instar 1.3.1607 → 1.3.1609

package/dist/server/DesktopMeshBroker.d.ts

@@ -1,9 +1,15 @@
 import type { PeerEndpointKind } from './peerUrlGuard.js';
 import type { RopeResultRecorder } from './poolPeerFetch.js';
+import { type DesktopRope } from './desktopPeerRopeFetch.js';
 interface DesktopPeer {
     machineId: string;
     url: string;
     kind: PeerEndpointKind;
+    ropes?: DesktopRope[];
+    ropeRefusals?: Array<{
+        url: string;
+        kind: PeerEndpointKind;
+    }>;
 }
 export interface DesktopMeshBrokerDeps {
     selfMachineId: string;
@@ -13,6 +19,8 @@ export interface DesktopMeshBrokerDeps {
     now?: () => number;
     fetch?: typeof fetch;
     recordRopeResult?: RopeResultRecorder;
+    /** Test seam for the per-rope TCP reachability check (defaults to a real connect). */
+    ropeConnectCheck?: (url: string, timeoutMs: number) => Promise<boolean>;
     onForget?: (requestId: string) => void;
     /** A new front process waits out target delegated-session liveness from a
      * previous incarnation before admitting fresh pool reservations. */

package/dist/server/DesktopMeshBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopMeshBroker.d.ts","sourceRoot":"","sources":["../../src/server/DesktopMeshBroker.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAE1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,UAAU,WAAW;IAAG,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAUhF,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,WAAW,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;wEACoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED;+EAC+E;AAC/E,qBAAa,iBAAiB;IAShB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8E;IACtG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,MAAM,CAAS;IAEvB,YAA6B,CAAC,EAAE,qBAAqB,EAIpD;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAyC;IAC/E,aAAa,IAAI,MAAM,CAAiC;IAElD,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAC1E,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1G,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CA2CjC;IAEK,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EACxD,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwCrE;IAED,+EAA+E;IACzE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EACvD,SAAS,EAAE,iBAAiB,GAAG,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQtH;IAED,4EAA4E;IACtE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEtE;IAED,2DAA2D;IAC3D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAKvE;IAED,KAAK,IAAI,IAAI,CAGZ;YAEa,OAAO;IAkCrB,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,MAAM;YAYA,IAAI;YAQJ,IAAI;IAwClB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW;CAGpB"}
+{"version":3,"file":"DesktopMeshBroker.d.ts","sourceRoot":"","sources":["../../src/server/DesktopMeshBroker.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAE1G,UAAU,WAAW;IACnB,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAC;IACvD,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IAAC,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;CACtF;AAUD,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,WAAW,EAAE,CAAC;IAC3B,kBAAkB,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,gBAAgB,CAAC,EAAE,kBAAkB,CAAC;IACtC,sFAAsF;IACtF,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACxE,QAAQ,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACvC;wEACoE;IACpE,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAKD;+EAC+E;AAC/E,qBAAa,iBAAiB;IAShB,OAAO,CAAC,QAAQ,CAAC,CAAC;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAoC;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8E;IACtG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAe;IACvC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAS;IAC1C,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,MAAM,CAAS;IAEvB,YAA6B,CAAC,EAAE,qBAAqB,EAIpD;IAED,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAyC;IAC/E,aAAa,IAAI,MAAM,CAAiC;IAElD,KAAK,CAAC,iBAAiB,EAAE,MAAM,EAAE,KAAK,EAAE;QAC5C,SAAS,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,oBAAoB,EAAE,MAAM,CAAC;QAC1E,YAAY,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KAC1G,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CA2CjC;IAEK,OAAO,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EACxD,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EAC5E,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CA2CrE;IAED,+EAA+E;IACzE,MAAM,CAAC,iBAAiB,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EACvD,SAAS,EAAE,iBAAiB,GAAG,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQtH;IAED,4EAA4E;IACtE,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAEtE;IAED,2DAA2D;IAC3D,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAKvE;IAED,KAAK,IAAI,IAAI,CAGZ;YAEa,OAAO;IAkCrB,OAAO,CAAC,OAAO;IASf,OAAO,CAAC,MAAM;YAYA,IAAI;YAMJ,IAAI;IA8ClB,OAAO,CAAC,MAAM;IACd,OAAO,CAAC,WAAW;CAGpB"}

