@absol-labs/agent 0.7.3 → 0.8.0

package/README.md

@@ -74,7 +74,9 @@ For a fresh autonomous agent, the default headless path is
 stores it in the host OS credential manager, and asks the public Metrik broker to create a
 policy-bound Privy EOA owned by that key. No Privy secret, OTP, browser, clipboard, or
 plaintext key file is required, and every later write is signed locally over the exact
-prepared Privy request. See
+prepared Privy request. Provisioning refuses a credential store that would not survive a
+host reboot — including the Linux kernel keyring a headless host silently falls back to —
+and ships `EncryptedFileCredentialStore` as the durable headless option. See
 [`docs/autonomous-privy-wallet.md`](./docs/autonomous-privy-wallet.md). The authenticated
 user-owned Privy flow remains available as an optional recoverable mode.
 
@@ -288,7 +290,9 @@ await server.listen(8787);
 Or run the ready-made standalone server from env (`METRIK_GATEWAY_ESCROW_ADDRESS`,
 `METRIK_GATEWAY_RPC_URL`, `METRIK_GATEWAY_SERVICE_REF`, `METRIK_GATEWAY_UPSTREAM_URL`,
 optional comma-separated `METRIK_GATEWAY_SERVICE_REFS` migration aliases,
-optional `METRIK_GATEWAY_CHAIN_ID` / `METRIK_GATEWAY_PORT` / `METRIK_GATEWAY_HOST`):
+optional `METRIK_GATEWAY_CHAIN_ID` / `METRIK_GATEWAY_PORT` / `METRIK_GATEWAY_HOST`,
+optional `METRIK_GATEWAY_CORROBORATING_RPC_URLS` /
+`METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS`):
 
 ```bash
 pnpm gateway
@@ -298,8 +302,19 @@ Every request must carry a valid capability; every failure mode (missing header,
 signature, wrong buyer, closed/expired/underfunded stream, replayed nonce, wrong
 method/path, wrong `serviceRef`) is rejected with a distinct machine-readable `reason`
 and a `402`/`403` - the real upstream is never touched on a rejection. Access is revoked
-automatically: once a stream is closed, expired, or reclaimed, the next on-chain read
-fails closed with no extra bookkeeping.
+automatically: once a stream is closed, expired, or reclaimed, the on-chain read fails
+closed with no extra bookkeeping.
+
+Stream state is never trusted from a single unverified view. Every configured RPC view is
+read per request (in parallel, at most one read each) and a request is authorized only if
+**every** view authorizes - so a stale view cannot keep serving a stream the buyer just
+closed. A view reporting a chain head older than
+`METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS` (default 30) is rejected outright
+(`stream-state-stale`), and because `close`/expiry/full-claim are irreversible on-chain,
+an observed terminal state is remembered for the process lifetime - a later stale
+`active` read can never re-authorize. Set
+`METRIK_GATEWAY_CORROBORATING_RPC_URLS` to one or more **independent** providers to
+collapse the post-close window to the freshest of them.
 
 **Buyer side** - after `hireVerifiedService`/`open()`, call the purchased service
 directly:

package/dist/gateway/caller-auth-gateway.d.ts

@@ -11,9 +11,48 @@ import { type SignedInvocationCapability } from "../capability/invocation-capabi
  * called. Revocation is automatic: once a stream is closed/expired/reclaimed,
  * the on-chain read step below fails closed and access stops with no extra
  * bookkeeping.
+ *
+ * ## Stream state must never be trusted from a single unverified view (#87)
+ *
+ * A capability presented seconds after the buyer's `close()` was mined was
+ * served, because authorization read the stream from ONE unpinned `latest`
+ * view and believed it unconditionally: the exposure window was exactly
+ * "however stale that view happened to be" - unbounded and unobservable.
+ * Provider replica lag, an unsafe-head reorg, provider response caching, or a
+ * cache added later for performance all land in the same failure mode, and it
+ * fails OPEN on the one transition that must be immediate.
+ *
+ * Three fail-closed properties remove that trust:
+ *
+ * 1. **Corroboration** - every configured view is read (bounded: one read per
+ *    view, in parallel) and the request is authorized ONLY if EVERY view
+ *    authorizes. Any view reporting a non-authorizable stream - or failing to
+ *    read at all - denies. Independent endpoints go stale independently, so
+ *    configuring one corroborating RPC collapses the window to the freshest of
+ *    them.
+ * 2. **Freshness bound** - a view that reports the block it observed
+ *    ({@link GatewayStreamView.observedAt}) is rejected outright when that
+ *    block is older than {@link CallerAuthGatewayConfig.maxStateStalenessSeconds},
+ *    turning silent staleness into an explicit `stream-state-stale` denial.
+ * 3. **Monotonic revocation** - `StreamEscrowV2` only ever assigns
+ *    `status = Closed` (never resets it), only ever decreases `deposit` (there
+ *    is no top-up), and fixes `expiresAt` at open. "Not active", "expired" and
+ *    "fully claimed" are therefore irreversible, so an observed terminal state
+ *    is remembered and a later view reporting ACTIVE - which is provably stale
+ *    - can never re-authorize. This is the only correctness-preserving caching
+ *    direction here: negative, never positive.
