@aster-rpc/aster 0.1.2

package/dist/trust/hooks.js

@@ -0,0 +1,125 @@
+/**
+ * Gate 0 connection hooks — ALPN-level connection gating.
+ *
+ * Spec reference: Aster-trust-spec.md
+ *
+ * The MeshEndpointHook runs a background loop reading hook events
+ * from the IrohNode and accepting/denying connections based on
+ * admission policy.
+ */
+/** Default policy: allow all connections. */
+export class AllowAllPolicy {
+    async onBeforeConnect() {
+        return { allow: true };
+    }
+}
+/** Policy that denies all connections. */
+export class DenyAllPolicy {
+    async onBeforeConnect() {
+        return { allow: false, errorCode: 1, reason: 'connections disabled' };
+    }
+}
+// ── ALPN constants ────────────────────────────────────────────────────────────
+const _encoder = new TextEncoder();
+const _decoder = new TextDecoder();
+/** Admission ALPN for producer enrollment. */
+export const PRODUCER_ADMISSION_ALPN = _encoder.encode('aster.producer_admission');
+/** Admission ALPN for consumer enrollment. */
+export const CONSUMER_ADMISSION_ALPN = _encoder.encode('aster.consumer_admission');
+const _ADMISSION_ALPN_STRINGS = new Set([
+    'aster.producer_admission',
+    'aster.consumer_admission',
+]);
+// ── MeshEndpointHook ──────────────────────────────────────────────────────────
+/**
+ * Connection-level admission gate (Gate 0, S3.3).
+ *
+ * Maintains an allowlist of admitted peer endpoint IDs. The decision logic is:
+ *
+ * - Admission ALPNs (aster.producer_admission, aster.consumer_admission)
+ *   -> always allow (credential presentation must be possible).
+ * - Any other ALPN, peer in admitted set -> allow.
+ * - Any other ALPN, peer NOT in admitted and allowUnenrolled=false -> deny.
+ * - allowUnenrolled=true -> allow all (local/dev mode; must be explicit opt-in).
+ */
+export class MeshEndpointHook {
+    admitted = new Set();
+    allowUnenrolled;
+    _peerStore;
+    constructor(allowUnenrolled = false, peerStore) {
+        this.allowUnenrolled = allowUnenrolled;
+        this._peerStore = peerStore;
+    }
+    // ── Decision logic ──────────────────────────────────────────────────────
+    /**
+     * Return true if this connection should be allowed.
+     *
+     * @param remoteEndpointId - NodeId of the connecting peer (from handshake).
+     * @param alpn - ALPN negotiated for this connection (Uint8Array).
+     */
+    shouldAllow(remoteEndpointId, alpn) {
+        // Admission ALPNs are always open -- credential presentation
+        const alpnStr = _decoder.decode(alpn);
+        if (_ADMISSION_ALPN_STRINGS.has(alpnStr)) {
+            return true;
+        }
+        // If we have a peer store, use it for expiry-aware checks
+        if (this._peerStore) {
+            if (this._peerStore.get(remoteEndpointId) != null) {
+                return true;
+            }
+        }
+        else if (this.admitted.has(remoteEndpointId)) {
+            return true;
+        }
+        // Open-mode bypass (local/dev only)
+        if (this.allowUnenrolled) {
+            return true;
+        }
+        return false;
+    }
+    // ── Allowlist management ────────────────────────────────────────────────
+    /** Add a peer to the admitted set after successful credential check. */
+    addPeer(endpointId) {
+        this.admitted.add(endpointId);
+    }
+    /** Remove a peer from the admitted set (e.g., on lease expiry). */
+    removePeer(endpointId) {
+        this.admitted.delete(endpointId);
+    }
+    // ── Iroh hook-loop integration ──────────────────────────────────────────
+    /**
+     * Background loop: poll hookReceiver and apply Gate 0 decisions.
+     *
+     * Wires this hook to Iroh's Phase 1b HookReceiver. Run via a detached
+     * promise after obtaining the receiver from netClient.takeHookReceiver().
+     *
+     * @param hookReceiver - An object with recvBeforeConnect() that returns
+     *   { info: { remoteEndpointId: string; alpn: Uint8Array }, respond(d: HookDecision): Promise<void> } | null
+     */
+    async runHookLoop(hookReceiver) {
+        try {
+            while (true) {
+                const event = await hookReceiver.recvBeforeConnect();
+                if (event == null)
+                    break;
+                const { info, respond } = event;
+                if (this.shouldAllow(info.remoteEndpointId, info.alpn)) {
+                    await respond({ allow: true });
+                }
+                else {
+                    await respond({ allow: false, errorCode: 403, reason: 'not admitted' });
+                }
+            }
+        }
+        catch (err) {
+            // Cancellation or shutdown — silently exit
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes('abort') || msg.includes('cancel'))
+                return;
+            // Log unexpected errors (no logger abstraction yet — console.error)
+            console.error('Hook loop error:', msg);
+        }
+    }
+}
+//# sourceMappingURL=hooks.js.map

