eq!(buf[1], 0x07);
-    }
-
-    #[tokio::test]
-    async fn roundtrip_ipv4_reply() {
-        let reply = Socks5Reply::success(Socks5Address::Ipv4(Ipv4Addr::new(127, 0, 0, 1)), 1080);
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-
-        let mut cursor = Cursor::new(&buf[..]);
-        let version = cursor.read_u8().await.unwrap();
-        let _reply_code = cursor.read_u8().await.unwrap();
-        let _rsv = cursor.read_u8().await.unwrap();
-        let atyp = cursor.read_u8().await.unwrap();
-        assert_eq!(version, 0x05);
-        assert_eq!(atyp, 0x01);
-        let mut octets = [0u8; 4];
-        cursor.read_exact(&mut octets).await.unwrap();
-        assert_eq!(Ipv4Addr::from(octets), Ipv4Addr::new(127, 0, 0, 1));
-        let port = cursor.read_u16().await.unwrap();
-        assert_eq!(port, 1080);
-    }
-
-    #[tokio::test]
-    async fn roundtrip_ipv6_reply() {
-        let addr = Ipv6Addr::new(0x2001, 0x0db8, 0, 0, 0, 0, 0, 1);
-        let reply = Socks5Reply::success(Socks5Address::Ipv6(addr), 443);
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-
-        let mut cursor = Cursor::new(&buf[..]);
-        let _version = cursor.read_u8().await.unwrap();
-        let _reply_code = cursor.read_u8().await.unwrap();
-        let _rsv = cursor.read_u8().await.unwrap();
-        let atyp = cursor.read_u8().await.unwrap();
-        assert_eq!(atyp, 0x04);
-        let mut octets = [0u8; 16];
-        cursor.read_exact(&mut octets).await.unwrap();
-        assert_eq!(Ipv6Addr::from(octets), addr);
-        let port = cursor.read_u16().await.unwrap();
-        assert_eq!(port, 443);
-    }
-
-    #[tokio::test]
-    async fn roundtrip_domain_reply() {
-        let reply = Socks5Reply::success(Socks5Address::Domain("example.com".to_string()), 8080);
-        let mut buf = Vec::new();
-        reply.write_to(&mut buf).await.unwrap();
-
-        let mut cursor = Cursor::new(&buf[..]);
-        let _version = cursor.read_u8().await.unwrap();
-        let _reply_code = cursor.read_u8().await.unwrap();
-        let _rsv = cursor.read_u8().await.unwrap();
-        let atyp = cursor.read_u8().await.unwrap();
-        assert_eq!(atyp, 0x03);
-        let len = cursor.read_u8().await.unwrap();
-        let mut domain = vec![0u8; len as usize];
-        cursor.read_exact(&mut domain).await.unwrap();
-        assert_eq!(String::from_utf8(domain).unwrap(), "example.com");
-        let port = cursor.read_u16().await.unwrap();
-        assert_eq!(port, 8080);
-    }
-}

crates/alknet-core/src/store.rs

@@ -0,0 +1,203 @@
+//! Credential store: `CredentialStore` repo trait, `InMemoryCredentialStore`
+//! default adapter, `EncryptedData` core mirror, and the shared `StoreError`.
+//!
+//! See `docs/architecture/crates/core/auth.md` and ADR-031 / ADR-035 for the
+//! full specification. The store persists `EncryptedData` blobs keyed by
+//! provider; it never decrypts (ADR-025 — the vault is the sole decryption
+//! boundary).
+
+use std::collections::HashMap;
+use std::sync::RwLock;
+
+use async_trait::async_trait;
+
+#[non_exhaustive]
+#[derive(Debug, thiserror::Error)]
+pub enum StoreError {
+    #[error("backend error: {message}")]
+    Backend { message: String },
+    #[error("not found: {entity}")]
+    NotFound { entity: String },
+    #[error("serialization error: {message}")]
+    Serialization { message: String },
+}
+
+#[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
+pub struct EncryptedData {
+    pub key_version: u32,
+    pub salt: Vec<u8>,
+    pub iv: Vec<u8>,
+    pub data: Vec<u8>,
+}
+
+#[async_trait]
+pub trait CredentialStore: Send + Sync {
+    fn get(&self, provider: &str) -> Option<EncryptedData>;
+    async fn put(&self, provider: &str, data: &EncryptedData) -> Result<(), StoreError>;
+    async fn delete(&self, provider: &str) -> Result<(), StoreError>;
+}
+
+pub struct InMemoryCredentialStore {
+    entries: RwLock<HashMap<String, EncryptedData>>,
+}
+
+impl InMemoryCredentialStore {
+    pub fn new() -> Self {
+        Self {
+            entries: RwLock::new(HashMap::new()),
+        }
+    }
+
+    pub fn with_entries(entries: HashMap<String, EncryptedData>) -> Self {
+        Self {
+            entries: RwLock::new(entries),
+        }
+    }
+}
+
+impl Default for InMemoryCredentialStore {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl CredentialStore for InMemoryCredentialStore {
+    fn get(&self, provider: &str) -> Option<EncryptedData> {
+        let entries = self.entries.read().unwrap_or_else(|e| e.into_inner());
+        entries.get(provider).cloned()
+    }
+
+    async fn put(&self, provider: &str, data: &EncryptedData) -> Result<(), StoreError> {
+        let mut entries = self.entries.write().unwrap_or_else(|e| e.into_inner());
+        entries.insert(provider.to_string(), data.clone());
+        Ok(())
+    }
+
+    async fn delete(&self, provider: &str) -> Result<(), StoreError> {
+        let mut entries = self.entries.write().unwrap_or_else(|e| e.into_inner());
+        entries.remove(provider);
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn sample_encrypted_data() -> EncryptedData {
+        EncryptedData {
+            key_version: 2,
+            salt: vec![],
+            iv: vec![1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12],
+            data: vec![0xde, 0xad, 0xbe, 0xef],
+        }
+    }
+
+    #[tokio::test]
+    async fn in_memory_get_put_delete_round_trip() {
+        let store = InMemoryCredentialStore::new();
+        let data = sample_encrypted_data();
+
+        assert!(store.get("openai").is_none());
+
+        store.put("openai", &data).await.unwrap();
+        let retrieved = store.get("openai").expect("provider should be present");
+        assert_eq!(retrieved.key_version, data.key_version);
+        assert_eq!(retrieved.salt, data.salt);
+        assert_eq!(retrieved.iv, data.iv);
+        assert_eq!(retrieved.data, data.data);
+
+        store.delete("openai").await.unwrap();
+        assert!(store.get("openai").is_none());
+    }
+
+    #[tokio::test]
+    async fn in_memory_get_returns_none_for_missing_provider() {
+        let store = InMemoryCredentialStore::new();
+        assert!(store.get("never-configured").is_none());
+    }
+
+    #[tokio::test]
+    async fn in_memory_delete_missing_provider_is_ok() {
+        let store = InMemoryCredentialStore::new();
+        store.delete("absent").await.unwrap();
+    }
+
+    #[tokio::test]
+    async fn in_memory_put_replaces_existing() {
+        let store = InMemoryCredentialStore::new();
+        let first = sample_encrypted_data();
+        let mut second = sample_encrypted_data();
+        second.data = vec![0xc0, 0xff, 0xee];
+
+        store.put("anthropic", &first).await.unwrap();
+        store.put("anthropic", &second).await.unwrap();
+
+        let retrieved = store.get("anthropic").expect("provider should be present");
+        assert_eq!(retrieved.data, second.data);
+    }
+
+    #[tokio::test]
+    async fn in_memory_with_entries_seeds_store() {
+        let mut entries = HashMap::new();
+        entries.insert("github".to_string(), sample_encrypted_data());
+        let store = InMemoryCredentialStore::with_entries(entries);
+
+        assert!(store.get("github").is_some());
+        assert!(store.get("openai").is_none());
+    }
+
+    #[test]
+    fn encrypted_data_serializes_and_deserializes_round_trip() {
+        let data = sample_encrypted_data();
+        let json = serde_json::to_string(&data).expect("serialize");
+        let decoded: EncryptedData = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(decoded.key_version, data.key_version);
+        assert_eq!(decoded.salt, data.salt);
+        assert_eq!(decoded.iv, data.iv);
+        assert_eq!(decoded.data, data.data);
+    }
+
+    #[test]
+    fn encrypted_data_round_trips_non_empty_salt() {
+        let data = EncryptedData {
+            key_version: 1,
+            salt: vec![0xab, 0xcd, 0xef],
+            iv: vec![0; 12],
+            data: vec![0x01, 0x02, 0x03],
+        };
+        let json = serde_json::to_string(&data).expect("serialize");
+        let decoded: EncryptedData = serde_json::from_str(&json).expect("deserialize");
+        assert_eq!(decoded.salt, data.salt);
+    }
+
+    #[test]
+    fn store_error_display_formatting() {
+        let backend = StoreError::Backend {
+            message: "disk full".to_string(),
+        };
+        assert_eq!(backend.to_string(), "backend error: disk full");
+
+        let not_found = StoreError::NotFound {
+            entity: "openai".to_string(),
+        };
+        assert_eq!(not_found.to_string(), "not found: openai");
+
+        let serialization = StoreError::Serialization {
+            message: "invalid utf8".to_string(),
+        };
+        assert_eq!(
+            serialization.to_string(),
+            "serialization error: invalid utf8"
+        );
+    }
+
+    #[test]
+    fn store_error_is_non_exhaustive() {
+        let err = StoreError::Backend {
+            message: "x".to_string(),
+        };
+        let _ = err.to_string();
+    }
+}