  */
 /** Machine-readable, closed set of rejection reasons - every failure mode is distinct. */
-export type CallerAuthDenialReason = "missing-capability-header" | "malformed-capability-header" | "capability-expired" | "invalid-signature" | "method-mismatch" | "path-mismatch" | "service-ref-mismatch" | "nonce-replayed" | "stream-not-found" | "buyer-mismatch" | "stream-not-active" | "stream-expired" | "stream-not-funded";
+export type CallerAuthDenialReason = "missing-capability-header" | "malformed-capability-header" | "capability-expired" | "invalid-signature" | "method-mismatch" | "path-mismatch" | "service-ref-mismatch" | "nonce-replayed" | "stream-not-found" | "buyer-mismatch" | "stream-not-active" | "stream-expired" | "stream-not-funded" | "stream-state-stale";
+/**
+ * Default freshness bound for on-chain stream state, in seconds. Base blocks
+ * are ~2s, so a healthy endpoint is a few seconds stale at most; this is a
+ * generous ceiling whose job is to reject GROSS staleness rather than to
+ * micro-manage a healthy provider.
+ */
+export declare const DEFAULT_MAX_STATE_STALENESS_SECONDS = 30;
+/** Maximum corroborating views the bounded hot path accepts (excludes the primary). */
+export declare const MAX_CORROBORATING_STREAM_READERS = 3;
 export interface CallerAuthDecision {
     readonly authorized: boolean;
     readonly reason?: CallerAuthDenialReason;
@@ -32,11 +71,47 @@ export interface GatewayStreamView {
     readonly claimedCumulative: bigint;
     readonly expiresAt: number;
     readonly status: "active" | "closed";
+    /**
+     * The chain head this view was observed against. Readers SHOULD report it:
+     * when present, the gateway rejects the view outright if the block is older
+     * than its freshness bound (`stream-state-stale`) instead of trusting
+     * unbounded staleness. Optional only so `StreamReader` implementations
+     * predating this field keep working; the default SDK reader always reports it.
+     */
+    readonly observedAt?: {
+        readonly blockNumber: bigint;
+        /** Unix seconds of the observed block. */
+        readonly blockTimestamp: number;
+    };
 }
 /** Pluggable on-chain stream reader, so the gateway is testable without a live RPC. */
 export interface StreamReader {
     getStream(streamId: Hex): Promise<GatewayStreamView>;
 }
+/**
+ * Remembers streams observed in an irreversible terminal state, so a later
+ * stale view cannot re-authorize them. Negative-only by construction: nothing
+ * that would GRANT access is ever cached.
+ */
+export interface StreamRevocationSet {
+    /** The remembered terminal denial for this stream, if any. */
+    get(streamId: Hex): CallerAuthDenialReason | undefined;
+    /** Records an irreversible terminal denial for this stream. */
+    record(streamId: Hex, reason: CallerAuthDenialReason): void;
+}
+/**
+ * In-memory {@link StreamRevocationSet}. Bounded (oldest entries are evicted
+ * past {@link maxEntries}) so a hostile caller cannot grow it without limit;
+ * eviction is safe because the on-chain read still denies an evicted stream -
+ * it only loses the short-circuit.
+ */
+export declare class InMemoryStreamRevocationSet implements StreamRevocationSet {
+    private readonly maxEntries;
+    private readonly revoked;
+    constructor(maxEntries?: number);
+    get(streamId: Hex): CallerAuthDenialReason | undefined;
+    record(streamId: Hex, reason: CallerAuthDenialReason): void;
+}
 export declare class UnknownStreamGatewayError extends Error {
     constructor(message: string, options?: {
         readonly cause?: unknown;
@@ -77,6 +152,28 @@ export interface CallerAuthGatewayConfig {
     readonly headerName?: string;
     /** Override the on-chain reader (tests inject a fake; default is the real SDK reader). */
     readonly streamReader?: StreamReader;
+    /**
+     * Independent corroborating views of the SAME escrow. Every view is read per
+     * request (in parallel) and the request is authorized only if EVERY view
+     * authorizes - so a stale primary cannot serve a closed stream. Bounded to
+     * {@link MAX_CORROBORATING_STREAM_READERS}.
+     */
+    readonly corroboratingStreamReaders?: readonly StreamReader[];
+    /**
+     * Corroborating RPC endpoints for the default SDK reader path. One reader is
+     * built per URL; ignored when `corroboratingStreamReaders` is supplied.
+     * Use endpoints on DIFFERENT providers - two URLs on one provider share its
+     * staleness.
+     */
+    readonly corroboratingRpcUrls?: readonly string[];
+    /**
+     * Reject stream state observed more than this many seconds behind the wall
+     * clock. Default {@link DEFAULT_MAX_STATE_STALENESS_SECONDS}. Enforced only
+     * for views that report {@link GatewayStreamView.observedAt}.
+     */
+    readonly maxStateStalenessSeconds?: number;
+    /** Override the terminal-state memory (default in-memory, bounded). */
+    readonly revocationSet?: StreamRevocationSet;
     /** Override the replay cache (tests inject a fake; default is in-memory). */
     readonly nonceCache?: NonceReplayCache;
     /** Injectable clock (unix seconds), for tests. */
@@ -96,7 +193,9 @@ export interface CallerAuthRequestInput {
  * See `./http-server.ts` for a ready-to-run reverse-proxy reference server.