package/dist/trust/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/trust/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAkBH,6CAA6C;AAC7C,MAAM,OAAO,cAAc;IACzB,KAAK,CAAC,eAAe;QACnB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;CACF;AAED,0CAA0C;AAC1C,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,eAAe;QACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACxE,CAAC;CACF;AAED,iFAAiF;AAEjF,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;AACnC,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;AAEnC,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAe,QAAQ,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE/F,8CAA8C;AAC9C,MAAM,CAAC,MAAM,uBAAuB,GAAe,QAAQ,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;AAE/F,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,0BAA0B;IAC1B,0BAA0B;CAC3B,CAAC,CAAC;AAEH,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,OAAO,gBAAgB;IAClB,QAAQ,GAAgB,IAAI,GAAG,EAAE,CAAC;IAClC,eAAe,CAAU;IAC1B,UAAU,CAAoD;IAEtE,YAAY,eAAe,GAAG,KAAK,EAAE,SAA4D;QAC/F,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;QACvC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,2EAA2E;IAE3E;;;;;OAKG;IACH,WAAW,CAAC,gBAAwB,EAAE,IAAgB;QACpD,6DAA6D;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,0DAA0D;QAC1D,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,IAAI,EAAE,CAAC;gBAClD,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;aAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,oCAAoC;QACpC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,2EAA2E;IAE3E,wEAAwE;IACxE,OAAO,CAAC,UAAkB;QACxB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAED,mEAAmE;IACnE,UAAU,CAAC,UAAkB;QAC3B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED,2EAA2E;IAE3E;;;;;;;;OAQG;IACH,KAAK,CAAC,WAAW,CAAC,YAKjB;QACC,IAAI,CAAC;YACH,OAAO,IAAI,EAAE,CAAC;gBACZ,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,CAAC;gBACrD,IAAI,KAAK,IAAI,IAAI;oBAAE,MAAM;gBAEzB,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;gBAChC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvD,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACjC,CAAC;qBAAM,CAAC;oBACN,MAAM,OAAO,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;gBAC1E,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,2CAA2C;YAC3C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBAAE,OAAO;YAC5D,oEAAoE;YACpE,OAAO,CAAC,KAAK,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF"}

