@spine-event-engine/auth 2.0.0-snapshot.25 → 2.0.0-snapshot.26

package/README.md

@@ -54,6 +54,32 @@ Events can refer to the exact Command that caused them. Those metadata fields
 are supplied by the caller; they are not proof of identity. Queries and
 subscription Topics receive the context supplied by the gateway resolver.
 
+## Pass verified reader information to the application node
+
+The gateway also forwards the admitted principal and the `authorityFacts`
+returned by `ContextResolver.resolve()`. These facts may contain JSON values,
+including role arrays, booleans, and nested objects. They are detached from the
+session and resolver result before forwarding. The framework does not copy the
+request credential into them or fetch fresh information from an identity provider.
+Your resolver decides which facts to supply on each request.
+
+For a browser gateway, supply the issuer through
+`BrowserServerOptions.forwardingProof`. When assembling a native gateway,
+configure `NativeSubscriptionCreator(transport, { issuer, maxBytes })`; a custom
+unary forwarder must produce the same operation-bound proof. See
+[Verified reader forwarding](REFERENCE.md#verified-reader-forwarding) for the forwarding adapters.
+
+In either setup, configure `ServerOptions.services.readerAdmission.forwarded`
+on the receiving application node. The issuer produces a proof for the service,
+method, request bytes, and reader facts. The verifier checks that proof and the
+forwarding peer. Both are replaceable application adapters. A header name, actor
+ID, or loopback connection does not establish a verified reader.
+
+Authenticated forwarding requires an issuer. Deliberate `publicAccess: true`
+forwards no principal or authority facts; the gateway's public admission marker
+does not become a user identity. See the [server reference](https://github.com/SpineEventEngine/spine-ts/blob/master/packages/server/REFERENCE.md#native-reader-admission)
+for direct native authentication and managed forwarding configuration.
+
 ## Browser and OIDC extensions
 
 The package does not provide HTTP routes, browser pages, users, permissions,

package/REFERENCE.md

@@ -7,7 +7,7 @@ Start with the [authentication overview](README.md) when choosing a gateway shap
 
 The package supplies provider-neutral gateway building blocks. An application places its gateway in front of a Spine TS or Spine JVM backend, then supplies the listener, credential extraction, identity provider, session storage, authorization rules, actor/tenant resolution, and forwarding implementation. The framework does not enforce a particular proxy, route topology, identity provider, tenant policy, or deployment configuration.
 
-`TransportFacts.from()` exposes only allowlisted request facts. Credentials are passed only to `Authenticator` or `SessionResolver`; they are not included in `IncomingRequest`. `IncomingRequest` is a discriminated union for command, query, subscription creation, activation, and cancellation. Command facts can include a decoded message when a `TypeRegistryLookup` knows its packed type; unknown and malformed `Any` values remain type-URL-only facts.
+`TransportFacts.from()` exposes only allowlisted request facts. Credentials are passed only to `Authenticator` or `SessionResolver`; they are not included in `IncomingRequest`. `IncomingRequest` is a discriminated union for command, entity query, application query, subscription creation, activation, and cancellation. Command facts can include a decoded message when a `TypeRegistryLookup` knows its packed type; unknown and malformed `Any` values remain type-URL-only facts.
 
 `AuthorizationPolicy.authorize()` is evaluated separately for each incoming request. `ContextResolver.resolve()` returns the trusted actor, optional tenant, timestamp, zone, and language. The caller-provided `ActorContext` must match that resolved actor and tenant, otherwise `UnaryGateway` rejects the request as `context-stale`. Backends may rely on these identity checks only when the deployment routes traffic through an application-selected gateway.
 
@@ -40,7 +40,7 @@ a failed remote cleanup remains retryable.
 
 ## Unary requests
 
-`UnaryGateway` accepts `CommandService.Post`, `QueryService.Read`, and
+`UnaryGateway` accepts `CommandService.Post`, `QueryService.Read`, `QueryService.Execute`, and
 `AuthenticationService.ResolveContext`. Construct both `UnaryGateway` and
 `SubscriptionGateway` with exactly one admission mode: a `SessionResolver`, or
 `publicAccess: true`. Public access creates no login session and no synthetic
@@ -50,10 +50,37 @@ Gateway, its authorization policy admits the public principal, and its
 also require finite request limits, an authorization function,
 `ContextResolver`, clock, and the corresponding forwarding collaborator.
 
-For Post and Read, it bounds and decodes bytes, admits the request through the selected mode, authorizes the decoded request, resolves trusted context, checks requested actor/tenant, and forwards exactly once. In authenticated mode, admission resolves the supplied session. In public mode, it uses the framework-owned public principal and no session. The forwarder receives only service, method, bytes, and optional cancellation signal. It does not receive credentials or extra transport facts. It returns `forwarded`, `resolved`, or a rejection reason: `request-too-large`, `unknown-operation`, `malformed-request`, `unauthenticated`, `forbidden`, or `context-stale`. Mapping a rejection to HTTP or gRPC status is the native transport adapter's job.
+For Post, Read, and Execute, it bounds and decodes bytes, admits the request through the selected mode, authorizes the decoded request, resolves trusted context, checks requested actor/tenant, and forwards exactly once. In authenticated mode, admission resolves the supplied session. In public mode, it uses the public admission marker and no session. The forwarder receives service, method, bytes, detached `reader` facts, and an optional cancellation signal. It does not receive credentials or extra transport facts. It returns `forwarded`, `resolved`, or a rejection reason: `request-too-large`, `unknown-operation`, `malformed-request`, `unauthenticated`, `forbidden`, or `context-stale`. Mapping a rejection to HTTP or gRPC status is the native transport adapter's job.
 