  */
 export declare class CallerAuthGateway {
-    private readonly streamReader;
+    private readonly streamReaders;
+    private readonly maxStateStalenessSeconds;
+    private readonly revocationSet;
     private readonly nonceCache;
     private readonly headerName;
     private readonly domain;
@@ -104,5 +203,7 @@ export declare class CallerAuthGateway {
     private readonly now;
     constructor(config: CallerAuthGatewayConfig);
     authorize(request: CallerAuthRequestInput): Promise<CallerAuthDecision>;
+    /** Returns the denial reason this single view produces, or `undefined` if it authorizes. */
+    private evaluateView;
 }
 //# sourceMappingURL=caller-auth-gateway.d.ts.map

package/dist/gateway/caller-auth-gateway.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth-gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAOL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;;GAWG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAC9B,2BAA2B,GAC3B,6BAA6B,GAC7B,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,CAAC;AAExB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CAClD;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACtC;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,YAAY,CAyBf;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,4GAA4G;IAC5G,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;CACxD;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAUtD,OAAO,CAAC,KAAK;CAQd;AAED,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,MAAM,EAAE,uBAAuB;IAkCrC,SAAS,CACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,kBAAkB,CAAC;CAkF/B"}
+{"version":3,"file":"caller-auth-gateway.d.ts","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EAOL,KAAK,0BAA0B,EAChC,MAAM,wCAAwC,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,0FAA0F;AAC1F,MAAM,MAAM,sBAAsB,GAC9B,2BAA2B,GAC3B,6BAA6B,GAC7B,oBAAoB,GACpB,mBAAmB,GACnB,iBAAiB,GACjB,eAAe,GACf,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,gBAAgB,GAChB,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,oBAAoB,CAAC;AAEzB;;;;;GAKG;AACH,eAAO,MAAM,mCAAmC,KAAK,CAAC;AAEtD,uFAAuF;AACvF,eAAO,MAAM,gCAAgC,IAAI,CAAC;AAgClD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,sBAAsB,CAAC;IACzC,4CAA4C;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC;IAChC,2CAA2C;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,iBAAiB,CAAC;IACpC,gFAAgF;IAChF,QAAQ,CAAC,UAAU,CAAC,EAAE,0BAA0B,CAAC;CAClD;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE;QACpB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;KACjC,CAAC;CACH;AAED,uFAAuF;AACvF,MAAM,WAAW,YAAY;IAC3B,SAAS,CAAC,QAAQ,EAAE,GAAG,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACtD;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,8DAA8D;IAC9D,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,sBAAsB,GAAG,SAAS,CAAC;IACvD,+DAA+D;IAC/D,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC7D;AAED;;;;;GAKG;AACH,qBAAa,2BAA4B,YAAW,mBAAmB;IAGzD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAFvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6C;gBAExC,UAAU,SAAS;IAEhD,GAAG,CAAC,QAAQ,EAAE,GAAG,GAAG,sBAAsB,GAAG,SAAS;IAItD,MAAM,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAsB,GAAG,IAAI;CAa5D;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAIpE;AAED,iGAAiG;AACjG,wBAAgB,qBAAqB,CAAC,OAAO,EAAE;IAC7C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GAAG,YAAY,CAoCf;AAED,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,4GAA4G;IAC5G,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC;CACxD;AAED;;;;GAIG;AACH,qBAAa,wBAAyB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA6B;IAElD,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO;IAUtD,OAAO,CAAC,KAAK;CAQd;AAED,MAAM,WAAW,uBAAuB;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,uFAAuF;IACvF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,4FAA4F;IAC5F,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,4EAA4E;IAC5E,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC;IACtC,8EAA8E;IAC9E,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,sEAAsE;IACtE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,0FAA0F;IAC1F,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,0BAA0B,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAClD;;;;OAIG;IACH,QAAQ,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAC3C,uEAAuE;IACvE,QAAQ,CAAC,aAAa,CAAC,EAAE,mBAAmB,CAAC;IAC7C,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IACvC,kDAAkD;IAClD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAsB;IACrC,kFAAkF;IAClF,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC/D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAS;IAClD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAsB;IACpD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAmB;IAC9C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAsB;IAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,MAAM,EAAE,uBAAuB;IAyDrC,SAAS,CACb,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,kBAAkB,CAAC;IAoG9B,4FAA4F;IAC5F,OAAO,CAAC,YAAY;CAiCrB"}

package/dist/gateway/caller-auth-gateway.js

@@ -1,6 +1,72 @@
 import { MetrikClient } from "@absol-labs/sdk";
 import { isAddress, isHex } from "viem";
 import { CAPABILITY_HEADER_NAME, decodeCapabilityHeader, hashInvocationPath, InvalidCapabilityHeaderError, recoverInvocationCapabilitySigner, } from "../capability/invocation-capability.js";
+/**
+ * Default freshness bound for on-chain stream state, in seconds. Base blocks
+ * are ~2s, so a healthy endpoint is a few seconds stale at most; this is a
+ * generous ceiling whose job is to reject GROSS staleness rather than to
+ * micro-manage a healthy provider.