package/dist/trust/iid.d.ts

@@ -0,0 +1,65 @@
+/**
+ * IID (Instance Identity Document) — cloud identity verification.
+ *
+ * Spec reference: Aster-trust-spec.md
+ *
+ * Validates that a connecting peer is running on an expected cloud instance
+ * (AWS/GCP/Azure) with specific attributes (account, region, role ARN).
+ *
+ * IID verification is Gate 2 (runtime check) in the admission pipeline.
+ * Triggered when credential attributes carry aster.iid_provider.
+ */
+/** Reserved IID attribute keys. */
+export declare const ATTR_IID_PROVIDER = "aster.iid_provider";
+export declare const ATTR_IID_ACCOUNT = "aster.iid_account";
+export declare const ATTR_IID_REGION = "aster.iid_region";
+export declare const ATTR_IID_ROLE_ARN = "aster.iid_role_arn";
+/** IID verification backend interface. */
+export interface IIDBackend {
+    verify(attributes: Record<string, string>, iidToken?: string): Promise<[boolean, string | undefined]>;
+}
+/**
+ * Mock IID backend for testing.
+ */
+export declare class MockIIDBackend implements IIDBackend {
+    private shouldPass;
+    private reason;
+    private expectedAttributes;
+    constructor(opts?: {
+        shouldPass?: boolean;
+        reason?: string;
+        expectedAttributes?: Record<string, string>;
+    });
+    verify(attributes: Record<string, string>, _iidToken?: string): Promise<[boolean, string | undefined]>;
+}
+/**
+ * AWS IID backend (stub — full RSA verification deferred to production).
+ */
+export declare class AWSIIDBackend implements IIDBackend {
+    verify(attributes: Record<string, string>, _iidToken?: string): Promise<[boolean, string | undefined]>;
+}
+/**
+ * GCP IID backend (stub).
+ */
+export declare class GCPIIDBackend implements IIDBackend {
+    verify(_attributes: Record<string, string>, _iidToken?: string): Promise<[boolean, string | undefined]>;
+}
+/**
+ * Azure IID backend (stub).
+ */
+export declare class AzureIIDBackend implements IIDBackend {
+    verify(_attributes: Record<string, string>, _iidToken?: string): Promise<[boolean, string | undefined]>;
+}
+/**
+ * Factory: get the appropriate IID backend for a provider.
+ */
+export declare function getIIDBackend(provider: string): IIDBackend;
+/**
+ * Run IID verification against credential attributes.
+ *
+ * If no backend supplied, auto-selects based on aster.iid_provider attribute.
+ *
+ * @returns [ok, reason]
+ */
+export declare function verifyIID(attributes: Record<string, string>, backend?: IIDBackend, iidToken?: string): Promise<[boolean, string | undefined]>;
+//# sourceMappingURL=iid.d.ts.map

package/dist/trust/iid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"iid.d.ts","sourceRoot":"","sources":["../../src/trust/iid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,mCAAmC;AACnC,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AACtD,eAAO,MAAM,gBAAgB,sBAAsB,CAAC;AACpD,eAAO,MAAM,eAAe,qBAAqB,CAAC;AAClD,eAAO,MAAM,iBAAiB,uBAAuB,CAAC;AAEtD,0CAA0C;AAC1C,MAAM,WAAW,UAAU;IACzB,MAAM,CACJ,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CAC3C;AAED;;GAEG;AACH,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,UAAU,CAAU;IAC5B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,kBAAkB,CAAqC;gBAEnD,IAAI,CAAC,EAAE;QACjB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KAC7C;IAMK,MAAM,CACV,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAU1C;AAED;;GAEG;AACH,qBAAa,aAAc,YAAW,UAAU;IACxC,MAAM,CACV,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAW1C;AAED;;GAEG;AACH,qBAAa,aAAc,YAAW,UAAU;IACxC,MAAM,CACV,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAG1C;AAED;;GAEG;AACH,qBAAa,eAAgB,YAAW,UAAU;IAC1C,MAAM,CACV,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;CAG1C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,CAa1D;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAClC,OAAO,CAAC,EAAE,UAAU,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAQxC"}