 ResolveContext returns informational trusted actor and tenant facts in both modes. In authenticated mode, it validates the current session and also returns its expiry. In public mode, it resolves context for the framework-owned public principal and omits `expiresAt` because no session exists. It neither authorizes a business request nor creates a reusable credential. Later requests are independently admitted and authorized.
 
+### Verified reader forwarding
+
+`reader.principal` contains the admitted application principal's ID and string
+attributes. `reader.authorityFacts` comes from `AuthorizedRequestContext.authorityFacts`
+and accepts finite JSON values, including nested objects and arrays. The gateway
+copies these values for the invocation. Public admission omits both fields even
+if a context resolver supplies facts for the public admission marker.
+The existing `ContextResolver` remains the replacement point for obtaining
+application-specific authority information; there is no provider polling or
+promise that its information remains current after resolution.
+
+`NativeSubscriptionCreator(transport, { issuer, maxBytes })` uses the configured
+issuer to forward that reader with each native operation. `BrowserServerOptions.forwardingProof`
+configures the same issuer in browser composition. Its `issue(bytes)` method
+returns a transport-safe proof. The application node's corresponding
+`services.readerAdmission.forwarded.verify(bytes, proof, peer)` verifies the
+forwarding peer and the assertion. The signed bytes bind the service, method,
+canonical request, and reader facts; an Activate proof cannot authorize Cancel.
+Internal metadata received from a caller is not accepted without that verifier.
+
+An authenticated native forwarding call without an issuer fails rather than
+discarding its reader identity. Configure both issuer and verifier for authenticated
+browser forwarding. These are TS forwarding ports; merely sending
+their metadata to a JVM backend does not add verified-reader support there.
+Custom forwarding implementations must establish the equivalent trust at their
+receiving boundary. Credentials and provider tokens are not forwarding fields.
+
 ## Sessions and sign-in
 
 `OpaqueSessions` implements a bounded, process-local `SessionResolver` with random cookie credentials. Defaults are an eight-hour lifetime, 10,000 retained sessions, and three identifier attempts. It lazily removes expired entries and is terminal after `close()`. It suits local development and the supported single-Gateway shape; choose an application session strategy that meets that gateway's restart and revocation requirements.
@@ -69,10 +96,14 @@ ResolveContext returns informational trusted actor and tenant facts in both mode
 `BackendSubscriptionEnvelope` is opaque to the Gateway. A custom `SubscriptionCreator` or `DynamicUnaryClient` must validate each forwarded update's subscription ID and Topic against the actual Subscription accepted by its backend. The built-in native creator performs this validation; a custom envelope does not imply the backend reused the requested child ID.
 
 `DurableSubscriptionBindings` from `@spine-event-engine/server/browser` retains one approved
-`GatewayAuthenticatedSubscription` per public Subscription. The retained Topic
-includes the trusted Actor and Tenant, so Activate and Cancel compare that pair
-with the newly resolved request context. It is single-Gateway persistence, not
-cross-process quota, reservation, lease, fence, or fingerprint coordination.
+`GatewayAuthenticatedSubscription` per public Subscription. The record includes
+the stable principal ID, while its Topic retains the trusted Actor and Tenant.
+Activate and Cancel check all three against the newly admitted request before
+affecting a stream or record. The same principal may reconnect with changed
+attributes or authority facts; those facts are not persisted as its identity.
+Explicit anonymous admission is distinct from a missing legacy binding. A
+missing binding cannot be claimed by the next caller. This remains single-Gateway
+persistence, not cross-process quota, reservation, lease, or fingerprint coordination.
 
 Public subscription creation has two stages. `Subscribe` stores a process-local
 definition and returns its ID; `Activate` must arrive within the shared
@@ -100,9 +131,10 @@ Read the [browser client and gateway guide](../../docs/BROWSER_CLIENT_AUTH_EXTEN
 
 `DynamicUnaryForwarder` accepts complete current application-node snapshots. It serializes reconciliation, retains only the latest pending snapshot during churn, starts clients in bounded batches, disposes departed clients, and round-robins commands and queries across the resulting set. A dispatched unary request is never retried. Empty membership reports backend unavailability until a later snapshot restores clients.
 
