Connection gater: policy-based admission control.

Called at multiple points during connection establishment to allow or deny based on policy (IP blocklist, Peer ID allowlist, etc.).

Default gater that allows all connections.

Handle a single inbound connection: gate → upgrade → pool → stream accept loop.

This function blocks until the connection closes. Each accepted connection should be spawned in its own async thread from the accept loop.

Accept inbound streams and dispatch to registered protocol handlers.

Runs forever, accepting streams from the muxer and spawning a handler thread for each. Uses multistream-select to negotiate the protocol, then dispatches to the registered StreamHandler.

Dispatch a single inbound stream to the appropriate protocol handler.

Runs multistream-select as responder to determine which protocol the remote peer wants, then looks up and invokes the registered handler.

Start listening on the given addresses.

For each address, selects a matching transport, binds a listener, and spawns an accept loop that handles inbound connections. Returns the actual bound addresses (port 0 resolved to actual port). Fails if the switch is already closed.

Accept loop: forever accepts connections and spawns handleInbound threads. Catches exceptions from individual connections without stopping the loop. Stops when the listener is closed (accept throws).

Get the current listen addresses from all active listeners.

Withdraw the listener bound to the given address: cancel its accept loop, close the underlying transport listener, and remove it from the Switch's listener set so switchListenAddrs stops reporting it.

For listeners whose reachability guarantee can lapse independently of the Switch's own lifetime (e.g. a circuit relay reservation that expired or was refused on refresh), this withdraws just that one address without tearing down the rest of the Switch. A no-op if no listener is bound to the address (already withdrawn, or never was).