package/dist/server/DesktopMeshBroker.js

@@ -2,7 +2,9 @@ import { createHash, timingSafeEqual } from 'node:crypto';
 import { mintDesktopLockedAssertion, mintDesktopOperatorAssertion } from '../core/DesktopOperatorAssertion.js';
 import { sign as signMachinePayload } from '../core/MachineIdentity.js';
 import { signRequest } from './machineAuth.js';
-import { desktopPeerUrlAllowed } from './DesktopPeerUrlGate.js';
+import { desktopPeerRopes, fetchDesktopPeerOverRopes } from './desktopPeerRopeFetch.js';
+/** Which rope answered a post — read only for the stream-relay ticket. */
+const ANSWERED_URL = Symbol('desktop-answered-url');
 /** Dashboard front for remote desktop. It handles routing and PIN-session
  * attestation, while the target alone mints grants and encrypts the stream. */
 export class DesktopMeshBroker {
@@ -112,7 +114,10 @@ export class DesktopMeshBroker {
                 || result.ticket.length < 16 || result.ticket.length > 256) {
                 throw new Error('desktop target ticket invalid');
             }
-            this.tickets.set(result.ticket, { requestId, url: peer.url, expiresAtMs: this.now() + 20_000 });
+            // The relay connects to the rope that actually answered, not the first one listed.
+            const answered = result[ANSWERED_URL];
+            const answeredUrl = typeof answered === 'string' ? answered : peer.url;
+            this.tickets.set(result.ticket, { requestId, url: answeredUrl, expiresAtMs: this.now() + 20_000 });
         }
         if (operation === 'status' && result.status === 'revoked')
             this.forget(requestId);
@@ -212,28 +217,30 @@ export class DesktopMeshBroker {
     }
     async peer(machineId) {
         const peer = this.d.peers().find(candidate => candidate.machineId === machineId);
-        if (!peer || !await desktopPeerUrlAllowed(peer)) {
+        if (!peer)
             throw new Error('desktop target unavailable');
-        }
         return peer;
     }
     async post(peer, endpoint, body, signal) {
-        const started = this.now();
+        // Every rope in order, signed once: a rope is skipped only when the request
+        // provably never reached a server; any HTTP reply is the target's answer.
         let response;
+        let rope;
         try {
-            response = await this.doFetch(new URL(endpoint, peer.url).toString(), {
-                method: 'POST', headers: { 'Content-Type': 'application/json',
-                    ...signRequest(this.d.selfMachineId, this.d.signingKeyPem, body) },
-                body: JSON.stringify(body), redirect: 'manual',
-                signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(3_000)]) : AbortSignal.timeout(3_000),
-            });
-            if (peer.kind !== 'last-known-url') {
-                this.d.recordRopeResult?.(peer.machineId, peer.kind, true, this.now() - started, peer.url);
-            }
+            ({ response, rope } = await fetchDesktopPeerOverRopes({
+                machineId: peer.machineId, ropes: desktopPeerRopes(peer), path: endpoint,
+                init: {
+                    method: 'POST', headers: { 'Content-Type': 'application/json',
+                        ...signRequest(this.d.selfMachineId, this.d.signingKeyPem, body) },
+                    body: JSON.stringify(body), redirect: 'manual',
+                },
+                budgetMs: 3_000, connectCheckCapMs: 1_000, signal, record: this.d.recordRopeResult,
+                fetchImpl: this.doFetch, now: this.now, connectCheck: this.d.ropeConnectCheck,
+            }));
         }
         catch (error) {
-            if (peer.kind !== 'last-known-url') {
-                this.d.recordRopeResult?.(peer.machineId, peer.kind, false, this.now() - started, peer.url);
+            if (error instanceof Error && error.message === 'desktop-peer-unreachable') {
+                throw new Error('desktop target unavailable');
             }
             throw error;
         }
@@ -263,7 +270,10 @@ export class DesktopMeshBroker {
         const parsed = JSON.parse(raw);
         if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
             throw new Error('desktop target response invalid');
-        return parsed;
+        const reply = parsed;
+        // Non-enumerable, so it never leaks into a caller's JSON reply.
+        Object.defineProperty(reply, ANSWERED_URL, { value: rope.url, enumerable: false });
+        return reply;
     }
     digest(value) { return createHash('sha256').update(value).digest('hex'); }
     equalDigest(left, right) {