-Dynamic subscriptions use the same reconciliation owner. Durable bindings retain
-the logical subscription definition and trusted Actor/Tenant facts only; native streams are
-ephemeral per-node work. Nodes may be added, removed, or re-added without
+Dynamic subscriptions use the same reconciliation process. Durable bindings retain
+the logical subscription definition, trusted Actor/Tenant facts, and stable reader
+identity; native streams and changing authority facts are per-process data.
+Nodes may be added, removed, or re-added without
 changing a durable definition. Notifications are best effort, may duplicate,
 and browser clients reconnect and re-query authoritative state after loss.
 

package/dist/gateway/dynamic-unary-forwarder.d.ts

@@ -52,13 +52,67 @@ export declare class DynamicUnaryForwarder implements UnaryForwarder {
      * @param options Configures discovery clients and resource bounds.
      */
     constructor(options: DynamicUnaryOptions);
+    /**
+     * Records the native child definition and its admitted logical reader.
+     *
+     * @param definition The serialized logical subscription definition.
+     * @param node Selected managed application node.
+     * @returns The child subscription definition.
+     */
+    private childDefinition;
     /**
      * Builds membership operations for one connected gateway client.
      *
      * @param client The connected gateway client.
      * @returns The member's forwarding and subscription operations.
      */
-    private static memberClient;
+    private memberClient;
+    /**
+     * Removes one native child and then retires its reader associations.
+     *
+     * @param client Connected member client that created this child.
+     * @param child Backend-issued child envelope.
+     * @param signal Cancellation signal for native disposal.
+     * @returns Completion after native disposal and reader cleanup.
+     */
+    private disposeChild;
+    /**
+     * Starts a native child and tracks an assigned ID for its admitted reader.
+     *
+     * @param client Native subscription client.
+     * @param definition The serialized subscription definition.
+     * @param signal The cancellation signal for this operation.
+     * @returns The managed-child subscription.
+     */
+    private subscribeChild;
+    /**
+     * Finds detached reader facts for one retained logical or native child definition.
+     *
+     * @param bytes The serialized message bytes.
+     * @returns The persisted reader binding field.
+     */
+    private readerField;
+    /**
+     * Records a backend-assigned child ID to its admitted logical reader.
+     *
+     * @param association Native child attempt that produced the backend ID.
+     * @param produced Backend update produced for a subscription.
+     */
+    private rememberProducedChild;
+    /**
+     * Records one child ID with its attempt and current logical reader.
+     *
+     * @param association Native child attempt that introduced the ID.
+     * @param childId Initial or backend-issued child ID.
+     * @param reader Current verified reader facts, if supplied.
+     */
+    private associateChildId;
+    /**
+     * Removes only IDs still associated with this retired child attempt.
+     *
+     * @param association Native child attempt after successful disposal.
+     */
+    private retireChild;
     /**
      * Checks a response-only successful child activation acknowledgement.
      *
@@ -117,8 +171,7 @@ export declare class DynamicUnaryForwarder implements UnaryForwarder {
      * @param wire Supplies the public subscription wire.
      * @param updates Receives relayed subscription updates.
      * @param signal Cancels update relay.
-     * @returns Completion after cancellation; rejects on unexpected child failure, possibly
-     * including bounded cleanup failure.
+     * @returns Completion after cancellation; rejects on unexpected child or bounded cleanup failure.
      */
     activateDefinition(wire: PublicSubscriptionWire, updates: SubscriptionUpdateSink, signal: AbortSignal): Promise<void>;
     /**
@@ -129,6 +182,12 @@ export declare class DynamicUnaryForwarder implements UnaryForwarder {
      * @returns Completion of child cleanup.
      */
     cancelDefinition(wire: PublicSubscriptionWire, signal: AbortSignal): Promise<void>;
+    /**
+     * Updates current reader facts for a retained definition and its native children.
+     *
+     * @param wire The admitted definition with current verified reader facts.
+     */
+    private rememberReader;
     /**
      * Resolves when the supplied signal aborts.
      *

package/dist/gateway/dynamic-unary-forwarder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-unary-forwarder.d.ts","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAEV,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc,EAAE,mBAAmB;IAG7E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE7F;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAED;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,cAAc;;IAQ1D;;;;OAIG;gBACS,OAAO,EAAE,mBAAmB;IAkCxC;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,YAAY;IA4B3B;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IASnC;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAM/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAItB;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,EACnB,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;OAMG;IACG,mBAAmB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;;;;OAQG;IACH,kBAAkB,CAChB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC;IAIhB;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIlF;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAI3D;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,UAAU;CAiB7E"}
+{"version":3,"file":"dynamic-unary-forwarder.d.ts","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAeA,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AAMjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAM1C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,KAAK,EAEV,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EAEvB,MAAM,2BAA2B,CAAC;AAEnC;;;;GAIG;AACH,MAAM,WAAW,kBAAmB,SAAQ,cAAc,EAAE,mBAAmB;IAG7E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAE7F;;OAEG;IACH,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAEtC;;OAEG;IACH,QAAQ,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC;IAE1C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC;CAC7B;AAWD;;;GAGG;AACH,qBAAa,qBAAsB,YAAW,cAAc;;IAkB1D;;;;OAIG;gBACS,OAAO,EAAE,mBAAmB;IAgCxC;;;;;;OAMG;IACH,OAAO,CAAC,eAAe;IAavB;;;;;OAKG;IACH,OAAO,CAAC,YAAY;IA2BpB;;;;;;;OAOG;YACW,YAAY;IAiB1B;;;;;;;OAOG;IACH,OAAO,CAAC,cAAc;IAsBtB;;;;;OAKG;IACH,OAAO,CAAC,WAAW;IAWnB;;;;;OAKG;IACH,OAAO,CAAC,qBAAqB;IAY7B;;;;;;OAMG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;;OAIG;IACH,OAAO,CAAC,WAAW;IAWnB;;;;;OAKG;IACH,OAAO,CAAC,MAAM,CAAC,eAAe;IAK9B;;;;;;OAMG;IACH,OAAO,CAAC,MAAM,CAAC,oBAAoB;IASnC;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;IAM/E;;;;OAIG;IACH,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQtB;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,EACnB,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;OAMG;IACG,mBAAmB,CACvB,OAAO,EAAE,sBAAsB,EAC/B,uBAAuB,CAAC,EAAE,MAAM,GAC/B,OAAO,CAAC,IAAI,CAAC;IAYhB;;;;;;;OAOG;IACH,kBAAkB,CAChB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,WAAW,GAClB,OAAO,CAAC,IAAI,CAAC;IAKhB;;;;;;OAMG;IACH,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAclF;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAStB;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvD;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,SAAS;IAI3D;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,eAAe,GAAG,UAAU;CAsB7E"}

