@agentunion/fastaun-browser 0.5.18 → 0.5.20

package/dist/client/rpc-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rpc-pipeline.d.ts","sourceRoot":"","sources":["../../src/client/rpc-pipeline.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA6KlD,KAAK,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AA2DvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAE9C,OAAO,EAAE,aAAa;IAI5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YA0BpD,QAAQ;YA+FR,aAAa;IA4H3B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,kBAAkB;IA8BjE,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAUtE,+BAA+B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,SAAK,GAAG,IAAI;IAYrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAgE7D,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAoB7D,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAe5E,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO;IAM/D,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IA2D3E,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,MAAM;IAkC7D,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO;IAQrE,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,0BAA0B;IAUlC,OAAO,CAAC,qBAAqB;IAQ7B,qBAAqB,IAAI,IAAI;IAQ7B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,0BAA0B;IAclC,OAAO,CAAC,wBAAwB;IAKhC,OAAO,CAAC,sBAAsB;IAK9B,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAe3C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,UAAO,GAAG,OAAO;IAwBlE,kBAAkB,IAAI,OAAO;IAQ7B,eAAe,IAAI,MAAM,IAAI;IAY7B,OAAO,CAAC,oBAAoB;IAKtB,oBAAoB,CAAC,CAAC,EAC1B,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;IAwD5C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAqB9C,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQxD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAOlD,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IA0ChC,OAAO,CAAC,0BAA0B;IAI5B,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;YAwD1F,oBAAoB;IAMlC,OAAO,CAAC,sBAAsB;IAIxB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBvF,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;IAMvD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,IAAI;IAQxE,OAAO,CAAC,aAAa;IA4CrB,OAAO,CAAC,mBAAmB;IAErB,OAAO,CACX,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3G,OAAO,CAAC,OAAO,CAAC;YAuBL,iCAAiC;IAoBzC,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,OAAO,CAAC;IAkEnB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,sBAAsB;IA4B9B,OAAO,CAAC,oBAAoB;IA4C5B,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,yBAAyB;IAcjC,OAAO,CAAC,4BAA4B;IAmBpC,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,yBAAyB;IAMjC,OAAO,CAAC,iCAAiC;IAQzC,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI;CAKtE"}
+{"version":3,"file":"rpc-pipeline.d.ts","sourceRoot":"","sources":["../../src/client/rpc-pipeline.ts"],"names":[],"mappings":"AAOA,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,SAAS,EACd,KAAK,SAAS,EACf,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA8KlD,KAAK,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;AA2DvE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,SAAS,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IACxC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAoC;IACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAqB;IAC1D,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,oBAAoB,CAA8B;gBAE9C,OAAO,EAAE,aAAa;IAI5B,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;YA0BpD,QAAQ;YA+FR,aAAa;IA4H3B,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,SAAS,GAAG,kBAAkB;IA8BjE,6BAA6B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAUtE,+BAA+B,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,SAAK,GAAG,IAAI;IAYrE,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAgE7D,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,IAAI;IAoB7D,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAiB5E,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO;IAM/D,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAqE3E,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,MAAM;IAkC7D,yBAAyB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,GAAG,OAAO;IAQrE,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,aAAa;IAWrB,OAAO,CAAC,0BAA0B;IAUlC,OAAO,CAAC,qBAAqB;IAQ7B,qBAAqB,IAAI,IAAI;IAQ7B,OAAO,CAAC,aAAa;IAkBrB,OAAO,CAAC,qBAAqB;IAQ7B,OAAO,CAAC,YAAY;IAKpB,OAAO,CAAC,0BAA0B;IAclC,OAAO,CAAC,wBAAwB;IAKhC,OAAO,CAAC,sBAAsB;IAK9B,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAe3C,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,UAAO,GAAG,OAAO;IAwBlE,kBAAkB,IAAI,OAAO;IAQ7B,eAAe,IAAI,MAAM,IAAI;IAY7B,OAAO,CAAC,oBAAoB;IAKtB,oBAAoB,CAAC,CAAC,EAC1B,EAAE,EAAE,MAAM,EACV,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAC9B,OAAO,CAAC;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,CAAA;KAAE,CAAC;IA0D5C,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAqB9C,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQxD,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAOlD,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC;IA0ChC,OAAO,CAAC,0BAA0B;IAI5B,iBAAiB,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,UAAQ,GAAG,OAAO,CAAC,CAAC,CAAC;YAwD1F,oBAAoB;IAMlC,OAAO,CAAC,sBAAsB;IAIxB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;IAwBvF,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB;IAMvD,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,kBAAkB,GAAG,IAAI;IAQxE,OAAO,CAAC,aAAa;IAmDrB,OAAO,CAAC,mBAAmB;IAErB,OAAO,CACX,MAAM,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,SAAS,EAClB,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAC3G,OAAO,CAAC,OAAO,CAAC;YAuBL,iCAAiC;IAoBzC,iBAAiB,CACrB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,SAAS,EACjB,MAAM,EAAE,OAAO,EACf,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,CAAA;KAAO,GACjE,OAAO,CAAC,OAAO,CAAC;IAkEnB,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,sBAAsB;IA4B9B,OAAO,CAAC,oBAAoB;IA4C5B,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,yBAAyB;IAcjC,OAAO,CAAC,4BAA4B;IAmBpC,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,yBAAyB;IAMjC,OAAO,CAAC,iCAAiC;IAQzC,wBAAwB,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,IAAI;CAKtE"}

package/dist/client/rpc-pipeline.js

@@ -1,6 +1,8 @@
 import { normalizeSlotId, slotIsolationKey } from '../config.js';
 import { ClientSignatureError, ConnectionError, PermissionError, TimeoutError, ValidationError } from '../errors.js';
-import { parseCertMetadata } from '../cert-utils.js';
+import { parseCertMetadata, verifySignatureWithCert } from '../cert-utils.js';
+import { orgRequestParams, validateOrgRequestJSON } from '../org-protocol.js';
+import { canonicalJson as canonicalClientRequest } from '../v2/crypto/canonical.js';
 import { validateAIDFormat, validateGroupIDFormat } from '../validators.js';
 import { p1363ToDer, pemToArrayBuffer, uint8ToBase64 } from '../crypto.js';
 import { ConnectionState, isJsonObject, } from '../types.js';
@@ -132,6 +134,7 @@ async function signingCertFingerprint(certPem) {
 }
 const PULL_GATE_STALE_MS = 35_000;
 const PULL_GATE_OPERATION_TIMEOUT_MS = 35_000;
+const PULL_GATE_MAX_ACTIVE = 4;
 function sameIdentityAdmissionRejection(error, original) {
     const errorCode = Number(error?.code);
     const originalCode = Number(original?.code);
@@ -526,7 +529,10 @@ export class RpcPipeline {
     }
     async applyClientSignature(method, params) {
         try {
-            if (!SIGNED_METHODS.has(method)) {
+            if (method.startsWith('org.')) {
+                params.aad = orgRequestParams(method, params).aad;
+            }
+            else if (!SIGNED_METHODS.has(method)) {
                 return;
             }
             if (this.shouldSkipClientSignature(method, params)) {
@@ -551,8 +557,11 @@ export class RpcPipeline {
         const currentAid = (internal && typeof internal === 'object')
             ? internal
             : this.runtime.client._currentAid;
-        if (!currentAid?.privateKeyPem)
+        if (!currentAid?.privateKeyPem) {
+            if (method.startsWith('org.'))
+                throw new ClientSignatureError('组织请求签名身份不可用');
             return;
+        }
         try {
             const aid = currentAid.aid;
             const certPem = currentAid.certPem ?? '';
@@ -570,11 +579,19 @@ export class RpcPipeline {
                     paramsForHash[k] = v;
                 }
             }
-            const paramsJson = stableStringify(paramsForHash);
+            if (method.startsWith('org.'))