package/dist/trust/iid.js

@@ -0,0 +1,104 @@
+/**
+ * IID (Instance Identity Document) — cloud identity verification.
+ *
+ * Spec reference: Aster-trust-spec.md
+ *
+ * Validates that a connecting peer is running on an expected cloud instance
+ * (AWS/GCP/Azure) with specific attributes (account, region, role ARN).
+ *
+ * IID verification is Gate 2 (runtime check) in the admission pipeline.
+ * Triggered when credential attributes carry aster.iid_provider.
+ */
+/** Reserved IID attribute keys. */
+export const ATTR_IID_PROVIDER = 'aster.iid_provider';
+export const ATTR_IID_ACCOUNT = 'aster.iid_account';
+export const ATTR_IID_REGION = 'aster.iid_region';
+export const ATTR_IID_ROLE_ARN = 'aster.iid_role_arn';
+/**
+ * Mock IID backend for testing.
+ */
+export class MockIIDBackend {
+    shouldPass;
+    reason;
+    expectedAttributes;
+    constructor(opts) {
+        this.shouldPass = opts?.shouldPass ?? true;
+        this.reason = opts?.reason;
+        this.expectedAttributes = opts?.expectedAttributes;
+    }
+    async verify(attributes, _iidToken) {
+        if (this.expectedAttributes) {
+            for (const [key, expected] of Object.entries(this.expectedAttributes)) {
+                if (attributes[key] !== expected) {
+                    return [false, `attribute mismatch: ${key}`];
+                }
+            }
+        }
+        return [this.shouldPass, this.reason];
+    }
+}
+/**
+ * AWS IID backend (stub — full RSA verification deferred to production).
+ */
+export class AWSIIDBackend {
+    async verify(attributes, _iidToken) {
+        // Stub: check that required attributes are present
+        if (!attributes[ATTR_IID_ACCOUNT]) {
+            return [false, 'missing aster.iid_account'];
+        }
+        if (!attributes[ATTR_IID_REGION]) {
+            return [false, 'missing aster.iid_region'];
+        }
+        // Full verification would fetch instance identity from metadata service
+        return [true, undefined];
+    }
+}
+/**
+ * GCP IID backend (stub).
+ */
+export class GCPIIDBackend {
+    async verify(_attributes, _iidToken) {
+        return [true, undefined];
+    }
+}
+/**
+ * Azure IID backend (stub).
+ */
+export class AzureIIDBackend {
+    async verify(_attributes, _iidToken) {
+        return [true, undefined];
+    }
+}
+/**
+ * Factory: get the appropriate IID backend for a provider.
+ */
+export function getIIDBackend(provider) {
+    switch (provider.toLowerCase()) {
+        case 'aws':
+            return new AWSIIDBackend();
+        case 'gcp':
+            return new GCPIIDBackend();
+        case 'azure':
+            return new AzureIIDBackend();
+        case 'mock':
+            return new MockIIDBackend();
+        default:
+            throw new Error(`unknown IID provider: ${provider}`);
+    }
+}
+/**
+ * Run IID verification against credential attributes.
+ *
+ * If no backend supplied, auto-selects based on aster.iid_provider attribute.
+ *
+ * @returns [ok, reason]
+ */
+export async function verifyIID(attributes, backend, iidToken) {
+    const provider = attributes[ATTR_IID_PROVIDER];
+    if (!provider) {
+        return [true, undefined]; // No IID required
+    }
+    const iidBackend = backend ?? getIIDBackend(provider);
+    return iidBackend.verify(attributes, iidToken);
+}
+//# sourceMappingURL=iid.js.map

package/dist/trust/iid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iid.js","sourceRoot":"","sources":["../../src/trust/iid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,mCAAmC;AACnC,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AACpD,MAAM,CAAC,MAAM,eAAe,GAAG,kBAAkB,CAAC;AAClD,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAUtD;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,UAAU,CAAU;IACpB,MAAM,CAAqB;IAC3B,kBAAkB,CAAqC;IAE/D,YAAY,IAIX;QACC,IAAI,CAAC,UAAU,GAAG,IAAI,EAAE,UAAU,IAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,IAAI,EAAE,MAAM,CAAC;QAC3B,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,CAAC;IACrD,CAAC;IAED,KAAK,CAAC,MAAM,CACV,UAAkC,EAClC,SAAkB;QAElB,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtE,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACjC,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,EAAE,CAAC,CAAC;gBAC/C,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,MAAM,CACV,UAAkC,EAClC,SAAkB;QAElB,mDAAmD;QACnD,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,KAAK,EAAE,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,EAAE,0BAA0B,CAAC,CAAC;QAC7C,CAAC;QACD,wEAAwE;QACxE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,aAAa;IACxB,KAAK,CAAC,MAAM,CACV,WAAmC,EACnC,SAAkB;QAElB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,OAAO,eAAe;IAC1B,KAAK,CAAC,MAAM,CACV,WAAmC,EACnC,SAAkB;QAElB,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,QAAQ,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QAC/B,KAAK,KAAK;YACR,OAAO,IAAI,aAAa,EAAE,CAAC;QAC7B,KAAK,KAAK;YACR,OAAO,IAAI,aAAa,EAAE,CAAC;QAC7B,KAAK,OAAO;YACV,OAAO,IAAI,eAAe,EAAE,CAAC;QAC/B,KAAK,MAAM;YACT,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B;YACE,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,UAAkC,EAClC,OAAoB,EACpB,QAAiB;IAEjB,MAAM,QAAQ,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB;IAC9C,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AACjD,CAAC"}

