Struct Node 

pub struct Node { /* private fields */ }

A running in-process node. Dropping it does NOT stop serving — call shutdown.

Implementations

impl Node

pub async fn control(&self) -> Result<ControlClient, ClientError>

A control connection to THIS node: the same typed mcpmesh-local/1 client a sidecar consumer gets from connect_control_default, over an in-memory pipe. Cheap; open one per concurrent conversation — a session/stream upgrade (open_session, subscribe) consumes its connection, exactly as on the socket.

pub fn endpoint_id(&self) -> EndpointId

This node’s mesh identity — what a peer’s invite/pair flow binds to.

pub fn sign_app(&self, domain: &[u8], msg: &[u8]) -> [u8; 64]

Sign an application payload with this node’s DEVICE key, under the embedder’s own domain (#59).

What this is for. mcpmesh authenticates the transport: inside a session, _meta["mcpmesh/peer"] says who is calling. That answers nothing about a payload which outlives its connection — anything store-and-forward (offline delivery, a relay, a mailbox, an app-level overlay) handles bytes whose author is not the peer that delivered them, and the transport authenticated the FORWARDER. This attributes the ORIGIN, against the same identity the transport already proves, so an embedder needs no second key, no second backup/revocation story, and no binding protocol tying the two together.

domain is yours; pick one per statement KIND (b"chat/message/1", b"mailbox/receipt/1"). A signature is only as narrow as its domain, and sharing one across two shapes lets a value from either be read as the other. mcpmesh’s own domains are out of reach whatever you choose — see mcpmesh_trust::app for why that is a property of the preimage rather than of your discipline.

Verify with verify_app, which needs no node.

Not a control verb, deliberately. Signing over the JSON-RPC socket would put the device key’s authority behind an IPC surface shared by every consumer of that socket. This is an in-process seam for the embedder that owns the node.

pub fn verify_app( endpoint_id: &EndpointId, domain: &[u8], msg: &[u8], sig: &[u8; 64], ) -> bool

Verify an application payload signed by endpoint_id under domain (#59).

An associated function: verification needs no node, which is the point — a consumer checking a relayed payload has the peer’s EndpointId and nothing else.

Returns false for a bad signature, a mismatched domain/message, or malformed bytes. It never panics: every input is attacker-supplied by construction.

It answers “which device produced these bytes” and nothing else. Whether that device was ENTITLED to make the statement is the embedder’s authorization question, answered from the embedder’s own state.

pub async fn wait(&self)

Resolves once shutdown has been requested — by shutdown from another handle, or by the control protocol’s shutdown verb (e.g. an operator driving this node’s control connection).

pub async fn shutdown(self)

Stop serving: raise the shutdown signal, stop the accept/poll/background loops and every live control connection (subscription streams end immediately; in-flight control requests get a dropped connection — acceptable, shutdown means shutdown), and close the endpoint (a graceful QUIC close — live sessions end cleanly).

Trait Implementations

impl Debug for Node

Hand-rolled: the boot internals are not Debug; the identity is the one diagnostic a {:?} needs.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.