crates/alknet-core/src/testutil.rs

@@ -1,141 +0,0 @@
-use anyhow::Result;
-use tokio::io::{AsyncRead, AsyncWrite, DuplexStream};
-
-#[cfg(feature = "transport-traits")]
-pub use crate::transport::{Transport, TransportAcceptor, TransportInfo, TransportKind};
-
-#[cfg(not(feature = "transport-traits"))]
-pub use local_traits::{Transport, TransportAcceptor, TransportInfo, TransportKind};
-
-#[cfg(not(feature = "transport-traits"))]
-mod local_traits {
-    use anyhow::Result;
-    use async_trait::async_trait;
-    use std::net::SocketAddr;
-    use tokio::io::{AsyncRead, AsyncWrite};
-
-    #[async_trait]
-    pub trait Transport: Send + Sync + 'static {
-        type Stream: AsyncRead + AsyncWrite + Unpin + Send + 'static;
-        async fn connect(&self) -> Result<Self::Stream>;
-        fn describe(&self) -> String;
-    }
-
-    #[async_trait]
-    pub trait TransportAcceptor: Send + Sync + 'static {
-        type Stream: AsyncRead + AsyncWrite + Unpin + Send + 'static;
-        async fn accept(&self) -> Result<(Self::Stream, TransportInfo)>;
-    }
-
-    #[derive(Debug, Clone)]
-    pub struct TransportInfo {
-        pub remote_addr: Option<SocketAddr>,
-        pub transport_kind: TransportKind,
-    }
-
-    #[derive(Debug, Clone)]
-    pub enum TransportKind {
-        Tcp,
-        Tls { server_name: Option<String> },
-        Iroh { endpoint_id: String },
-    }
-}
-
-pub struct MockStream {
-    inner: DuplexStream,
-}
-
-impl MockStream {
-    pub fn new(inner: DuplexStream) -> Self {
-        Self { inner }
-    }
-}
-
-impl AsyncRead for MockStream {
-    fn poll_read(
-        self: std::pin::Pin<&mut Self>,
-        cx: &mut std::task::Context<'_>,
-        buf: &mut tokio::io::ReadBuf<'_>,
-    ) -> std::task::Poll<std::io::Result<()>> {
-        std::pin::Pin::new(&mut self.get_mut().inner).poll_read(cx, buf)
-    }
-}
-
-impl AsyncWrite for MockStream {
-    fn poll_write(
-        self: std::pin::Pin<&mut Self>,
-        cx: &mut std::task::Context<'_>,
-        buf: &[u8],
-    ) -> std::task::Poll<std::io::Result<usize>> {
-        std::pin::Pin::new(&mut self.get_mut().inner).poll_write(cx, buf)
-    }
-
-    fn poll_flush(
-        self: std::pin::Pin<&mut Self>,
-        cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<std::io::Result<()>> {
-        std::pin::Pin::new(&mut self.get_mut().inner).poll_flush(cx)
-    }
-
-    fn poll_shutdown(
-        self: std::pin::Pin<&mut Self>,
-        cx: &mut std::task::Context<'_>,
-    ) -> std::task::Poll<std::io::Result<()>> {
-        std::pin::Pin::new(&mut self.get_mut().inner).poll_shutdown(cx)
-    }
-}
-
-impl Unpin for MockStream {}
-
-pub struct MockTransport {
-    buf_size: usize,
-}
-
-impl MockTransport {
-    pub fn new(buf_size: usize) -> Self {
-        Self { buf_size }
-    }
-}
-
-#[async_trait::async_trait]
-impl Transport for MockTransport {
-    type Stream = MockStream;
-
-    async fn connect(&self) -> Result<Self::Stream> {
-        let (client, _) = tokio::io::duplex(self.buf_size);
-        Ok(MockStream::new(client))
-    }
-
-    fn describe(&self) -> String {
-        "mock".to_string()
-    }
-}
-
-pub struct MockTransportAcceptor {
-    buf_size: usize,
-}
-
-impl MockTransportAcceptor {
-    pub fn new(buf_size: usize) -> Self {
-        Self { buf_size }
-    }
-}
-
-#[async_trait::async_trait]
-impl TransportAcceptor for MockTransportAcceptor {
-    type Stream = MockStream;
-
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-        let (_, server) = tokio::io::duplex(self.buf_size);
-        let info = TransportInfo {
-            remote_addr: None,
-            transport_kind: TransportKind::Tcp,
-        };
-        Ok((MockStream::new(server), info))
-    }
-}
-
-pub fn mock_pair(buf_size: usize) -> (MockStream, MockStream) {
-    let (client, server) = tokio::io::duplex(buf_size);
-    (MockStream::new(client), MockStream::new(server))
-}