package/dist/server/DesktopMeshBroker.js.map

@@ -1 +1 @@
-{"version":3,"file":"DesktopMeshBroker.js","sourceRoot":"","sources":["../../src/server/DesktopMeshBroker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AA2BhE;+EAC+E;AAC/E,MAAM,OAAO,iBAAiB;IASC,CAAC;IARb,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,EAAmE,CAAC;IACrF,GAAG,CAAe;IAClB,OAAO,CAAe;IACtB,gBAAgB,CAAS;IAClC,aAAa,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,CAAwB;iBAAxB,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,UAAU,CAAC,SAAiB,IAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/E,aAAa,KAAa,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAExD,KAAK,CAAC,KAAK,CAAC,iBAAyB,EAAE,KAGtC;QACC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5G,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa;eAC5F,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC;eAC5C,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,GAAG;eACzF,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACL,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,4BAA4B,CAAC;gBAC7C,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS;gBACvE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAC1E,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;aAC1F,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE;gBAClE,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACnD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;gBACxE,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,KAAK,IAAI;aAClG,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;mBACvD,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,EAAE;mBACtF,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC,EAAE,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAmB,CAAC;YAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC9E,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK;gBAC3F,QAAQ,EAAE,IAAI,GAAG,EAAE;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,iBAAyB,EAAE,SAAiB,EACxD,SAA4E,EAC5E,OAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,EAAE;oBACrD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS;iBACjE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,EAAE;gBAC9D,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS;gBAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAC9C,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxG,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;mBACtE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM,CAAC,iBAAyB,EAAE,SAAiB,EACvD,SAA+C,EAAE,QAAiC;QAClF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3H,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,0BAA0B,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;YACtF,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;SAC1F,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,8BAA8B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,2DAA2D;IAC3D,aAAa,CAAC,MAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,iBAAyB;QAChE,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,+BAA+B,EAAE;oBAC/E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;iBAC3E,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,uEAAuE;YACzE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG;gBAAE,OAAO;YAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iCAAiC,EAAE;oBACvD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;iBAC3C,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;oBAAS,CAAC;gBAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,iBAAyB,EAAE,SAAiB;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW;eACpG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,CAAC;YACR,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,QAAQ;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG;YAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7G,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,SAAiB;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,qBAAqB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,QAAgB,EAAE,IAA6B,EAAE,MAAoB;QACzG,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;gBACpE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;oBAC3D,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE;gBACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ;gBAC9C,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACpG,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC7F,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gDAAgD;gBAC1G,CAAC,CAAC,mDAAmD,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAAC,CAAC;YAClG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvH,OAAO,MAAiC,CAAC;IAC3C,CAAC;IAEO,MAAM,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,WAAW,CAAC,IAAY,EAAE,KAAa;QAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;CACF"}
+{"version":3,"file":"DesktopMeshBroker.js","sourceRoot":"","sources":["../../src/server/DesktopMeshBroker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AAC/G,OAAO,EAAE,IAAI,IAAI,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAoB,MAAM,2BAA2B,CAAC;AA+B1G,0EAA0E;AAC1E,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,CAAC,CAAC;AAEpD;+EAC+E;AAC/E,MAAM,OAAO,iBAAiB;IASC,CAAC;IARb,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,OAAO,GAAG,IAAI,GAAG,EAAmE,CAAC;IACrF,GAAG,CAAe;IAClB,OAAO,CAAe;IACtB,gBAAgB,CAAS;IAClC,aAAa,GAAG,CAAC,CAAC;IAClB,MAAM,GAAG,KAAK,CAAC;IAEvB,YAA6B,CAAwB;iBAAxB,CAAC;QAC5B,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC;QAChC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,mBAAmB,IAAI,MAAM,CAAC,CAAC;IACzE,CAAC;IAED,UAAU,CAAC,SAAiB,IAAa,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC/E,aAAa,KAAa,OAAO,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC;IAExD,KAAK,CAAC,KAAK,CAAC,iBAAyB,EAAE,KAGtC;QACC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC5G,0EAA0E;QAC1E,oEAAoE;QACpE,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa;eAC5F,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,CAAC,aAAa,IAAI,CAAC;eAC5C,OAAO,KAAK,CAAC,oBAAoB,KAAK,QAAQ,IAAI,KAAK,CAAC,oBAAoB,CAAC,MAAM,GAAG,GAAG;eACzF,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,EAAE,CAAC;YACpG,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YACL,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC9C,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,4BAA4B,CAAC;gBAC7C,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,KAAK,CAAC,SAAS;gBACvE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;gBAC1E,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;aAC1F,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,6BAA6B,EAAE;gBAClE,SAAS,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACnD,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;gBAChD,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,MAAM;gBACxE,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,KAAK,IAAI;aAClG,CAAC,CAAC;YACH,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;mBACvD,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,EAAE;mBACtF,MAAM,CAAC,kBAAkB,CAAC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,SAAmB,CAAC,EAAE,CAAC;gBAC7F,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;YACD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAmB,CAAC;YAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAC7F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;YAChB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;gBAC3B,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC;gBAC9E,kBAAkB,EAAE,MAAM,CAAC,kBAAkB,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,EAAE,KAAK;gBAC3F,QAAQ,EAAE,IAAI,GAAG,EAAE;aACpB,CAAC,CAAC;YACH,OAAO,EAAE,SAAS,EAAE,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,iBAAyB,EAAE,SAAiB,EACxD,SAA4E,EAC5E,OAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,wEAAwE;YACxE,mEAAmE;YACnE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;gBAC5C,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,EAAE;oBACrD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS;iBACjE,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,qEAAqE;gBACrE,sEAAsE;YACxE,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5C,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxG,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,MAA+B,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,+BAA+B,EAAE;gBAC9D,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS;gBAChE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChC,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAAC,CAAC;QAC9C,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACxG,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC3B,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;mBACtE,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC7D,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YACnD,CAAC;YACD,mFAAmF;YACnF,MAAM,QAAQ,GAAI,MAAkC,CAAC,YAAY,CAAC,CAAC;YACnE,MAAM,WAAW,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YACvE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,IAAI,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM,CAAC,iBAAyB,EAAE,SAAiB,EACvD,SAA+C,EAAE,QAAiC;QAClF,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3H,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,SAAS,GAAG,0BAA0B,CAAC;YAC3C,eAAe,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;YACtF,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;SAC1F,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClF,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CAAC,SAAiB;QAClC,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,8BAA8B,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,2DAA2D;IAC3D,aAAa,CAAC,MAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5F,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;IACpD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvE,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,iBAAyB;QAChE,IAAI,IAAI,CAAC,MAAM;YAAE,OAAO;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACnF,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACvB,qEAAqE;YACrE,0EAA0E;YAC1E,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,+BAA+B,EAAE;oBAC/E,kBAAkB,EAAE,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;iBAC3E,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,gEAAgE;gBAChE,uEAAuE;YACzE,CAAC;YACD,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,GAAG;gBAAE,OAAO;YAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iCAAiC,EAAE;oBACvD,kBAAkB,EAAE,GAAG,CAAC,kBAAkB;iBAC3C,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACxB,CAAC;oBAAS,CAAC;gBAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAAC,CAAC;QAChD,CAAC;QAAC,MAAM,CAAC;YACP,yEAAyE;YACzE,wEAAwE;QAC1E,CAAC;IACH,CAAC;IAEO,OAAO,CAAC,iBAAyB,EAAE,SAAiB;QAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,WAAW;eACpG,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAEO,MAAM,CAAC,SAAiB;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,GAAG,EAAE,CAAC;YACR,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,KAAK,MAAM,UAAU,IAAI,GAAG,CAAC,QAAQ;gBAAE,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1D,GAAG,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAChC,IAAI,GAAG;YAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,CAAC;QACtC,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7G,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,SAAiB;QAClC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;QACjF,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,IAAiB,EAAE,QAAgB,EAAE,IAA6B,EAAE,MAAoB;QACzG,4EAA4E;QAC5E,0EAA0E;QAC1E,IAAI,QAAkB,CAAC;QACvB,IAAI,IAAiB,CAAC;QACtB,IAAI,CAAC;YACH,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,MAAM,yBAAyB,CAAC;gBACpD,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ;gBACxE,IAAI,EAAE;oBACJ,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB;wBAC3D,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE;oBACpE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,QAAQ;iBAC/C;gBACD,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB;gBAClF,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,gBAAgB;aAC9E,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,0BAA0B,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAChD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gDAAgD;gBAC1G,CAAC,CAAC,mDAAmD,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;QAC9D,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACpG,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,SAAS,CAAC;YACR,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;YACzB,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;gBAAC,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAAC,CAAC;YAClG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvH,MAAM,KAAK,GAAG,MAAiC,CAAC;QAChD,gEAAgE;QAChE,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,KAAa,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC1F,WAAW,CAAC,IAAY,EAAE,KAAa;QAC7C,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,CAAC;CACF"}

