@macula-io/ts 0.28.0 → 0.30.0

package/README.md

@@ -25,10 +25,9 @@
 > P-384, which meets CNSA 2.0 and BSI TR-02102; signed requests), over macula-go's
 > pool. Calls and streams by direct dial, serving (under an org or in a node's
 > own namespace), publish/subscribe, the DHT and node-served content are
-> tested against in-process macula 12 stations on every `npm test`.
-> UCAN-gated calls are not here yet; see [Not yet
-> implemented](#not-yet-implemented). Releases before 0.18.0 speak the retired
-> 10.x wire and cannot reach the current fleet.
+> tested against in-process macula 12 stations on every `npm test`, as are
+> UCAN-gated calls, streams and serving. Releases before 0.18.0 speak the
+> retired 10.x wire and cannot reach the current fleet.
 
 ## What is this?
 
@@ -174,18 +173,13 @@ call and session to JavaScript through a `ThreadSafeFunction`.
 | A node's own namespace (`ownProcedure`) | ✅ | ✅ | `~<node_id>/<name>`: served and called with no org and no realm key; the node's signature authorizes it |
 | Streams (`openStream`, `serveStream`) | ✅ | ✅ | Server, client and bidi; a QUIC stream per session, released on every path |
 | Sealed calls and streams (`confidential`, `kemAdvertise`) | ✅ | ✅ | macula 13's E2E seal scheme 1 through macula-go v0.18.0: a call or stream is sealed to the provider's advertised KEM key whenever its advertisement names one (`"preferred"`, the default), `"required"` never calls a provider that names none, and what could not be kept confidential is a `ConfidentialityError` with its `reason`. A provider names its key only with `kemAdvertise: 1` (off by default: turn it on once every station runs macula 12.11 or later and its callers run macula 13, macula-go 0.18 or this release); it serves `"preferred"` (with `kemAdvertise`, clear calls are taken only while its last keyless advertisement could still be served, then refused `sealed_required`), `"required"` or `"off"`, and each request says `sealed: 0 \| 1`. A provider that cannot open a sealed call twice answers a `ProviderError` of code `sealed_refused`, its `detail` the key id it holds now (hex, or empty when it holds none). `Pool.callReport` (a call's result with its seal report) and `Stream.report()` tell a caller afterwards whether the exchange went sealed, to which provider and key (`sealed: 0 \| 1`, `provider`, `sealKeyId`; macula-go v0.19.0). The report says sealing ran on that exchange, nothing more |
+| UCANs (`NodeKey.ucan`, `Ucan`, `ucan`/`proofs`, `policy`) | ✅ | ✅ | macula 12's D7 through macula-go v0.17.0's C ABI: `NodeKey.ucan(audience, caps, expS, {prf})` mints a token for the node that presents it (`caps` a list of `{with, can}`, each `with` an MRI), and `Ucan.proofId` names a delegated token's parent. `call`, `callReport` and `openStream` present `ucan` with `proofs`, its chain's parents; an empty token, or proofs without one, is refused before anything is sent. `serve` and `serveStream` take `policy`: `Ucan.ucanRequired(issuer)` (a chain rooted at that node's identity key) or `Ucan.realmMemberRequired(keyId, can)` (rooted at that realm key, granting that can). libmacula checks each call and open before it reaches the handler: a refused call is a `ProviderError`, a refused open a `StreamError`, of code `unauthorized` (`malformed_frame` for a proof no token names). Tested against in-process stations: no token, a token for another node and one from another root refused; a direct grant and a one-level delegation served. Since 0.30.0 (macula-go v0.26.0) an issuer did:key over 4,400 characters is refused at once, before it is decoded (macula#87), and an `exp` more than ten years out authorizes nothing (macula#68) |
 | Publish/subscribe | ✅ | ✅ | Signed publications, delivered once across links |
 | DHT (`findRecord`, `findRecords`, `findRecordsByType`, `putRecord`) | ✅ | — | Records verified before they are handed on |
 | Realm proof v2 (`NodeKey.deviceRequestProof`) | ✅ | — | macula-realm#29: a join session over HTTP (`"http"`, the realm's JSON rule) or a membership UCAN over the mesh (`"mesh"`), with its device_info and ttl_seconds, the realm and the procedure signed, and a nonce; the realm's own vector reproduced through macula-go's encoder |
 | Ownership proof v2 (`NodeKey.ownershipProof`) | ✅ | — | mcl-om#7: the payload's `asserted_by`, binding every field a handler reads, the procedure, the realm, a timestamp and a nonce; a payload carrying `caller` is refused; mcl_om's own vector reproduced, and a payload signed here and delivered through a station accepted by mcl_om 0.32.0's `verify_asserted_by` |
 | Node-served content (`shareContent`, `unshareContent`, `getContent`) | ✅ | ✅ | macula 12.6.0 (D27): shared on the node's own `~<node_id>/content_v1` and announced; a fetch checks the block, the manifest and every chunk against the content id, bounded, with no realm key; `NotSharedError` / `ContentUnavailableError` |
 
-## Not yet implemented
-
-- **UCAN-gated calls and serving.** macula 12 uses post-quantum UCANs
-  (macula-go#2). Calls carry no token yet, and a gated procedure cannot be
-  served.