crates/alknet-core/src/transport/acme.rs

@@ -1,352 +0,0 @@
-use std::net::SocketAddr;
-use std::path::PathBuf;
-use std::sync::Arc;
-
-use anyhow::{anyhow, Result};
-use rustls::crypto::aws_lc_rs::default_provider;
-use rustls::ServerConfig;
-use rustls_acme::caches::DirCache;
-use rustls_acme::{AcmeConfig, AcmeState, ResolvesServerCertAcme};
-use tokio::net::TcpListener;
-use tokio_rustls::TlsAcceptor as TokioTlsAcceptor;
-use tracing::{error, info};
-
-use super::{TransportAcceptor, TransportInfo, TransportKind};
-
-const ACME_TLS_ALPN_NAME: &[u8] = b"acme-tls/1";
-
-#[derive(Debug, Clone)]
-pub enum AcmeMode {
-    Domain { domain: String },
-    Ip,
-}
-
-pub struct AcmeCertProvider {
-    mode: AcmeMode,
-    cache_dir: Option<PathBuf>,
-    directory_url: String,
-    contact: Vec<String>,
-}
-
-impl std::fmt::Debug for AcmeCertProvider {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("AcmeCertProvider")
-            .field("mode", &self.mode)
-            .field("cache_dir", &self.cache_dir)
-            .field("directory_url", &self.directory_url)
-            .field("contact", &self.contact)
-            .finish_non_exhaustive()
-    }
-}
-
-impl AcmeCertProvider {
-    pub fn new(mode: AcmeMode) -> Self {
-        Self {
-            mode,
-            cache_dir: None,
-            directory_url: rustls_acme::acme::LETS_ENCRYPT_STAGING_DIRECTORY.to_string(),
-            contact: Vec::new(),
-        }
-    }
-
-    pub fn domain(domain: impl Into<String>) -> Self {
-        Self::new(AcmeMode::Domain {
-            domain: domain.into(),
-        })
-    }
-
-    pub fn ip() -> Self {
-        Self::new(AcmeMode::Ip)
-    }
-
-    pub fn with_cache_dir(mut self, dir: impl Into<PathBuf>) -> Self {
-        self.cache_dir = Some(dir.into());
-        self
-    }
-
-    pub fn with_directory(mut self, url: impl Into<String>) -> Self {
-        self.directory_url = url.into();
-        self
-    }
-
-    pub fn with_production_directory(mut self) -> Self {
-        self.directory_url = rustls_acme::acme::LETS_ENCRYPT_PRODUCTION_DIRECTORY.to_string();
-        self
-    }
-
-    pub fn with_contact(mut self, contact: impl Into<String>) -> Self {
-        self.contact.push(contact.into());
-        self
-    }
-
-    pub fn mode(&self) -> &AcmeMode {
-        &self.mode
-    }
-
-    fn build_acme_state(&self) -> (AcmeState<std::io::Error>, Arc<ResolvesServerCertAcme>) {
-        let domains: Vec<String> = match &self.mode {
-            AcmeMode::Domain { domain } => vec![domain.clone()],
-            AcmeMode::Ip => vec![],
-        };
-
-        let base_config = AcmeConfig::new(domains)
-            .directory(&self.directory_url)
-            .contact(self.contact.clone());
-
-        let state = match &self.cache_dir {
-            Some(cache_dir) => base_config.cache(DirCache::new(cache_dir.clone())).state(),
-            None => base_config
-                .cache(rustls_acme::caches::NoCache::default())
-                .state(),
-        };
-
-        let resolver = state.resolver();
-        (state, resolver)
-    }
-
-    pub fn build_server_config_with_resolver(
-        &self,
-        resolver: Arc<ResolvesServerCertAcme>,
-    ) -> Result<Arc<ServerConfig>> {
-        let provider = default_provider().into();
-        let mut config = ServerConfig::builder_with_provider(provider)
-            .with_safe_default_protocol_versions()
-            .map_err(|e| anyhow!("failed to set protocol versions: {}", e))?
-            .with_no_client_auth()
-            .with_cert_resolver(resolver);
-        config.alpn_protocols.push(ACME_TLS_ALPN_NAME.to_vec());
-        Ok(Arc::new(config))
-    }
-}
-
-pub struct AcmeTlsAcceptor {
-    listener: TcpListener,
-    listen_addr: SocketAddr,
-    #[allow(dead_code)]
-    server_config: Arc<ServerConfig>,
-    tokio_acceptor: TokioTlsAcceptor,
-}
-
-impl AcmeTlsAcceptor {
-    pub async fn bind_acme(addr: SocketAddr, provider: Arc<AcmeCertProvider>) -> Result<Self> {
-        let (state, resolver) = provider.build_acme_state();
-
-        let server_config = provider.build_server_config_with_resolver(resolver.clone())?;
-
-        Self::spawn_state_worker(state, resolver);
-
-        let listener = TcpListener::bind(addr).await?;
-        let listen_addr = listener.local_addr()?;
-
-        let tokio_acceptor = TokioTlsAcceptor::from(server_config.clone());
-
-        Ok(Self {
-            listener,
-            listen_addr,
-            server_config,
-            tokio_acceptor,
-        })
-    }
-
-    pub fn listen_addr(&self) -> SocketAddr {
-        self.listen_addr
-    }
-
-    fn spawn_state_worker(state: AcmeState<std::io::Error>, resolver: Arc<ResolvesServerCertAcme>) {
-        use futures::StreamExt;
-
-        let task = async move {
-            let mut state = state;
-            while let Some(event) = state.next().await {
-                match event {
-                    Ok(ok) => {
-                        if let rustls_acme::EventOk::DeployedNewCert = ok {
-                            info!("ACME: new certificate deployed");
-                        } else {
-                            info!("ACME event: {:?}", ok);
-                        }
-                    }
-                    Err(err) => error!("ACME event error: {:?}", err),
-                }
-                if Arc::strong_count(&resolver) == 1 {
-                    info!("ACME resolver dropped, stopping background task");
-                    break;
-                }
-            }
-        };
-        tokio::spawn(task);
-    }
-}
-
-#[async_trait::async_trait]
-impl TransportAcceptor for AcmeTlsAcceptor {
-    type Stream = tokio_rustls::server::TlsStream<tokio::net::TcpStream>;
-
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-        let (tcp_stream, remote_addr) = self.listener.accept().await?;
-        let tls_stream = self.tokio_acceptor.accept(tcp_stream).await?;
-
-        let server_name = tls_stream.get_ref().1.server_name().map(|s| s.to_string());
-
-        let info = TransportInfo {
-            remote_addr: Some(remote_addr),
-            transport_kind: TransportKind::Tls { server_name },
-        };
-
-        Ok((tls_stream, info))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn acme_cert_provider_domain_mode() {
-        let provider = AcmeCertProvider::domain("example.com");
-        assert!(matches!(provider.mode(), AcmeMode::Domain { .. }));
-        if let AcmeMode::Domain { domain } = provider.mode() {
-            assert_eq!(domain, "example.com");
-        }
-    }
-
-    #[test]
-    fn acme_cert_provider_ip_mode() {
-        let provider = AcmeCertProvider::ip();
-        assert!(matches!(provider.mode(), AcmeMode::Ip));
-    }
-
-    #[test]
-    fn acme_cert_provider_default_staging_directory() {
-        let provider = AcmeCertProvider::domain("example.com");
-        assert_eq!(
-            provider.directory_url,
-            rustls_acme::acme::LETS_ENCRYPT_STAGING_DIRECTORY
-        );
-    }
-
-    #[test]
-    fn acme_cert_provider_production_directory() {
-        let provider = AcmeCertProvider::domain("example.com").with_production_directory();
-        assert_eq!(
-            provider.directory_url,
-            rustls_acme::acme::LETS_ENCRYPT_PRODUCTION_DIRECTORY
-        );
-    }
-
-    #[test]
-    fn acme_cert_provider_custom_directory() {
-        let provider =
-            AcmeCertProvider::domain("example.com").with_directory("https://custom.acme.dir/");
-        assert_eq!(provider.directory_url, "https://custom.acme.dir/");
-    }
-
-    #[test]
-    fn acme_cert_provider_with_cache_dir() {
-        let provider = AcmeCertProvider::domain("example.com").with_cache_dir("/tmp/acme_cache");
-        assert_eq!(provider.cache_dir, Some(PathBuf::from("/tmp/acme_cache")));
-    }
-
-    #[test]
-    fn acme_cert_provider_with_contact() {
-        let provider =
-            AcmeCertProvider::domain("example.com").with_contact("mailto:admin@example.com");
-        assert_eq!(
-            provider.contact,
-            vec!["mailto:admin@example.com".to_string()]
-        );
-    }
-
-    #[test]
-    fn acme_cert_provider_build_state_domain() {
-        let provider = AcmeCertProvider::domain("example.com");
-        let (_state, resolver) = provider.build_acme_state();
-        assert!(Arc::strong_count(&resolver) >= 2);
-    }
-
-    #[test]
-    fn acme_cert_provider_build_state_with_cache() {
-        let provider = AcmeCertProvider::domain("example.com").with_cache_dir("/tmp/test_cache");
-        let (_state, resolver) = provider.build_acme_state();
-        assert!(Arc::strong_count(&resolver) >= 2);
-    }
-
-    #[test]
-    fn acme_cert_provider_build_server_config() {
-        let _ = default_provider().install_default();
-        let provider = AcmeCertProvider::domain("example.com");
-        let (_, resolver) = provider.build_acme_state();
-        let config = provider
-            .build_server_config_with_resolver(resolver)
-            .unwrap();
-        assert!(!config.alpn_protocols.is_empty());
-        assert!(config
-            .alpn_protocols
-            .iter()
-            .any(|p| p == ACME_TLS_ALPN_NAME));
-    }
-
-    #[test]
-    fn acme_mode_domain_debug() {
-        let mode = AcmeMode::Domain {
-            domain: "test.example.com".to_string(),
-        };
-        let debug_str = format!("{:?}", mode);
-        assert!(debug_str.contains("test.example.com"));
-    }
-
-    #[test]
-    fn acme_mode_ip_debug() {
-        let mode = AcmeMode::Ip;
-        let debug_str = format!("{:?}", mode);
-        assert!(debug_str.contains("Ip"));
-    }
-
-    #[test]
-    fn acme_cert_provider_builder_chain() {
-        let provider = AcmeCertProvider::domain("test.example.com")
-            .with_production_directory()
-            .with_cache_dir("/tmp/cache")
-            .with_contact("mailto:admin@test.example.com");
-        assert!(matches!(provider.mode(), AcmeMode::Domain { .. }));
-        assert_eq!(
-            provider.directory_url,
-            rustls_acme::acme::LETS_ENCRYPT_PRODUCTION_DIRECTORY
-        );
-        assert_eq!(provider.cache_dir, Some(PathBuf::from("/tmp/cache")));
-        assert_eq!(provider.contact.len(), 1);
-    }
-
-    #[tokio::test]
-    async fn acme_tls_acceptor_bind_acme() {
-        let _ = default_provider().install_default();
-        let provider = Arc::new(AcmeCertProvider::domain("example.com"));
-        let addr: SocketAddr = "127.0.0.1:0".parse().unwrap();
-        let acceptor = AcmeTlsAcceptor::bind_acme(addr, provider).await.unwrap();
-        assert_ne!(acceptor.listen_addr().port(), 0);
-    }
-
-    #[tokio::test]
-    #[ignore]
-    async fn acme_staging_domain_cert_provisioning() {
-        let _ = default_provider().install_default();
-
-        let cache_dir = tempfile::tempdir().unwrap();
-        let provider = Arc::new(
-            AcmeCertProvider::domain("acme-test.example.com")
-                .with_cache_dir(cache_dir.path())
-                .with_contact("mailto:admin@example.com"),
-        );
-
-        let addr: SocketAddr = "0.0.0.0:443".parse().unwrap();
-        let result = AcmeTlsAcceptor::bind_acme(addr, provider).await;
-        assert!(
-            result.is_ok(),
-            "ACME TlsAcceptor should bind: {:?}",
-            result.err()
-        );
-
-        let acceptor = result.unwrap();
-        assert_eq!(acceptor.listen_addr().port(), 443);
-    }
-}