package/dist/server/desktopPeerRopeFetch.d.ts

@@ -0,0 +1,56 @@
+import type { PeerEndpointKind } from './peerUrlGuard.js';
+import { type RopeResultRecorder } from './poolPeerFetch.js';
+export interface DesktopRope {
+    url: string;
+    kind: PeerEndpointKind;
+}
+/** The shape `resolvePeerUrls()` returns: the selected rope, the ropes the
+ *  credential guard skipped ahead of it, and (when wired) every rope in order. */
+export interface DesktopPeerEntry extends DesktopRope {
+    machineId: string;
+    ropes?: DesktopRope[];
+    ropeRefusals?: Array<{
+        url: string;
+        kind: PeerEndpointKind;
+    }>;
+}
+/** Every rope for this peer, in priority order, de-duplicated by URL. With no
+ *  full list wired, the refused ropes come first: the resolver ranked them
+ *  above the selection. */
+export declare function desktopPeerRopes(peer: DesktopPeerEntry): DesktopRope[];
+/** True only for failures that prove the request never left this machine. */
+export declare function isConnectClassFailure(error: unknown): boolean;
+/** Can a TCP connection to this rope's host and port be opened in time? */
+export declare function tcpConnectCheck(url: string, timeoutMs: number): Promise<boolean>;
+export interface DesktopRopeFetchOptions {
+    machineId: string;
+    ropes: DesktopRope[];
+    path: string;
+    /** Request init without `signal`; the helper supplies the time budget. */
+    init: Omit<RequestInit, 'signal'>;
+    /** Total time for the whole call, every rope and check included. */
+    budgetMs: number;
+    /** Longest a connect check may take before the next rope is tried. */
+    connectCheckCapMs: number;
+    /** Caller cancellation (e.g. a desktop Stop). */
+    signal?: AbortSignal;
+    record?: RopeResultRecorder;
+    fetchImpl?: typeof fetch;
+    allowed?: (rope: DesktopRope) => Promise<boolean>;
+    connectCheck?: (url: string, timeoutMs: number) => Promise<boolean>;
+    now?: () => number;
+}
+export declare class DesktopPeerUnreachableError extends Error {
+    constructor();
+}
+/**
+ * Send one desktop request to a peer over the first rope that carries it.
+ * Returns the response and the rope that answered. Throws
+ * `DesktopPeerUnreachableError` when no rope is admissible or none could be
+ * reached, and rethrows an ambiguous failure from the rope that was in use.
+ */
+export declare function fetchDesktopPeerOverRopes(o: DesktopRopeFetchOptions): Promise<{
+    response: Response;
+    rope: DesktopRope;
+}>;
+//# sourceMappingURL=desktopPeerRopeFetch.d.ts.map

package/dist/server/desktopPeerRopeFetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktopPeerRopeFetch.d.ts","sourceRoot":"","sources":["../../src/server/desktopPeerRopeFetch.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE5E,MAAM,WAAW,WAAW;IAAG,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAEpE;kFACkF;AAClF,MAAM,WAAW,gBAAiB,SAAQ,WAAW;IACnD,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,gBAAgB,CAAA;KAAE,CAAC,CAAC;CAC/D;AAED;;2BAE2B;AAC3B,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,GAAG,WAAW,EAAE,CAYtE;AAOD,6EAA6E;AAC7E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAQ7D;AAED,2EAA2E;AAC3E,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAsBhF;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClC,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,iDAAiD;IACjD,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAClD,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,2BAA4B,SAAQ,KAAK;IACpD,cAA+F;CAChG;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAAC,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC,CAqC9H"}

