@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/peer-authorization.js

@@ -1,6 +1,6 @@
 import debug from 'debug';
 import { digest, verify } from '@optimystic/quereus-plugin-crypto';
-import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields } from './control-authorization.js';
+import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields } from './control-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 const log = debug('sereus:cadre:peer-authorization');
 /**
@@ -142,20 +142,22 @@ export function verifyRevocationSigner(partyId, row) {
 /**
  * Canonical digest an owner signs to seat a further `OwnerKey` row — the signed-add branch
  * of `OwnerKey.Authorized`, which stores the pair as `VouchOwner` / `VouchSig`. SQL mirror:
- * `digest('CadreControl.OwnerKey', 'add', party_id(), new.Key, new.StampId)`. The removal
- * digest needs no builder here: it is the generic guarded `'remove'` digest over (Key, StampId).
+ * `digest('CadreControl.OwnerKey', 'add', party_id(), new.Key, coalesce(new.Label, ''), new.StampId)`.
+ * The removal digest needs no builder here: it is the generic guarded `'remove'` digest over
+ * (Key, StampId).
  */
-export function ownerKeyAddDigest(partyId, key, stampId) {
-    return taggedDigest('CadreControl.OwnerKey', 'add', partyId, [key, stampId]);
+export function ownerKeyAddDigest(partyId, key, label, stampId) {
+    return taggedDigest('CadreControl.OwnerKey', 'add', partyId, [key, label ?? '', stampId]);
 }
 /**
  * Does an owner-signed `OwnerKey` row's stored voucher verify — `vouchSig` by `vouchOwner`
- * over {@link ownerKeyAddDigest} for (`partyId`, `key`, `stampId`)? Whether `vouchOwner` is
- * anchored is the caller's question, as for {@link verifyCadrePeerVoucher}. Never throws.
+ * over {@link ownerKeyAddDigest} for (`partyId`, `key`, `label`, `stampId`)? Whether
+ * `vouchOwner` is anchored is the caller's question, as for {@link verifyCadrePeerVoucher}.
+ * Never throws.
  */
-export function verifyOwnerKeyVoucher(partyId, key, stampId, vouchOwner, vouchSig) {
+export function verifyOwnerKeyVoucher(partyId, key, label, stampId, vouchOwner, vouchSig) {
     try {
-        return verifyB64(ownerKeyAddDigest(partyId, key, stampId), vouchSig, vouchOwner);
+        return verifyB64(ownerKeyAddDigest(partyId, key, label, stampId), vouchSig, vouchOwner);
     }
     catch (error) {
         log('verifyOwnerKeyVoucher failed: %o', error);
@@ -310,40 +312,24 @@ export function verifyCadreInviteRedemption(partyId, fields, inviteSig, peerSig)
         return false;
     }
 }
-/**
- * The links of an invitation admission that do not depend on WHICH table's row was
- * admitted — shared by {@link verifyInvitationAdmission} (`CadrePeer`) and
- * {@link verifyInvitationOwnerAdmission} (`OwnerKey`), which differ only in the row
- * columns the usage must name and, for an owner row, in `grantsOwner`. The chain is
- *
- *   row --vouchUsage--> usage --inviteKey--> invitation --issuerKey--> anchored owner
- *
- * and every link here is verified: the issuer is anchored (`isAnchored`) and is the row's
- * `vouchOwner`; the usage names this invitation and is the row's `vouchUsage`; a targeted
- * invitation names the redeeming device; the stored `peerKey` really is the key behind the
- * usage's `peerId` (the schema cannot unwrap a multihash, so a writer could assert any
- * pair); the invitation's stored `'add'` signature verifies over the row rebuilt from its
- * columns; the holder's `'redeem'` signature verifies with the invitation key and the
- * device's `'consent'` signature with its own key. All three signatures are judged for
- * `partyId`. Throws on malformed input; the two callers turn that into `false`.