crates/alknet-core/src/transport/iroh_transport.rs

@@ -1,328 +0,0 @@
-use anyhow::{anyhow, Result};
-use async_trait::async_trait;
-use iroh::{
-    endpoint::RecvStream, node_info::NodeIdExt, Endpoint, NodeId, RelayMap, RelayMode, RelayUrl,
-};
-use tokio::io;
-
-use super::{Transport, TransportAcceptor, TransportInfo, TransportKind};
-
-pub const ALPN: &[u8] = b"alknet-ssh";
-const DEFAULT_RELAY_URL: &str = "https://relay.iroh.network/";
-
-/// A client-side iroh QUIC P2P transport that connects to a remote iroh endpoint.
-///
-/// Connects via `Endpoint::connect(node_id, alpn)`, opens a bidirectional
-/// QUIC stream with `conn.open_bi()`, and joins the halves with
-/// `tokio::io::join(recv, send)` to produce a duplex stream for russh.
-/// Per ADR-003, `tokio::io::join` is used instead of a custom wrapper.
-///
-/// Use [`IrohTransport::new`] to create a standalone endpoint, or
-/// [`IrohTransport::from_endpoint`] to share an existing iroh `Endpoint`
-/// with other protocol handlers (blobs, gossip, docs).
-pub struct IrohTransport {
-    node_id: NodeId,
-    endpoint: Endpoint,
-    owned: bool,
-}
-
-impl IrohTransport {
-    /// Create a new iroh transport with its own dedicated endpoint.
-    ///
-    /// The endpoint is created with the `alknet-ssh` ALPN and the provided
-    /// relay URL. Use this when alknet is the only iroh service on this node.
-    pub async fn new(
-        node_id: NodeId,
-        relay_url: Option<RelayUrl>,
-        proxy_url: Option<url::Url>,
-    ) -> Result<Self> {
-        let relay_url = relay_url.unwrap_or_else(|| {
-            DEFAULT_RELAY_URL
-                .parse()
-                .expect("default relay URL is valid")
-        });
-        let relay_map = RelayMap::from_url(relay_url);
-        let mut builder = Endpoint::builder()
-            .relay_mode(RelayMode::Custom(relay_map))
-            .alpns(vec![ALPN.to_vec()]);
-        if let Some(ref proxy) = proxy_url {
-            builder = builder.proxy_url(proxy.clone());
-        }
-        let endpoint = builder.bind().await?;
-        Ok(Self {
-            node_id,
-            endpoint,
-            owned: true,
-        })
-    }
-
-    /// Create an iroh transport using an existing shared endpoint.
-    ///
-    /// The endpoint must already have the `alknet-ssh` ALPN registered
-    /// (typically via [`iroh::protocol::Router::builder`]). This enables
-    /// running alknet alongside iroh-blobs, iroh-gossip, iroh-docs, and
-    /// other protocol handlers on the same QUIC endpoint — one connection
-    /// per peer, multiplexed by ALPN.
-    pub fn from_endpoint(node_id: NodeId, endpoint: Endpoint) -> Self {
-        Self {
-            node_id,
-            endpoint,
-            owned: false,
-        }
-    }
-
-    pub fn endpoint_id(&self) -> String {
-        self.endpoint.node_id().to_z32()
-    }
-
-    pub fn endpoint(&self) -> &Endpoint {
-        &self.endpoint
-    }
-
-    pub fn owned(&self) -> bool {
-        self.owned
-    }
-}
-
-#[async_trait]
-impl Transport for IrohTransport {
-    type Stream = io::Join<RecvStream, iroh::endpoint::SendStream>;
-
-    async fn connect(&self) -> Result<Self::Stream> {
-        let conn = self.endpoint.connect(self.node_id, ALPN).await?;
-        let (send, recv) = conn.open_bi().await?;
-        Ok(io::join(recv, send))
-    }
-
-    fn describe(&self) -> String {
-        format!("iroh://{}", self.node_id.to_z32())
-    }
-}
-
-/// A server-side iroh QUIC P2P transport acceptor that listens for incoming connections.
-///
-/// Binds an iroh `Endpoint` with the configured relay URL and optional proxy
-/// (ADR-010). Accepts incoming connections, accepts bidirectional QUIC streams,
-/// and joins the halves with `tokio::io::join(recv, send)`. Exposes
-/// `endpoint_id()` for CLI display of the server's z-base-32 node ID.
-///
-/// Use [`IrohAcceptor::bind`] to create a standalone endpoint, or
-/// [`IrohAcceptor::from_endpoint`] to share an existing iroh `Endpoint`
-/// with other protocol handlers (blobs, gossip, docs).
-///
-/// When using `from_endpoint`, the alknet-ssh ALPN must be registered
-/// via an iroh `Router` that calls `Handler::accept()` on incoming
-/// connections with the `alknet-ssh` ALPN, then passes the accepted
-/// bidirectional stream to `russh::server::run_stream()`.
-pub struct IrohAcceptor {
-    endpoint: Endpoint,
-    owned: bool,
-}
-
-impl IrohAcceptor {
-    /// Bind a new iroh endpoint with a dedicated `alknet-ssh` ALPN.
-    ///
-    /// Use this when alknet is the only iroh service on this node.
-    pub async fn bind(relay_url: Option<RelayUrl>, proxy_url: Option<url::Url>) -> Result<Self> {
-        let relay_url = relay_url.unwrap_or_else(|| {
-            DEFAULT_RELAY_URL
-                .parse()
-                .expect("default relay URL is valid")
-        });
-        let relay_map = RelayMap::from_url(relay_url);
-        let mut builder = Endpoint::builder()
-            .relay_mode(RelayMode::Custom(relay_map))
-            .alpns(vec![ALPN.to_vec()]);
-        if let Some(ref proxy) = proxy_url {
-            builder = builder.proxy_url(proxy.clone());
-        }
-        let endpoint = builder.bind().await?;
-        Ok(Self {
-            endpoint,
-            owned: true,
-        })
-    }
-
-    /// Create an iroh acceptor using an existing shared endpoint.
-    ///
-    /// The endpoint must already have the `alknet-ssh` ALPN registered
-    /// (typically via [`iroh::protocol::Router::builder`]). When using a
-    /// shared endpoint, incoming connections with the `alknet-ssh` ALPN
-    /// are routed by the Router to a `ProtocolHandler` that this acceptor
-    /// does not manage — the caller is responsible for bridging the
-    /// Router's `accept()` callback to this acceptor's stream handling.
-    ///
-    /// For the standalone case where alknet owns the endpoint, use
-    /// [`IrohAcceptor::bind`] instead, which handles the accept loop
-    /// internally.