package/dist/server/desktopPeerRopeFetch.js

@@ -0,0 +1,141 @@
+/**
+ * desktopPeerRopeFetch — remote-desktop calls to a peer machine try EVERY rope
+ * that peer advertises, in the resolver's order, instead of only the first.
+ *
+ * Why this exists. `resolvePeerUrls()` hands each fan-out site ONE selection per
+ * machine: the best rope the ordinary credential guard admits. The desktop gate
+ * (`desktopPeerUrlAllowed`) admits one more rope than that guard — plain-http
+ * Tailscale proven by the local daemon — so for a machine whose Tailscale rope is
+ * the only live one (a Windows PC under WSL, whose `lan` rope is the WSL-internal
+ * NAT address and whose quick tunnel went stale), the selection the desktop code
+ * received was the dead LAN rope, the call failed, and the guided setup reported
+ * "Can't reach" a machine that answered fine over Tailscale (2026-11-02).
+ *
+ * Retry rule. A rope is abandoned for the next one ONLY when the request provably
+ * never reached a server: a short TCP connect check failed before the request was
+ * sent, or the request itself failed with a connect-class error (refused, no route,
+ * DNS failure, connect timeout). Any HTTP reply — whatever its status — is
+ * authoritative and returned as-is, and an ambiguous failure (an abort or timeout
+ * after the connection opened, a reset mid-request) is rethrown without trying
+ * another rope: these requests are signed and some of them act on the target.
+ *
+ * The connect check runs only when an admissible rope remains after the current
+ * one, so a single-rope peer behaves exactly as before. The whole call, including
+ * the checks, stays inside the caller's time budget.
+ */
+import { connect } from 'node:net';
+import { desktopPeerUrlAllowed } from './DesktopPeerUrlGate.js';
+import { poolPeerFetch } from './poolPeerFetch.js';
+/** Every rope for this peer, in priority order, de-duplicated by URL. With no
+ *  full list wired, the refused ropes come first: the resolver ranked them
+ *  above the selection. */
+export function desktopPeerRopes(peer) {
+    const ordered = peer.ropes && peer.ropes.length > 0
+        ? peer.ropes
+        : [...(peer.ropeRefusals ?? []), { url: peer.url, kind: peer.kind }];
+    const seen = new Set();
+    const out = [];
+    for (const rope of ordered) {
+        if (!rope || typeof rope.url !== 'string' || seen.has(rope.url))
+            continue;
+        seen.add(rope.url);
+        out.push({ url: rope.url, kind: rope.kind });
+    }
+    return out;
+}
+const CONNECT_CLASS_CODES = new Set([
+    'ECONNREFUSED', 'EHOSTUNREACH', 'ENETUNREACH', 'ENOTFOUND', 'EAI_AGAIN', 'EADDRNOTAVAIL',
+    'UND_ERR_CONNECT_TIMEOUT',
+]);
+/** True only for failures that prove the request never left this machine. */
+export function isConnectClassFailure(error) {
+    let current = error;
+    for (let depth = 0; depth < 4 && current && typeof current === 'object'; depth++) {
+        const code = current.code;
+        if (typeof code === 'string' && CONNECT_CLASS_CODES.has(code))
+            return true;
+        current = current.cause;
+    }
+    return false;
+}
+/** Can a TCP connection to this rope's host and port be opened in time? */
+export function tcpConnectCheck(url, timeoutMs) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        // @silent-fallback-ok — a malformed rope URL is treated as unreachable; the gate refuses it anyway.
+        return Promise.resolve(false);
+    }
+    const port = Number(parsed.port || (parsed.protocol === 'https:' ? 443 : 80));
+    const host = parsed.hostname.replace(/^\[|\]$/g, '');
+    return new Promise(resolve => {
+        let settled = false;
+        const socket = connect({ host, port });
+        const done = (ok) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            socket.destroy();
+            resolve(ok);
+        };
+        const timer = setTimeout(() => done(false), Math.max(1, timeoutMs));
+        socket.once('connect', () => done(true));
+        socket.once('error', () => done(false));
+    });
+}
+export class DesktopPeerUnreachableError extends Error {
+    constructor() { super('desktop-peer-unreachable'); this.name = 'DesktopPeerUnreachableError'; }
+}
+/**
+ * Send one desktop request to a peer over the first rope that carries it.
+ * Returns the response and the rope that answered. Throws
+ * `DesktopPeerUnreachableError` when no rope is admissible or none could be
+ * reached, and rethrows an ambiguous failure from the rope that was in use.
+ */
+export async function fetchDesktopPeerOverRopes(o) {
+    const now = o.now ?? Date.now;
+    const deadline = now() + o.budgetMs;
+    const allowed = o.allowed ?? desktopPeerUrlAllowed;
+    const check = o.connectCheck ?? tcpConnectCheck;
+    const admissible = [];
+    for (const rope of o.ropes) {
+        if (now() >= deadline)
+            break;
+        if (await allowed(rope))
+            admissible.push(rope);
+    }
+    for (let index = 0; index < admissible.length; index++) {
+        const rope = admissible[index];
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            break;
+        const hasNext = index < admissible.length - 1;
+        if (hasNext) {
+            const started = now();
+            const reachable = await check(rope.url, Math.min(o.connectCheckCapMs, remaining));
+            if (!reachable) {
+                if (rope.kind !== 'last-known-url')
+                    o.record?.(o.machineId, rope.kind, false, now() - started, rope.url);
+                continue;
+            }
+        }
+        const left = deadline - now();
+        if (left <= 0)
+            break;
+        const timeout = AbortSignal.timeout(left);
+        try {
+            const response = await poolPeerFetch(o.record, { machineId: o.machineId, url: rope.url.replace(/\/+$/, ''), kind: rope.kind }, o.path, { ...o.init, signal: o.signal ? AbortSignal.any([o.signal, timeout]) : timeout }, o.fetchImpl);
+            return { response, rope };
+        }
+        catch (error) {
+            if (hasNext && !o.signal?.aborted && isConnectClassFailure(error))
+                continue;
+            throw error;
+        }
+    }
+    throw new DesktopPeerUnreachableError();
+}
+//# sourceMappingURL=desktopPeerRopeFetch.js.map