-
 ## Testing
 
 ```bash

package/dist/binding.d.ts

@@ -23,6 +23,8 @@ interface Native {
     deviceRequestMessage(publicKey: Uint8Array, realm: Uint8Array, procedure: string, timestampMs: number, nonce: Uint8Array, requestJson: string, rule: number): Uint8Array;
     keyOwnershipProof(key: Handle, realm: Uint8Array, procedure: string, payloadJson: string): Promise<string>;
     ownershipProofMessage(identity: Uint8Array, realm: Uint8Array, procedure: string, timestampMs: number, nonce: Uint8Array, fieldsJson: string): Uint8Array;
+    keyUcan(key: Handle, audience: Uint8Array, capsJson: string, expS: number, optionsJson: string): Promise<string>;
+    ucanProofId(token: string): string;
     keyFree(key: Handle): void;
     verify(data: Uint8Array, signature: Uint8Array, publicKey: Uint8Array, profile: string): boolean;
     signedObjectVerify(label: string, object: Uint8Array, profile: string): string;

package/dist/binding.js.map

@@ -1 +1 @@
-{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AA4ErE,8EAA8E;AAC9E,SAAS,IAAI;IACX,IAAI,CAAC;QACH,8DAA8D;QAC9D,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAW,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,4BAA4B;AAC5B,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,8DAA8D;QAC9D,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAW,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2CAA2C,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,6EAA6E,GAAG,GAAG;QACrF,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D,CAAC;AACrF,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;AAErB,yEAAyE;AACzE,SAAS,KAAK,CAA0C,EAAK;IAC3D,OAAO,CAAC,CAAC,GAAG,IAAmB,EAAE,EAAE;QACjC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7F,CAAC,CAAM,CAAC;AACV,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC"}
+{"version":3,"file":"binding.js","sourceRoot":"","sources":["../src/binding.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,4EAA4E;AAC5E,sEAAsE;AACtE,4EAA4E;AAC5E,2EAA2E;AAC3E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,6EAA6E;AAC7E,0EAA0E;AAC1E,yBAAyB;AACzB,EAAE;AACF,4EAA4E;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAExC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AA8ErE,8EAA8E;AAC9E,SAAS,IAAI;IACX,IAAI,CAAC;QACH,8DAA8D;QAC9D,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC,QAAQ,CAAW,CAAC;IACvD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,+CAA+C,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,IAAI,KAAK,GAAG,IAAI,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9H,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,4EAA4E;AAC5E,4BAA4B;AAC5B,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,EAAE,CAAC;IAC5C,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,8DAA8D;QAC9D,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAW,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,2CAA2C,CAAC;IACrD,CAAC;IACD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9E,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC;QACtB,CAAC,CAAC,6EAA6E,GAAG,GAAG;QACrF,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,2DAA2D,CAAC;AACrF,CAAC;AAED,MAAM,KAAK,GAAG,IAAI,EAAE,CAAC;AAErB,yEAAyE;AACzE,SAAS,KAAK,CAA0C,EAAK;IAC3D,OAAO,CAAC,CAAC,GAAG,IAAmB,EAAE,EAAE;QACjC,IAAI,GAAY,CAAC;QACjB,IAAI,CAAC;YACH,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;QACpB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,YAAY,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,GAAG,MAAM,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7F,CAAC,CAAM,CAAC;AACV,CAAC;AAED,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CACtC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC"}

package/dist/index.d.ts

@@ -3,4 +3,5 @@ export { Pool, Subscription, Served, RecordType, type Seed, type PoolOptions, ty
 export { NotSharedError, ContentUnavailableError, DEFAULT_CONTENT_TIMEOUT_MS, type ContentOptions, type Mcid, } from "./content.js";
 export { Stream, StreamMode, type StreamEvent, type StreamRequest } from "./stream.js";
 export { verifySignedObject, type VerifiedObject } from "./signed_object.js";
+export { Ucan, type Capability, type ServePolicy } from "./ucan.js";
 export { ProviderError, RelayError, StreamError, MaculaError, ConfidentialityError, UnverifiedError, DEFAULT_CALL_TIMEOUT_MS, type Confidential, type ServedConfidential, type SealReport, type JsonValue, type BytesOutput, type Id, } from "./wire.js";

package/dist/index.js

@@ -4,5 +4,6 @@ export { Pool, Subscription, Served, RecordType, } from "./pool.js";
 export { NotSharedError, ContentUnavailableError, DEFAULT_CONTENT_TIMEOUT_MS, } from "./content.js";
 export { Stream, StreamMode } from "./stream.js";
 export { verifySignedObject } from "./signed_object.js";
+export { Ucan } from "./ucan.js";
 export { ProviderError, RelayError, StreamError, MaculaError, ConfidentialityError, UnverifiedError, DEFAULT_CALL_TIMEOUT_MS, } from "./wire.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,yBAAyB,GAM1B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,UAAU,GAQX,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,0BAA0B,GAG3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAwC,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAuB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,uBAAuB,GAOxB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,OAAO,EACL,OAAO,EACP,sBAAsB,EACtB,yBAAyB,GAM1B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,IAAI,EACJ,YAAY,EACZ,MAAM,EACN,UAAU,GAQX,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,cAAc,EACd,uBAAuB,EACvB,0BAA0B,GAG3B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,UAAU,EAAwC,MAAM,aAAa,CAAC;AACvF,OAAO,EAAE,kBAAkB,EAAuB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAqC,MAAM,WAAW,CAAC;AACpE,OAAO,EACL,aAAa,EACb,UAAU,EACV,WAAW,EACX,WAAW,EACX,oBAAoB,EACpB,eAAe,EACf,uBAAuB,GAOxB,MAAM,WAAW,CAAC"}

package/dist/key.d.ts

@@ -1,5 +1,6 @@
 import { type Handle } from "./binding.js";
 import { type Id, type JsonValue } from "./wire.js";
+import type { Capability } from "./ucan.js";
 /** A crypto profile: "pq_hybrid" (the fleet's) or "pq_pure". */
 export type Profile = "pq_hybrid" | "pq_pure";
 /**
@@ -93,6 +94,16 @@ export declare class NodeKey {
     ownershipProof(realm: Id, procedure: string, payload: {
         [field: string]: JsonValue;
     }): Promise<OwnershipProven>;
+    /** A UCAN this key grants the node audience (macula's D7): caps until expS
+     * (Unix seconds). A token is minted for the node that presents it. `prf`
+     * names a delegated token's parent by Ucan.proofId (at most one); `nbf`,
+     * `nnc` and `fct` are the token's own fields. */
+    ucan(audience: Id, caps: readonly Capability[], expS: number, options?: {
+        nbf?: number;
+        nnc?: string;
+        fct?: JsonValue;
+        prf?: readonly string[];
+    }): Promise<string>;
     /** The exact bytes an ownership proof v2 signs for identity (a node_id), at
      * timestampMs with a 16-byte nonce, over payload's fields: all of it but
      * "asserted_by" and a text "caller", as a verifier reads a delivered

package/dist/key.js

@@ -95,6 +95,28 @@ export class NodeKey {
         const signed = await native.keyOwnershipProof(this.live(), id32(realm, "realm"), procedure, JSON.stringify(payload));
         return JSON.parse(signed);
     }
+    /** A UCAN this key grants the node audience (macula's D7): caps until expS
+     * (Unix seconds). A token is minted for the node that presents it. `prf`
+     * names a delegated token's parent by Ucan.proofId (at most one); `nbf`,
+     * `nnc` and `fct` are the token's own fields. */
+    async ucan(audience, caps, expS, options = {}) {
+        if (!Number.isSafeInteger(expS))
+            throw new TypeError("@macula-io/ts: a UCAN's expiry is whole Unix seconds");
+        const o = {};
+        if (options.nbf !== undefined) {
+            // NaN and Infinity would go out as null, which mints no not-before at all.
