Module engine 

HolePunchEngine: pure-logic state machine for NAT hole punching.

Follows the asymmetric protocol from direct-link-protocol.md:

Phase 1: A probes facilitator T → learns A_pub Phase 2: A sends UPGRADE_REQUEST {facilitator: T, initiator_public: A_pub} → B B responds with UPGRADE_ACCEPT or UPGRADE_REJECT Phase 3: B probes T (from request) → learns B_pub B sends UPGRADE_READY {responder_public: B_pub} → A Phase 4: Both punch simultaneously Phase 5: Direct link established

Methods return Vec<HolePunchAction> instead of performing I/O.

Structs

HolePunchEngine

The hole-punch state machine for a single link.

Functions

derive_punch_token

Derives a 32-byte punch token from the link’s derived key and session ID.