package/dist/server/desktopPeerRopeFetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktopPeerRopeFetch.js","sourceRoot":"","sources":["../../src/server/desktopPeerRopeFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAAE,aAAa,EAA2B,MAAM,oBAAoB,CAAC;AAY5E;;2BAE2B;AAC3B,MAAM,UAAU,gBAAgB,CAAC,IAAsB;IACrD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QACjD,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAS;QAC1E,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe;IACxF,yBAAyB;CAC1B,CAAC,CAAC;AAEH,6EAA6E;AAC7E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,OAAO,GAAY,KAAK,CAAC;IAC7B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,IAAI,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,KAAK,EAAE,EAAE,CAAC;QACjF,MAAM,IAAI,GAAI,OAA8B,CAAC,IAAI,CAAC;QAClD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC3E,OAAO,GAAI,OAA+B,CAAC,KAAK,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,SAAiB;IAC5D,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QACpC,oGAAoG;QACpG,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACrD,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE;QAC3B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,CAAC,EAAW,EAAE,EAAE;YAC3B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC;AAqBD,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACpD,gBAAgB,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC,CAAC,CAAC;CAChG;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,CAA0B;IACxE,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAC9B,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC;IACpC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,qBAAqB,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,IAAI,eAAe,CAAC;IAChD,MAAM,UAAU,GAAkB,EAAE,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM;QAC7B,IAAI,MAAM,OAAO,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QACvD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC;YAAE,MAAM;QAC1B,MAAM,OAAO,GAAG,KAAK,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9C,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACtB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,EAAE,SAAS,CAAC,CAAC,CAAC;YAClF,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB;oBAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACzG,SAAS;YACX,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAI,IAAI,CAAC;YAAE,MAAM;QACrB,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,CAAC,CAAC,MAAM,EAC3C,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EACtF,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC;YACjG,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,IAAI,qBAAqB,CAAC,KAAK,CAAC;gBAAE,SAAS;YAC5E,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,IAAI,2BAA2B,EAAE,CAAC;AAC1C,CAAC"}

package/dist/server/poolPeerFetch.d.ts

@@ -48,5 +48,5 @@ export interface PoolPeerTarget {
  * `isPeerUrlAllowedForCredentials` before dialling, because refusing to send a
  * credential is a separate question from whether the wire works.
  */
-export declare function poolPeerFetch(record: RopeResultRecorder | undefined, peer: PoolPeerTarget, path: string, init?: Parameters<typeof fetch>[1]): Promise<Response>;
+export declare function poolPeerFetch(record: RopeResultRecorder | undefined, peer: PoolPeerTarget, path: string, init?: Parameters<typeof fetch>[1], fetchImpl?: typeof fetch): Promise<Response>;
 //# sourceMappingURL=poolPeerFetch.d.ts.map

package/dist/server/poolPeerFetch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"poolPeerFetch.d.ts","sourceRoot":"","sources":["../../src/server/poolPeerFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;kDACkD;AAClD,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,KAAK,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzF;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,QAAQ,CAAC,CAWnB"}
+{"version":3,"file":"poolPeerFetch.d.ts","sourceRoot":"","sources":["../../src/server/poolPeerFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;kDACkD;AAClD,MAAM,MAAM,QAAQ,GAAG,WAAW,GAAG,KAAK,GAAG,YAAY,CAAC;AAE1D,MAAM,WAAW,kBAAkB;IACjC,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACzF;AAED,sEAAsE;AACtE,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,kBAAkB,GAAG,SAAS,EACtC,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAClC,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,QAAQ,CAAC,CAWnB"}

package/dist/server/poolPeerFetch.js

@@ -39,11 +39,11 @@ function ropeKindOf(kind) {
  * `isPeerUrlAllowedForCredentials` before dialling, because refusing to send a
  * credential is a separate question from whether the wire works.
  */
-export async function poolPeerFetch(record, peer, path, init) {
+export async function poolPeerFetch(record, peer, path, init, fetchImpl = fetch) {
     const rope = ropeKindOf(peer.kind);
     const started = Date.now();
     try {
-        const res = await fetch(`${peer.url}${path}`, init);
+        const res = await fetchImpl(`${peer.url}${path}`, init);
         if (rope && record)
             record(peer.machineId, rope, true, Date.now() - started, peer.url);
         return res;