+            if (!Number.isSafeInteger(options.nbf))
+                throw new TypeError("@macula-io/ts: a UCAN's nbf is whole Unix seconds");
+            o.nbf = options.nbf;
+        }
+        if (options.nnc !== undefined)
+            o.nnc = options.nnc;
+        if (options.fct !== undefined)
+            o.fct = options.fct;
+        if (options.prf !== undefined && options.prf.length > 0)
+            o.prf = options.prf;
+        return native.keyUcan(this.live(), id32(audience, "audience"), JSON.stringify(caps), expS, Object.keys(o).length === 0 ? "" : JSON.stringify(o));
+    }
     /** The exact bytes an ownership proof v2 signs for identity (a node_id), at
      * timestampMs with a 16-byte nonce, over payload's fields: all of it but
      * "asserted_by" and a text "caller", as a verifier reads a delivered

package/dist/key.js.map

@@ -1 +1 @@
-{"version":3,"file":"key.js","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,cAAc;AACd,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,IAAI,EAA2B,MAAM,WAAW,CAAC;AAa/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAoBxE,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAU,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElF,MAAM,OAAO,OAAO;IACU,MAAM;IAAlC,YAA4B,MAAqB;sBAArB,MAAM;IAAkB,CAAC;IAErD;iCAC6B;IAC7B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAY,WAAW;QAClD,OAAO,IAAI,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;0DACsD;IACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAO,GAAY,WAAW;QAC5D,OAAO,IAAI,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,OAAO,GAAY,WAAW;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,iCAAiC;IACjC,MAAM;QACJ,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,SAAS;QACP,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,6CAA6C;IAC7C,SAAS;QACP,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,yBAAyB;IACzB,OAAO;QACL,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAY,CAAC;IACnD,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAuC,EAC5F,IAAuB;QACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACpH,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;IACjD,CAAC;IAED;4DACwD;IACxD,MAAM,CAAC,oBAAoB,CAAC,SAAqB,EAAE,KAAS,EAAE,SAAiB,EAAE,WAAmB,EAAE,KAAiB,EACrH,OAAuC,EAAE,IAAuB;QAChE,OAAO,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAC/F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,cAAc,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAuC;QACxF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAoB,CAAC;IAC/C,CAAC;IAED;;;2DAGuD;IACvD,MAAM,CAAC,qBAAqB,CAAC,QAAY,EAAE,KAAS,EAAE,SAAiB,EAAE,WAAmB,EAAE,KAAiB,EAC7G,OAAuC;QACvC,OAAO,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EACjH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED;;;4DAGwD;IACxD,MAAM,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAqB,EAAE,SAAqB,EAAE,OAAO,GAAY,WAAW;QAC1G,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,gBAAgB;IAChB,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../src/key.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,6EAA6E;AAC7E,4EAA4E;AAC5E,cAAc;AACd,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAe,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,GAAG,EAAE,IAAI,EAA2B,MAAM,WAAW,CAAC;AAc/D,4DAA4D;AAC5D,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAClE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAC;AAoBxE,MAAM,UAAU,GAAG,CAAC,IAAuB,EAAU,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElF,MAAM,OAAO,OAAO;IACU,MAAM;IAAlC,YAA4B,MAAqB;sBAArB,MAAM;IAAkB,CAAC;IAErD;iCAC6B;IAC7B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,GAAY,WAAW;QAClD,OAAO,IAAI,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC;IAED;0DACsD;IACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAY,EAAE,OAAO,GAAY,WAAW;QAC5D,OAAO,IAAI,OAAO,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAY,EAAE,OAAO,GAAY,WAAW;QACpE,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC5C,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACrB,OAAO,GAAG,CAAC;QACb,CAAC;QACD,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,IAAI,CAAC,IAAY;QACrB,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC1C,CAAC;IAED,iCAAiC;IACjC,MAAM;QACJ,OAAO,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IAED,oCAAoC;IACpC,SAAS;QACP,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,6CAA6C;IAC7C,SAAS;QACP,OAAO,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,yBAAyB;IACzB,OAAO;QACL,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAY,CAAC;IACnD,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,IAAI,CAAC,IAAgB;QACzB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,kBAAkB,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAuC,EAC5F,IAAuB;QACvB,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACpH,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAuB,CAAC;IACjD,CAAC;IAED;4DACwD;IACxD,MAAM,CAAC,oBAAoB,CAAC,SAAqB,EAAE,KAAS,EAAE,SAAiB,EAAE,WAAmB,EAAE,KAAiB,EACrH,OAAuC,EAAE,IAAuB;QAChE,OAAO,MAAM,CAAC,oBAAoB,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EAC/F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,cAAc,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAuC;QACxF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAoB,CAAC;IAC/C,CAAC;IAED;;;qDAGiD;IACjD,KAAK,CAAC,IAAI,CAAC,QAAY,EAAE,IAA2B,EAAE,IAAY,EAChE,OAAO,GAA6E,EAAE;QACtF,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;QAC7G,MAAM,CAAC,GAA6E,EAAE,CAAC;QACvF,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,2EAA2E;YAC3E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;YACjH,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACtB,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC;YAAE,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QAC7E,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EACvF,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED;;;2DAGuD;IACvD,MAAM,CAAC,qBAAqB,CAAC,QAAY,EAAE,KAAS,EAAE,SAAiB,EAAE,WAAmB,EAAE,KAAiB,EAC7G,OAAuC;QACvC,OAAO,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,KAAK,EACjH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED;;;4DAGwD;IACxD,MAAM,CAAC,MAAM,CAAC,IAAgB,EAAE,SAAqB,EAAE,SAAqB,EAAE,OAAO,GAAY,WAAW;QAC1G,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED,2DAA2D;IAC3D,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;IACrB,CAAC;IAED,gBAAgB;IAChB,IAAI;QACF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC/E,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF"}