package/dist/trust/mesh.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Mesh state — gossip-based service discovery.
+ *
+ * Tracks which peers offer which services, updated via gossip broadcasts.
+ * Supports JSON persistence to ~/.aster/mesh_state.json.
+ */
+/** A service available from a peer. */
+export interface PeerService {
+    peerEndpointId: string;
+    serviceName: string;
+    serviceVersion: number;
+    contractId: string;
+}
+/** Mesh state: tracks discovered peers and their services. */
+export declare class MeshState {
+    private peers;
+    private _acceptedProducers;
+    /** Hex-encoded 32-byte gossip topic ID for the producer mesh. */
+    topicId: string;
+    /** Add a peer to the accepted set (used by producer admission). */
+    addPeer(peerEndpointId: string): void;
+    /** Check if a peer is in the accepted set. */
+    isPeerAccepted(peerEndpointId: string): boolean;
+    /** Record services from a peer. */
+    update(peerEndpointId: string, services: PeerService[]): void;
+    /** Remove a peer. */
+    remove(peerEndpointId: string): void;
+    /** Find peers offering a service by name. */
+    findService(serviceName: string): PeerService[];
+    /** All known peers. */
+    allPeers(): string[];
+    /** Number of known peers. */
+    get size(): number;
+    /** Serialize to JSON-compatible dict. */
+    toJson(): Record<string, unknown>;
+    /** Deserialize from JSON dict. */
+    static fromJson(data: Record<string, unknown>): MeshState;
+}
+/** Save mesh state to ~/.aster/mesh_state.json (atomic rename). */
+export declare function saveMeshState(state: MeshState, path?: string): void;
+/** Load mesh state from ~/.aster/mesh_state.json. Returns null if not found. */
+export declare function loadMeshState(path?: string): MeshState | null;
+//# sourceMappingURL=mesh.d.ts.map

package/dist/trust/mesh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.d.ts","sourceRoot":"","sources":["../../src/trust/mesh.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,uCAAuC;AACvC,MAAM,WAAW,WAAW;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,8DAA8D;AAC9D,qBAAa,SAAS;IACpB,OAAO,CAAC,KAAK,CAAoC;IACjD,OAAO,CAAC,kBAAkB,CAAqB;IAC/C,iEAAiE;IACjE,OAAO,SAAM;IAEb,mEAAmE;IACnE,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAOrC,8CAA8C;IAC9C,cAAc,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAI/C,mCAAmC;IACnC,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,IAAI;IAI7D,qBAAqB;IACrB,MAAM,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI;IAKpC,6CAA6C;IAC7C,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,EAAE;IAU/C,uBAAuB;IACvB,QAAQ,IAAI,MAAM,EAAE;IAIpB,6BAA6B;IAC7B,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,yCAAyC;IACzC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAUjC,kCAAkC;IAClC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS;CAe1D;AAOD,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,SAAkB,GAAG,IAAI,CAM5E;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,IAAI,SAAkB,GAAG,SAAS,GAAG,IAAI,CAQtE"}