package/dist/server/poolPeerFetch.js.map

@@ -1 +1 @@
-{"version":3,"file":"poolPeerFetch.js","sourceRoot":"","sources":["../../src/server/poolPeerFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAiBH,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsC,EACtC,IAAoB,EACpB,IAAY,EACZ,IAAkC;IAElC,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACpD,IAAI,IAAI,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"poolPeerFetch.js","sourceRoot":"","sources":["../../src/server/poolPeerFetch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAiBH,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAsC,EACtC,IAAoB,EACpB,IAAY,EACZ,IAAkC,EAClC,SAAS,GAAiB,KAAK;IAE/B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC;QACxD,IAAI,IAAI,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACvF,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,IAAI,IAAI,MAAM;YAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACxF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.1607",
+  "version": "1.3.1609",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-11-02T18:58:23.234Z",
-  "instarVersion": "1.3.1607",
+  "generatedAt": "2026-11-02T20:33:29.976Z",
+  "instarVersion": "1.3.1609",
   "entryCount": 206,
   "entries": {
     "hook:session-start": {
@@ -1563,7 +1563,7 @@
       "type": "subsystem",
       "domain": "server",
       "sourcePath": "src/server/AgentServer.ts",
-      "contentHash": "ae74f4958b6513824dc9f9722fa0c230af16491b15505e00bf7fc29223660e19",
+      "contentHash": "550d714dccc200c1d11f1badbea09b715c9f717e99a690fc2e32cf09e39c8981",
       "since": "2025-01-01"
     },
     "subsystem:session-manager": {

package/src/data/standards-guard-index.json

@@ -2,7 +2,7 @@
   "schemaVersion": 1,
   "generatedFrom": "source-tree",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1607",
+  "packageVersion": "1.3.1609",
   "guards": [
     {
       "ref": "docs/audits/phase-b/f10-triage.md",

package/src/data/standards-guard-index.meta.json

@@ -1,5 +1,5 @@
 {
-  "sha256": "dd4cc84314d3b96be5e2a6531a1c93d1ba08f018e3e0b5f2c1cf2abcdd4222d8",
+  "sha256": "ccaa1ee5b44efb04fe258136a20c35325729fa9683990dc4015d33d480a8b715",
   "registrySha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
-  "packageVersion": "1.3.1607"
+  "packageVersion": "1.3.1609"
 }

package/src/data/standards-registry.meta.json

@@ -2,5 +2,5 @@
   "sha256": "db01d9f92c6aa26ca903702896b41be53722982ed07d27633237bb254c214290",
   "articleCount": 93,
   "generatedFrom": "docs/STANDARDS-REGISTRY.md",
-  "packageVersion": "1.3.1607"
+  "packageVersion": "1.3.1609"
 }

package/upgrades/1.3.1608.md

@@ -0,0 +1,23 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- Remote Desktop peer calls (the guided setup's per-machine check, the readiness probe, and the remote-desktop session requests from the dashboard front) now try every rope the target machine advertises, in priority order, instead of only the single rope the shared selection picked. A rope the desktop gate refuses is skipped; a rope that cannot be connected to is skipped; any HTTP reply is final, and a request that may already have reached the target is never resent. Total time budgets are unchanged (8 s setup, 3 s probe and session calls).
+- Before this, a machine whose preferred admissible rope was dead (for example a Windows machine under WSL advertising its WSL-internal network address) showed as "Can't reach" in setup even when it answered over Tailscale.
+- `resolvePeerUrls()` entries carry an optional `ropes` list (every candidate rope in order) for this purpose.
+
+## What to Tell Your User
+
+If Remote Desktop setup said it couldn't reach one of your machines even though that machine was online, it should now find it. Nothing else changes.
+
+## Summary of New Capabilities
+
+None. This is a bug fix.
+
+## Evidence
+
+- Unit tests: first rope dead → second rope used; HTTP error on first rope → no retry; ambiguous timeout → no retry; every rope dead → unreachable; single-rope peers unchanged; the session stream is relayed to the rope that answered.
+- Live symptom (2026-11-02, Studio): Mama PC's tailscale rope answered 200 while its lan (WSL NAT 172.22.x) and stale quick-tunnel ropes answered nothing; setup dialled only the lan rope.

package/upgrades/1.3.1609.md

@@ -0,0 +1,20 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+- Every item in the dashboard's "What needs you" card now links to where you act on it: its own conversation, the Desktop page for that machine, the Accounts page for a sign-in, or otherwise the Attention topic where it was posted. Before, items without a conversation were plain text.
+
+## What to Tell Your User
+
+Everything in "What needs you" is now a link. Tap an item and you land where you can deal with it, for example the remote-desktop setup for that exact machine.
+
+## Summary of New Capabilities
+
+None. This completes the existing "needs you" card.
+
+## Evidence
+
+- On a live agent, both items in "What needs you" (remote-desktop permission on two machines) showed as plain text with no link. On the preview, each now links to the Desktop page with that machine selected.