package/dist/pool.d.ts

@@ -1,6 +1,7 @@
 import { type Handle } from "./binding.js";
 import { NodeKey } from "./key.js";
 import { Stream, StreamMode, type StreamRequest } from "./stream.js";
+import type { ServePolicy } from "./ucan.js";
 import { type ContentOptions, type Mcid } from "./content.js";
 import { type Confidential, type SealReport, type ServedConfidential, type BytesOutput, type Id, type JsonValue } from "./wire.js";
 /** A station to link to, pinned by the node_id it must prove. */
@@ -129,10 +130,15 @@ export declare class Pool {
      * (`confidential` "preferred", the default); "required" never calls a
      * provider that names none. A provider's ERROR is thrown as a
      * ProviderError, a station's relay error as a RelayError, a call that
-     * could not be kept confidential as a ConfidentialityError. */
+     * could not be kept confidential as a ConfidentialityError. `ucan` presents
+     * a token minted for this node to a gated procedure, with `proofs`, its
+     * chain's parents; a gated provider that refuses it answers a ProviderError
+     * of code "unauthorized". An open procedure ignores any token. */
     call(realm: Id, procedure: string, payload?: JsonValue, options?: {
         provider?: Id;
         confidential?: Confidential;
+        ucan?: string;
+        proofs?: readonly string[];
         timeoutMs?: number;
         bytes?: BytesOutput;
     }): Promise<JsonValue>;
@@ -143,6 +149,8 @@ export declare class Pool {
     callReport(realm: Id, procedure: string, payload?: JsonValue, options?: {
         provider?: Id;
         confidential?: Confidential;
+        ucan?: string;
+        proofs?: readonly string[];
         timeoutMs?: number;
         bytes?: BytesOutput;
     }): Promise<{
@@ -175,26 +183,35 @@ export declare class Pool {
      * (sealed_required), so a caller older than macula 13, macula-go 0.18 or
      * this release cannot call it after that; without kemAdvertise it names
      * no key and serves in the clear. "required" refuses every clear call
-     * (sealed_required) and needs kemAdvertise; "off" serves in the clear. */
+     * (sealed_required) and needs kemAdvertise; "off" serves in the clear.
+     * `policy` (Ucan.ucanRequired, Ucan.realmMemberRequired) serves only
+     * callers whose UCAN chain it accepts; a refused call never reaches the
+     * handler. */
     serve(realm: Id, procedure: string, handler: (request: Request) => JsonValue | Promise<JsonValue>, options?: {
         confidential?: ServedConfidential;
+        policy?: ServePolicy;
         bytes?: BytesOutput;
     }): Promise<Served>;
     /** Serves procedure in realm as a stream of mode: handler drives each
      * session. The stream is closed when the handler returns without ending
      * it, aborted with code error when it throws, and released either way.
-     * `confidential` as serve's. */
+     * `confidential` and `policy` as serve's. */
     serveStream(realm: Id, procedure: string, mode: StreamMode, handler: (stream: Stream, request: StreamRequest) => void | Promise<void>, options?: {
         confidential?: ServedConfidential;
+        policy?: ServePolicy;
         bytes?: BytesOutput;
     }): Promise<Served>;
     /** Opens a stream of mode on procedure in realm at a provider, by direct
      * dial, sealed as call is (`confidential`). A refusal arrives on its first
      * recv(); a stream that could not be kept confidential is a
-     * ConfidentialityError here. */
+     * ConfidentialityError here. `ucan` and `proofs` as call's; a gated
+     * provider's refusal arrives on the first recv() as a StreamError of code
+     * "unauthorized". */
     openStream(realm: Id, procedure: string, mode: StreamMode, payload?: JsonValue, options?: {
         provider?: Id;
         confidential?: Confidential;
+        ucan?: string;
+        proofs?: readonly string[];
         deadlineMs?: number;
         timeoutMs?: number;
         bytes?: BytesOutput;

package/dist/pool.js

@@ -10,12 +10,21 @@ import { Stream } from "./stream.js";
 import { DEFAULT_CONTENT_TIMEOUT_MS, mcid50 } from "./content.js";
 import { DEFAULT_CALL_TIMEOUT_MS, MaculaError, bytesOut, hex, sealReport, id32, } from "./wire.js";
 /** A call's or a stream's options, as macula_pool_call_opts takes them. */
-function callOptionsJson(provider, confidential, report) {
+function callOptionsJson(provider, confidential, presented, report) {
     const o = {};
     if (provider !== undefined)
         o.provider = hex(id32(provider, "provider"));
     if (confidential !== undefined)
         o.confidential = confidential;
+    if (presented.ucan === "")
+        throw new TypeError("@macula-io/ts: a UCAN is never empty; leave it out for none");
+    if (presented.ucan !== undefined)
+        o.ucan = presented.ucan;
+    if (presented.proofs !== undefined && presented.proofs.length > 0) {
+        if (presented.ucan === undefined)
+            throw new TypeError("@macula-io/ts: proofs go with the UCAN they prove");
+        o.proofs = presented.proofs;
+    }
     // Handed on as given: callReport sends 1, and openStream hands on whatever
     // it was given, so the ABI refuses a report on a stream open rather than it
     // vanishing here. call sends none.