package/dist/trust/mesh.js

@@ -0,0 +1,105 @@
+/**
+ * Mesh state — gossip-based service discovery.
+ *
+ * Tracks which peers offer which services, updated via gossip broadcasts.
+ * Supports JSON persistence to ~/.aster/mesh_state.json.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, renameSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir } from 'node:os';
+/** Mesh state: tracks discovered peers and their services. */
+export class MeshState {
+    peers = new Map();
+    _acceptedProducers = new Set();
+    /** Hex-encoded 32-byte gossip topic ID for the producer mesh. */
+    topicId = '';
+    /** Add a peer to the accepted set (used by producer admission). */
+    addPeer(peerEndpointId) {
+        this._acceptedProducers.add(peerEndpointId);
+        if (!this.peers.has(peerEndpointId)) {
+            this.peers.set(peerEndpointId, []);
+        }
+    }
+    /** Check if a peer is in the accepted set. */
+    isPeerAccepted(peerEndpointId) {
+        return this._acceptedProducers.has(peerEndpointId);
+    }
+    /** Record services from a peer. */
+    update(peerEndpointId, services) {
+        this.peers.set(peerEndpointId, services);
+    }
+    /** Remove a peer. */
+    remove(peerEndpointId) {
+        this.peers.delete(peerEndpointId);
+        this._acceptedProducers.delete(peerEndpointId);
+    }
+    /** Find peers offering a service by name. */
+    findService(serviceName) {
+        const results = [];
+        for (const services of this.peers.values()) {
+            for (const svc of services) {
+                if (svc.serviceName === serviceName)
+                    results.push(svc);
+            }
+        }
+        return results;
+    }
+    /** All known peers. */
+    allPeers() {
+        return [...this.peers.keys()];
+    }
+    /** Number of known peers. */
+    get size() {
+        return this.peers.size;
+    }
+    /** Serialize to JSON-compatible dict. */
+    toJson() {
+        return {
+            accepted_producers: [...this._acceptedProducers],
+            peers: Object.fromEntries([...this.peers.entries()].map(([k, v]) => [k, v])),
+            topic_id: this.topicId,
+        };
+    }
+    /** Deserialize from JSON dict. */
+    static fromJson(data) {
+        const state = new MeshState();
+        const producers = data.accepted_producers;
+        if (producers) {
+            for (const p of producers)
+                state._acceptedProducers.add(p);
+        }
+        const peers = data.peers;
+        if (peers) {
+            for (const [k, v] of Object.entries(peers)) {
+                state.peers.set(k, v);
+            }
+        }
+        state.topicId = data.topic_id ?? '';
+        return state;
+    }
+}
+// -- Mesh state persistence ---------------------------------------------------
+const MESH_STATE_DIR = join(homedir(), '.aster');
+const MESH_STATE_FILE = join(MESH_STATE_DIR, 'mesh_state.json');
+/** Save mesh state to ~/.aster/mesh_state.json (atomic rename). */
+export function saveMeshState(state, path = MESH_STATE_FILE) {
+    const dir = dirname(path);
+    if (!existsSync(dir))
+        mkdirSync(dir, { recursive: true });
+    const tmp = path + '.tmp';
+    writeFileSync(tmp, JSON.stringify(state.toJson(), null, 2));
+    renameSync(tmp, path);
+}
+/** Load mesh state from ~/.aster/mesh_state.json. Returns null if not found. */
+export function loadMeshState(path = MESH_STATE_FILE) {
+    try {
+        if (!existsSync(path))
+            return null;
+        const data = JSON.parse(readFileSync(path, 'utf-8'));
+        return MeshState.fromJson(data);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=mesh.js.map

package/dist/trust/mesh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mesh.js","sourceRoot":"","sources":["../../src/trust/mesh.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAUlC,8DAA8D;AAC9D,MAAM,OAAO,SAAS;IACZ,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IACzC,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/C,iEAAiE;IACjE,OAAO,GAAG,EAAE,CAAC;IAEb,mEAAmE;IACnE,OAAO,CAAC,cAAsB;QAC5B,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,8CAA8C;IAC9C,cAAc,CAAC,cAAsB;QACnC,OAAO,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,CAAC;IAED,mCAAmC;IACnC,MAAM,CAAC,cAAsB,EAAE,QAAuB;QACpD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,qBAAqB;IACrB,MAAM,CAAC,cAAsB;QAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAED,6CAA6C;IAC7C,WAAW,CAAC,WAAmB;QAC7B,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;gBAC3B,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW;oBAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,uBAAuB;IACvB,QAAQ;QACN,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,yCAAyC;IACzC,MAAM;QACJ,OAAO;YACL,kBAAkB,EAAE,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC;YAChD,KAAK,EAAE,MAAM,CAAC,WAAW,CACvB,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAClD;YACD,QAAQ,EAAE,IAAI,CAAC,OAAO;SACvB,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,MAAM,CAAC,QAAQ,CAAC,IAA6B;QAC3C,MAAM,KAAK,GAAG,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,kBAA0C,CAAC;QAClE,IAAI,SAAS,EAAE,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,SAAS;gBAAE,KAAK,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAkD,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3C,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,OAAO,GAAI,IAAI,CAAC,QAAmB,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAED,gFAAgF;AAEhF,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AACjD,MAAM,eAAe,GAAG,IAAI,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;AAEhE,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,KAAgB,EAAE,IAAI,GAAG,eAAe;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,GAAG,GAAG,IAAI,GAAG,MAAM,CAAC;IAC1B,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,IAAI,GAAG,eAAe;IAClD,IAAI,CAAC;QACH,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACrD,OAAO,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/trust/nonce.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Nonce store for OTT (one-time-token) replay protection.
+ *
+ * Spec reference: Aster-trust-spec.md
+ *
+ * Tracks consumed nonces to prevent credential replay attacks.
+ * Each OTT nonce can only be used once.
+ */
+/** Nonce store interface. */
+export interface NonceStore {
+    /** Check if a nonce has been consumed. */
+    has(nonce: string): boolean;
+    /** Mark a nonce as consumed. */
+    consume(nonce: string): void;
+    /** Number of consumed nonces. */
+    readonly size: number;
+}
+/**
+ * In-memory nonce store with optional TTL expiry.
+ *
+ * Nonces are stored in a Map with their consumption timestamp.
+ * Expired nonces are cleaned up periodically to prevent unbounded growth.
+ */
+export declare class InMemoryNonceStore implements NonceStore {
+    private nonces;
+    private ttlMs;
+    /**
+     * @param ttlMs - How long to remember consumed nonces (default: 24 hours).
+     *   After this time, a nonce could theoretically be replayed, but the
+     *   credential itself should have expired by then.
+     */
+    constructor(ttlMs?: number);
+    has(nonce: string): boolean;
+    consume(nonce: string): void;
+    get size(): number;
+    /** Remove expired nonces. */
+    private cleanup;
+}
+//# sourceMappingURL=nonce.d.ts.map

