feat(discovery): standardize desktop mDNS on DNS-SD for iOS/Android interop

[momics]

Closes #329.

Summary

Desktop iroh-http nodes are currently invisible to iOS and Android. The desktop
discovery stack (swarm-discovery via iroh-mdns-address-lookup) emits no DNS-SD
PTR record, so Apple's mDNSResponder / NWBrowser and Android's NsdManager
never register desktop advertisers — dns-sd -B finds nothing while a swarm-discovery advertiser is running (see #329 for the full root-cause analysis and evidence).

This PR reworks desktop mDNS to speak standard DNS-SD (PTR + SRV + TXT) via the
mdns-sd crate, wired to iroh's dialer through a custom AddressLookup so that
fetch(nodeId) still auto-resolves LAN peers. Because that gives us a standards-compliant DNS-SD engine, the PR also exposes it as a generic advertise/browse API so applications can publish and discover any DNS-SD service, not just iroh-http peers — with the iroh peer path defined as a specialization of that generic surface, at parity across desktop and mobile.

⚠️ Breaking changes

Wire format. Desktop mDNS moves from swarm-discovery to standard DNS-SD (_iroh-http._udp.local, PTR + SRV + TXT), which changes the LAN discovery wire format. A node on a pre-switch version will not discover, or be discovered by, a node on this version over mDNS, so mixed-version LANs must upgrade together. iroh-http is also no longer interoperable with plain-iroh's built-in mDNS swarm discovery, which omits the DNS-SD PTR record; in exchange, desktop advertisers become visible to Bonjour, iOS NWBrowser, and Android NsdManager. This affects LAN enumeration only — once a node id and address are known (via ticket, direct address, or DNS), the QUIC handshake is unchanged.

Discovery API. The generic DNS-SD engine is now the primitive, exposed directly as node.advertise(config) and node.browse(config). The iroh-http peer discovery that previously lived under those names has moved to the explicit specialization node.advertisePeer() and node.browsePeers(). The node.dnsSd sub-object and the exported DnsSd class are removed. The rationale is captured in ADR-018, and interop details are documented in docs/features/discovery.md.

Migration:

Before	After
node.advertise({ serviceName }) (iroh peer)	node.advertisePeer({ serviceName })
node.browse({ serviceName }) (iroh peer)	node.browsePeers({ serviceName })
node.dnsSd.advertise(config)	node.advertise(config)
node.dnsSd.browse(config)	node.browse(config)

Tauri permission. The iroh-http:mdns and iroh-http:dns-sd permission sets are replaced by a single iroh-http:discovery set covering all ten discovery commands. Capabilities that granted either of the old sets must grant iroh-http:discovery instead.

Generic DNS-SD surface

node.advertise and node.browse publish and discover any DNS-SD service, returning lossless ServiceRecords (instance label, host, port, socket addresses, and every TXT property). The iroh-http path, node.advertisePeer and node.browsePeers, is a thin specialization over the same engine that additionally wires the endpoint address lookup and injects the pk TXT. browsePeers also excludes the local node from its own stream — mDNS echoes a node's records back to itself, but a peer stream should only surface other nodes (you never dial yourself; self-fetch is loopback per ADR-015). The generic browse primitive stays faithful to DNS-SD and still reports the node's own records. Both run on the node because the native discovery FFI is loaded through the node addon — Deno's dlopen runs during createNode. asIrohPeer(record) recognizes an iroh-http peer inside a generic browse.

Discovery harmonization (mobile parity + one permission)

The peer and generic paths are now unified rather than two loosely-related groups:

• One permission. iroh-http:mdns + iroh-http:dns-sd collapse into iroh-http:discovery, since the peer path is just a specialization of the generic one and both drive the same commands. The example and compliance-runner capabilities, the plugin README, the permission-integrity test, and the autogenerated schema/reference are updated accordingly.
• Generic DNS-SD on mobile. Mobile builds previously rejected generic advertise/browse with a hard not supported on mobile error, even though peer discovery already bridged to the native layer. The generic path now reuses that same machinery. Android resolves full records (host, port, TXT, addresses) via resolveService; iOS surfaces the instance name, service type, and TXT but leaves host/port/addresses unresolved, because NWBrowser does not resolve an endpoint without opening an NWConnection — a documented best-effort limitation, not a hard failure. The mobile Rust bridge is verified with cargo check/clippy against the iOS target; the native Swift and Kotlin changes cannot be compiled in CI and require on-device verification (tracked below).