+ */
+export const DEFAULT_MAX_STATE_STALENESS_SECONDS = 30;
+/** Maximum corroborating views the bounded hot path accepts (excludes the primary). */
+export const MAX_CORROBORATING_STREAM_READERS = 3;
+/**
+ * Denial precedence when views disagree: the most authoritative statement about
+ * the stream wins, so a single fresh "closed" is never masked by another view's
+ * read error or staleness.
+ */
+const DENIAL_PRECEDENCE = [
+    "stream-not-active",
+    "stream-expired",
+    "buyer-mismatch",
+    "service-ref-mismatch",
+    "stream-not-funded",
+    "stream-state-stale",
+    "stream-not-found",
+];
+/**
+ * Denials that reflect an IRREVERSIBLE on-chain state (see the class docs):
+ * once observed, they hold forever, so they are remembered and a stale ACTIVE
+ * read can never re-authorize.
+ *
+ * Deliberately limited to states derived PURELY from on-chain values. Expiry is
+ * equally irreversible but is derived from the local clock, and a skewed clock
+ * must not be able to permanently revoke a live stream - expiry re-denies on
+ * every request anyway, at no extra cost.
+ */
+const TERMINAL_DENIALS = new Set([
+    "stream-not-active",
+    "stream-not-funded",
+]);
+/**
+ * In-memory {@link StreamRevocationSet}. Bounded (oldest entries are evicted
+ * past {@link maxEntries}) so a hostile caller cannot grow it without limit;
+ * eviction is safe because the on-chain read still denies an evicted stream -
+ * it only loses the short-circuit.
+ */
+export class InMemoryStreamRevocationSet {
+    maxEntries;
+    revoked = new Map();
+    constructor(maxEntries = 10_000) {
+        this.maxEntries = maxEntries;
+    }
+    get(streamId) {
+        return this.revoked.get(streamId.toLowerCase());
+    }
+    record(streamId, reason) {
+        const key = streamId.toLowerCase();
+        if (this.revoked.has(key)) {
+            return;
+        }
+        if (this.revoked.size >= this.maxEntries) {
+            const oldest = this.revoked.keys().next();
+            if (!oldest.done) {
+                this.revoked.delete(oldest.value);
+            }
+        }
+        this.revoked.set(key, reason);
+    }
+}
 export class UnknownStreamGatewayError extends Error {
     constructor(message, options) {
         super(message, options);
@@ -16,7 +82,14 @@ export function createSdkStreamReader(options) {
     return {
         async getStream(streamId) {
             try {
-                const stream = await metrik.getStreamV2(streamId);
+                // Read the stream and the chain head this endpoint is serving in one
+                // round trip (concurrent, same transport) so the view can be
+                // freshness-checked. A failed head read is treated as an unusable view
+                // (fail closed) rather than silently dropping the freshness signal.
+                const [stream, block] = await Promise.all([
+                    metrik.getStreamV2(streamId),
+                    metrik.publicClient.getBlock({ blockTag: "latest" }),
+                ]);
                 return {
                     buyer: stream.buyer,
                     serviceRef: stream.serviceRef,
@@ -24,6 +97,10 @@ export function createSdkStreamReader(options) {
                     claimedCumulative: stream.claimedCumulative,
                     expiresAt: stream.expiresAt,
                     status: stream.status,
+                    observedAt: {
+                        blockNumber: block.number,
+                        blockTimestamp: Number(block.timestamp),
+                    },
                 };
             }
             catch (cause) {
@@ -64,7 +141,9 @@ export class InMemoryNonceReplayCache {
  * See `./http-server.ts` for a ready-to-run reverse-proxy reference server.
  */
 export class CallerAuthGateway {
-    streamReader;
+    streamReaders;
+    maxStateStalenessSeconds;
+    revocationSet;
     nonceCache;
     headerName;
     domain;
@@ -85,12 +164,27 @@ export class CallerAuthGateway {
         }
         this.serviceRefs = new Set(serviceRefs.map((value) => value.toLowerCase()));
         this.headerName = (config.headerName ?? CAPABILITY_HEADER_NAME).toLowerCase();
-        this.streamReader =
-            config.streamReader ??
-                createSdkStreamReader({
-                    escrowAddress: config.escrowAddress,
-                    rpcUrl: config.rpcUrl,
-                });
+        const primaryReader = config.streamReader ??
+            createSdkStreamReader({
+                escrowAddress: config.escrowAddress,
+                rpcUrl: config.rpcUrl,
+            });
+        const corroborating = config.corroboratingStreamReaders ??
+            (config.corroboratingRpcUrls ?? []).map((rpcUrl) => createSdkStreamReader({
+                escrowAddress: config.escrowAddress,
+                rpcUrl,
+            }));
+        if (corroborating.length > MAX_CORROBORATING_STREAM_READERS) {
+            throw new Error(`at most ${MAX_CORROBORATING_STREAM_READERS} corroborating stream readers are supported (bounded hot path)`);
+        }
+        this.streamReaders = [primaryReader, ...corroborating];
+        const maxStaleness = config.maxStateStalenessSeconds ?? DEFAULT_MAX_STATE_STALENESS_SECONDS;
+        if (!Number.isFinite(maxStaleness) || maxStaleness <= 0) {
+            throw new Error("maxStateStalenessSeconds must be a positive number");
+        }
+        this.maxStateStalenessSeconds = maxStaleness;
+        this.revocationSet =
+            config.revocationSet ?? new InMemoryStreamRevocationSet();
         this.nonceCache = config.nonceCache ?? new InMemoryNonceReplayCache();
         this.domain = {
             chainId: config.chainId ?? 84532,
@@ -142,30 +236,93 @@ export class CallerAuthGateway {
         if (!this.nonceCache.consume(capability.nonce, capability.expiry)) {
             return deny("nonce-replayed", 403, capability);
         }
-        let stream;
-        try {
-            stream = await this.streamReader.getStream(capability.streamId);
+        const streamId = capability.streamId;
+        // An irreversible terminal state already observed for this stream holds
+        // forever: no read can un-close it, so short-circuit (and never re-read a
+        // dead stream).