@@ -24,8 +33,13 @@ function callOptionsJson(provider, confidential, report) {
     return JSON.stringify(o);
 }
 /** A served procedure's options, as macula_pool_serve_opts takes them. */
-function serveOptionsJson(confidential) {
-    return JSON.stringify(confidential === undefined ? {} : { confidential });
+function serveOptionsJson(confidential, policy) {
+    const o = {};
+    if (confidential !== undefined)
+        o.confidential = confidential;
+    if (policy !== undefined)
+        o.policy = policy;
+    return JSON.stringify(o);
 }
 /** macula 12's record types. */
 export var RecordType;
@@ -124,10 +138,13 @@ export class Pool {
      * (`confidential` "preferred", the default); "required" never calls a
      * provider that names none. A provider's ERROR is thrown as a
      * ProviderError, a station's relay error as a RelayError, a call that
-     * could not be kept confidential as a ConfidentialityError. */
+     * could not be kept confidential as a ConfidentialityError. `ucan` presents
+     * a token minted for this node to a gated procedure, with `proofs`, its
+     * chain's parents; a gated provider that refuses it answers a ProviderError
+     * of code "unauthorized". An open procedure ignores any token. */
     async call(realm, procedure, payload = {}, options = {}) {
         bytesOut(null, options.bytes);
-        const result = await native.poolCall(this.live(), id32(realm, "realm"), procedure, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential), options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS);
+        const result = await native.poolCall(this.live(), id32(realm, "realm"), procedure, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential, options), options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS);
         return bytesOut(JSON.parse(result), options.bytes);
     }
     /** call, with the caller's seal report: whether the exchange behind the
@@ -136,7 +153,7 @@ export class Pool {
      * sealed_refused and one reseal, the report names the reseal's key. */
     async callReport(realm, procedure, payload = {}, options = {}) {
         bytesOut(null, options.bytes);
-        const reply = JSON.parse(await native.poolCall(this.live(), id32(realm, "realm"), procedure, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential, 1), options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS));
+        const reply = JSON.parse(await native.poolCall(this.live(), id32(realm, "realm"), procedure, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential, options, 1), options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS));
         return { result: bytesOut(reply.result, options.bytes), report: sealReport(reply) };
     }
     /** The procedure's trusted providers, freshest first. */
@@ -177,10 +194,13 @@ export class Pool {
      * (sealed_required), so a caller older than macula 13, macula-go 0.18 or
      * this release cannot call it after that; without kemAdvertise it names
      * no key and serves in the clear. "required" refuses every clear call
-     * (sealed_required) and needs kemAdvertise; "off" serves in the clear. */
+     * (sealed_required) and needs kemAdvertise; "off" serves in the clear.
+     * `policy` (Ucan.ucanRequired, Ucan.realmMemberRequired) serves only
+     * callers whose UCAN chain it accepts; a refused call never reaches the
+     * handler. */
     async serve(realm, procedure, handler, options = {}) {
         bytesOut(null, options.bytes);
-        const handle = await native.poolServe(this.live(), id32(realm, "realm"), procedure, serveOptionsJson(options.confidential), (d) => {
+        const handle = await native.poolServe(this.live(), id32(realm, "realm"), procedure, serveOptionsJson(options.confidential, options.policy), (d) => {
             if (d.kind !== "request")
                 return;
             void answer(d, handler, options.bytes);
@@ -190,10 +210,10 @@ export class Pool {
     /** Serves procedure in realm as a stream of mode: handler drives each
      * session. The stream is closed when the handler returns without ending
      * it, aborted with code error when it throws, and released either way.
-     * `confidential` as serve's. */
+     * `confidential` and `policy` as serve's. */
     async serveStream(realm, procedure, mode, handler, options = {}) {
         bytesOut(null, options.bytes);
-        const handle = await native.poolServeStream(this.live(), id32(realm, "realm"), procedure, mode, serveOptionsJson(options.confidential), (d) => {
+        const handle = await native.poolServeStream(this.live(), id32(realm, "realm"), procedure, mode, serveOptionsJson(options.confidential, options.policy), (d) => {
             if (d.kind !== "request")
                 return;
             void runStream(new Stream(d.handle, options.bytes), handler);
@@ -203,10 +223,12 @@ export class Pool {
     /** Opens a stream of mode on procedure in realm at a provider, by direct
      * dial, sealed as call is (`confidential`). A refusal arrives on its first
      * recv(); a stream that could not be kept confidential is a
-     * ConfidentialityError here. */
+     * ConfidentialityError here. `ucan` and `proofs` as call's; a gated
+     * provider's refusal arrives on the first recv() as a StreamError of code
+     * "unauthorized". */
     async openStream(realm, procedure, mode, payload = {}, options = {}) {
         bytesOut(null, options.bytes);
-        const handle = await native.poolOpenStream(this.live(), id32(realm, "realm"), procedure, mode, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential, options.report), options.deadlineMs ?? 0, options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS);
+        const handle = await native.poolOpenStream(this.live(), id32(realm, "realm"), procedure, mode, JSON.stringify(payload), callOptionsJson(options.provider, options.confidential, options, options.report), options.deadlineMs ?? 0, options.timeoutMs ?? DEFAULT_CALL_TIMEOUT_MS);
         return new Stream(handle, options.bytes);