+                validateOrgRequestJSON(paramsForHash);
+            const paramsJson = method.startsWith('org.') ? new TextDecoder().decode(canonicalClientRequest(paramsForHash)) : stableStringify(paramsForHash);
             const paramsHashBuf = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(paramsJson));
             const paramsHash = Array.from(new Uint8Array(paramsHashBuf))
                 .map(b => b.toString(16).padStart(2, '0'))
                 .join('');
+            if (params.client_signature !== undefined) {
+                const existing = params.client_signature;
+                if (!isJsonObject(existing) || existing.aid !== aid || existing.cert_fingerprint !== await signingCertFingerprint(certPem) || existing.params_hash !== paramsHash || typeof existing.timestamp !== 'string' || !/^\d+$/.test(existing.timestamp) || typeof existing.signature !== 'string' || !await verifySignatureWithCert(certPem, existing.signature, new TextEncoder().encode(`${method}|${aid}|${existing.timestamp}|${paramsHash}`)))
+                    throw new Error('已有客户端签名与请求内容不一致');
+                return;
+            }
             const signData = new TextEncoder().encode(`${method}|${aid}|${ts}|${paramsHash}`);
             const cryptoKey = await signingPrivateKey(currentAid.privateKeyPem);
             const sigP1363 = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, cryptoKey, signData);
@@ -647,7 +664,7 @@ export class RpcPipeline {
         const name = this.pullGateName(key);
         let state = this.pullGateStates.get(name);
         if (!state) {
-            state = { active: null, foreground: [], background: [], byKey: new Map(), lifecycle: new Map(), watchdog: null };
+            state = { activeByNamespace: new Map(), foreground: [], background: [], byKey: new Map(), lifecycle: new Map(), watchdog: null };
             this.pullGateStates.set(name, state);
         }
         this.startPullGateWatchdog(state, name);
@@ -677,21 +694,23 @@ export class RpcPipeline {
         }
     }
     checkPullGate(state, name) {
-        const active = state.active;
-        if (!active) {
+        const activeJobs = [...state.activeByNamespace.values()];
+        if (activeJobs.length === 0) {
             this.drainPullGate(state);
             return;
         }
-        if (!active.pullingStartedAt || Date.now() - active.pullingStartedAt < this.pullGateOperationTimeoutMs())
-            return;
-        if (active.timedOut)
-            return;
-        active.timedOut = true;
-        active.invalidated = true;
-        active.cancel?.();
-        const err = new TimeoutError(`pull gate timeout: ${active.namespace}`, { retryable: true });
-        this.runtime.client._clientLog?.warn(`pull gate watchdog timeout: gate=${name} key=${active.key}`);
-        active.reject(err);
+        for (const active of activeJobs) {
+            if (!active.pullingStartedAt || Date.now() - active.pullingStartedAt < this.pullGateOperationTimeoutMs())
+                continue;
+            if (active.timedOut)
+                continue;
+            active.timedOut = true;
+            active.invalidated = true;
+            active.cancel?.();
+            const err = new TimeoutError(`pull gate timeout: ${active.namespace}`, { retryable: true });
+            this.runtime.client._clientLog?.warn(`pull gate watchdog timeout: gate=${name} key=${active.key}`);
+            active.reject(err);
+        }
     }
     realtimePullNamespace(key) {
         for (const marker of ['|tail|', '|forward|']) {
@@ -711,7 +730,7 @@ export class RpcPipeline {
         if (typeof cancel !== 'function' || !key)
             return request;
         const state = this.pullGateStates.get(this.pullGateName(key));
-        const active = state?.active;
+        const active = [...(state?.activeByNamespace.values() ?? [])].find((candidate) => candidate.key === key);
         if (!active || active.key !== key || active.timedOut || active.invalidated)
             return request;
         const boundCancel = () => cancel.call(request);
@@ -744,7 +763,7 @@ export class RpcPipeline {
                 return false;
             return this.realtimePullNamespace(job.key) === normalized;
         };
-        return matches(state.active)
+        return [...state.activeByNamespace.values()].some(matches)
             || state.foreground.some(matches)
             || state.background.some(matches);
     }
@@ -776,13 +795,13 @@ export class RpcPipeline {
         if (!state)
             return false;
         const matches = (job) => job !== null && job.namespace === ns;
-        return matches(state.active) || state.foreground.some(matches) || state.background.some(matches);
+        return [...state.activeByNamespace.values()].some(matches) || state.foreground.some(matches) || state.background.some(matches);
     }
     hasAnyPullActivity() {
         if (this.pullWorkTokens.size > 0)