+        const revoked = this.revocationSet.get(streamId);
+        if (revoked !== undefined) {
+            return deny(revoked, httpStatusFor(revoked), capability);
         }
-        catch {
-            return deny("stream-not-found", 403, capability);
+        // Read EVERY configured view (bounded: one read per view, all in parallel).
+        const results = await Promise.allSettled(this.streamReaders.map((reader) => reader.getStream(streamId)));
+        // Strictest view wins. A view that fails to read, is measurably stale, or
+        // reports a non-authorizable stream denies the request - authorization
+        // requires unanimous consent from every view.
+        const denials = [];
+        const views = [];
+        for (const result of results) {
+            if (result.status === "rejected") {
+                denials.push("stream-not-found");
+                continue;
+            }
+            const reason = this.evaluateView(result.value, capability, nowSeconds);
+            if (reason === undefined) {
+                views.push(result.value);
+            }
+            else {
+                denials.push(reason);
+            }
+        }
+        if (denials.length > 0) {
+            const reason = strictestDenial(denials);
+            if (TERMINAL_DENIALS.has(reason)) {
+                this.revocationSet.record(streamId, reason);
+            }
+            return deny(reason, httpStatusFor(reason), capability);
+        }
+        // Report the freshest corroborated view to the caller.
+        return { authorized: true, stream: freshestView(views), capability };
+    }
+    /** Returns the denial reason this single view produces, or `undefined` if it authorizes. */
+    evaluateView(stream, capability, nowSeconds) {
+        // Freshness first: a measurably stale view is not evidence of anything, so
+        // it must not be able to vouch for an ACTIVE stream.
+        if (stream.observedAt !== undefined &&
+            nowSeconds - stream.observedAt.blockTimestamp >
+                this.maxStateStalenessSeconds) {
+            return "stream-state-stale";
         }
         if (stream.buyer.toLowerCase() !== capability.buyer.toLowerCase()) {
-            return deny("buyer-mismatch", 403, capability);
+            return "buyer-mismatch";
         }
         if (stream.serviceRef.toLowerCase() !== capability.serviceRef.toLowerCase()) {
-            return deny("service-ref-mismatch", 403, capability);
+            return "service-ref-mismatch";
         }
         if (stream.status !== "active") {
-            return deny("stream-not-active", 403, capability);
+            return "stream-not-active";
         }
         if (nowSeconds >= stream.expiresAt) {
-            return deny("stream-expired", 403, capability);
+            return "stream-expired";
         }
         if (stream.deposit <= stream.claimedCumulative) {
-            return deny("stream-not-funded", 402, capability);
+            return "stream-not-funded";
+        }
+        return undefined;
+    }
+}
+function httpStatusFor(reason) {
+    return reason === "stream-not-funded" ? 402 : 403;
+}
+function strictestDenial(denials) {
+    for (const candidate of DENIAL_PRECEDENCE) {
+        if (denials.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return denials[0];
+}
+function freshestView(views) {
+    let freshest = views[0];
+    for (const view of views.slice(1)) {
+        const current = freshest.observedAt?.blockNumber;
+        const candidate = view.observedAt?.blockNumber;
+        if (candidate !== undefined &&
+            (current === undefined || candidate > current)) {
+            freshest = view;
         }
-        return { authorized: true, stream, capability };
     }
+    return freshest;
 }
 function deny(reason, httpStatus, capability) {
     return {

package/dist/gateway/caller-auth-gateway.js.map

@@ -1 +1 @@
-{"version":3,"file":"caller-auth-gateway.js","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,GAGlC,MAAM,wCAAwC,CAAC;AAyDhD,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAAsC;QACjE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAClD,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;iBACtB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,yBAAyB,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9F,EAAE,KAAK,EAAE,CACV,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,OAAO,wBAAwB;IAClB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,OAAO,CAAC,KAAU,EAAE,gBAAwB;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK;QACX,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,gBAAgB,GAAG,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA+BD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,YAAY,CAAe;IAC3B,UAAU,CAAmB;IAC7B,UAAU,CAAS;IACnB,MAAM,CAAkC;IACxC,WAAW,CAAsB;IACjC,GAAG,CAAe;IAEnC,YAAY,MAA+B;QACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,CAChB,MAAM,CAAC,UAAU,IAAI,sBAAsB,CAC5C,CAAC,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,YAAY;YACf,MAAM,CAAC,YAAY;gBACnB,qBAAqB,CAAC;oBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,MAAM,EAAE,MAAM,CAAC,MAAgB;iBAChC,CAAC,CAAC;QACL,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;YAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;SACxC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAA+B;QAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,iCAAiC,CAC9C,UAAU,EACV,IAAI,CAAC,MAAM,EACX,UAAU,CAAC,SAAgB,CAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAY,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,MAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,UAAU,CAAC,QAAe,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,kBAAkB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,IACE,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,EACvE,CAAC;YACD,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAClD,CAAC;CACF;AAED,SAAS,IAAI,CACX,MAA8B,EAC9B,UAAqB,EACrB,UAAuC;IAEvC,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM;QACN,UAAU;QACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAAqD,EACrD,IAAY;IAEZ,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"caller-auth-gateway.js","sourceRoot":"","sources":["../../src/gateway/caller-auth-gateway.