- */
-function verifyAdmissionChain(partyId, vouchOwner, vouchUsage, usage, invite, isAnchored) {
-    return isAnchored(vouchOwner)
-        && invite.issuerKey === vouchOwner
-        && usage.usageStampId === vouchUsage
-        && usage.inviteKey === invite.key
-        && (invite.peerId === null || invite.peerId === usage.peerId)
-        && ed25519PublicKeyB64FromPeerId(usage.peerId) === usage.peerKey
-        && verifyB64(cadreInviteAddDigest(partyId, invite), invite.issuerSig, invite.issuerKey)
-        && verifyB64(cadreInviteRedeemDigest(partyId, invite.key, usage.usageStampId, usage.peerKey), usage.inviteSig, invite.key)
-        && verifyB64(cadreInviteConsentDigest(partyId, invite.key, usage.usageStampId, usage.peerKey), usage.peerSig, usage.peerKey);
-}
 /**
  * Is an invitation-admitted `CadrePeer` row (`vouchSig` null, `vouchUsage` set) a
  * member this node should trust? The read-side mirror of the consent branch of
  * `CadrePeer.AuthorizedInsert`, re-checked against THIS node's anchor because the
- * replicated `OwnerKey` table can be polluted. The usage must name this peer id and this
- * exact row incarnation (`peerStampId`); every other link is {@link verifyAdmissionChain}.
+ * replicated `OwnerKey` table can be polluted. The chain is
+ *
+ *   row --vouchUsage--> usage --inviteKey--> invitation --issuerKey--> anchored owner
+ *
+ * and every link is verified: the issuer is anchored (`isAnchored`) and is the row's
+ * `vouchOwner`; the usage is the row's `vouchUsage`, names this peer id and this exact row
+ * incarnation (`peerStampId`), and names this invitation; a targeted invitation names the
+ * redeeming device; the stored `peerKey` really is the key behind the usage's `peerId` (the
+ * schema cannot unwrap a multihash, so a writer could assert any pair); the invitation's
+ * stored `'add'` signature verifies over the row rebuilt from its columns; the holder's
+ * `'redeem'` signature verifies with the invitation key and the device's `'consent'`
+ * signature with its own key. All three signatures are judged for `partyId`. A machine
+ * invitation admits a machine and nothing else, so no `OwnerKey` row is ever verified
+ * through this chain; a grant-seated owner row is {@link verifyOwnerGrantAdmission}'s.
  *
  * Expiry, use count and withdrawal are deliberately NOT re-checked: they were conditions
  * at redemption (`CadreInviteUsage.Authorized`), and membership persists until an owner
@@ -358,9 +344,17 @@ export function verifyInvitationAdmission(partyId, row, usage, invite, isAnchore
         return row.stampId !== null
             && row.vouchOwner !== null
             && row.vouchUsage !== null
+            && isAnchored(row.vouchOwner)
+            && invite.issuerKey === row.vouchOwner
+            && usage.usageStampId === row.vouchUsage
             && usage.peerStampId === row.stampId
             && usage.peerId === row.peerId
-            && verifyAdmissionChain(partyId, row.vouchOwner, row.vouchUsage, usage, invite, isAnchored);
+            && usage.inviteKey === invite.key
+            && (invite.peerId === null || invite.peerId === usage.peerId)
+            && ed25519PublicKeyB64FromPeerId(usage.peerId) === usage.peerKey
+            && verifyB64(cadreInviteAddDigest(partyId, invite), invite.issuerSig, invite.issuerKey)
+            && verifyB64(cadreInviteRedeemDigest(partyId, invite.key, usage.usageStampId, usage.peerKey), usage.inviteSig, invite.key)
+            && verifyB64(cadreInviteConsentDigest(partyId, invite.key, usage.usageStampId, usage.peerKey), usage.peerSig, usage.peerKey);
     }
     catch (error) {
         log('verifyInvitationAdmission failed: %o', error);
@@ -368,25 +362,101 @@ export function verifyInvitationAdmission(partyId, row, usage, invite, isAnchore
     }
 }
 /**
- * Is an invitation-admitted `OwnerKey` row (`vouchSig` null, `vouchUsage` set) an owner
- * this node should derive into its anchor? The read-side mirror of the consent branch of
- * `OwnerKey.Authorized` (`owner-anchor-sync.ts` → `deriveOwnerAnchor`): the invitation
- * must grant ownership, and the usage must name this key (`peerKey`) and this exact row
- * incarnation (`ownerStampId`); every other link is {@link verifyAdmissionChain}. Same
- * never-throws contract and the same deliberate omissions as
- * {@link verifyInvitationAdmission}.
+ * Canonical digest an owner signs to seat an `OwnerGrant` row — the read-side mirror of
+ * `ownerGrantAddMessage` in control-database.ts, base64url instead of raw bytes. The whole
+ * row is bound, the label included, through the one field builder both sides share
+ * (`ownerGrantRowFields`). SQL mirror: `OwnerGrant.AuthorizedInsert`.