package/dist/trust/nonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.d.ts","sourceRoot":"","sources":["../../src/trust/nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,6BAA6B;AAC7B,MAAM,WAAW,UAAU;IACzB,0CAA0C;IAC1C,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAC5B,gCAAgC;IAChC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,YAAW,UAAU;IACnD,OAAO,CAAC,MAAM,CAA6B;IAC3C,OAAO,CAAC,KAAK,CAAS;IAEtB;;;;OAIG;gBACS,KAAK,SAAsB;IAIvC,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAK3B,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAI5B,IAAI,IAAI,IAAI,MAAM,CAGjB;IAED,6BAA6B;IAC7B,OAAO,CAAC,OAAO;CAMhB"}

package/dist/trust/nonce.js

@@ -0,0 +1,46 @@
+/**
+ * Nonce store for OTT (one-time-token) replay protection.
+ *
+ * Spec reference: Aster-trust-spec.md
+ *
+ * Tracks consumed nonces to prevent credential replay attacks.
+ * Each OTT nonce can only be used once.
+ */
+/**
+ * In-memory nonce store with optional TTL expiry.
+ *
+ * Nonces are stored in a Map with their consumption timestamp.
+ * Expired nonces are cleaned up periodically to prevent unbounded growth.
+ */
+export class InMemoryNonceStore {
+    nonces = new Map(); // nonce -> consumed_epoch_ms
+    ttlMs;
+    /**
+     * @param ttlMs - How long to remember consumed nonces (default: 24 hours).
+     *   After this time, a nonce could theoretically be replayed, but the
+     *   credential itself should have expired by then.
+     */
+    constructor(ttlMs = 24 * 60 * 60 * 1000) {
+        this.ttlMs = ttlMs;
+    }
+    has(nonce) {
+        this.cleanup();
+        return this.nonces.has(nonce);
+    }
+    consume(nonce) {
+        this.nonces.set(nonce, Date.now());
+    }
+    get size() {
+        this.cleanup();
+        return this.nonces.size;
+    }
+    /** Remove expired nonces. */
+    cleanup() {
+        const cutoff = Date.now() - this.ttlMs;
+        for (const [nonce, ts] of this.nonces) {
+            if (ts < cutoff)
+                this.nonces.delete(nonce);
+        }
+    }
+}
+//# sourceMappingURL=nonce.js.map

package/dist/trust/nonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce.js","sourceRoot":"","sources":["../../src/trust/nonce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAYH;;;;;GAKG;AACH,MAAM,OAAO,kBAAkB;IACrB,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC,CAAC,6BAA6B;IACjE,KAAK,CAAS;IAEtB;;;;OAIG;IACH,YAAY,KAAK,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;QACrC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,KAAa;QACf,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,OAAO,CAAC,KAAa;QACnB,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,IAAI;QACN,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;IAC1B,CAAC;IAED,6BAA6B;IACrB,OAAO;QACb,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC;QACvC,KAAK,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,EAAE,GAAG,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;CACF"}