package/dist/gateway/dynamic-unary-forwarder.js

@@ -15,11 +15,17 @@ import { clone, fromBinary, toBinary } from "@bufbuild/protobuf";
 import { ApplicationNode } from "@spine-event-engine/deployment";
 import { BackendMembershipKernel, } from "@spine-event-engine/deployment/spi/backend-membership";
 import { SubscriptionSchema, SubscriptionUpdateSchema } from "@spine-event-engine/proto/client";
+import { snapshotTrustedReader, } from "@spine-event-engine/core/spi/trusted-reader";
 /**
  * Adapts Gateway unary operations to the deployment-owned membership kernel.
  * Durable logical ownership remains in the Gateway's subscription bindings.
  */
 export class DynamicUnaryForwarder {
+    #readers = new Map();
+    #children = new Map();
+    #associationsById = new Map();
+    #pendingAssociations = new WeakMap();
+    #activeAssociations = new WeakMap();
     #kernel;
     /**
      * Creates the Gateway adapter around the deployment membership kernel.
@@ -32,11 +38,11 @@ export class DynamicUnaryForwarder {
                 options.maxBackendEnvelopeBytes < 1))
             throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
         this.#kernel = new BackendMembershipKernel({
-            create: async (node, signal) => DynamicUnaryForwarder.memberClient(await options.create(node, signal)),
+            create: async (node, signal) => this.memberClient(await options.create(node, signal)),
             memberKey: (node) => node.id,
             sameMember: (left, right) => left.endpoint === right.endpoint && left.tlsServerName === right.tlsServerName,
             definitionKey: (definition) => DynamicUnaryForwarder.definitionKey(definition),
-            childDefinition: (definition, node) => DynamicUnaryForwarder.childDefinition(definition, node),
+            childDefinition: (definition, node) => this.childDefinition(definition, node),
             childSize: (child) => child.bytes.byteLength,
             isActivationAck: (update) => DynamicUnaryForwarder.isActivationAck(update),
             logicalActivationAck: (definition, childAck) => DynamicUnaryForwarder.logicalActivationAck(definition, childAck),
@@ -48,24 +54,159 @@ export class DynamicUnaryForwarder {
                 : { maxChildBytes: options.maxBackendEnvelopeBytes }),
         });
     }
+    /**
+     * Records the native child definition and its admitted logical reader.
+     *
+     * @param definition The serialized logical subscription definition.
+     * @param node Selected managed application node.
+     * @returns The child subscription definition.
+     */
+    childDefinition(definition, node) {
+        const child = DynamicUnaryForwarder.childDefinition(definition, node);
+        const logicalId = DynamicUnaryForwarder.definitionKey(definition);
+        const reader = this.#readers.get(logicalId ?? "");
+        const childId = DynamicUnaryForwarder.definitionKey(child);
+        if (logicalId !== undefined && childId !== undefined) {
+            const association = { logicalId, initialId: childId, ids: new Set() };
+            this.#pendingAssociations.set(child, association);
+            this.associateChildId(association, childId, reader);
+        }
+        return child;
+    }
     /**
      * Builds membership operations for one connected gateway client.
      *
      * @param client The connected gateway client.
      * @returns The member's forwarding and subscription operations.
      */
-    static memberClient(client) {
+    memberClient(client) {
         return {
             forward: (request) => client.forward(request),
-            subscribe: (definition, signal) => client.subscribe({ kind: "public-subscription", bytes: definition.slice() }, signal),
+            subscribe: (definition, signal) => this.subscribeChild(client, definition, signal),
             activate: (child, updates, signal) => client.activate({
-                wire: { kind: "backend-subscription-envelope", bytes: child.bytes.slice() },
+                wire: {
+                    kind: "backend-subscription-envelope",
+                    bytes: child.bytes.slice(),
+                    ...this.readerField(child.bytes),
+                },
                 updates,
             }, signal),
-            dispose: (child, signal) => client.dispose({ kind: "backend-subscription-envelope", bytes: child.bytes.slice() }, signal),
+            dispose: (child, signal) => this.disposeChild(client, child, signal),
             close: () => client.close(),
         };
     }
+    /**
+     * Removes one native child and then retires its reader associations.
+     *
+     * @param client Connected member client that created this child.
+     * @param child Backend-issued child envelope.
+     * @param signal Cancellation signal for native disposal.
+     * @returns Completion after native disposal and reader cleanup.
+     */
+    async disposeChild(client, child, signal) {
+        await client.dispose({
+            kind: "backend-subscription-envelope",
+            bytes: child.bytes.slice(),
+            ...this.readerField(child.bytes),
+        }, signal);
+        const association = this.#activeAssociations.get(child);
+        if (association !== undefined)
+            this.retireChild(association);
+    }
+    /**
+     * Starts a native child and tracks an assigned ID for its admitted reader.
+     *
+     * @param client Native subscription client.
+     * @param definition The serialized subscription definition.
+     * @param signal The cancellation signal for this operation.
+     * @returns The managed-child subscription.
+     */
+    subscribeChild(client, definition, signal) {
+        const reader = this.readerField(definition);
+        const association = this.#pendingAssociations.get(definition);
+        const result = client.subscribe({ kind: "public-subscription", bytes: definition.slice(), ...reader }, signal);
+        return result.then((child) => {
+            if (association !== undefined) {
+                this.#activeAssociations.set(child, association);
+                this.rememberProducedChild(association, child.bytes);
+            }
+            return child;
+        }, (error) => {
+            if (association !== undefined)
+                this.retireChild(association);
+            throw error;
+        });
+    }
+    /**
+     * Finds detached reader facts for one retained logical or native child definition.
+     *
+     * @param bytes The serialized message bytes.
+     * @returns The persisted reader binding field.