+ */
+export function ownerGrantAddDigest(partyId, row) {
+    return taggedDigest('CadreControl.OwnerGrant', 'add', partyId, ownerGrantRowFields(row));
+}
+/**
+ * Canonical digest the HOLDER of an `OwnerGrant`'s private key signs to redeem it once:
+ * proof of possession, verified against the grant key itself
+ * (`OwnerGrantUsage.GrantPossessed`). Binds the redemption's nonce and the key being seated,
+ * so one redemption cannot be re-presented for another key or another use. Mirror of
+ * `ownerGrantRedeemMessage` in control-database.ts.
+ */
+export function ownerGrantRedeemDigest(partyId, grantKey, usageStampId, seatedKey) {
+    return taggedDigest('CadreControl.OwnerGrantUsage', 'redeem', partyId, [grantKey, usageStampId, seatedKey]);
+}
+/**
+ * Canonical digest the key being SEATED signs to prove it is held by the redeemer
+ * (`OwnerGrantUsage.OwnerConsented`), over the same fields as {@link ownerGrantRedeemDigest}
+ * under a distinct action tag, so the holder's and the key's signatures are never
+ * interchangeable. Mirror of `ownerGrantConsentMessage` in control-database.ts.
+ */
+export function ownerGrantConsentDigest(partyId, grantKey, usageStampId, seatedKey) {
+    return taggedDigest('CadreControl.OwnerGrantUsage', 'consent', partyId, [grantKey, usageStampId, seatedKey]);
+}
+/**
+ * Does an `OwnerGrant` row carry a valid `'add'` signature by its own `issuerKey`, for
+ * `partyId`? The grant twin of {@link verifyCadreInviteRow}, with the same contract: whether
+ * that issuer IS an owner is the caller's question, and a malformed row verifies as `false`.
+ */
+export function verifyOwnerGrantRow(partyId, grant) {
+    try {
+        return verifyB64(ownerGrantAddDigest(partyId, grant), grant.issuerSig, grant.issuerKey);
+    }
+    catch (error) {
+        log('verifyOwnerGrantRow failed: %o', error);
+        return false;
+    }
+}
+/**
+ * The two signatures an owner-grant redemption carries, checked before any database work:
+ * the holder's `'redeem'` signature with the grant key and the seated key's `'consent'`
+ * signature with itself, both over (`grantKey`, `usageStampId`, `seatedKey`). The grant twin
+ * of {@link verifyCadreInviteRedemption}, with the same contract: the schema
+ * (`OwnerGrantUsage.GrantPossessed` / `OwnerConsented`) stays the authority, this turns a bad
+ * signature into a clean refusal instead of a constraint failure at commit. Never throws.
+ */
+export function verifyOwnerGrantRedemption(partyId, fields, grantSig, ownerSig) {
+    try {
+        return verifyB64(ownerGrantRedeemDigest(partyId, fields.grantKey, fields.usageStampId, fields.seatedKey), grantSig, fields.grantKey)
+            && verifyB64(ownerGrantConsentDigest(partyId, fields.grantKey, fields.usageStampId, fields.seatedKey), ownerSig, fields.seatedKey);
+    }
+    catch (error) {
+        log('verifyOwnerGrantRedemption failed: %o', error);
+        return false;
+    }
+}
+/**
+ * Is a grant-seated `OwnerKey` row (`vouchSig` null, `vouchUsage` naming an `OwnerGrantUsage`
+ * row) an owner this node should derive into its anchor? The read-side mirror of the grant
+ * branch of `OwnerKey.Authorized` (`owner-anchor-sync.ts` → `deriveOwnerAnchor`). The chain is
+ *
+ *   row --vouchUsage--> usage --grantKey--> grant --issuerKey--> anchored owner
+ *
+ * and every link is verified: the issuer is anchored and is the row's `vouchOwner`; the usage
+ * is the row's `vouchUsage` and names this key and this exact row incarnation
+ * (`seatedStampId`); the usage names this grant; the row carries the grant's label; the
+ * grant's stored `'add'` signature verifies over the row rebuilt from its columns; the
+ * holder's `'redeem'` signature verifies with the grant key and the seated key's `'consent'`
+ * signature with itself. All three signatures are judged for `partyId`.