package/dist/trust/producer.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Producer admission — the server-side admission handshake.
+ *
+ * Spec reference: Aster-trust-spec.md S6
+ *
+ * When a producer wants to join a mesh, the accepting producer:
+ * 1. Accepts a connection on the producer admission ALPN
+ * 2. Reads an AdmissionRequest (credential JSON + optional IID token)
+ * 3. Validates the credential (signature, expiry, root pubkey)
+ * 4. Responds with AdmissionResponse (accepted/rejected + mesh state)
+ */
+import type { MeshState } from './mesh.js';
+import type { NonceStore } from './nonce.js';
+/** ALPN for producer admission. */
+export declare const PRODUCER_ADMISSION_ALPN: Uint8Array<ArrayBuffer>;
+/** Producer admission request (inbound). */
+export interface ProducerAdmissionRequest {
+    credentialJson: string;
+    iidToken?: string;
+}
+/** Producer admission response (outbound). */
+export interface ProducerAdmissionResponse {
+    accepted: boolean;
+    salt: string;
+    acceptedProducers: string[];
+    /** Reason is for internal logging only — never leaked to peer. */
+    reason?: string;
+}
+/** Options for the producer admission server. */
+export interface ProducerAdmissionOptions {
+    /** The mesh's trusted root public key (hex). */
+    rootPubkey: string;
+    /** Current mesh state (mutated on successful admission). */
+    meshState: MeshState;
+    /** Optional nonce store for OTT replay protection. */
+    nonceStore?: NonceStore;
+    /** Logger. */
+    logger?: {
+        info(...args: any[]): void;
+        warn(...args: any[]): void;
+        error(...args: any[]): void;
+    };
+}
+/** QUIC connection interface for admission. */
+interface AdmissionConnection {
+    acceptBi(): Promise<{
+        takeSend(): AdmissionSend;
+        takeRecv(): AdmissionRecv;
+    }>;
+    remoteNodeId(): string;
+}
+interface AdmissionSend {
+    writeAll(data: Uint8Array): Promise<void>;
+    finish(): Promise<void>;
+}
+interface AdmissionRecv {
+    readToEnd(maxLen: number): Promise<Uint8Array>;
+}
+/** Node interface for accepting admission connections. */
+interface AdmissionNode {
+    acceptAster(): Promise<AdmissionConnection>;
+}
+/**
+ * Handle a single producer admission connection.
+ *
+ * Reads the credential, validates it, updates mesh state on success,
+ * and responds with the admission result.
+ */
+export declare function handleProducerAdmission(conn: AdmissionConnection, opts: ProducerAdmissionOptions): Promise<ProducerAdmissionResponse>;
+/**
+ * Serve producer admission — accept loop that handles incoming
+ * producer admission connections until stopped.
+ */
+export declare function serveProducerAdmission(node: AdmissionNode, opts: ProducerAdmissionOptions & {
+    running?: {
+        value: boolean;
+    };
+}): Promise<void>;
+export {};
+//# sourceMappingURL=producer.d.ts.map

package/dist/trust/producer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"producer.d.ts","sourceRoot":"","sources":["../../src/trust/producer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,mCAAmC;AACnC,eAAO,MAAM,uBAAuB,yBAAuD,CAAC;AAE5F,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8CAA8C;AAC9C,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,kEAAkE;IAClE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,iDAAiD;AACjD,MAAM,WAAW,wBAAwB;IACvC,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,SAAS,EAAE,SAAS,CAAC;IACrB,sDAAsD;IACtD,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,cAAc;IACd,MAAM,CAAC,EAAE;QAAE,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,IAAI,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CAClG;AAED,+CAA+C;AAC/C,UAAU,mBAAmB;IAC3B,QAAQ,IAAI,OAAO,CAAC;QAAE,QAAQ,IAAI,aAAa,CAAC;QAAC,QAAQ,IAAI,aAAa,CAAA;KAAE,CAAC,CAAC;IAC9E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,UAAU,aAAa;IACrB,QAAQ,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,UAAU,aAAa;IACrB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,0DAA0D;AAC1D,UAAU,aAAa;IACrB,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,mBAAmB,EACzB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC,CA+FpC;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,wBAAwB,GAAG;IAAE,OAAO,CAAC,EAAE;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAChE,OAAO,CAAC,IAAI,CAAC,CAef"}