             return true;
         for (const state of this.pullGateStates.values()) {
-            if (state.active || state.foreground.length > 0 || state.background.length > 0)
+            if (state.activeByNamespace.size > 0 || state.foreground.length > 0 || state.background.length > 0)
                 return true;
         }
         return false;
@@ -823,7 +842,9 @@ export class RpcPipeline {
         }
         const key = `${normalized}|inline|seq=${seq}`;
         const state = this.pullGateState(key);
-        if (state.active !== null || state.foreground.length > 0 || state.background.length > 0) {
+        if (state.activeByNamespace.has(normalized)
+            || state.foreground.some((job) => job.namespace === normalized)
+            || state.background.some((job) => job.namespace === normalized)) {
             return { acquired: false };
         }
         const guard = {
@@ -854,8 +875,8 @@ export class RpcPipeline {
         }
         finally {
             this.inlineRealtimeScopes.delete(normalized);
-            if (state.active === guard)
-                state.active = null;
+            if (state.activeByNamespace.get(normalized) === guard)
+                state.activeByNamespace.delete(normalized);
             this.drainPullGate(state);
             this.runtime.client._delivery?.onPullGateIdle?.(normalized);
             this.armQueuedPullTimers(state);
@@ -867,7 +888,7 @@ export class RpcPipeline {
         if (this.inlineRealtimeScopes.has(this.pullScopeKey(key)))
             return null;
         const serialized = this.pullGateStates.get(this.pullGateName(key));
-        if (serialized?.active?.inline === true)
+        if ([...(serialized?.activeByNamespace.values() ?? [])].some((job) => job.inline === true))
             return null;
         const client = this.runtime.client;
         const now = Date.now();
@@ -897,7 +918,7 @@ export class RpcPipeline {
         const ns = this.pullScopeKey(namespace);
         if (!ns)
             return true;
-        const active = this.pullGateStates.get(this.pullGateName(ns))?.active;
+        const active = this.pullGateStates.get(this.pullGateName(ns))?.activeByNamespace.get(ns);
         return !active || active.namespace !== ns || (!active.timedOut && !active.invalidated);
     }
     invalidatePulls() {
@@ -907,8 +928,8 @@ export class RpcPipeline {
         const waits = [];
         for (const state of this.pullGateStates.values()) {
             const jobs = new Set();
-            if (state.active)
-                jobs.add(state.active);
+            for (const active of state.activeByNamespace.values())
+                jobs.add(active);
             for (const job of state.foreground)
                 jobs.add(job);
             for (const job of state.background)
@@ -973,7 +994,7 @@ export class RpcPipeline {
         const candidate = state.byKey.get(key);
         const existing = candidate && !candidate.timedOut && !candidate.invalidated ? candidate : null;
         if (existing) {
-            if (!background && existing.background && existing !== state.active) {
+            if (!background && existing.background && ![...state.activeByNamespace.values()].includes(existing)) {
                 const index = state.background.indexOf(existing);
                 if (index >= 0)
                     state.background.splice(index, 1);
@@ -1022,8 +1043,8 @@ export class RpcPipeline {
             return;
         const state = this.pullGateState(key);
         const namespace = this.pullScopeKey(key);
-        const job = state.active?.key === key ? state.active : null;
-        if (!job || state.active !== job)
+        const job = [...state.activeByNamespace.values()].find((candidate) => candidate.key === key) ?? null;
+        if (!job)
             return;
         const replacementKey = String(nextKey || key);
         if (state.byKey.get(job.key) === job)
@@ -1036,7 +1057,7 @@ export class RpcPipeline {
         state.lifecycle.set(namespace, 'pulled');
         job.suspended = true;
         job.resume = new Promise((resolve) => { job.resumeResolve = resolve; });
-        state.active = null;
+        state.activeByNamespace.delete(namespace);
         (job.background ? state.background : state.foreground).push(job);
         this.drainPullGate(state);
         if (job.resume) {
@@ -1056,58 +1077,63 @@ export class RpcPipeline {
         if (!ns)
             return;
         const state = this.pullGateStates.get(this.pullGateName(ns));
-        if (!state || state.active?.namespace !== ns)
+        if (!state || !state.activeByNamespace.has(ns))
             return;
         state.lifecycle.set(ns, lifecycle);
     }
     drainPullGate(state) {
-        if (state.active)
-            return;
         const takeRunnable = (queue) => {
-            const index = queue.findIndex((candidate) => !this.inlineRealtimeScopes.has(candidate.namespace));