package/upgrades/side-effects/console-needs-you-links.eli16.md

@@ -0,0 +1,7 @@
+# Every item in "What needs you" now has a place to tap
+
+The dashboard's home screen has a card called "What needs you". It lists the things only you can do: approve something, sign in somewhere, or fix a setting on a machine. The rule we agreed is that everything in that list must come with a button or a link that takes you straight to where you act, because a request you cannot act on is just noise.
+
+Until now that rule was only half true. An item tied to a conversation linked to that conversation. Anything else (for example "Remote Desktop needs its Mac permission again" on the Mac Mini) was shown as plain text you could expand and read, with nowhere to go. That is what both items on the list looked like this morning.
+
+Now every item gets a destination. A remote-desktop item opens the Desktop page with that exact machine selected, where the step-by-step setup and the Retry button are. A sign-in item opens the Accounts page. Anything else opens the Attention conversation in Telegram, where that item was posted and where you can answer it. If the dashboard cannot work out where the Attention conversation is, the item falls back to readable text, never a broken link. Nothing is hidden or removed by this change; it only adds the missing links.

package/upgrades/side-effects/console-needs-you-links.md

@@ -0,0 +1,33 @@
+# Side-effects review: every "needs you" row has somewhere to act
+
+## Change
+`dashboard/console/home-model.js` adds `needAction(item)`; `buildNeeds` uses it for every row. Order: the item's own topic; a `desktop` item opens `/dashboard/desktop.html?machineId=<its machine>` (that page has the guided setup and Retry for that machine); a sign-in item opens Accounts; anything else opens the Attention topic in Telegram, where the item was posted. `dashboard/console/console.js` reads `GET /telegram/system-topics` once to learn the Attention topic and maps the new `href` and `attention` action kinds to links.
+
+Before, a row without a topic id rendered as expandable text with no link. On the Studio today both rows in "needs you" (Remote Desktop permission on Mac Lan and Mac Mini) were like that.
+
+## 1. Over-block
+None. Not a gate.
+
+## 2. Under-block
+If the Attention topic cannot be read, an `attention` row falls back to the old expandable text (no link). It never shows a broken link.
+
+## 3. Level-of-abstraction fit
+The console page model decides where a row links. Correct layer.
+
+## 4. Signal vs authority
+No decision point. Not applicable.
+
+## 5. Interactions
+A row with a link renders as a link instead of an expandable row, so its description is not shown inline; the destination (Desktop page, conversation, Attention topic) carries the full text. The headline now says "Tap to review and respond." for these items, as it already did for conversation items. The card still hides itself when there is exactly one actionable item, because the headline then links to it.
+
+## 6. External surfaces
+One extra read (`GET /telegram/system-topics`) per console load. It is read-only and already authenticated.
+
+## 6b. Operator-surface quality
+Checked on the preview: each of the two Remote Desktop rows links to the Desktop page with that machine selected.
+
+## 7. Multi-machine posture
+Items come from `/attention?scope=pool` and carry their machine id; the Desktop link uses the item's own machine. The Attention topic is the agent-wide system topic (one per agent). Machine-local page code.
+
+## 8. Rollback cost
+Revert the commit; no data or migration.

package/upgrades/side-effects/desktop-peer-rope-fallback.eli16.md

@@ -0,0 +1,30 @@
+# Why setup said "Can't reach Mama PC", and the fix (plain English)
+
+## What happened
+
+Each of your machines tells the others several ways to reach it, called ropes: its Tailscale address, its local network address, and its Cloudflare tunnel. When the Studio's Remote Desktop setup page checked Mama PC, it asked for "the best rope" for Mama PC and got only one answer.
+
+The ordinary rule for picking that one rope does not allow plain Tailscale connections, so it skipped Mama PC's Tailscale rope (the one that works) and picked its local network address instead. But Mama PC runs Instar inside WSL on Windows, and the local address it reports is a private address inside Windows that no other machine can reach. The setup page tried only that one dead address, gave up, and said "Can't reach Mama PC", even though Mama PC answered fine over Tailscale.
+
+## What already existed
+
+The remote desktop code already had its own permission check that allows Tailscale when the local Tailscale app confirms the other machine is really on the tailnet. It just never got to use it, because it only ever saw the one rope.
+
+## What is new
+
+- The remote desktop calls (the setup page, the readiness check, and the live remote desktop session itself) now look at every rope the machine reports, in the usual order.
+- They skip ropes the permission check refuses, and if a rope cannot even be connected to, they try the next one.
+- If a machine answers at all, even with an error, that answer stands. They never resend a request that might already have arrived, because some of these requests make changes on the other machine.
+- The whole check still finishes within the same time limits as before (8 seconds for setup, 3 for the others).
+
+## Safeguards
+
+Nothing about who is allowed to connect changes; the same permission check runs on each rope. A machine whose first rope works behaves exactly as before. The live remote desktop stream goes to the rope that actually answered.
+
+## Not fixed here
+
+Mama PC still advertises that unreachable WSL-internal address. The setup now works around it; stopping it from being advertised needs a careful change of its own, so it has been filed as a separate issue.
+
+## What you need to decide
+
+Nothing. This is a small change that a revert fully undoes.