-    pub fn from_endpoint(endpoint: Endpoint) -> Self {
-        Self {
-            endpoint,
-            owned: false,
-        }
-    }
-
-    pub fn endpoint_id(&self) -> String {
-        self.endpoint.node_id().to_z32()
-    }
-
-    pub fn endpoint(&self) -> &Endpoint {
-        &self.endpoint
-    }
-
-    pub fn owned(&self) -> bool {
-        self.owned
-    }
-}
-
-#[async_trait]
-impl TransportAcceptor for IrohAcceptor {
-    type Stream = io::Join<RecvStream, iroh::endpoint::SendStream>;
-
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-        let incoming = self
-            .endpoint
-            .accept()
-            .await
-            .ok_or_else(|| anyhow!("endpoint closed"))?;
-        let conn = incoming.await?;
-        let node_id = conn.remote_node_id()?;
-        let (send, recv) = conn.accept_bi().await?;
-        let stream = io::join(recv, send);
-        let info = TransportInfo {
-            remote_addr: None,
-            transport_kind: TransportKind::Iroh {
-                endpoint_id: node_id.to_z32(),
-            },
-        };
-        Ok((stream, info))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[tokio::test]
-    async fn iroh_acceptor_bind_creates_endpoint() {
-        let acceptor = IrohAcceptor::bind(None, None).await.unwrap();
-        let endpoint_id = acceptor.endpoint_id();
-        assert!(!endpoint_id.is_empty());
-        let parsed = NodeId::from_z32(&endpoint_id);
-        assert!(parsed.is_ok());
-        assert!(acceptor.owned());
-    }
-
-    #[tokio::test]
-    async fn iroh_acceptor_bind_with_custom_relay() {
-        let relay: RelayUrl = "https://relay.iroh.network/".parse().unwrap();
-        let acceptor = IrohAcceptor::bind(Some(relay), None).await.unwrap();
-        assert!(!acceptor.endpoint_id().is_empty());
-        assert!(acceptor.owned());
-    }
-
-    #[tokio::test]
-    async fn iroh_acceptor_from_endpoint() {
-        let acceptor = IrohAcceptor::bind(None, None).await.unwrap();
-        let endpoint = acceptor.endpoint.clone();
-        let shared = IrohAcceptor::from_endpoint(endpoint);
-        assert_eq!(shared.endpoint_id(), acceptor.endpoint_id());
-        assert!(!shared.owned());
-    }
-
-    #[test]
-    fn iroh_transport_describe_format() {
-        let node_id: NodeId = iroh::SecretKey::generate(rand_core::OsRng).public().into();
-        let desc = format!("iroh://{}", node_id.to_z32());
-        assert!(desc.starts_with("iroh://"));
-    }
-
-    #[tokio::test]
-    async fn iroh_transport_connect_builds_endpoint() {
-        let node_id: NodeId = iroh::SecretKey::generate(rand_core::OsRng).public().into();
-        let transport = IrohTransport::new(node_id, None, None).await.unwrap();
-        assert!(transport.describe().starts_with("iroh://"));
-        assert!(!transport.endpoint_id().is_empty());
-        assert!(transport.owned());
-    }
-
-    #[tokio::test]
-    async fn iroh_transport_from_endpoint() {
-        let node_id: NodeId = iroh::SecretKey::generate(rand_core::OsRng).public().into();
-        let acceptor = IrohAcceptor::bind(None, None).await.unwrap();
-        let endpoint = acceptor.endpoint.clone();
-        let transport = IrohTransport::from_endpoint(node_id, endpoint);
-        assert!(transport.describe().starts_with("iroh://"));
-        assert_eq!(transport.endpoint_id(), acceptor.endpoint_id());
-        assert!(!transport.owned());
-    }
-
-    #[tokio::test]
-    #[ignore]
-    async fn iroh_client_connects_to_iroh_server() {
-        let acceptor = IrohAcceptor::bind(None, None).await.unwrap();
-        let server_node_id = acceptor.endpoint().node_id();
-
-        let transport = IrohTransport::new(server_node_id, None, None)
-            .await
-            .unwrap();
-
-        let mut addrs_watcher = acceptor.endpoint().direct_addresses();
-        addrs_watcher.initialized().await.unwrap();
-        let addr_set = addrs_watcher.get().unwrap().unwrap_or_default();
-        for addr in addr_set {
-            transport
-                .endpoint
-                .add_node_addr(iroh::NodeAddr::from_parts(
-                    server_node_id,
-                    None,
-                    vec![addr.addr],
-                ))
-                .unwrap();
-        }
-
-        let accept_handle = tokio::spawn(async move {
-            let (stream, info) = acceptor.accept().await.unwrap();
-            assert!(matches!(info.transport_kind, TransportKind::Iroh { .. }));
-            stream
-        });
-
-        let _client_stream: io::Join<RecvStream, iroh::endpoint::SendStream> =
-            transport.connect().await.unwrap();
-        let _server_stream = accept_handle.await.unwrap();
-    }
-
-    #[tokio::test]
-    #[ignore]
-    async fn iroh_shared_endpoint_client_connects_to_server() {
-        let acceptor = IrohAcceptor::bind(None, None).await.unwrap();
-        let server_node_id = acceptor.endpoint().node_id();
-        let shared_endpoint = acceptor.endpoint().clone();
-
-        let transport = IrohTransport::from_endpoint(server_node_id, shared_endpoint);
-
-        let mut addrs_watcher = acceptor.endpoint().direct_addresses();
-        addrs_watcher.initialized().await.unwrap();
-        let addr_set = addrs_watcher.get().unwrap().unwrap_or_default();
-        for addr in addr_set {
-            transport
-                .endpoint
-                .add_node_addr(iroh::NodeAddr::from_parts(
-                    server_node_id,
-                    None,
-                    vec![addr.addr],
-                ))
-                .unwrap();
-        }
-
-        let accept_handle = tokio::spawn(async move {
-            let (stream, info) = acceptor.accept().await.unwrap();
-            assert!(matches!(info.transport_kind, TransportKind::Iroh { .. }));
-            stream
-        });
-
-        let _client_stream: io::Join<RecvStream, iroh::endpoint::SendStream> =
-            transport.connect().await.unwrap();
-        let _server_stream = accept_handle.await.unwrap();
-    }
-}

