Module paths 

Platform paths + endpoint resolution — featureless/std-only, so any consumer resolves the daemon endpoint from the ONE rule. Shared paths rule: resolved per-platform in ONE place (XDG on unix; APPDATA/LOCALAPPDATA + named-pipe names on windows). Featureless and std-only — it lives on the vocabulary crate precisely so EVERY consumer (the daemon, the CLI, and plugins, which are barred from mcpmesh-trust) resolves the same endpoint from the same rule instead of a per-crate replica. mcpmesh_trust::paths re-exports it.

Constants

MAX_SOCKET_PATH

Functions

config_dir

Per-platform config dir: $XDG_CONFIG_HOME/mcpmesh when that var is set, non-empty, and absolute; otherwise $HOME/.config/mcpmesh (unix). On Windows, %APPDATA%\mcpmesh (an absolute XDG_CONFIG_HOME override still wins, for test isolation).

data_dir

Per-platform data dir for durable state: $XDG_DATA_HOME/mcpmesh when that var is set, non-empty, and absolute; otherwise $HOME/.local/share/mcpmesh (unix). state.redb (the peer allowlist) lives here. Unlike the runtime dir (ephemeral, per-boot), this is durable across reboots. On Windows, %LOCALAPPDATA%\mcpmesh\data (LOCALAPPDATA, not APPDATA — this data need not roam with the user profile).

default_audit_dir

The append-only audit-log directory (<state_dir>/audit/). One monthly JSONL file per calendar month (YYYY-MM.jsonl) lives here; the writer creates the directory lazily on first append. Local-only — nothing here is ever transmitted.

default_blob_scopes_path

The persisted blob-scope sidecar (<data_dir>/blob-scopes.json). One JSON document: scope_name -> { hashes, grants }, atomic-write single-writer.

default_blobs_dir

The gated app-blob store directory (<data_dir>/blobs/ — the daemon’s gated iroh-blobs store).

default_config_path

default_device_key_path

default_endpoint

The local control endpoint, resolved for THIS platform: a Unix socket at <runtime_dir>/mcpmesh.sock on unix. On Windows there is no per-user runtime dir with the right ACL semantics, so the control plane is a named pipe instead — see the private windows_pipe_name helper; the returned PathBuf is the pipe name (\\.\pipe\…), which is what transport::connect_local/bind_local dial. The ONE resolver both wire ends share: the daemon binds exactly what this returns, so clients rendezvous by construction, never by copied formula.

default_org_root_key_path

The org-root key (<config_dir>/org-root.key) — held by the operator. Present ONLY on the operator’s node (minted by org create); signs rosters.

default_roster_confirmed_path

The per-node roster-freshness sidecar (<config_dir>/roster.confirmed). One epoch-seconds integer: the last instant this node validated the installed roster as current via an authenticated channel (a TLS URL poll ≥ installed, a gossip-delivered roster passing validation, or a manual install). Per-node LIVENESS state, NOT a roster-document field — keeps roster.json a pure re-serialization.

default_roster_path

The installed roster document (<config_dir>/roster.json).

default_state_db_path

The peer allowlist store path (<data_dir>/state.redb).

default_user_key_path

This person’s user key (<config_dir>/user.key). Minted by join; binds a person’s devices. Present on every enrolled person’s device (never moves between machines).

profile_root

The active profile root: the in-process override if set, else an absolute non-empty MCPMESH_HOME. None = the standard XDG (unix) / APPDATA (windows) layout. When Some, ALL state — config, data, state, and the runtime socket — roots under this ONE directory (#32), so isolating an instance takes one knob instead of overriding five XDG vars.

runtime_dir

Per-platform runtime dir for the control socket: $XDG_RUNTIME_DIR/mcpmesh when that var is set, non-empty, and absolute (Linux); otherwise $TMPDIR/mcpmesh, or std::env::temp_dir()/mcpmesh when TMPDIR is unset (macOS — its per-user $TMPDIR is itself private). Returns the path only; the daemon creates it 0700 + verifies ownership before binding (a bind-time concern — see cli ipc::bind_control_socket).

set_root

Pin the profile root for THIS process (the in-process form of --profile/--home). Returns Err(dir) if a root was already pinned (first set wins). The spawned daemon inherits the same root via the MCPMESH_HOME env var the launcher sets, so both ends resolve identically.

state_dir

Per-platform STATE dir for durable, per-node runtime state: $XDG_STATE_HOME/mcpmesh when that var is set, non-empty, and absolute; otherwise $HOME/.local/state/mcpmesh. Distinct from data_dir() (~/.local/share, XDG_DATA_HOME): the XDG basedir spec places state data (logs, history — the audit JSONL here) under ~/.local/state, separate from portable app data. Mirrors the data_dir() derivation exactly, swapping the var and the .local/state segment. On Windows, %LOCALAPPDATA%\mcpmesh\state (mirrors data_dir()’s Windows branch, state segment).