Plan

• Docs: mobile mDNS/DNS-SD setup guide (iOS Info.plist + Android manifest), linked from the discovery feature doc, Tauri guidelines, and docs index.
• iroh-http-discovery: standard DNS-SD advertise/browse (mdns-sd) emitting PTR + SRV + TXT (including a pk TXT), with the base32 endpoint id as the instance name.
• Custom iroh AddressLookup fed by the browse stream so desktop fetch(nodeId) still auto-resolves LAN peers (mirrors MobileAddressLookup).
• Generic node.advertise / node.browse, iroh advertisePeer / browsePeers, and the asIrohPeer helper, with Deno, Node, and Tauri examples (ADR-018).
• Unify the iroh-http:mdns + iroh-http:dns-sd Tauri permissions into a single iroh-http:discovery set.
• Implement generic DNS-SD on mobile (Android full records; iOS metadata-only) over the existing native bridge.
• Exclude the local node from browsePeers so a node that both advertises and browses doesn't surface itself (the generic browse stays faithful).
• Interop verified on one LAN: desktop → iOS, desktop → Android, mobile → desktop (no regression), desktop ↔ desktop, mobile ↔ mobile.
• Verify the native mobile discovery (Swift/Kotlin) on-device — behavioral mDNS testing requires a real LAN and stays manual.
• Reconcile the plugin README iOS section (currently in fix(tauri): make the plugin build for iOS/Android #328) to point at the new canonical doc, post-merge.

Follow-ups (out of scope, tracked separately)

• CI guardrails for the native FFI contract — compiling the Swift/Kotlin plugin sources in CI and a string-parity contract test between the Rust-invoked command names and the native @objc/@Command handlers, so a native rename can't silently break at runtime. Split out to Add CI guardrails for the mobile discovery FFI contract (native compile + string-parity test) #333 to keep this PR focused on the DNS-SD wire format and the peer-vs-generic API. (The behavioral mDNS verification stays manual regardless.)

Notes

The #329 open question is resolved in favour of a full replacement of swarm-discovery, giving a single interoperable wire format. This branch is cut from main and is independent of the iOS build fix in #328.

[momics]

Follow-up: peer-vs-generic naming applied end-to-end

Pushed four commits that finish the naming cleanup discussed on #329 — the low-level surface now mirrors the peer-vs-generic axis of the public API instead of the misleading mdns / dns_sd transport split (both paths are DNS-SD-over-mDNS; the real distinction is the generic primitive vs. the iroh-peer specialization that wires AddressLookup).

Commit	Scope
bbef6e0	Rust core seam: start_advertise/start_browse → advertise_peer/browse_peers (+ all call sites, example, interop test)
12678fa	BREAKING — FFI exports, Deno dispatch keys, Tauri commands, permission leaves, shared IrohAdapter interface
79433ef	BREAKING — mobile native contract (run_mobile_plugin strings + iOS @objc + Android @Command)
6022707	docs: ADR-017/018 alignment + a "Naming convention (as shipped)" table

Names, per layer

Layer	Generic primitive	Peer specialization
TS API (node)	advertise / browse	advertisePeer / browsePeers
Rust core seam	dns_sd::advertise / dns_sd::browse	advertise_peer / browse_peers
Node napi / Deno key	advertise / browse / browseNext / advertiseClose / browseClose	advertisePeer / browsePeers / browsePeersNext / advertisePeerClose / browsePeersClose
Tauri command	advertise / browse / browse_next / …	advertise_peer / browse_peers / browse_peers_next / …
Tauri permission leaf	allow-advertise / allow-browse / allow-browse-next / …	allow-advertise-peer / allow-browse-peers / allow-browse-peers-next / …
Mobile native method	advertise_start/stop / browse_start/poll/stop	advertise_peer_start/stop / browse_peers_start/poll/stop

The stable surface is unchanged: the single iroh-http:discovery permission set, the high-level node.advertise/browse/advertisePeer/browsePeers methods, and the DnsSdAdvertiseOptions/DnsSdBrowseOptions option types (still accurate for generic DNS-SD config). The rename is breaking only for low-level consumers of the raw FFI exports, Tauri invoke names, per-command permissions, or the mobile native methods.

Additional breaking detail

Beyond the permission-set unification already noted in the PR body, the permission leaf ids are renamed too (e.g. allow-mdns-browse → allow-browse-peers). Capabilities that pinned individual leaves rather than the iroh-http:discovery set must migrate.

Verification

cargo clippy --workspace --all-targets --features discovery -D warnings, cargo test -p iroh-http-discovery, Tauri permission tests (4/4), npm run typecheck (node + tauri), shared tsc, deno check, and cargo check --target aarch64-apple-ios-sim --features discovery all green. The Swift/Kotlin @objc/@Command renames compile against the new contract but — like the rest of the mobile native path — still need on-device verification (already tracked in the plan checklist).

[momics]

Review pass — DNS-SD standardization

Read through the whole branch (ADRs 016→018, core engine, all three FFI adapters, tauri permissions, and the mobile native plugins) and ran the CI gates locally. Overall this is coherent, well-argued work — the generic-primitive / iroh-peer-specialization layering carries cleanly through every layer, and the breaking renames are consistent. Left a few inline comments; the cross-cutting notes are below.

Why CI is red (found it)

The fail-fast deno fmt --check step fails on one file: packages/iroh-http-tauri/README.md — the permissions table wasn't reformatted after the iroh-http:mdns / iroh-http:dns-sd → iroh-http:discovery collapse. It's the first job step, so it blocks everything. Fix is just deno fmt. Everything downstream of it passed locally: workspace clippy + the strict tauri clippy (unwrap_used/panic/arithmetic_side_effects), cargo fmt --all --check, typecheck (node/deno/tauri), tauri tests (26 + 4 permissions + doc), cargo check --no-default-features for node & deno, cargo-deny, and discovery unit tests (15/15).