+            const index = queue.findIndex((candidate) => (!this.inlineRealtimeScopes.has(candidate.namespace)
+                && !state.activeByNamespace.has(candidate.namespace)));
             return index >= 0 ? queue.splice(index, 1)[0] : undefined;
         };
-        const job = takeRunnable(state.foreground) ?? takeRunnable(state.background);
-        if (!job)
-            return;
-        state.active = job;
-        this.runtime.client._delivery?.onPullStarted?.(job.namespace);
-        if (job.timer)
-            clearTimeout(job.timer);
-        job.pullingStartedAt = Date.now();
-        job.timedOut = false;
-        state.lifecycle.set(job.namespace, 'pulling');
-        const resumeResolve = job.resumeResolve;
-        job.resume = null;
-        job.resumeResolve = null;
-        if (job.suspended) {
-            job.suspended = false;
-            resumeResolve?.();
-            return;
+        while (state.activeByNamespace.size < PULL_GATE_MAX_ACTIVE) {
+            const foregroundJob = takeRunnable(state.foreground);
+            const foregroundDrained = foregroundJob !== undefined && state.foreground.length === 0;
+            const job = foregroundJob ?? takeRunnable(state.background);
+            if (!job)
+                break;
+            state.activeByNamespace.set(job.namespace, job);
+            this.runtime.client._delivery?.onPullStarted?.(job.namespace);
+            if (foregroundDrained)
+                this.runtime.client._delivery?.onForegroundPullsDrained?.();
+            if (job.timer)
+                clearTimeout(job.timer);
+            job.pullingStartedAt = Date.now();
+            job.timedOut = false;
+            state.lifecycle.set(job.namespace, 'pulling');
+            const resumeResolve = job.resumeResolve;
+            job.resume = null;
+            job.resumeResolve = null;
+            if (job.suspended) {
+                job.suspended = false;
+                resumeResolve?.();
+                continue;
+            }
+            job.running = true;
+            let failed = false;
+            void this.executePullOperation(job.operation, job.background).then((value) => { if (!job.timedOut && !job.invalidated)
+                job.resolve(value); }, (error) => {
+                failed = true;
+                if (!job.timedOut && !job.invalidated)
+                    job.reject(error);
+            }).finally(() => {
+                this.pullWorkTokens.delete(job.workToken);
+                state.lifecycle.set(job.namespace, 'idle');
+                if (state.activeByNamespace.get(job.namespace) === job)
+                    state.activeByNamespace.delete(job.namespace);
+                if (state.byKey.get(job.key) === job)
+                    state.byKey.delete(job.key);
+                this.drainPullGate(state);
+                job.settledResolve?.();
+                job.settledResolve = null;
+                if (!job.invalidated)
+                    this.runtime.client._delivery?.onPullGateIdle?.(job.namespace);
+                if (failed || job.invalidated)
+                    this.runtime.client._delivery?.onPullAborted?.();
+                this.runtime.client._delivery?.onPullWorkSettled?.();
+            });
         }
-        job.running = true;
-        let failed = false;
-        void this.executePullOperation(job.operation, job.background).then((value) => { if (!job.timedOut && !job.invalidated)
-            job.resolve(value); }, (error) => {
-            failed = true;
-            if (!job.timedOut && !job.invalidated)
-                job.reject(error);
-        }).finally(() => {
-            this.pullWorkTokens.delete(job.workToken);
-            state.lifecycle.set(job.namespace, 'idle');
-            if (state.active === job)
-                state.active = null;
-            if (state.byKey.get(job.key) === job)
-                state.byKey.delete(job.key);
-            this.drainPullGate(state);
-            job.settledResolve?.();
-            job.settledResolve = null;
-            if (!job.invalidated)
-                this.runtime.client._delivery?.onPullGateIdle?.(job.namespace);
-            if (failed || job.invalidated)
-                this.runtime.client._delivery?.onPullAborted?.();
-            this.runtime.client._delivery?.onPullWorkSettled?.();
-        });
     }
     armQueuedPullTimers(_state) { }
     async rawCall(method, params, options) {
@@ -1116,7 +1142,7 @@ export class RpcPipeline {
         const rpcBackground = Boolean(payload._rpc_background) || client._backgroundRpcDepth > 0 || options?.background === true;
         delete payload._rpc_background;
         const signed = options?.signed ?? true;
-        if (signed) {
+        if (signed || method.startsWith('org.')) {
             await this.applyClientSignature(method, payload);
         }
         const timeout = options?.timeout;