+     */
+    readerField(bytes) {
+        let id;
+        try {
+            id = DynamicUnaryForwarder.definitionKey(bytes);
+        }
+        catch {
+            return {};
+        }
+        const reader = this.#readers.get(id ?? "");
+        return reader === undefined ? {} : { reader: snapshotTrustedReader(reader) };
+    }
+    /**
+     * Records a backend-assigned child ID to its admitted logical reader.
+     *
+     * @param association Native child attempt that produced the backend ID.
+     * @param produced Backend update produced for a subscription.
+     */
+    rememberProducedChild(association, produced) {
+        if (this.#associationsById.get(association.initialId) !== association)
+            return;
+        let producedId;
+        try {
+            producedId = DynamicUnaryForwarder.definitionKey(produced);
+        }
+        catch {
+            return;
+        }
+        if (producedId === undefined)
+            return;
+        this.associateChildId(association, producedId, this.#readers.get(association.initialId));
+    }
+    /**
+     * Records one child ID with its attempt and current logical reader.
+     *
+     * @param association Native child attempt that introduced the ID.
+     * @param childId Initial or backend-issued child ID.
+     * @param reader Current verified reader facts, if supplied.
+     */
+    associateChildId(association, childId, reader) {
+        association.ids.add(childId);
+        const children = this.#children.get(association.logicalId) ?? new Set();
+        children.add(childId);
+        this.#children.set(association.logicalId, children);
+        this.#associationsById.set(childId, association);
+        if (reader !== undefined)
+            this.#readers.set(childId, reader);
+    }
+    /**
+     * Removes only IDs still associated with this retired child attempt.
+     *
+     * @param association Native child attempt after successful disposal.
+     */
+    retireChild(association) {
+        const children = this.#children.get(association.logicalId);
+        for (const id of association.ids) {
+            if (this.#associationsById.get(id) !== association)
+                continue;
+            this.#associationsById.delete(id);
+            this.#readers.delete(id);
+            children?.delete(id);
+        }
+        if (children?.size === 0)
+            this.#children.delete(association.logicalId);
+    }
     /**
      * Checks a response-only successful child activation acknowledgement.
      *
@@ -114,7 +255,11 @@ export class DynamicUnaryForwarder {
      * @returns Completion of backend cleanup.
      */
     close() {
-        return this.#kernel.close();
+        return this.#kernel.close().finally(() => {
+            this.#readers.clear();
+            this.#children.clear();
+            this.#associationsById.clear();
+        });
     }
     /**
      * Creates backend children for one logical Gateway subscription.
@@ -128,6 +273,7 @@ export class DynamicUnaryForwarder {
         if (maxBackendEnvelopeBytes !== undefined &&
             (!Number.isSafeInteger(maxBackendEnvelopeBytes) || maxBackendEnvelopeBytes < 1))
             throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
+        this.rememberReader(request);
         return this.#kernel
             .subscribe(request.bytes, signal, maxBackendEnvelopeBytes)
             .catch((error) => DynamicUnaryForwarder.#gatewayError(error));
@@ -143,6 +289,7 @@ export class DynamicUnaryForwarder {
         if (maxBackendEnvelopeBytes !== undefined &&
             (!Number.isSafeInteger(maxBackendEnvelopeBytes) || maxBackendEnvelopeBytes < 1))
             throw new RangeError("maxBackendEnvelopeBytes must be a positive safe integer.");
+        this.rememberReader(request);
         await this.#kernel
             .rehydrate(request.bytes, maxBackendEnvelopeBytes)
             .catch((error) => DynamicUnaryForwarder.#gatewayError(error));
@@ -153,10 +300,10 @@ export class DynamicUnaryForwarder {
      * @param wire Supplies the public subscription wire.
      * @param updates Receives relayed subscription updates.
      * @param signal Cancels update relay.
-     * @returns Completion after cancellation; rejects on unexpected child failure, possibly
-     * including bounded cleanup failure.
+     * @returns Completion after cancellation; rejects on unexpected child or bounded cleanup failure.
      */
     activateDefinition(wire, updates, signal) {
+        this.rememberReader(wire);
         return this.#kernel.activate(wire.bytes, updates, signal);
     }
     /**
@@ -167,7 +314,34 @@ export class DynamicUnaryForwarder {
      * @returns Completion of child cleanup.
      */
     cancelDefinition(wire, signal) {
-        return this.#kernel.cancel(wire.bytes, signal);
+        this.rememberReader(wire);
+        return this.#kernel.cancel(wire.bytes, signal).then(() => {
+            const id = DynamicUnaryForwarder.definitionKey(wire.bytes);
+            if (id === undefined)
+                return;
+            this.#readers.delete(id);
+            for (const childId of this.#children.get(id) ?? []) {
+                this.#readers.delete(childId);
+                this.#associationsById.delete(childId);
+            }
+            this.#children.delete(id);
+        });
+    }
+    /**
+     * Updates current reader facts for a retained definition and its native children.
+     *
+     * @param wire The admitted definition with current verified reader facts.
+     */
+    rememberReader(wire) {
+        if (wire.reader === undefined)
+            return;
+        const id = DynamicUnaryForwarder.definitionKey(wire.bytes);
+        if (id === undefined)
+            return;
+        const reader = snapshotTrustedReader(wire.reader);
+        this.#readers.set(id, reader);
+        for (const childId of this.#children.get(id) ?? [])
+            this.#readers.set(childId, reader);
     }
     /**
      * Resolves when the supplied signal aborts.
@@ -205,6 +379,11 @@ export class DynamicUnaryForwarder {
         subscriptionId.value = `${id}/${node.id}`;
         return toBinary(SubscriptionSchema, subscription);
     }
+    /**
+     * Sanitizes a gateway failure before returning it to the caller.
+     *
+     * @param error The failure being classified or propagated.
+     */
     static #gatewayError(error) {
         if (error instanceof Error && error.message === "backend membership is unavailable.")
             throw new Error("Gateway backend is absent.");