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,4BAA4B,EAC5B,iCAAiC,GAGlC,MAAM,wCAAwC,CAAC;AA8DhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,EAAE,CAAC;AAEtD,uFAAuF;AACvF,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC,CAAC;AAElD;;;;GAIG;AACH,MAAM,iBAAiB,GAAsC;IAC3D,mBAAmB;IACnB,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,mBAAmB;IACnB,oBAAoB;IACpB,kBAAkB;CACnB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,gBAAgB,GAAwC,IAAI,GAAG,CAAC;IACpE,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAoDH;;;;;GAKG;AACH,MAAM,OAAO,2BAA2B;IAGT;IAFZ,OAAO,GAAG,IAAI,GAAG,EAAkC,CAAC;IAErE,YAA6B,aAAa,MAAM;QAAnB,eAAU,GAAV,UAAU,CAAS;IAAG,CAAC;IAEpD,GAAG,CAAC,QAAa;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,CAAC,QAAa,EAAE,MAA8B;QAClD,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe,EAAE,OAAsC;QACjE,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED,iGAAiG;AACjG,MAAM,UAAU,qBAAqB,CAAC,OAGrC;IACC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC;QACtC,MAAM,EAAE,OAAO,CAAC,aAAa;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,IAAI,CAAC;gBACH,qEAAqE;gBACrE,6DAA6D;gBAC7D,uEAAuE;gBACvE,oEAAoE;gBACpE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;oBACxC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC;oBAC5B,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;iBACrD,CAAC,CAAC;gBACH,OAAO;oBACL,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,UAAU,EAAE;wBACV,WAAW,EAAE,KAAK,CAAC,MAAM;wBACzB,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;qBACxC;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,yBAAyB,CACjC,yBAAyB,QAAQ,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAC9F,EAAE,KAAK,EAAE,CACV,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAQD;;;;GAIG;AACH,MAAM,OAAO,wBAAwB;IAClB,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IAElD,OAAO,CAAC,KAAU,EAAE,gBAAwB;QAC1C,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK;QACX,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAChD,IAAI,gBAAgB,GAAG,UAAU,EAAE,CAAC;gBAClC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAqDD;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,aAAa,CAA0B;IACvC,wBAAwB,CAAS;IACjC,aAAa,CAAsB;IACnC,UAAU,CAAmB;IAC7B,UAAU,CAAS;IACnB,MAAM,CAAkC;IACxC,WAAW,CAAsB;IACjC,GAAG,CAAe;IAEnC,YAAY,MAA+B;QACzC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACvE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBACrE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,IAAI,KAAK,CACb,gEAAgE,CACjE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;QAC5E,IAAI,CAAC,UAAU,GAAG,CAChB,MAAM,CAAC,UAAU,IAAI,sBAAsB,CAC5C,CAAC,WAAW,EAAE,CAAC;QAChB,MAAM,aAAa,GACjB,MAAM,CAAC,YAAY;YACnB,qBAAqB,CAAC;gBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM,EAAE,MAAM,CAAC,MAAgB;aAChC,CAAC,CAAC;QACL,MAAM,aAAa,GACjB,MAAM,CAAC,0BAA0B;YACjC,CAAC,MAAM,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CACjD,qBAAqB,CAAC;gBACpB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM;aACP,CAAC,CACH,CAAC;QACJ,IAAI,aAAa,CAAC,MAAM,GAAG,gCAAgC,EAAE,CAAC;YAC5D,MAAM,IAAI,KAAK,CACb,WAAW,gCAAgC,gEAAgE,CAC5G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,CAAC,aAAa,EAAE,GAAG,aAAa,CAAC,CAAC;QAEvD,MAAM,YAAY,GAChB,MAAM,CAAC,wBAAwB,IAAI,mCAAmC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,wBAAwB,GAAG,YAAY,CAAC;QAC7C,IAAI,CAAC,aAAa;YAChB,MAAM,CAAC,aAAa,IAAI,IAAI,2BAA2B,EAAE,CAAC;QAC5D,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,IAAI,wBAAwB,EAAE,CAAC;QACtE,IAAI,CAAC,MAAM,GAAG;YACZ,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,KAAK;YAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;SACxC,CAAC;QACF,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CACb,OAA+B;QAE/B,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,2BAA2B,EAAE,GAAG,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,UAAsC,CAAC;QAC3C,IAAI,CAAC;YACH,UAAU,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,4BAA4B,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC,6BAA6B,EAAE,GAAG,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE9B,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,iCAAiC,CAC9C,UAAU,EACV,IAAI,CAAC,MAAM,EACX,UAAU,CAAC,SAAgB,CAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAC5D,OAAO,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,UAAU,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;YACrE,OAAO,IAAI,CAAC,iBAAiB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1D,IAAI,gBAAgB,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC/D,OAAO,IAAI,CAAC,sBAAsB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAED,sEAAsE;QACtE,0EAA0E;QAC1E,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAY,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,gBAAgB,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;QACjD,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAe,CAAC;QAE5C,wEAAwE;QACxE,0EAA0E;QAC1E,gBAAgB;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