+ *
+ * Expiry, use count and withdrawal are deliberately NOT re-checked, as
+ * {@link verifyInvitationAdmission} omits them: they were conditions at redemption
+ * (`OwnerGrantUsage.Authorized`), and ownership persists until an owner removes the row.
+ * Same never-throws contract as the siblings.
  */
-export function verifyInvitationOwnerAdmission(partyId, row, usage, invite, isAnchored) {
+export function verifyOwnerGrantAdmission(partyId, row, usage, grant, isAnchored) {
     try {
         return row.vouchOwner !== null
             && row.vouchUsage !== null
-            && invite.grantsOwner
-            && usage.peerKey === row.key
-            && usage.ownerStampId === row.stampId
-            && verifyAdmissionChain(partyId, row.vouchOwner, row.vouchUsage, usage, invite, isAnchored);
+            && isAnchored(row.vouchOwner)
+            && grant.issuerKey === row.vouchOwner
+            && usage.usageStampId === row.vouchUsage
+            && usage.seatedKey === row.key
+            && usage.seatedStampId === row.stampId
+            && usage.grantKey === grant.key
+            && (grant.label ?? '') === (row.label ?? '')
+            && verifyB64(ownerGrantAddDigest(partyId, grant), grant.issuerSig, grant.issuerKey)
+            && verifyB64(ownerGrantRedeemDigest(partyId, grant.key, usage.usageStampId, usage.seatedKey), usage.grantSig, grant.key)
+            && verifyB64(ownerGrantConsentDigest(partyId, grant.key, usage.usageStampId, usage.seatedKey), usage.ownerSig, usage.seatedKey);
     }
     catch (error) {
-        log('verifyInvitationOwnerAdmission failed: %o', error);
+        log('verifyOwnerGrantAdmission failed: %o', error);
         return false;
     }
 }

package/dist/peer-authorization.js.map

@@ -1 +1 @@
-{"version":3,"file":"peer-authorization.js","sourceRoot":"","sources":["../src/peer-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE1H,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAA0B,EAAE,MAAqB,EAAE,OAAe,EAAE,SAAmB;IAC3G,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AACjH,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,MAA4B,EAAE,MAAqB,EAAE,SAAmB;IACnG,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AACxG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,mBAAmB,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAuBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAA6B;IACjF,OAAO,YAAY,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE;QAC9D,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,KAAK;QACT,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACnD,GAAG,CAAC,GAAG,IAAI,EAAE;QACb,GAAG,CAAC,OAAO;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACtF,OAAO,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACrF,OAAO,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACpF,OAAO,YAAY,CAAC,wBAAwB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAyB,EAAE,MAAc,EAAE,OAAe;IAC1G,OAAO,YAAY,CAAC,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,GAAkB;IACxE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAW,EAAE,OAAe;IAC7E,OAAO,YAAY,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW,EAAE,OAAe,EAAE,UAAkB,EAAE,QAAgB;IACvH,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,cAAsB,EACtB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,uBAAuB,CAAC,MAAM,CAAC,EAC/B,SAAS,EACT,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAc,EACd,OAAe,EACf,cAAsB,EACtB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAChD,SAAS,EACT,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAkB;IAExE,OAAO,mBAAmB,CAAC,6BAA6B,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAEtC;IACC,IAAI,CAAC;QACH,OAAO,MAAM,CACX,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,EAChF,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAA4B;IAChF,OAAO,YAAY,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB,EAAE,OAAe;IAC/G,OAAO,YAAY,CAAC,+BAA+B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB,EAAE,OAAe;IAChH,OAAO,YAAY,CAAC,+BAA+B,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,2GAA2G;AAC3G,SAAS,SAAS,CAAC,SAAiB,EAAE,SAAiB,EAAE,SAAiB;IACxE,OAAO,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAsB;IAC1E,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,MAAoE,EACpE,SAAiB,EACjB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;eACjI,SAAS,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,oBAAoB,CAC3B,OAAe,EACf,UAAkB,EAClB,UAAkB,EAClB,KAA0B,EAC1B,MAAsB,EACtB,UAAyC;IAEzC,OAAO,UAAU,CAAC,UAAU,CAAC;WACxB,MAAM,CAAC,SAAS,KAAK,UAAU;WAC/B,KAAK,CAAC,YAAY,KAAK,UAAU;WACjC,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG;WAC9B,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;WAC1D,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,OAAO;WAC7D,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