package/dist/gateway/dynamic-unary-forwarder.js.map

@@ -1 +1 @@
-{"version":3,"file":"dynamic-unary-forwarder.js","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AA2DhG;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACvB,OAAO,CAKd;IAEF;;;;OAIG;IACH,YAAY,OAA4B;QACtC,IACE,OAAO,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBACrD,OAAO,CAAC,uBAAuB,GAAG,CAAC,CAAC;YAEtC,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAKxC;YACA,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAC7B,qBAAqB,CAAC,YAAY,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACxE,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;YAC5B,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAChF,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC;YAC9E,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CACpC,qBAAqB,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC;YACzD,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU;YAC5C,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,MAAM,CAAC;YAC1E,oBAAoB,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAC7C,qBAAqB,CAAC,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,uBAAuB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,YAAY,CACzB,MAA0B;QAM1B,OAAO;YACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAChC,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC;YACtF,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,QAAQ,CACb;gBACE,IAAI,EAAE,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE;gBAC3E,OAAO;aACR,EACD,MAAM,CACP;YACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CACzB,MAAM,CAAC,OAAO,CACZ,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EACrE,MAAM,CACP;YACH,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,eAAe,CAAC,MAA8B;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC7F,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,oBAAoB,CACjC,UAAsB,EACtB,QAAgC;QAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5F,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAiC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAiD;QACvD,OAAO,IAAI,CAAC,OAAO;aAChB,OAAO,CAAC,OAAO,CAAC;aAChB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAA+B,EAC/B,MAAmB,EACnB,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC,OAAO;aAChB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,CAAC;aACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAA+B,EAC/B,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,MAAM,IAAI,CAAC,OAAO;aACf,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;OAQG;IACH,kBAAkB,CAChB,IAA4B,EAC5B,OAA+B,EAC/B,MAAmB;QAEnB,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,IAA4B,EAAE,MAAmB;QAChE,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAmB;QACrC,OAAO,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAiB;QACpC,OAAO,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAiB,EAAE,IAAqB;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAClC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,YAAY,CAAC,EAAE,CAAC;QACvC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACvD,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,KAAc;QACjC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,oCAAoC;YAClF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC;YACpF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;CACF"}
+{"version":3,"file":"dynamic-unary-forwarder.js","sourceRoot":"","sources":["../../src/gateway/dynamic-unary-forwarder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EACL,uBAAuB,GAExB,MAAM,uDAAuD,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEhG,OAAO,EACL,qBAAqB,GAEtB,MAAM,6CAA6C,CAAC;AAmErD;;;GAGG;AACH,MAAM,OAAO,qBAAqB;IACvB,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAC;IAEnD,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;IAE3C,iBAAiB,GAAG,IAAI,GAAG,EAAkC,CAAC;IAE9D,oBAAoB,GAAG,IAAI,OAAO,EAAsC,CAAC;IAEzE,mBAAmB,GAAG,IAAI,OAAO,EAAuD,CAAC;IAEzF,OAAO,CAKd;IAEF;;;;OAIG;IACH,YAAY,OAA4B;QACtC,IACE,OAAO,CAAC,uBAAuB,KAAK,SAAS;YAC7C,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,uBAAuB,CAAC;gBACrD,OAAO,CAAC,uBAAuB,GAAG,CAAC,CAAC;YAEtC,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,IAAI,CAAC,OAAO,GAAG,IAAI,uBAAuB,CAKxC;YACA,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACrF,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE;YAC5B,UAAU,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAC1B,IAAI,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAChF,aAAa,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC;YAC9E,eAAe,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC;YAC7E,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU;YAC5C,eAAe,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,qBAAqB,CAAC,eAAe,CAAC,MAAM,CAAC;YAC1E,oBAAoB,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,EAAE,CAC7C,qBAAqB,CAAC,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,mBAAmB,KAAK,SAAS;gBAC3C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,EAAE,CAAC;YACzD,GAAG,CAAC,OAAO,CAAC,uBAAuB,KAAK,SAAS;gBAC/C,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,uBAAuB,EAAE,CAAC;SACxD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,eAAe,CAAC,UAAsB,EAAE,IAAqB;QACnE,MAAM,KAAK,GAAG,qBAAqB,CAAC,eAAe,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,qBAAqB,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACrD,MAAM,WAAW,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;YAC9E,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAClB,MAA0B;QAM1B,OAAO;YACL,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;YAC7C,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC;YAClF,QAAQ,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,QAAQ,CACb;gBACE,IAAI,EAAE;oBACJ,IAAI,EAAE