;QAC3D,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CACtC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAC/D,CAAC;QAEF,0EAA0E;QAC1E,uEAAuE;QACvE,8CAA8C;QAC9C,MAAM,OAAO,GAA6B,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAwB,EAAE,CAAC;QACtC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;gBACjC,SAAS;YACX,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YACvE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACjC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;YACD,OAAO,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;QACzD,CAAC;QAED,uDAAuD;QACvD,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;IACvE,CAAC;IAED,4FAA4F;IACpF,YAAY,CAClB,MAAyB,EACzB,UAAsC,EACtC,UAAkB;QAElB,2EAA2E;QAC3E,qDAAqD;QACrD,IACE,MAAM,CAAC,UAAU,KAAK,SAAS;YAC/B,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc;gBAC3C,IAAI,CAAC,wBAAwB,EAC/B,CAAC;YACD,OAAO,oBAAoB,CAAC;QAC9B,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YAClE,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IACE,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,EACvE,CAAC;YACD,OAAO,sBAAsB,CAAC;QAChC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,IAAI,UAAU,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACnC,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;CACF;AAED,SAAS,aAAa,CAAC,MAA8B;IACnD,OAAO,MAAM,KAAK,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,eAAe,CACtB,OAA0C;IAE1C,KAAK,MAAM,SAAS,IAAI,iBAAiB,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAA2B,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,KAAmC;IACvD,IAAI,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAsB,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC;QAC/C,IACE,SAAS,KAAK,SAAS;YACvB,CAAC,OAAO,KAAK,SAAS,IAAI,SAAS,GAAG,OAAO,CAAC,EAC9C,CAAC;YACD,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,IAAI,CACX,MAA8B,EAC9B,UAAqB,EACrB,UAAuC;IAEvC,OAAO;QACL,UAAU,EAAE,KAAK;QACjB,MAAM;QACN,UAAU;QACV,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,OAAqD,EACrD,IAAY;IAEZ,+EAA+E;IAC/E,mEAAmE;IACnE,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/gateway/http-server.d.ts

@@ -27,6 +27,10 @@ export interface CallerAuthGatewayEnvConfig {
     readonly chainId: number;
     readonly upstreamUrl: string;
     readonly headerName?: string;
+    /** Independent RPCs used to corroborate stream state (see `CallerAuthGateway`). */
+    readonly corroboratingRpcUrls: readonly string[];
+    /** Freshness bound for on-chain stream state, in seconds. */
+    readonly maxStateStalenessSeconds: number;
 }
 /**
  * Parses the gateway's env contract:
@@ -36,6 +40,14 @@ export interface CallerAuthGatewayEnvConfig {
  * - `METRIK_GATEWAY_SERVICE_REF` (required) - primary bytes32 service ref.
  * - `METRIK_GATEWAY_SERVICE_REFS` (optional) - comma-separated migration aliases.
  * - `METRIK_GATEWAY_UPSTREAM_URL` (required) - the real service to proxy to on pass.
+ * - `METRIK_GATEWAY_CORROBORATING_RPC_URLS` (optional, STRONGLY recommended) -
+ *   comma-separated INDEPENDENT RPC endpoints for the same escrow. Stream state
+ *   is authorized only if every configured view agrees, so a stale primary view
+ *   cannot serve a stream that has just been closed. At most
+ *   {@link MAX_CORROBORATING_STREAM_READERS}.
+ * - `METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS` (optional) - reject stream
+ *   state observed more than N seconds behind the wall clock. Default
+ *   {@link DEFAULT_MAX_STATE_STALENESS_SECONDS}.
  * - `METRIK_GATEWAY_CHAIN_ID` (optional) - default `84532` (Base Sepolia).
  * - `METRIK_GATEWAY_HEADER_NAME` (optional) - default `x-metrik-capability`.
  * - `PORT` / `METRIK_GATEWAY_PORT` (optional) - default `8787`.

package/dist/gateway/http-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/gateway/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,iBAAiB,EAElB,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GACpC,uBAAuB,CAsCzB;AAmID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,CAqD5B;AAUD,oFAAoF;AACpF,wBAAsB,mCAAmC,CACvD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,uBAAuB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAkBnE"}
+{"version":3,"file":"http-server.d.ts","sourceRoot":"","sources":["../../src/gateway/http-server.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,MAAM,EAEZ,MAAM,WAAW,CAAC;AAGnB,OAAO,EAAoB,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAEhE,OAAO,EACL,iBAAiB,EAIlB,MAAM,0BAA0B,CAAC;AA8BlC,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IACpC,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,0EAA0E;IAC1E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC7E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,6BAA6B,GACpC,uBAAuB,CAsCzB;AAmID,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,mFAAmF;IACnF,QAAQ,CAAC,oBAAoB,EAAE,SAAS,MAAM,EAAE,CAAC;IACjD,6DAA6D;IAC7D,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,+BAA+B,CAC7C,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,0BAA0B,CA4F5B;AAUD,oFAAoF;AACpF,wBAAsB,mCAAmC,CACvD,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,OAAO,CAAC,uBAAuB,GAAG;IAAE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA6BnE"}

package/dist/gateway/http-server.js

@@ -1,6 +1,6 @@
 import { createServer, } from "node:http";
 import { isAddress, isHex } from "viem";
-import { CallerAuthGateway, } from "./caller-auth-gateway.js";
+import { CallerAuthGateway, DEFAULT_MAX_STATE_STALENESS_SECONDS, MAX_CORROBORATING_STREAM_READERS, } from "./caller-auth-gateway.js";
 /**
  * Reference standalone reverse-proxy gateway server (metrik-agent#63).