crates/alknet-core/src/transport/mod.rs

@@ -1,203 +0,0 @@
-//! Pluggable transport layer for Alknet.
-//!
-//! The transport layer produces a duplex byte stream (`AsyncRead + AsyncWrite + Unpin + Send`)
-//! that SSH consumes. This is the core architectural abstraction — SSH never opens its own
-//! network connections; it runs entirely over whatever stream the transport provides.
-//!
-//! Available transports (feature-gated):
-//! - `TcpTransport` / `TcpAcceptor` — always available, direct TCP
-//! - `TlsTransport` / `TlsAcceptor` — behind the `tls` feature, TCP + rustls
-//! - `IrohTransport` / `IrohAcceptor` — behind the `iroh` feature, QUIC P2P via iroh
-//! - `AcmeTlsAcceptor` — behind the `acme` feature, auto-provision TLS certs via Let's Encrypt
-//!
-//! See [ADR-001](docs/architecture/decisions/001-pluggable-transport.md) and
-//! [ADR-004](docs/architecture/decisions/004-ssh-over-transport.md) for design rationale.
-
-#[cfg(feature = "iroh")]
-mod iroh_transport;
-mod tcp;
-
-#[cfg(feature = "iroh")]
-pub use iroh_transport::{IrohAcceptor, IrohTransport, ALPN as IROH_ALPN};
-pub use tcp::{TcpAcceptor, TcpTransport};
-
-#[cfg(feature = "tls")]
-mod tls;
-
-#[cfg(feature = "tls")]
-pub use tls::{AcmeConfig, TlsAcceptor, TlsTransport};
-
-#[cfg(feature = "acme")]
-mod acme;
-
-#[cfg(feature = "acme")]
-pub use acme::{AcmeCertProvider, AcmeMode, AcmeTlsAcceptor};
-
-use std::net::SocketAddr;
-
-use anyhow::Result;
-use async_trait::async_trait;
-use tokio::io::{AsyncRead, AsyncWrite};
-
-/// Client-side transport trait. Produces a single duplex stream per connection.
-///
-/// Implementations connect to a remote endpoint and return a stream that SSH
-/// runs over via `russh::client::connect_stream()`. Each call to `connect()` creates
-/// a new stream — multiple sessions need multiple calls or multiple transports.
-#[async_trait]
-pub trait Transport: Send + Sync + 'static {
-    /// The duplex stream type produced by this transport.
-    type Stream: AsyncRead + AsyncWrite + Unpin + Send + 'static;
-
-    /// Connect to the remote endpoint and return a duplex stream.
-    async fn connect(&self) -> Result<Self::Stream>;
-
-    /// Return a human-readable description of this transport for logging.
-    fn describe(&self) -> String;
-}
-
-/// Server-side transport acceptor. Accepts incoming connections and returns streams.
-///
-/// Implementations bind to a local endpoint and produce streams that SSH
-/// runs over via `russh::server::run_stream()`.
-#[async_trait]
-pub trait TransportAcceptor: Send + Sync + 'static {
-    /// The duplex stream type produced by this acceptor.
-    type Stream: AsyncRead + AsyncWrite + Unpin + Send + 'static;
-
-    /// Accept an incoming connection and return a duplex stream with metadata.
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)>;
-}
-
-/// Metadata about an incoming transport connection.
-///
-/// Carries the remote address (if available) and the kind of transport
-/// used. The server handler uses this for logging and auth decisions.
-/// See ADR-001 for the pluggable transport rationale and ADR-004
-/// for why SSH runs entirely over the transport stream.
-#[derive(Debug, Clone)]
-pub struct TransportInfo {
-    pub remote_addr: Option<SocketAddr>,
-    pub transport_kind: TransportKind,
-}
-
-/// The kind of transport that produced a connection.
-///
-/// Each variant identifies the transport mechanism. Used by the
-/// server handler for logging and authorization decisions.
-/// See ADR-001 and ADR-004.
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub enum TransportKind {
-    Tcp,
-    Tls { server_name: Option<String> },
-    Iroh { endpoint_id: String },
-    WebTransport { server_name: Option<String> },
-}
-
-impl std::fmt::Display for TransportKind {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        match self {
-            TransportKind::Tcp => write!(f, "tcp"),
-            TransportKind::Tls { .. } => write!(f, "tls"),
-            TransportKind::Iroh { .. } => write!(f, "iroh"),
-
-            TransportKind::WebTransport { .. } => write!(f, "webtransport"),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{duplex, DuplexStream};
-
-    struct MockTransport;
-
-    #[async_trait]
-    impl Transport for MockTransport {
-        type Stream = DuplexStream;
-
-        async fn connect(&self) -> Result<Self::Stream> {
-            let (stream, _) = duplex(1024);
-            Ok(stream)
-        }
-
-        fn describe(&self) -> String {
-            "mock".to_string()
-        }
-    }
-
-    struct MockAcceptor;
-
-    #[async_trait]
-    impl TransportAcceptor for MockAcceptor {
-        type Stream = DuplexStream;
-
-        async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-            let (stream, _) = duplex(1024);
-            let info = TransportInfo {
-                remote_addr: None,
-                transport_kind: TransportKind::Tcp,
-            };
-            Ok((stream, info))
-        }
-    }
-
-    #[tokio::test]
-    async fn transport_trait_object() {
-        let _boxed: Box<dyn Transport<Stream = DuplexStream>> = Box::new(MockTransport);
-    }
-
-    #[tokio::test]
-    async fn transport_acceptor_trait_object() {
-        let _boxed: Box<dyn TransportAcceptor<Stream = DuplexStream>> = Box::new(MockAcceptor);
-    }
-
-    #[tokio::test]
-    async fn transport_connect_returns_stream() {
-        let t = MockTransport;
-        let _stream = t.connect().await.unwrap();
-    }
-
-    #[tokio::test]
-    async fn transport_describe_returns_string() {
-        let t = MockTransport;
-        assert_eq!(t.describe(), "mock");
-    }
-
-    #[tokio::test]
-    async fn acceptor_accept_returns_stream_and_info() {
-        let a = MockAcceptor;
-        let (_, info) = a.accept().await.unwrap();
-        assert!(info.remote_addr.is_none());
-        assert!(matches!(info.transport_kind, TransportKind::Tcp));
-    }
-
-    #[test]
-    fn transport_kind_variants() {
-        let tcp = TransportKind::Tcp;
-        let tls = TransportKind::Tls {
-            server_name: Some("example.com".to_string()),
-        };
-        let iroh = TransportKind::Iroh {
-            endpoint_id: "abc123".to_string(),
-        };
-        let wt = TransportKind::WebTransport {
-            server_name: Some("example.com".to_string()),
-        };
-
-        if let TransportKind::Tcp = tcp {}
-        if let TransportKind::Tls {
-            server_name: Some(name),
-        } = tls
-        {
-            assert_eq!(name, "example.com");
-        }
-        if let TransportKind::Iroh { endpoint_id } = iroh {
-            assert_eq!(endpoint_id, "abc123");
-        }
-        if let TransportKind::WebTransport { server_name } = wt {
-            assert_eq!(server_name, Some("example.com".to_string()));
-        }
-    }
-}

crates/alknet-core/src/transport/tcp.rs

@@ -1,162 +0,0 @@
-use std::net::SocketAddr;
-
-use anyhow::Result;
-use async_trait::async_trait;
-use tokio::net::{TcpListener, TcpStream};
-
-use super::{Transport, TransportAcceptor, TransportInfo, TransportKind};
-
-/// A TCP-based client transport that connects to a remote address.
-///
-/// Connects via `TcpStream::connect(addr)`. Uses tokio's default
-/// connect timeout behavior: the OS controls connection timeout
-/// (typically ~2 minutes on Linux via `net.ipv4.tcp_syn_retries`).
-/// For custom timeouts, wrap `TcpTransport` with
-/// `tokio::time::timeout(duration, transport.connect())`.
-pub struct TcpTransport {
-    addr: SocketAddr,
-}
-
-impl TcpTransport {
-    pub fn new(addr: SocketAddr) -> Self {
-        Self { addr }
-    }
-}
-
-#[async_trait]
-impl Transport for TcpTransport {
-    type Stream = TcpStream;
-
-    async fn connect(&self) -> Result<Self::Stream> {
-        let stream = TcpStream::connect(self.addr).await?;
-        Ok(stream)
-    }
-
-    fn describe(&self) -> String {
-        format!("tcp://{}", self.addr)
-    }
-}
-
-/// A TCP-based server transport acceptor that listens for incoming connections.
-///
-/// Binds via `TcpListener::bind(addr)`. Accepts connections and returns
-/// the stream together with `TransportInfo` containing the remote address
-/// and `TransportKind::Tcp`.
-pub struct TcpAcceptor {
-    listener: TcpListener,
-    listen_addr: SocketAddr,
-}
-
-impl TcpAcceptor {
-    /// Bind a TCP listener on the given address.
-    ///
-    /// Returns the acceptor ready to receive connections.
-    /// The actual bound address may differ from the requested one
-    /// (e.g., when binding to port 0 the OS assigns an ephemeral port).
-    pub async fn bind(addr: SocketAddr) -> Result<Self> {
-        let listener = TcpListener::bind(addr).await?;
-        let listen_addr = listener.local_addr()?;
-        Ok(Self {
-            listener,
-            listen_addr,
-        })
-    }
-
-    pub fn listen_addr(&self) -> SocketAddr {
-        self.listen_addr
-    }
-}
-
-#[async_trait]
-impl TransportAcceptor for TcpAcceptor {
-    type Stream = TcpStream;
-
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-        let (stream, remote_addr) = self.listener.accept().await?;
-        let info = TransportInfo {
-            remote_addr: Some(remote_addr),
-            transport_kind: TransportKind::Tcp,
-        };
-        Ok((stream, info))
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-    #[tokio::test]
-    async fn tcp_transport_connect_creates_stream() {
-        let acceptor = TcpAcceptor::bind("127.0.0.1:0".parse().unwrap())
-            .await
-            .unwrap();
-        let addr = acceptor.listen_addr();
-        let transport = TcpTransport::new(addr);
-
-        let accept_handle = tokio::spawn(async move { acceptor.accept().await.unwrap() });
-
-        let stream = transport.connect().await.unwrap();
-        assert_eq!(stream.local_addr().unwrap().ip(), addr.ip());
-
-        let (_server_stream, info) = accept_handle.await.unwrap();
-        assert!(info.remote_addr.is_some());
-        assert!(matches!(info.transport_kind, TransportKind::Tcp));
-    }
-
-    #[tokio::test]
-    async fn tcp_acceptor_accept_receives_connection() {
-        let acceptor = TcpAcceptor::bind("127.0.0.1:0".parse().unwrap())
-            .await
-            .unwrap();
-        let addr = acceptor.listen_addr();
-
-        tokio::spawn(async move {
-            TcpStream::connect(addr).await.unwrap();
-        });
-
-        let (stream, info) = acceptor.accept().await.unwrap();
-        assert!(info.remote_addr.is_some());
-        assert!(matches!(info.transport_kind, TransportKind::Tcp));
-        assert_eq!(
-            info.remote_addr.unwrap().ip(),
-            stream.peer_addr().unwrap().ip()
-        );
-    }
-
-    #[test]
-    fn tcp_transport_describe_format() {
-        let addr: SocketAddr = "1.2.3.4:22".parse().unwrap();
-        let transport = TcpTransport::new(addr);
-        assert_eq!(transport.describe(), "tcp://1.2.3.4:22");
-    }
-
-    #[tokio::test]
-    async fn tcp_stream_is_duplex() {
-        let acceptor = TcpAcceptor::bind("127.0.0.1:0".parse().unwrap())
-            .await
-            .unwrap();
-        let addr = acceptor.listen_addr();
-
-        let mut client = TcpStream::connect(addr).await.unwrap();
-        let (mut server, _) = acceptor.accept().await.unwrap();
-
-        client.write_all(b"hello").await.unwrap();
-        let mut buf = [0u8; 5];
-        server.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello");
-
-        server.write_all(b"world").await.unwrap();
-        let mut buf = [0u8; 5];
-        client.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"world");
-    }
-
-    #[tokio::test]
-    async fn tcp_acceptor_bind_port_zero_assigns_ephemeral() {
-        let acceptor = TcpAcceptor::bind("127.0.0.1:0".parse().unwrap())
-            .await
-            .unwrap();
-        assert_ne!(acceptor.listen_addr().port(), 0);
-    }
-}