,+BAA+B;oBACrC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;oBAC1B,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;iBACjC;gBACD,OAAO;aACR,EACD,MAAM,CACP;YACH,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;YACpE,KAAK,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE;SAC5B,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CACxB,MAA0B,EAC1B,KAAkC,EAClC,MAAmB;QAEnB,MAAM,MAAM,CAAC,OAAO,CAClB;YACE,IAAI,EAAE,+BAA+B;YACrC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE;YAC1B,GAAG,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC;SACjC,EACD,MAAM,CACP,CAAC;QACF,MAAM,WAAW,GAAG,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxD,IAAI,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;;OAOG;IACK,cAAc,CAAC,MAA0B,EAAE,UAAsB,EAAE,MAAmB;QAC5F,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAC7B,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EACrE,MAAM,CACP,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;YACR,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;gBACjD,IAAI,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,EACD,CAAC,KAAc,EAAE,EAAE;YACjB,IAAI,WAAW,KAAK,SAAS;gBAAE,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7D,MAAM,KAAK,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACK,WAAW,CAAC,KAAiB;QACnC,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED;;;;;OAKG;IACK,qBAAqB,CAAC,WAAmC,EAAE,QAAoB;QACrF,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,KAAK,WAAW;YAAE,OAAO;QAC9E,IAAI,UAA8B,CAAC;QACnC,IAAI,CAAC;YACH,UAAU,GAAG,qBAAqB,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;QACD,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO;QACrC,IAAI,CAAC,gBAAgB,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CACtB,WAAmC,EACnC,OAAe,EACf,MAAwC;QAExC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QAChF,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QACpD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC/D,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,WAAmC;QACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC3D,KAAK,MAAM,EAAE,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACjC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,WAAW;gBAAE,SAAS;YAC7D,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QACD,IAAI,QAAQ,EAAE,IAAI,KAAK,CAAC;YAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACzE,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,eAAe,CAAC,MAA8B;QAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,wBAAwB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC7F,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,oBAAoB,CACjC,UAAsB,EACtB,QAAgC;QAEhC,MAAM,MAAM,GAAG,UAAU,CAAC,wBAAwB,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,CAAC,YAAY,GAAG,UAAU,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,QAAQ,CAAC,wBAAwB,EAAE,MAAM,CAAC,EAAE,CAAC;IAC5F,CAAC;IAED;;;;;OAKG;IACH,SAAS,CAAC,KAAiC;QACzC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,OAAiD;QACvD,OAAO,IAAI,CAAC,OAAO;aAChB,OAAO,CAAC,OAAO,CAAC;aAChB,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;OAIG;IACH,KAAK;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACvC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QACjC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CACjB,OAA+B,EAC/B,MAAmB,EACnB,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC,OAAO;aAChB,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,uBAAuB,CAAC;aACzD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CACvB,OAA+B,EAC/B,uBAAgC;QAEhC,IACE,uBAAuB,KAAK,SAAS;YACrC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,CAAC,IAAI,uBAAuB,GAAG,CAAC,CAAC;YAE/E,MAAM,IAAI,UAAU,CAAC,0DAA0D,CAAC,CAAC;QACnF,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,OAAO;aACf,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,uBAAuB,CAAC;aACjD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE,CAAC,qBAAqB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;OAOG;IACH,kBAAkB,CAChB,IAA4B,EAC5B,OAA+B,EAC/B,MAAmB;QAEnB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;OAMG;IACH,gBAAgB,CAAC,IAA4B,EAAE,MAAmB;QAChE,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;YACvD,MAAM,EAAE,GAAG,qBAAqB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC3D,IAAI,EAAE,KAAK,SAAS;gBAAE,OAAO;YAC7B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC9B,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,CAAC;YACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,IAA4B;QACjD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO;QACtC,MAAM,EAAE,GAAG,qBAAqB,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,EAAE,KAAK,SAAS;YAAE,OAAO;QAC7B,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzF,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,YAAY,CAAC,MAAmB;QACrC,OAAO,uBAAuB,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,aAAa,CAAC,KAAiB;QACpC,OAAO,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,CAAC;IACzD,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,eAAe,CAAC,KAAiB,EAAE,IAAqB;QAC7D,MAAM,YAAY,GAAG,KAAK,CAAC,kBAAkB,EAAE,UAAU,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC;QACtF,MAAM,EAAE,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,CAAC;QAClC,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QAC9D,MAAM,cAAc,GAAG,YAAY,CAAC,EAAE,CAAC;QACvC,IAAI,cAAc,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;QACvD,cAAc,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC,kBAAkB,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,aAAa,CAAC,KAAc;QACjC,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,oCAAoC;YAClF,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,sCAAsC;YACpF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,MAAM,KAAK,CAAC;IACd,CAAC;CACF"}