     }
     /** The verified record under key, or null when there is none. */

package/dist/pool.js.map

@@ -1 +1 @@
-{"version":3,"file":"pool.js","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,UAAU;AACV,OAAO,EAAE,MAAM,EAA8B,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,MAAM,EAAkC,MAAM,aAAa,CAAC;AACrE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAkC,MAAM,cAAc,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,GAAG,EACH,UAAU,EAIV,IAAI,GAIL,MAAM,WAAW,CAAC;AAmEnB,2EAA2E;AAC3E,SAAS,eAAe,CAAC,QAAwB,EAAE,YAAsC,EAAE,MAAgB;IACzG,MAAM,CAAC,GAAmE,EAAE,CAAC;IAC7E,IAAI,QAAQ,KAAK,SAAS;QAAE,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,SAAS;QAAE,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,2EAA2E;IAC3E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,YAA4C;IACpE,OAAO,IAAI,CAAC,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;AAC5E,CAAC;AAaD,gCAAgC;AAChC,MAAM,CAAN,IAAY,UAQX;AARD,WAAY,UAAU;IACpB,uDAAiB,CAAA;IACjB,+EAA6B,CAAA;IAC7B,sDAAgB,CAAA;IAChB,0EAA0B,CAAA;IAC1B,kEAAsB,CAAA;IACtB,4DAAmB,CAAA;IACnB,0EAA0B,CAAA;AAC5B,CAAC,EARW,UAAU,KAAV,UAAU,QAQrB;AAED,uDAAuD;AACvD,MAAM,OAAO,YAAY;IAIM,MAAM;IAAmB,MAAM;IAHpD,YAAY,GAAkB,IAAI,CAAC;IAE3C,gBAAgB;IAChB,YAA6B,MAAc,EAAW,MAA8B;sBAAvD,MAAM;sBAAmB,MAAM;IAA2B,CAAC;IAExF;;;kFAG8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO;QACvC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,wCAAwC;AACxC,MAAM,OAAO,MAAM;IAIY,MAAM;IAH3B,OAAO,GAAG,KAAK,CAAC;IAExB,gBAAgB;IAChB,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,6CAA6C;IAC7C,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,IAAI;IAGsB,MAAM;IAFnC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAqC,MAAc;sBAAd,MAAM;IAAW,CAAC;IAEvD,4EAA4E;IAC5E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,KAAsB,EAAE,OAAO,GAAgB,EAAE;QAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrH,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,UAAU;YACvB,kBAAkB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC;YAClD,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC7C,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC7C,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACzC,CAAC;QACF,OAAO,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,qCAAqC;IACrC,MAAM;QACJ,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;4EAEwE;IACxE,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,MAAM;QACJ,mCAAmC;QACnC,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;mEAM+D;IAC/D,KAAK,CAAC,IAAI,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAAc,EAAE,EAC9D,OAAO,GAA4F,EAAE;QAErG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACxG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;QACzG,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;2EAGuE;IACvE,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAAc,EAAE,EACpE,OAAO,GAA4F,EAAE;QAErG,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAClH,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,CAAC;QAC7G,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,SAAS,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAA2B,EAAE;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EACvF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED;yBACqB;IACrB,KAAK,CAAC,OAAO,CAAC,KAAS,EAAE,KAAa,EAAE,OAAkB,EAAE,OAAO,GAAuB,EAAE;QAC1F,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAClH,CAAC;IAED;;iCAE6B;IAC7B,KAAK,CAAC,SAAS,CAAC,KAAS,EAAE,KAAa,EAAE,OAA+B,EACvE,OAAO,GAA4B,EAAE;QACrC,IAAI,MAAM,GAAiC,GAAG,EAAE,GAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAChF,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY;gBACvG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;8EAW0E;IAC1E,KAAK,CAAC,KAAK,CAAC,KAAS,EAAE,SAAiB,EAAE,OAA6D,EACrG,OAAO,GAA+D,EAAE;QACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAChF,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EACtC,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;oCAGgC;IAChC,KAAK,CAAC,WAAW,CAAC,KAAS,EAAE,SAAiB,EAAE,IAAgB,EAC9D,OAAyE,EACzE,OAAO,GAA+D,EAAE;QACxE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAC5F,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EACtC,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;oCAGgC;IAChC,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,SAAiB,EAAE,IAAgB,EAAE,OAAO,GAAc,EAAE,EACtF,OAAO,GAAiH,EAAE;QAE1H,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAC3F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAG,OAAgC,CAAC,MAAM,CAAC,EAC1H,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;QACzE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,UAAU,CAAC,GAAO,EAAE,OAAO,GAAgD,EAAE;QACjF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAClF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,WAAW,CAAC,GAAO,EAAE,OAAO,GAAgD,EAAE;QAElF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EACpF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;iBACa;IACb,KAAK,CAAC,iBAAiB,CAAC,IAAyB,EAAE,OAAO,GAAgD,EAAE;QAE1G,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAC9E,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;;;8EAI0E;IAC1E,KAAK,CAAC,YAAY,CAAC,KAAS,EAAE,IAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,GAA2B,EAAE;QAC7F,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EACpF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,cAAc,CAAC,KAAS,EAAE,IAAU,EAAE,OAAO,GAA2B,EAAE;QAC9E,MAAM,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;IACjI,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,IAAU,EAAE,OAAO,GAAmB,EAAE;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC1D,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACzD,IAAI,OAAO,CAAC,cAAc;YAAE,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7E,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EACzE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAC;IACrH,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,SAAS,CAAC,IAAgB,EAAE,OAAO,GAA2B,EAAE;QACpE,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;IAC9F,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,4EAA4E;AAC5E,KAAK,UAAU,MAAM,CAAC,CAAW,EAAE,OAA6D,EAC9F,KAA8B;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;QACjF,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAyE;IAEhH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,iBAAiB;AACjB,SAAS,QAAQ,CAAC,CAAM,EAAE,KAA8B;IACtD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU;QACtF,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ,EAAE,KAA8B;IACzD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;AACzG,CAAC"}
