Crate alksocks 

alksocks — SOCKS5 (RFC 1928) as a produced resource on alkcall channels.

A producer/consumer protocol crate (the alktty/alktunnels shape): the producer half registers the channels/socks5/sub open op and drives the RFC 1928 conversation in-stream over the channel’s BiStream; the consumer half opens SOCKS5 channels and speaks the protocol inside them. The defining posture: the protocol never binds a port — kernel binds exist only as explicit, feature-gated assembly shapes (local), never in the protocol layer.

The landed surface (the protocol core)

• The wire vocabulary and the explicit typestate live in rfc1928: a targeted fork of fast-socks5 v1.0.0’s T-generic subset (MIT, third-party upstream) carrying two deliberate changes (BIND support, new_reply publication) — see docs/architecture/rfc1928.md, ADR-013, and ADR-011.
• The wire codec (wire): the ASSOCIATE datagram frame ([len: u16 BE][addr + data], ADR-003) — framing is applied exactly once, by this layer; the egress speaks inner bytes.
• The wire-stable open-op surface (params): the channels/socks5/sub op id, the alk/socks5 ALPN, the trivial {} params (ADR-001), and the two scope constants (socks5:open, socks5:bind — two grants, never implied, ADR-006). The typed open-error vocabulary lives in error.
• The three seams (egress): DialFn / EgressFactory / BindAcceptFactory (ADR-004) — functions, not traits, at the three I/O planes; ownership rides the handle structurally; the egress readiness contract (next_reply Pending when nothing is ready) is load-bearing API.
• The producer half (producer): the session-gate establisher, the command-dispatch pump (CONNECT pass-through / ASSOCIATE datagram stage / BIND phase model), the scope gates (the open gate socks5:open at the registry; the command gate socks5:bind at BIND dispatch), and register_socks5_openable — substrate-agnostic over the seams; never a bind in the protocol layer.
• The consumer half (consumer): the typed channels-native sessions — Socks5ChannelSession (CONNECT), AssociateSession (the framed datagram stage), BindSession (the reply#1/reply#2 reader) — each owning its channel’s teardown; no Clone. The cred-bearing front door’s re-origination rides the token-carrying surface (TokenClient
  • the *_with_token constructor twins).

The assembly layer (feature-gated, ADR-008/009): local (the socket-backed providers — local::tcp_dial / local::udp_egress / local::bind_accept — plus the producer-side local::ProducerDoor) and door (the consumer’s front doors — the NoAuth raw-pipe + RFC 1929 cred-bearing FrontDoor, the UdpFrontDoor with the RFC codec at the door boundary only, ADR-005/003/014) ride local; the composed providers (composed::direct_egress — the alktunnels direct-op egress, composed::bindfirst_accept — the bind-first accept, ADR-007/008) ride composed. The default crate is protocol-only and wasm-clean by construction.

Architecture: docs/architecture/overview.md (spec set: wire.md, producer.md, consumer.md, rfc1928.md); the cross-cutting behavior is pinned end to end by tests/core-integration.rs (the protocol core: one registration, all three commands; concurrency; the teardown matrix; the identity/scope matrix; the readiness contract) and tests/assembly-integration.rs (the assembly layer: the full -D story through the doors, the composed variant set, mixed assembly, the assembly teardown matrix).

Re-exports

pub use consumer::AssociateSession;

pub use consumer::BindDataPlane;

pub use consumer::BindReply1;

pub use consumer::BindSession;

pub use consumer::Socks5ChannelSession;

pub use consumer::SpentSessionError;

pub use consumer::TakenAssociateInner;

pub use egress::egress_factory;

pub use egress::BindAccept;

pub use egress::BindAcceptError;

pub use egress::BindAcceptFactory;

pub use egress::BindAcceptFactoryError;

pub use egress::BindTargetHandle;

pub use egress::DialFn;

pub use egress::Egress;

pub use egress::EgressError;

pub use egress::EgressFactory;

pub use egress::SocksDialError;

pub use egress::TargetHandle;

pub use error::ReplyError;

pub use error::SocksError;

pub use error::SocksEstablishmentReason;

pub use error::SocksOpenError;

pub use error::SocksServerError;

pub use error::SocksSessionError;

pub use params::establishment_reason;

pub use params::socks5_open_spec;

pub use params::Socks5Params;

pub use params::OP_SOCKS5_OPEN;

pub use params::SOCKS5_ALPN;

pub use params::SOCKS5_BIND_SCOPE;

pub use params::SOCKS5_OPEN_SCOPE;

pub use producer::make_socks5_pump_handler;

pub use producer::register_socks5_openable;

pub use producer::serve_socks5_over;

pub use producer::socks5_session_establisher;

pub use producer::IdentityWitness;

pub use producer::Socks5Producer;

pub use producer::Socks5ProducerBuilder;

pub use wire::addr_encoding_len;

pub use wire::frame;

pub use wire::frame_inner;

pub use wire::DatagramReader;

pub use wire::WireError;

pub use wire::MAX_INNER_LEN;

Modules

consumer

The consumer half: the channels-native session types and teardown ownership (consumer.md §The Channels-Native Sessions).

egress

The three I/O-plane seam types (ADR-004) — the dial seam (CONNECT), the egress seam (UDP ASSOCIATE), the accept seam (TCP BIND) — as function-shaped callbacks with their error vocabularies. These types are the inversion point (AGENTS.md convention 7): the protocol layer never names a substrate type; the feature-gated providers (local/composed, batch 2) and the test harness construct them.

error

The crate’s error surfaces: the typed open-error vocabulary (SocksOpenError, alkcall ADR-049 §4), the session-level error (SocksSessionError) for the consumer sessions, and the re-exported RFC data-plane vocabulary (SocksError, SocksServerError, ReplyError).

params

The trivial open-op params, the wire-stable constants, and the OperationSpec builder — wire.md §The Open Op, ADR-001, ADR-006.

producer

The producer half: the open op spec (scope-gated), the session-gate establisher, the command-dispatch pump handler (typestate driving + the three seams), teardown.

rfc1928

The RFC 1928 core: a targeted fork of fast-socks5 v1.0.0’s T-generic subset (MIT, third-party upstream — github.com/dizda/fast-socks5; /workspace/fast-socks5 is the read-only reference checkout, kept for differential testing of RFC edge cases).

wire

The ASSOCIATE datagram frame codec (ADR-003): the crate’s one framed stage — [len: u16 BE][addr + data] per datagram, both directions of the channel BiStream. CONNECT/BIND are raw pass-through (no framing). Normative WHAT: wire.md §The Data Plane; the binary contract: bast.md (AssociateFrame). The length codec is first-party code shaped on alktunnels’ frame_datagram/DatagramReader (same F-2 behavior; no dependency on it).