package/dist/gateway/index.d.ts

@@ -1,4 +1,5 @@
 import type { TypeRegistryLookup } from "@spine-event-engine/core";
+import { type TrustedReaderContext } from "@spine-event-engine/core/spi/trusted-reader";
 import type { AuthorizationPolicy, Clock, ContextResolver, RequestCredential, SessionResolver, TransportRequestContext } from "../index.js";
 /**
  * Owned request bytes and canonical operation identity accepted by the B2 gateway.
@@ -43,6 +44,10 @@ export interface UnaryForwarder {
         readonly service: string;
         readonly method: string;
         readonly value: Uint8Array;
+        /**
+         * Verified reader data, detached from the session and context resolver.
+         */
+        readonly reader?: TrustedReaderContext;
         readonly signal?: AbortSignal;
     }): Promise<Uint8Array>;
 }

package/dist/gateway/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gateway/index.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,KAAK,EAEV,mBAAmB,EACnB,KAAK,EACL,eAAe,EAGf,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEpD;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAC/B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;CAC7B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAErD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,WAAW,GACX,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,CAAC;AAoBN;;GAEG;AACH,qBAAa,YAAY;;IAGvB;;;;OAIG;gBACS,OAAO,EAAE,mBAAmB;IAQxC;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA+FxE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/gateway/index.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,6CAA6C,CAAC;AACrD,OAAO,KAAK,EAEV,mBAAmB,EACnB,KAAK,EACL,eAAe,EAIf,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACxB,MAAM,aAAa,CAAC;AAGrB;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAGlC;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IAEpD;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,uBAAuB,CAAC;IAE5C;;OAEG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAG7B;;;;;OAKG;IACH,OAAO,CAAC,OAAO,EAAE;QACf,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;QAE3B;;WAEG;QACH,QAAQ,CAAC,MAAM,CAAC,EAAE,oBAAoB,CAAC;QACvC,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;KAC/B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CACzB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC;CAC/B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,YAAY,EAAE,IAAI,CAAC;CAC7B,CAAC;AAEN;;;;;GAKG;AACH,MAAM,WAAW,yBAAyB;IAGxC;;OAEG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,kBAAkB,CAAC;IAEvC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IAEjC;;OAEG;IACH,QAAQ,CAAC,SAAS,EAAE,mBAAmB,CAAC,WAAW,CAAC,CAAC;IAErD;;OAEG;IACH,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IAEnC;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IAEtB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;CAC7C;AAED;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;AAE/E;;GAEG;AACH,MAAM,MAAM,qBAAqB,GAC7B,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,WAAW,GACX,eAAe,CAAC;AAEpB;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAC1B;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAE3B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B,GACD;IAGE;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAC;CACxC,CAAC;AAqCN;;GAEG;AACH,qBAAa,YAAY;;IAGvB;;;;OAIG;gBACS,OAAO,EAAE,mBAAmB;IAQxC;;;;;OAKG;IACG,MAAM,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA6JxE"}