crates/alknet-core/src/transport/tls.rs

@@ -1,429 +0,0 @@
-use std::net::SocketAddr;
-use std::sync::Arc;
-
-use anyhow::{anyhow, Result};
-use async_trait::async_trait;
-use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
-use rustls::pki_types::{CertificateDer, PrivateKeyDer, ServerName};
-use rustls::{ClientConfig, DigitallySignedStruct, RootCertStore, ServerConfig};
-use tokio::net::{TcpListener, TcpStream};
-use tokio_rustls::{
-    client::TlsStream as ClientTlsStream, TlsAcceptor as TokioTlsAcceptor, TlsConnector,
-};
-
-#[cfg(feature = "acme")]
-use rustls::crypto::aws_lc_rs::default_provider;
-#[cfg(feature = "acme")]
-use rustls_acme::ResolvesServerCertAcme;
-
-use super::{Transport, TransportAcceptor, TransportInfo, TransportKind};
-
-#[cfg(feature = "acme")]
-const ACME_TLS_ALPN_NAME: &[u8] = b"acme-tls/1";
-
-/// A TLS-based client transport that connects to a remote address over TLS.
-///
-/// Wraps a TCP connection with a TLS client session via `tokio_rustls::TlsConnector`.
-/// Supports insecure mode (accepts any certificate, for development) and
-/// custom root CA certificates for verification. The `tls_server_name` field
-/// overrides the SNI hostname sent during the TLS handshake (ADR-010).
-pub struct TlsTransport {
-    addr: SocketAddr,
-    tls_server_name: Option<String>,
-    insecure: bool,
-    root_cert: Option<CertificateDer<'static>>,
-}
-
-impl TlsTransport {
-    pub fn new(addr: SocketAddr) -> Self {
-        Self {
-            addr,
-            tls_server_name: None,
-            insecure: false,
-            root_cert: None,
-        }
-    }
-
-    pub fn with_server_name(mut self, name: impl Into<String>) -> Self {
-        self.tls_server_name = Some(name.into());
-        self
-    }
-
-    pub fn with_insecure(mut self, insecure: bool) -> Self {
-        self.insecure = insecure;
-        self
-    }
-
-    pub fn with_root_cert(mut self, cert: CertificateDer<'static>) -> Self {
-        self.root_cert = Some(cert);
-        self
-    }
-
-    fn build_client_config(&self) -> Result<ClientConfig> {
-        if self.insecure {
-            let config = ClientConfig::builder()
-                .dangerous()
-                .with_custom_certificate_verifier(Arc::new(NoVerifier))
-                .with_no_client_auth();
-            return Ok(config);
-        }
-
-        let mut root_store = RootCertStore::empty();
-        root_store.extend(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
-
-        if let Some(ref cert) = self.root_cert {
-            root_store.add(cert.clone())?;
-        }
-
-        let config = ClientConfig::builder()
-            .with_root_certificates(root_store)
-            .with_no_client_auth();
-        Ok(config)
-    }
-
-    fn resolve_server_name(&self) -> Result<ServerName<'static>> {
-        let name = match &self.tls_server_name {
-            Some(n) => n.clone(),
-            None => self.addr.ip().to_string(),
-        };
-        ServerName::try_from(name.clone())
-            .map_err(move |e| anyhow!("invalid server name '{}': {}", name, e))
-    }
-}
-
-#[async_trait]
-impl Transport for TlsTransport {
-    type Stream = ClientTlsStream<TcpStream>;
-
-    async fn connect(&self) -> Result<Self::Stream> {
-        let tcp_stream = TcpStream::connect(self.addr).await?;
-        let config = self.build_client_config()?;
-        let connector = TlsConnector::from(Arc::new(config));
-        let server_name = self.resolve_server_name()?;
-        let tls_stream = connector.connect(server_name, tcp_stream).await?;
-        Ok(tls_stream)
-    }
-
-    fn describe(&self) -> String {
-        format!("tls://{}", self.addr)
-    }
-}
-
-/// Stub configuration for ACME certificate provisioning (ADR-008).
-/// Feature-gated behind the `acme` feature. When implemented, this will
-/// hold the ACME domain and challenge responder configuration.
-#[derive(Debug)]
-pub struct AcmeConfig {
-    pub domain: String,
-}
-
-/// A TLS-based server transport acceptor that accepts TCP connections
-/// and wraps them with TLS server sessions via `tokio_rustls::TlsAcceptor`.
-///
-/// Supports three certificate modes (ADR-008):
-/// - Manual certs via `bind()` with explicit cert/key
-/// - ACME certs via `bind_acme()` with an `AcmeCertProvider`
-/// - The stub `AcmeConfig` parameter in `bind()` is kept for backward compat
-pub struct TlsAcceptor {
-    listener: TcpListener,
-    listen_addr: SocketAddr,
-    #[allow(dead_code)]
-    server_config: Arc<ServerConfig>,
-    tokio_acceptor: TokioTlsAcceptor,
-}
-
-impl TlsAcceptor {
-    pub async fn bind(
-        addr: SocketAddr,
-        tls_certs: Vec<CertificateDer<'static>>,
-        tls_key: PrivateKeyDer<'static>,
-        _acme_config: Option<AcmeConfig>,
-    ) -> Result<Self> {
-        let listener = TcpListener::bind(addr).await?;
-        let listen_addr = listener.local_addr()?;
-
-        let server_config = ServerConfig::builder()
-            .with_no_client_auth()
-            .with_single_cert(tls_certs, tls_key)?;
-
-        let server_config = Arc::new(server_config);
-        let tokio_acceptor = TokioTlsAcceptor::from(server_config.clone());
-
-        Ok(Self {
-            listener,
-            listen_addr,
-            server_config,
-            tokio_acceptor,
-        })
-    }
-
-    #[cfg(feature = "acme")]
-    pub async fn bind_acme(
-        addr: SocketAddr,
-        acme_resolver: Arc<ResolvesServerCertAcme>,
-    ) -> Result<Self> {
-        let listener = TcpListener::bind(addr).await?;
-        let listen_addr = listener.local_addr()?;
-
-        let provider = default_provider().into();
-        let mut server_config = ServerConfig::builder_with_provider(provider)
-            .with_safe_default_protocol_versions()
-            .map_err(|e| anyhow!("failed to set protocol versions: {}", e))?
-            .with_no_client_auth()
-            .with_cert_resolver(acme_resolver);
-        server_config
-            .alpn_protocols
-            .push(ACME_TLS_ALPN_NAME.to_vec());
-
-        let server_config = Arc::new(server_config);
-        let tokio_acceptor = TokioTlsAcceptor::from(server_config.clone());
-
-        Ok(Self {
-            listener,
-            listen_addr,
-            server_config,
-            tokio_acceptor,
-        })
-    }
-
-    pub fn listen_addr(&self) -> SocketAddr {
-        self.listen_addr
-    }
-}
-
-#[async_trait]
-impl TransportAcceptor for TlsAcceptor {
-    type Stream = tokio_rustls::server::TlsStream<TcpStream>;
-
-    async fn accept(&self) -> Result<(Self::Stream, TransportInfo)> {
-        let (tcp_stream, remote_addr) = self.listener.accept().await?;
-        let tls_stream = self.tokio_acceptor.accept(tcp_stream).await?;
-
-        let server_name = tls_stream.get_ref().1.server_name().map(|s| s.to_string());
-
-        let info = TransportInfo {
-            remote_addr: Some(remote_addr),
-            transport_kind: TransportKind::Tls { server_name },
-        };
-
-        Ok((tls_stream, info))
-    }
-}
-
-#[derive(Debug)]
-struct NoVerifier;
-
-impl ServerCertVerifier for NoVerifier {
-    fn verify_server_cert(
