Module endpoint 

The iroh endpoint adapter (phase D, #406).

Binds a QUIC endpoint that speaks SYNC_ALPN over a pinned relay, and runs one run_session per connection. iroh’s stream types implement tokio::io::AsyncRead/AsyncWrite, so the bi- stream drops straight into the transport-agnostic session with no adapter shims.

Endpoint::builder(presets::Minimal) is deliberate: Minimal disables the public n0 node directory, so discovery happens ONLY through the relay this deployment pins — a peer is reachable iff it shares the configured relay, never via a third-party lookup.

Authorization (#881)

iroh authenticates the transport KEY; on top of that, both connect_and_sync and accept_and_sync run the mutual node-authorization handshake (run_auth_phase) BEFORE any inventory is exchanged. Under AuthPolicy::Closed a peer is admitted only if it presents a signed binding proving its authenticated node id belongs to a roster device of the account; under AuthPolicy::Open any peer is admitted (for a future public read-only knowledge base). The ONBOARDING case — admitting a not-yet-roster device via a one-time invite token (AuthPolicy::InviteToken) — is not implemented in this slice and fails closed; it is the pairing flow (sync init / sync pair / sync join) that the CLI slice wires up.

Enums

EndpointError

Endpoint construction or connection setup failed, before a session could run.

SyncFailure

A sync attempt that failed setting up the connection, authorizing the peer, or running the session.

Functions

accept_and_sync

Accept ONE inbound connection and run a session against it. D4’s sync serve loops this; keeping it single-shot here keeps the store’s !Send connection on one task (no spawn).

build_endpoint

Bind a sync endpoint pinned to relay_url, with a stable node id derived from secret_key (the 32-byte ed25519 seed of the transport identity — its own key, distinct from any account device key). The same seed yields the same node id across launches, so a peer’s ticket stays valid.

connect_and_sync

Dial peer, authorize each other under policy, then run one sync session, returning what moved. The auth handshake (#881) runs BEFORE any inventory: the dialer presents its binding, then verifies the acceptor’s before revealing anything, so a poisoned address never leaks the account log to an impostor.

endpoint_addr

This endpoint’s dialable address — hand it (or a ticket wrapping it) to a peer so it can connect_and_sync back.