;WACpF,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;WACvH,SAAS,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;AACjI,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,GAA2B,EAC3B,KAA0B,EAC1B,MAAsB,EACtB,UAAyC;IAEzC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI;eACtB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO;eACjC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;eAC3B,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAe,EACf,GAAgB,EAChB,KAA0B,EAC1B,MAAsB,EACtB,UAAyC;IAEzC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI;eACzB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,MAAM,CAAC,WAAW;eAClB,KAAK,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG;eACzB,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC,OAAO;eAClC,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;IAChG,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}
+{"version":3,"file":"peer-authorization.js","sourceRoot":"","sources":["../src/peer-authorization.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EAAE,0BAA0B,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC;AAE/I,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAGjE,MAAM,GAAG,GAAG,KAAK,CAAC,iCAAiC,CAAC,CAAC;AAErD;;;;;;;GAOG;AACH,SAAS,YAAY,CAAC,MAA0B,EAAE,MAAqB,EAAE,OAAe,EAAE,SAAmB;IAC3G,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AACjH,CAAC;AAED,oFAAoF;AACpF,SAAS,mBAAmB,CAAC,MAA4B,EAAE,MAAqB,EAAE,SAAmB;IACnG,OAAO,MAAM,CAAC,0BAA0B,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,WAAW,CAAW,CAAC;AACxG,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc;IACpD,OAAO,mBAAmB,CAAC,kBAAkB,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;AACpE,CAAC;AAuBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAA6B;IACjF,OAAO,YAAY,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE;QAC9D,GAAG,CAAC,MAAM;QACV,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,KAAK;QACT,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;QACnD,GAAG,CAAC,GAAG,IAAI,EAAE;QACb,GAAG,CAAC,OAAO;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACtF,OAAO,YAAY,CAAC,0BAA0B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACrF,OAAO,YAAY,CAAC,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,MAAc,EAAE,OAAe;IACpF,OAAO,YAAY,CAAC,wBAAwB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AACtF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,SAAyB,EAAE,MAAc,EAAE,OAAe;IAC1G,OAAO,YAAY,CAAC,yBAAyB,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;AAClG,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,GAAkB;IACxE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACpH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAW,EAAE,KAAoB,EAAE,OAAe;IACnG,OAAO,YAAY,CAAC,uBAAuB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAe,EAAE,GAAW,EAAE,KAAoB,EAAE,OAAe,EAAE,UAAkB,EAAE,QAAgB;IAC7I,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,kCAAkC,EAAE,KAAK,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,cAAsB,EACtB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,uBAAuB,CAAC,MAAM,CAAC,EAC/B,SAAS,EACT,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,MAAc,EACd,OAAe,EACf,cAAsB,EACtB,SAAiB;IAEjB,IAAI,CAAC;QACH,OAAO,MAAM,CACX,sBAAsB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAChD,SAAS,EACT,cAAc,EACd,SAAS,EACT,WAAW,EACX,WAAW,EACX,WAAW,CACZ,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAa,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAkB;IAExE,OAAO,mBAAmB,CAAC,6BAA6B,EAAE,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACnH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAEtC;IACC,IAAI,CAAC;QACH,OAAO,MAAM,CACX,sBAAsB,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,CAAC,EAChF,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAA4B;IAChF,OAAO,YAAY,CAAC,0BAA0B,EAAE,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB,EAAE,OAAe;IAC/G,OAAO,YAAY,CAAC,+BAA+B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,SAAiB,EAAE,YAAoB,EAAE,OAAe;IAChH,OAAO,YAAY,CAAC,+BAA+B,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED,2GAA2G;AAC3G,SAAS,SAAS,CAAC,SAAiB,EAAE,SAAiB,EAAE,SAAiB;IACxE,OAAO,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;AACnG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe,EAAE,MAAsB;IAC1E,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,2BAA2B,CACzC,OAAe,EACf,MAAoE,EACpE,SAAiB,EACjB,OAAe;IAEf,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;eACjI,SAAS,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,GAA2B,EAC3B,KAA0B,EAC1B,MAAsB,EACtB,UAAyC;IAEzC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,OAAO,KAAK,IAAI;eACtB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;eAC1B,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU;eACnC,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC,UAAU;eACrC,KAAK,CAAC,WAAW,KAAK,GAAG,CAAC,OAAO;eACjC,KAAK,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM;eAC3B,KAAK,CAAC,SAAS,KAAK,MAAM,CAAC,GAAG;eAC9B,CAAC,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC;eAC1D,6BAA6B,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,OAAO;eAC7D,SAAS,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAC;eACpF,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC;eACvH,SAAS,CAAC,wBAAwB,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACjI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,GAA2B;IAC9E,OAAO,YAAY,CAAC,yBAAyB,EAAE,KAAK,EAAE,OAAO,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB,EAAE,SAAiB;IAC/G,OAAO,YAAY,CAAC,8BAA8B,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,QAAgB,EAAE,YAAoB,EAAE,SAAiB;IAChH,OAAO,YAAY,CAAC,8BAA8B,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,QAAQ,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,KAAoB;IACvE,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC1F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAe,EACf,MAAqE,EACrE,QAAgB,EAChB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;eAC/H,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACvI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,uCAAuC,EAAE,KAAK,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAe,EACf,GAAgB,EAChB,KAAyB,EACzB,KAAoB,EACpB,UAAyC;IAEzC,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,UAAU,KAAK,IAAI;eACzB,GAAG,CAAC,UAAU,KAAK,IAAI;eACvB,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC;eAC1B,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,UAAU;eAClC,KAAK,CAAC,YAAY,KAAK,GAAG,CAAC,UAAU;eACrC,KAAK,CAAC,SAAS,KAAK,GAAG,CAAC,GAAG;eAC3B,KAAK,CAAC,aAAa,KAAK,GAAG,CAAC,OAAO;eACnC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,GAAG;eAC5B,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;eACzC,SAAS,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;eAChF,SAAS,CAAC,sBAAsB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC;eACrH,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACpI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,GAAG,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/peer-join-backfill.d.ts

@@ -1,6 +1,7 @@
 import type { Libp2p, PeerId } from '@libp2p/interface';
 import type { IPeerNetwork } from '@optimystic/db-core';
 import { BlockTransferClient, type IRawStorage } from '@optimystic/db-p2p';
+import type { Libp2pNodeWithRepo } from './types.js';
 /**
  * The block-transfer protocol's hard cap on one length-prefixed message. Mirrors
  * `MAX_BLOCK_MESSAGE_BYTES` in `@optimystic/db-p2p`'s `protocol-limits.ts` (8 MiB), which
@@ -19,7 +20,10 @@ export declare const PEER_JOIN_BACKFILL_WARN_AFTER_FAILURES = 3;
 export interface PeerJoinBackfillConfig {
     /** Default true. False disables the catch-up entirely (the pre-existing behaviour). */
     enabled?: boolean;
-    /** Settle time after a connection opens before catching that peer up, ms. Default 1000. */
+    /**
+     * Settle time before re-running a peer this instance has already run for (a denied or failed
+     * peer's next schedule), ms. Default 1000. A peer never run for is run at once.
+     */
     debounceMs?: number;
     /** Ceiling on blocks copied in one catch-up. Default 10_000. Reaching it is LOGGED, never silent. */
     maxBlocks?: number;
@@ -76,6 +80,12 @@ export interface PeerJoinBackfillDeps {
      * see the module comment for why the strand no-gate argument does not carry over.
      */
     authorizePeer?: (peerId: string) => Promise<boolean>;
+    /**
+     * The node's `reportBlockHeld` ({@link Libp2pNodeWithRepo.reportBlockHeld}), told of each block a
+     * peer accepted so Optimystic's under-replication drain does not push the peer the same block
+     * again, one request per block. Absent = nothing reported, and the drain re-sends.
+     */
+    reportBlockHeld?: Libp2pNodeWithRepo['reportBlockHeld'];
     /**
      * Test seam: build the per-peer push client. Defaults to a real
      * `BlockTransferClient` over {@link peerNetwork} + {@link protocolPrefix}.
@@ -84,11 +94,21 @@ export interface PeerJoinBackfillDeps {
 }
 /** What one peer's catch-up actually did. Returned for tests and logged at the end of each run. */
 export interface PeerJoinBackfillResult {
-    /** Blocks offered: had a committed `latest` AND materialized content locally. */
+    /** Blocks offered: had a committed `latest` AND materialized content locally, and the peer was not known to hold it. */
     offered: number;
+    /**
+     * Skipped: the peer already accepted or refused this revision from this node, or signed its
+     * commit (see "What is pushed" in the module comment). Not offered, so not counted toward
+     * `maxBlocks`.