-        &self,
-        _end_entity: &CertificateDer<'_>,
-        _intermediates: &[CertificateDer<'_>],
-        _server_name: &ServerName<'_>,
-        _ocsp_response: &[u8],
-        _now: rustls::pki_types::UnixTime,
-    ) -> std::result::Result<ServerCertVerified, rustls::Error> {
-        Ok(ServerCertVerified::assertion())
-    }
-
-    fn verify_tls12_signature(
-        &self,
-        _message: &[u8],
-        _cert: &CertificateDer<'_>,
-        _doc: &DigitallySignedStruct,
-    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
-        Ok(HandshakeSignatureValid::assertion())
-    }
-
-    fn verify_tls13_signature(
-        &self,
-        _message: &[u8],
-        _cert: &CertificateDer<'_>,
-        _doc: &DigitallySignedStruct,
-    ) -> std::result::Result<HandshakeSignatureValid, rustls::Error> {
-        Ok(HandshakeSignatureValid::assertion())
-    }
-
-    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
-        vec![
-            rustls::SignatureScheme::ECDSA_NISTP256_SHA256,
-            rustls::SignatureScheme::ECDSA_NISTP384_SHA384,
-            rustls::SignatureScheme::ED25519,
-            rustls::SignatureScheme::RSA_PSS_SHA256,
-            rustls::SignatureScheme::RSA_PSS_SHA384,
-            rustls::SignatureScheme::RSA_PSS_SHA512,
-        ]
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use rcgen::{CertificateParams, KeyPair};
-    use rustls::crypto::aws_lc_rs::default_provider;
-    use tokio::io::{AsyncReadExt, AsyncWriteExt};
-
-    fn ensure_crypto_provider() {
-        let _ = default_provider().install_default();
-    }
-
-    fn generate_self_signed_cert() -> (CertificateDer<'static>, PrivateKeyDer<'static>) {
-        let params = CertificateParams::new(vec!["localhost".to_string()]).unwrap();
-        let key_pair = KeyPair::generate().unwrap();
-        let cert = params.self_signed(&key_pair).unwrap();
-        let cert_der: CertificateDer<'static> = cert.into();
-        let key_der = PrivateKeyDer::Pkcs8(key_pair.serialize_der().into());
-        (cert_der, key_der)
-    }
-
-    #[test]
-    fn tls_transport_describe_format() {
-        let addr: SocketAddr = "1.2.3.4:443".parse().unwrap();
-        let transport = TlsTransport::new(addr).with_server_name("example.com");
-        assert_eq!(transport.describe(), "tls://1.2.3.4:443");
-    }
-
-    #[test]
-    fn tls_transport_describe_with_ip() {
-        let addr: SocketAddr = "1.2.3.4:443".parse().unwrap();
-        let transport = TlsTransport::new(addr);
-        assert_eq!(transport.describe(), "tls://1.2.3.4:443");
-    }
-
-    #[test]
-    fn tls_transport_builder_methods() {
-        let addr: SocketAddr = "1.2.3.4:443".parse().unwrap();
-        let transport = TlsTransport::new(addr)
-            .with_server_name("alknet.test")
-            .with_insecure(true);
-        assert_eq!(transport.tls_server_name, Some("alknet.test".to_string()));
-        assert!(transport.insecure);
-    }
-
-    #[tokio::test]
-    async fn tls_connect_insecure_self_signed() {
-        ensure_crypto_provider();
-        let (cert_der, key_der) = generate_self_signed_cert();
-
-        let acceptor = TlsAcceptor::bind(
-            "127.0.0.1:0".parse().unwrap(),
-            vec![cert_der],
-            key_der,
-            None,
-        )
-        .await
-        .unwrap();
-        let addr = acceptor.listen_addr();
-
-        let transport = TlsTransport::new(addr)
-            .with_server_name("localhost")
-            .with_insecure(true);
-
-        let accept_handle = tokio::spawn(async move { acceptor.accept().await.unwrap() });
-
-        let mut client = transport.connect().await.unwrap();
-
-        let (mut server, info) = accept_handle.await.unwrap();
-        assert!(info.remote_addr.is_some());
-        assert!(matches!(info.transport_kind, TransportKind::Tls { .. }));
-
-        client.write_all(b"hello tls").await.unwrap();
-        let mut buf = [0u8; 9];
-        server.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"hello tls");
-
-        server.write_all(b"reply").await.unwrap();
-        let mut buf = [0u8; 5];
-        client.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, b"reply");
-    }
-
-    #[tokio::test]
-    async fn tls_acceptor_returns_server_name() {
-        ensure_crypto_provider();
-        let (cert_der, key_der) = generate_self_signed_cert();
-
-        let acceptor = TlsAcceptor::bind(
-            "127.0.0.1:0".parse().unwrap(),
-            vec![cert_der],
-            key_der,
-            None,
-        )
-        .await
-        .unwrap();
-        let addr = acceptor.listen_addr();
-
-        let transport = TlsTransport::new(addr)
-            .with_server_name("localhost")
-            .with_insecure(true);
-
-        let accept_handle = tokio::spawn(async move { acceptor.accept().await.unwrap() });
-
-        let _client = transport.connect().await.unwrap();
-
-        let (_, info) = accept_handle.await.unwrap();
-        if let TransportKind::Tls { server_name } = info.transport_kind {
-            assert_eq!(server_name, Some("localhost".to_string()));
-        } else {
-            panic!("expected TransportKind::Tls");
-        }
-    }
-
-    #[tokio::test]
-    async fn tls_full_client_to_server_connection() {
-        ensure_crypto_provider();
-        let (cert_der, key_der) = generate_self_signed_cert();
-
-        let acceptor = TlsAcceptor::bind(
-            "127.0.0.1:0".parse().unwrap(),
-            vec![cert_der],
-            key_der,
-            None,
-        )
-        .await
-        .unwrap();
-        let addr = acceptor.listen_addr();
-
-        let transport = TlsTransport::new(addr)
-            .with_server_name("localhost")
-            .with_insecure(true);
-
-        let accept_handle = tokio::spawn(async move { acceptor.accept().await.unwrap() });
-
-        let mut client = transport.connect().await.unwrap();
-        let (mut server, _info) = accept_handle.await.unwrap();
-
-        let msg = b"alknet integration test";
-        client.write_all(msg).await.unwrap();
-        let mut buf = vec![0u8; msg.len()];
-        server.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf[..], msg);
-
-        let reply = b"ok";
-        server.write_all(reply).await.unwrap();
-        let mut buf = [0u8; 2];
-        client.read_exact(&mut buf).await.unwrap();
-        assert_eq!(&buf, reply);
-    }
-
-    #[tokio::test]
-    async fn tls_acceptor_bind_port_zero_assigns_ephemeral() {
-        ensure_crypto_provider();
-        let (cert_der, key_der) = generate_self_signed_cert();
-
-        let acceptor = TlsAcceptor::bind(
-            "127.0.0.1:0".parse().unwrap(),
-            vec![cert_der],
-            key_der,
-            None,
-        )
-        .await
-        .unwrap();
-        assert_ne!(acceptor.listen_addr().port(), 0);
-    }
-
-    #[test]
-    fn no_verifier_accepts_any_cert() {
-        let verifier = NoVerifier;
-        assert!(verifier.supported_verify_schemes().len() > 0);
-    }
-}

crates/alknet-core/tests/auth_tests.rs

@@ -1,2 +0,0 @@
-#[tokio::test]
-async fn auth_placeholder() {}