+{"version":3,"file":"pool.js","sourceRoot":"","sources":["../src/pool.ts"],"names":[],"mappings":"AAAA,4EAA4E;AAC5E,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,4EAA4E;AAC5E,0EAA0E;AAC1E,UAAU;AACV,OAAO,EAAE,MAAM,EAA8B,MAAM,cAAc,CAAC;AAElE,OAAO,EAAE,MAAM,EAAkC,MAAM,aAAa,CAAC;AAErE,OAAO,EAAE,0BAA0B,EAAE,MAAM,EAAkC,MAAM,cAAc,CAAC;AAClG,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,QAAQ,EACR,GAAG,EACH,UAAU,EAIV,IAAI,GAIL,MAAM,WAAW,CAAC;AA0EnB,2EAA2E;AAC3E,SAAS,eAAe,CAAC,QAAwB,EAAE,YAAsC,EAAE,SAAoB,EAC7G,MAAgB;IAChB,MAAM,CAAC,GAA8G,EAAE,CAAC;IACxH,IAAI,QAAQ,KAAK,SAAS;QAAE,CAAC,CAAC,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC;IACzE,IAAI,YAAY,KAAK,SAAS;QAAE,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,IAAI,SAAS,CAAC,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IAC9G,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;QAAE,CAAC,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IAC1D,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,IAAI,SAAS,CAAC,mDAAmD,CAAC,CAAC;QAC3G,CAAC,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,2EAA2E;IAC3E,4EAA4E;IAC5E,mCAAmC;IACnC,IAAI,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,0EAA0E;AAC1E,SAAS,gBAAgB,CAAC,YAA4C,EAAE,MAA+B;IACrG,MAAM,CAAC,GAAgE,EAAE,CAAC;IAC1E,IAAI,YAAY,KAAK,SAAS;QAAE,CAAC,CAAC,YAAY,GAAG,YAAY,CAAC;IAC9D,IAAI,MAAM,KAAK,SAAS;QAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC;AAaD,gCAAgC;AAChC,MAAM,CAAN,IAAY,UAQX;AARD,WAAY,UAAU;IACpB,uDAAiB,CAAA;IACjB,+EAA6B,CAAA;IAC7B,sDAAgB,CAAA;IAChB,0EAA0B,CAAA;IAC1B,kEAAsB,CAAA;IACtB,4DAAmB,CAAA;IACnB,0EAA0B,CAAA;AAC5B,CAAC,EARW,UAAU,KAAV,UAAU,QAQrB;AAED,uDAAuD;AACvD,MAAM,OAAO,YAAY;IAIM,MAAM;IAAmB,MAAM;IAHpD,YAAY,GAAkB,IAAI,CAAC;IAE3C,gBAAgB;IAChB,YAA6B,MAAc,EAAW,MAA8B;sBAAvD,MAAM;sBAAmB,MAAM;IAA2B,CAAC;IAExF;;;kFAG8E;IAC9E,OAAO;QACL,OAAO,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,CAAC;IAED,2CAA2C;IAC3C,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;YAAE,OAAO;QACvC,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;CACF;AAED,wCAAwC;AACxC,MAAM,OAAO,MAAM;IAIY,MAAM;IAH3B,OAAO,GAAG,KAAK,CAAC;IAExB,gBAAgB;IAChB,YAA6B,MAAc;sBAAd,MAAM;IAAW,CAAC;IAE/C,6CAA6C;IAC7C,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;CACF;AAED,MAAM,OAAO,IAAI;IAGsB,MAAM;IAFnC,MAAM,GAAG,KAAK,CAAC;IAEvB,YAAqC,MAAc;sBAAd,MAAM;IAAW,CAAC;IAEvD,4EAA4E;IAC5E,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAY,EAAE,KAAsB,EAAE,OAAO,GAAgB,EAAE;QAClF,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACrH,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;YACzC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAChG,CAAC;QACD,MAAM,IAAI,GAAG;YACX,WAAW,EAAE,UAAU;YACvB,kBAAkB,EAAE,OAAO,CAAC,iBAAiB,IAAI,CAAC;YAClD,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC7C,gBAAgB,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC;YAC7C,UAAU,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC;YAClC,aAAa,EAAE,OAAO,CAAC,YAAY,IAAI,CAAC;SACzC,CAAC;QACF,OAAO,IAAI,IAAI,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxG,CAAC;IAED,qCAAqC;IACrC,MAAM;QACJ,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED;;4EAEwE;IACxE,YAAY,CAAC,IAAY;QACvB,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,MAAM;QACJ,mCAAmC;QACnC,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC;IAED;;;;;;;;;sEASkE;IAClE,KAAK,CAAC,IAAI,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAAc,EAAE,EAC9D,OAAO,GACmB,EAAE;QAE5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACxG,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;QAClH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;;2EAGuE;IACvE,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAAc,EAAE,EACpE,OAAO,GACmB,EAAE;QAE5B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAClH,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,CAAC;QACtH,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,yDAAyD;IACzD,KAAK,CAAC,SAAS,CAAC,KAAS,EAAE,SAAiB,EAAE,OAAO,GAA2B,EAAE;QAChF,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EACvF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,CAAC;IAED;yBACqB;IACrB,KAAK,CAAC,OAAO,CAAC,KAAS,EAAE,KAAa,EAAE,OAAkB,EAAE,OAAO,GAAuB,EAAE;QAC1F,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IAClH,CAAC;IAED;;iCAE6B;IAC7B,KAAK,CAAC,SAAS,CAAC,KAAS,EAAE,KAAa,EAAE,OAA+B,EACvE,OAAO,GAA4B,EAAE;QACrC,IAAI,MAAM,GAAiC,GAAG,EAAE,GAAE,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;QAC3E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EAChF,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxB,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7B,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY;gBACvG,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;;;kBAcc;IACd,KAAK,CAAC,KAAK,CAAC,KAAS,EAAE,SAAiB,EAAE,OAA6D,EACrG,OAAO,GAAqF,EAAE;QAC9F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAChF,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EACtD,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;iDAG6C;IAC7C,KAAK,CAAC,WAAW,CAAC,KAAS,EAAE,SAAiB,EAAE,IAAgB,EAC9D,OAAyE,EACzE,OAAO,GAAqF,EAAE;QAC9F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAC5F,gBAAgB,CAAC,OAAO,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EACtD,CAAC,CAAW,EAAE,EAAE;YACd,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO;YACjC,KAAK,SAAS,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACL,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;yBAKqB;IACrB,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,SAAiB,EAAE,IAAgB,EAAE,OAAO,GAAc,EAAE,EACtF,OAAO,GACuC,EAAE;QAEhD,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAC3F,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,OAAO,EACrF,OAAgC,CAAC,MAAM,CAAC,EAC3C,OAAO,CAAC,UAAU,