Stale comments (couldn't inline — lines aren't in the diff)

ios/Sources/IrohHttpPlugin.swift:209 and android/.../IrohHttpPlugin.kt:137 still say the desktop advertiser "(iroh swarm-discovery) publishes the base32 id as the instance name and emits no pk TXT." This PR removes swarm-discovery, and the new mdns-sd desktop advertiser (advertise_peer in the discovery crate) does emit a pk TXT. The instance-name fallback still works, so it's harmless — but the rationale is now wrong and will mislead the next reader.

Biggest structural risk: mobile is untested by CI

The Swift/Kotlin plugins and the #[cfg(mobile)] command paths are not compiled or run by any CI job (no iOS/Android target). ADR-017/018 already mark on-device interop as pending. So the mobile half of "standardize across all platforms" rests entirely on review + future device testing — that's the main thing still to nail, and it's structural rather than a specific defect.

Verified non-issue (chased it down so you don't have to)

I suspected mobile advertised the node id as iroh's 64-char hex Display while desktop used 52-char base32 — which would trip validate_node_id (strict a-z2-7). It's fine: IrohEndpoint::node_id() returns the base32 string on every platform, and iroh's FromStr accepts both encodings, so MdnsSdAddressLookup auto-dial is robust either way.

Nits

• Generic advertise and peer advertise_peer share one advertise_slab (node + tauri), so advertiseClose / advertisePeerClose are interchangeable. Works (same type, unique handles) but asymmetric with browse, which uses separate slabs.
• deny.toml now emits unnecessary-skip warnings for r-efi and netlink-packet-route — leftovers from the dropped swarm-discovery dep tree; safe to prune.
• Node advertise* are async fn (Tokio-handle reasons) while the Deno equivalents are sync — both correct, just inconsistent.
• New tauri Rust (commands.rs, mobile_*.rs) isn't rustfmt-clean. CI doesn't fmt the tauri manifest (it's out of the workspace), so non-blocking, but worth a cargo fmt there for hygiene.
• No shared test exercises the new generic node.advertise() / node.browse() / asIrohPeer() — discovery.mjs still only covers the peer surface.
• feat: exclude self from browsePeers() (b1490c5) looks correct. Note it filters at the JS layer, so on mobile the Rust MdnsSdAddressLookup may still upsert self before JS drops the event — harmless (you'd just resolve your own addrs), but worth being aware of.

[momics]

Heads-up: browsePeers reports isActive: false for every event on the Tauri adapter (desktop + iOS)

While building a discovered-peer list on top of this branch I hit a real bug that lives in the Tauri adapter on this PR (it's not example-only, and it's squarely "getting DNS-SD right").

Root cause — payload/contract mismatch. The native browse_peers_next command serializes PeerDiscoveryEventPayload as { isActive, nodeId, addrs } (camelCase), but the shared PeerDiscoveryEvent contract is tagged by type:

// packages/iroh-http-shared/src/discovery.ts
export interface PeerDiscoveryEvent {
  type: "discovered" | "expired";
  nodeId: string;
  addrs?: string[];
}

IrohNode.browsePeers derives the peer's liveness from that tag:

isActive: event.type === "discovered",

The Node adapter maps the native shape onto the contract (type: ev.isActive ? "discovered" : "expired"), but the Tauri guest-js adapter returned the raw invoke payload cast straight to PeerDiscoveryEvent:

// packages/iroh-http-tauri/guest-js/index.ts (before)
return invoke<PeerDiscoveryEvent | null>(`${PLUGIN}|browse_peers_next`, {
  browseHandle: Number(browseHandle),
});

So event.type is undefined → event.type === "discovered" is always false → every discovered peer is reported isActive: false. Arrivals never surface; only no-op departures fire. The raw event log still prints (it doesn't depend on isActive), which is what makes it look like discovery is "working."

Fix — map at the adapter boundary, mirroring Node:

// packages/iroh-http-tauri/guest-js/index.ts (after)
const ev = await invoke<
  { isActive: boolean; nodeId: string; addrs: string[] } | null
>(`${PLUGIN}|browse_peers_next`, { browseHandle: Number(browseHandle) });
if (!ev) return null;
return {
  type: ev.isActive ? "discovered" : "expired",
  nodeId: ev.nodeId,
  addrs: ev.addrs,
};

Note the generic browse path is unaffected — ServiceRecord.isActive is already carried natively, so only the peer event needed mapping.

Since someone is actively reviewing this PR, I haven't pushed to this branch — the one-hunk change is captured verbatim above so it can be folded in here. (For reference, I applied it on a derived branch as 511bd72.)

This is also a textbook instance of the silent Rust↔TS shape drift that #333 (native FFI contract guardrails) proposes to catch in CI. Refs #329, #333.