1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
[]
= "mcpmesh-node"
= true
= true
= true
= true
= true
= "Embed a full mcpmesh node in-process — the daemon core as a library"
[]
= true
[]
= true
= true
= true
= true
= true
= true
# `process`: the `run` backend spawns a child MCP server per session via
# tokio::process::Command with async stdin/stdout handles (the workspace tokio omits it).
= { = true, = ["process"] }
= true
= true
= true
# `service` (implies `client`): the control server consumes the seam's hardened local
# endpoint types, and `Node::control` hands back the seam's ControlClient over an
# in-memory duplex.
= { = true, = ["service"] }
# Org-root VerifyingKey for roster install/load + the `org_root_pk` b64u decode. Same
# crate mcpmesh-trust already pins → a dependency edge only, no new crate version.
= true
# Runtime-dir ownership + peer-uid checks (spec §11.2/§13). Already in the tree via
# iroh; SAFE wrappers (no inline unsafe → satisfies forbid(unsafe)).
= { = "1", = ["process", "fs"] }
# state.redb — the pure-Rust embedded KV the spec pins for the peer allowlist store
# (§15). MIT OR Apache-2.0 (already in deny.toml allow); no C deps.
= "2"
# Surgical config.toml writes for `serve`/RegisterService: read the doc as a
# `toml::Table`, upsert the `[services.*]` entry, atomic-write back.
= "0.8"
# base32 line-encoding for the `mcpmesh-invite:` artifact. Already in the tree via iroh.
= "2"
# blake3 transcript hash for the pairing short authentication code (spec §4.2).
= "1"
# OS CSPRNG for the 32-byte pairing invite secret (spec §4.2).
= true
= true
# Roster + presence gossip topics (spec §4.3/§10.1). iroh-gossip 0.101.0 depends on
# iroh "1" → unifies on the workspace-pinned iroh =1.0.1, NO iroh bump.
= { = true }
# Roster-blob fetch only (spec §4.3/§9). iroh-blobs 0.103.0 → iroh ^1.0.0, unifies on =1.0.1.
= { = true }
# HTTPS roster poll (spec §4.3), rustls-tls (no OpenSSL).
= { = true }
# The rustls CryptoProvider install: reqwest (`rustls-no-provider`) resolves the provider
# at CLIENT-BUILD time and PANICS if none is installed; iroh installs no process-default.
# `Node::start` installs a ring process-default once (idempotent — a host app that already
# installed its own provider wins).
= { = "0.23", = false, = ["ring", "std"] }
# The gossip broadcast/receive payload type (`Bytes`) + the `StreamExt::next` the
# GossipReceiver stream yields. Not re-exported nameably by iroh-gossip, so direct deps.
= { = true }
= { = true }
# Custom-discovery pkarr relay URLs (spec §10.3): iroh's Pkarr builders take `url::Url`.
= { = true }
[]
= true
# Log-capture for the pairing-rendezvous surface-discipline test: assert no peer
# EndpointId leaks into a refusal's logs.
= "0.3"
= true