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;QACzE,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,UAAU,CAAC,GAAO,EAAE,OAAO,GAAgD,EAAE;QACjF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAClF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,WAAW;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC;IAED,oEAAoE;IACpE,KAAK,CAAC,WAAW,CAAC,GAAO,EAAE,OAAO,GAAgD,EAAE;QAElF,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EACpF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;iBACa;IACb,KAAK,CAAC,iBAAiB,CAAC,IAAyB,EAAE,OAAO,GAAgD,EAAE;QAE1G,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAC9E,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,CAAC;IAED;;;;8EAI0E;IAC1E,KAAK,CAAC,YAAY,CAAC,KAAS,EAAE,IAAgB,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,GAA2B,EAAE;QAC7F,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EACpF,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,kEAAkE;IAClE,KAAK,CAAC,cAAc,CAAC,KAAS,EAAE,IAAU,EAAE,OAAO,GAA2B,EAAE;QAC9E,MAAM,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;IACjI,CAAC;IAED;;;kCAG8B;IAC9B,KAAK,CAAC,UAAU,CAAC,KAAS,EAAE,IAAU,EAAE,OAAO,GAAmB,EAAE;QAClE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,MAAM,GAA2B,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC1D,IAAI,OAAO,CAAC,SAAS;YAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC;QAC7D,IAAI,OAAO,CAAC,QAAQ;YAAE,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACzD,IAAI,OAAO,CAAC,cAAc;YAAE,MAAM,CAAC,gBAAgB,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7E,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,KAAK,EACzE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,SAAS,IAAI,0BAA0B,CAAC,CAAC;IACrH,CAAC;IAED,oDAAoD;IACpD,KAAK,CAAC,SAAS,CAAC,IAAgB,EAAE,OAAO,GAA2B,EAAE;QACpE,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC;IAC9F,CAAC;IAED,0CAA0C;IAC1C,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAEO,IAAI;QACV,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACnE,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;CACF;AAED,4EAA4E;AAC5E,KAAK,UAAU,MAAM,CAAC,CAAW,EAAE,OAA6D,EAC9F,KAA8B;IAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAY,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS;QACjF,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAyE;IAEhH,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC1F,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,iBAAiB;AACjB,SAAS,QAAQ,CAAC,CAAM,EAAE,KAA8B;IACtD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU;QACtF,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,SAAS,CAAC,GAAQ,EAAE,KAA8B;IACzD,OAAO,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;AACzG,CAAC"}

package/dist/ucan.d.ts

@@ -0,0 +1,29 @@
+import { type Id } from "./wire.js";
+/** One capability a token grants: `with` an MRI (mri:realm:<realm>,
+ * mri:org:<realm>/<org>, mri:proc:<realm>/<org>/<name>), `can` an ability. */
+export interface Capability {
+    readonly with: string;
+    readonly can: string;
+}
+/** Who may call or open a served procedure: a UCAN chain rooted at a node's
+ * identity key (ucanRequired), or at a realm key granting a can
+ * (realmMemberRequired). A refused call is a ProviderError of code
+ * "unauthorized" ("malformed_frame" for a proof no token names), a refused
+ * open a StreamError of the same code. */
+export type ServePolicy = {
+    readonly kind: "ucan_required";
+    readonly issuer: string;
+} | {
+    readonly kind: "realm_member_required";
+    readonly key_id: string;
+    readonly can: string;
+};
+export declare const Ucan: {
+    /** The proof id a child token's `prf` names token by: lowercase hex SHA-384
+     * of its text. */
+    proofId(token: string): string;
+    /** A chain rooted at the identity key of the node issuer names. */
+    ucanRequired(issuer: Id): ServePolicy;
+    /** A chain rooted at the realm key whose id keyId names, granting can. */
+    realmMemberRequired(keyId: Id, can: string): ServePolicy;
+};

package/dist/ucan.js

@@ -0,0 +1,25 @@
+// UCANs (macula 12's D7): a token is minted with NodeKey.ucan for the node that
+// presents it; a gated procedure serves only callers whose chain a ServePolicy
+// accepts. libmacula checks each call and open before it reaches TypeScript.
+import { native } from "./binding.js";
+import { hex, id32 } from "./wire.js";
+export const Ucan = {
+    /** The proof id a child token's `prf` names token by: lowercase hex SHA-384
+     * of its text. */
+    proofId(token) {
+        if (token === "")
+            throw new TypeError("@macula-io/ts: a UCAN is never empty");
+        return native.ucanProofId(token);
+    },
+    /** A chain rooted at the identity key of the node issuer names. */
+    ucanRequired(issuer) {
+        return { kind: "ucan_required", issuer: hex(id32(issuer, "issuer")) };
+    },
+    /** A chain rooted at the realm key whose id keyId names, granting can. */
+    realmMemberRequired(keyId, can) {
+        if (can === "")
+            throw new TypeError("@macula-io/ts: a realm member policy names a can");
+        return { kind: "realm_member_required", key_id: hex(id32(keyId, "realm key id")), can };
+    },
+};
+//# sourceMappingURL=ucan.js.map

package/dist/ucan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ucan.js","sourceRoot":"","sources":["../src/ucan.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAW,MAAM,WAAW,CAAC;AAkB/C,MAAM,CAAC,MAAM,IAAI,GAAG;IAClB;sBACkB;IAClB,OAAO,CAAC,KAAa;QACnB,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC9E,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,mEAAmE;IACnE,YAAY,CAAC,MAAU;QACrB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;IACxE,CAAC;IAED,0EAA0E;IAC1E,mBAAmB,CAAC,KAAS,EAAE,GAAW;QACxC,IAAI,GAAG,KAAK,EAAE;YAAE,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACxF,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;IAC1F,CAAC;CACF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@macula-io/ts",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "TypeScript SDK for the Macula mesh, over macula-go's shared C ABI",
   "license": "Apache-2.0",
   "keywords": [