+     */
+    alreadyHeld: number;
     /** Blocks the remote reported it persisted. */
     accepted: number;
-    /** Block ids the remote reported in `missing` (parse or persist failure on its side). */
+    /**
+     * Block ids the remote reported in `missing` (unparseable, not persisted, or pushed without a
+     * commit proof it accepts). Remembered per revision; not offered to that peer again until the
+     * local revision moves.
+     */
     rejected: string[];
     /** Skipped: metadata has no `latest` (pending-only — not yet a durability claim here). */
     uncommitted: number;
@@ -109,8 +129,8 @@ export interface PeerJoinBackfillResult {
  *
  * Best-effort throughout: nothing here throws into a libp2p event handler or into a
  * runtime bring-up; a failed chunk is logged and the run continues. A peer is marked
- * fully caught up ONLY after a run with no thrown chunk and an empty `missing` list, so
- * the next `peer:identify` from a peer whose catch-up failed retries it.
+ * caught up only after a run with no thrown chunk, so a peer whose catch-up failed is
+ * retried; each block is pushed to each peer once (see "What is pushed" in the module comment).
  */
 export declare class PeerJoinBackfill {
     private readonly deps;
@@ -119,10 +139,22 @@ export declare class PeerJoinBackfill {
     private started;
     private stopped;
     /**
-     * Peers fully caught up this runtime (never rescheduled until the runtime is rebuilt; only
-     * {@link forceCatchUpPeer} pushes to one again).
+     * Peers caught up since their current connection opened. Cleared for a peer when its last
+     * connection closes, so a reconnect re-runs; {@link forceCatchUpPeer} runs past it.
      */
     private readonly done;
+    /**
+     * Peers that disconnected while their run was in flight, so that run does not mark them
+     * {@link done} after the disconnect cleared it. Cleared when the run ends.
+     */
+    private readonly disconnectedInFlight;
+    /** Per-peer, per-block verdicts from push replies; see {@link PeerMemo}. */
+    private readonly memos;
+    /**
+     * Peers a run has been started for. A peer not in it is run at once on its first schedule;
+     * later schedules wait out `debounceMs`.
+     */
+    private readonly contacted;
     /**
      * Peers with a catch-up currently running, each with that run (suppresses concurrent
      * duplicates; {@link forceCatchUpPeer} waits on the run).
@@ -130,9 +162,9 @@ export declare class PeerJoinBackfill {
     private readonly inFlight;
     /**
      * Peers whose (re-)schedule arrived while their OWN run was in flight, replayed once
-     * that run finishes. Load-bearing for the gated path: the gate's authorization check is
-     * a control-database read, so the window between it and the run's end is wide enough for
-     * the very membership commit that would have authorized the peer to land inside it —
+     * that run finishes. Load-bearing for the gated path: the gate is judged once, at the start
+     * of a run, and the run's pushes take long enough for the very membership commit that would
+     * have authorized the peer to land after that check —
      * dropping that schedule (rather than deferring it) leaves the denied peer waiting for a
      * reconnect, which is exactly what the re-arm exists to avoid.
      */
@@ -150,17 +182,32 @@ export declare class PeerJoinBackfill {
     /** Peers already reported on `console.warn`; reset when a run finally lands cleanly. */
     private readonly warned;
     private readonly onPeerIdentify;
+    private readonly onPeerDisconnect;
     private loggedNoListBlockIds;
     constructor(deps: PeerJoinBackfillDeps, config?: PeerJoinBackfillConfig);
     /**
      * Subscribe to `peer:identify` AND schedule a catch-up for already-connected peers whose
      * stored protocols already name this network's block-transfer protocol — a peer that does
-     * not speak it (a bare circuit relay, a bootstrap node) is never scheduled at all. See
-     * {@link speaksBlockTransfer} and the module comment.
+     * not speak it (a bare circuit relay, a bootstrap node) is never scheduled at all. Also
+     * subscribes to `peer:disconnect`, so a peer caught up before it went away is run again on
+     * its return. See {@link speaksBlockTransfer} and the module comment.