  *
@@ -156,6 +156,14 @@ function logError(context, error) {
  * - `METRIK_GATEWAY_SERVICE_REF` (required) - primary bytes32 service ref.
  * - `METRIK_GATEWAY_SERVICE_REFS` (optional) - comma-separated migration aliases.
  * - `METRIK_GATEWAY_UPSTREAM_URL` (required) - the real service to proxy to on pass.
+ * - `METRIK_GATEWAY_CORROBORATING_RPC_URLS` (optional, STRONGLY recommended) -
+ *   comma-separated INDEPENDENT RPC endpoints for the same escrow. Stream state
+ *   is authorized only if every configured view agrees, so a stale primary view
+ *   cannot serve a stream that has just been closed. At most
+ *   {@link MAX_CORROBORATING_STREAM_READERS}.
+ * - `METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS` (optional) - reject stream
+ *   state observed more than N seconds behind the wall clock. Default
+ *   {@link DEFAULT_MAX_STATE_STALENESS_SECONDS}.
  * - `METRIK_GATEWAY_CHAIN_ID` (optional) - default `84532` (Base Sepolia).
  * - `METRIK_GATEWAY_HEADER_NAME` (optional) - default `x-metrik-capability`.
  * - `PORT` / `METRIK_GATEWAY_PORT` (optional) - default `8787`.
@@ -197,6 +205,31 @@ export function parseCallerAuthGatewayEnvConfig(env = process.env) {
     }
     const host = env.METRIK_GATEWAY_HOST ?? "0.0.0.0";
     const headerName = env.METRIK_GATEWAY_HEADER_NAME;
+    const corroboratingRpcUrls = [
+        ...new Set((env.METRIK_GATEWAY_CORROBORATING_RPC_URLS ?? "")
+            .split(",")
+            .map((value) => value.trim())
+            .filter((value) => value.length > 0)),
+    ];
+    for (const candidate of corroboratingRpcUrls) {
+        try {
+            // eslint-disable-next-line no-new -- validates the URL is well-formed.
+            new URL(candidate);
+        }
+        catch {
+            throw new Error(`METRIK_GATEWAY_CORROBORATING_RPC_URLS must contain only valid URLs (got ${candidate})`);
+        }
+    }
+    if (corroboratingRpcUrls.length > MAX_CORROBORATING_STREAM_READERS) {
+        throw new Error(`METRIK_GATEWAY_CORROBORATING_RPC_URLS accepts at most ${MAX_CORROBORATING_STREAM_READERS} URLs (bounded hot path)`);
+    }
+    const stalenessRaw = env.METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS ??
+        String(DEFAULT_MAX_STATE_STALENESS_SECONDS);
+    const maxStateStalenessSeconds = Number(stalenessRaw);
+    if (!Number.isInteger(maxStateStalenessSeconds) ||
+        maxStateStalenessSeconds <= 0) {
+        throw new Error(`invalid METRIK_GATEWAY_MAX_STATE_STALENESS_SECONDS: ${stalenessRaw}`);
+    }
     return {
         host,
         port,
@@ -208,6 +241,8 @@ export function parseCallerAuthGatewayEnvConfig(env = process.env) {
         ],
         chainId,
         upstreamUrl,
+        corroboratingRpcUrls,
+        maxStateStalenessSeconds,
         ...(headerName === undefined ? {} : { headerName }),
     };
 }
@@ -227,10 +262,19 @@ export async function startCallerAuthGatewayServerFromEnv(env = process.env) {
         serviceRef: config.serviceRef,
         serviceRefs: config.serviceRefs,
         chainId: config.chainId,
+        corroboratingRpcUrls: config.corroboratingRpcUrls,
+        maxStateStalenessSeconds: config.maxStateStalenessSeconds,
         ...(config.headerName === undefined
             ? {}
             : { headerName: config.headerName }),
     });
+    if (config.corroboratingRpcUrls.length === 0) {
+        console.error("[metrik-caller-auth-gateway] WARNING: no METRIK_GATEWAY_CORROBORATING_RPC_URLS " +
+            "configured — stream state is authorized from a single RPC view. A stale view " +
+            "can authorize a stream that has just been closed (bounded to " +
+            `${config.maxStateStalenessSeconds}s by the freshness check). Configure at least ` +
+            "one INDEPENDENT provider to close that window.");
+    }
     const server = createCallerAuthGatewayServer({
         gateway,
         upstreamUrl: config.upstreamUrl,