      */
     start(): void;
     /** Unsubscribe, clear timers; in-flight runs observe the stopped flag and bail. */
     stop(): void;
+    /**
+     * A peer's last connection closed: it is no longer caught up, so its next `peer:identify`
+     * re-runs. Only `done` is cleared. The memo stays (it keeps the re-run to what moved),
+     * `contacted` stays (a link flapping inside one settle window costs one run), and the
+     * backoff state stays (clearing it re-dials an unreachable peer on every reconnect; see the
+     * module comment's retry paragraph).
+     *
+     * When the returning peer wrote while away with a cohort that named this node, its own
+     * re-run pushes those blocks here and reports them through `reportBlockHeld`, so its
+     * under-replication drain does not push them again. Revisit if a measurement shows reconnect
+     * re-runs dominating push traffic.
+     */
+    private forgetCaughtUp;
     /**
      * (Re-)schedule a debounced catch-up for every currently-connected peer whose protocols, as
      * already stored in the libp2p peer store, name this network's block-transfer protocol. A
@@ -177,7 +224,11 @@ export declare class PeerJoinBackfill {
     scheduleConnectedPeers(): Promise<number>;
     /** Schedules `peerId` only if the peer store already knows it speaks this network's protocol. */
     private scheduleIfKnownToSpeak;
-    /** Debounced entry point for connection churn: one run per peer per settle window. */
+    /**
+     * Entry point for connection churn: one run per peer per settle window, except that a peer
+     * never run for is run at once (on a zero-delay timer, so a burst of identify events in one
+     * turn still collapses, and no work happens inside the libp2p event dispatch).
+     */
     private schedulePeer;
     /**
      * Run one peer's catch-up now, bypassing the debounce. Never rejects. Returns an
@@ -186,14 +237,16 @@ export declare class PeerJoinBackfill {
      */
     catchUpPeer(peerId: PeerId): Promise<PeerJoinBackfillResult>;
     /**
-     * Run one peer's catch-up now and wait for it, whatever this instance remembers about the
-     * peer: wait out a run already in flight for it, then push the whole store again even when
-     * the peer is memoized as caught up. Never rejects; an all-zero result only when stopped.
+     * Run one peer's catch-up now and wait for it, even when the peer is memoized as caught up:
+     * wait out a run already in flight for it, then run again. The run still skips every block the
+     * peer is known to hold (it accepted or refused that revision, or signed it), so for a peer that
+     * holds the whole store it pushes nothing and returns `alreadyHeld` equal to the store size.
+     * Never rejects; an all-zero result only when stopped.
      *
      * For a caller that must know the peer holds this store before it proceeds, where
      * {@link catchUpPeer}'s empty answer would hide a run that was denied (a `peer:identify`
-     * run can pass the gate a moment before the caller authorized the peer) or a memo older
-     * than the commits since.
+     * run can pass the gate a moment before the caller authorized the peer) or commits made
+     * since the peer was caught up.
      */
     forceCatchUpPeer(peerId: PeerId): Promise<PeerJoinBackfillResult>;
     /**
@@ -218,10 +271,26 @@ export declare class PeerJoinBackfill {
      * timeout. Reset when a run finally lands cleanly, so a peer that recovers can report again.
      */
     private warnPersistentFailure;
+    /** This peer's memo, created empty on first use. */
+    private memoFor;
+    /**
+     * Tell the node which blocks of one push reply the peer accepted, at the revision pushed.
+     * Best-effort: a failed report is logged and costs only the drain's duplicate push.
+     */
+    private reportAccepted;
     /**
-     * The actual copy. `clean` = every chunk pushed and the remote persisted every block.
+     * The actual copy. `clean` = the gate admitted the peer, the store is listable and no push
+     * threw (a block the receiver refused is remembered per block instead, see {@link PeerMemo}).
      * `pushFailed` = at least one push THREW, which is the only non-clean outcome a retry can
-     * change; the others are verdicts (denied, inert store, blocks the receiver refused).
+     * change; the others are verdicts (denied, inert store).
      */
     private runCatchUp;
+    /**
+     * Read one block for the push to `key`, or count why it is skipped in `result` and return
+     * nothing: not committed, already held by the peer (memo or its own commit signature), not
+     * materialized, or too large for one message. The proof is read for EXACTLY the revision the
+     * meta will name, from the same `latest`; absent is normal (nothing retained a proof for that
+     * revision), and the block still ships with its meta for the receiver to decide.
+     */
+    private readOffer;
 }