instar 1.3.514 → 1.3.516

package/dist/core/MeshRpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAM3C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;QACvD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CA6D7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}
+{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAM3C;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,CAAC;QACvD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GACD;IAkBE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,CAAC;AAEzB,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;CAC1D;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAqE7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAwBpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}

package/dist/core/MeshRpc.js

@@ -106,6 +106,7 @@ export function checkCommandRBAC(command, sender, deps) {
         case 'topic-profile-pull':
         case 'commitments-sync':
         case 'preferences-sync':
+        case 'pool-view-fetch':
         case 'secret-share':
             // Read/observe class (or e2e-encrypted) — any registered peer (already
             // proven a registered peer by verifyEnvelope). journal-sync joins this
@@ -120,6 +121,13 @@ export function checkCommandRBAC(command, sender, deps) {
             // per-topic profile entries — disclosure-only for registered
             // same-operator peers; the receiver revalidates every field (§10.2)
             // before anything persists, so the verb carries reach, not authority.
+            // pool-view-fetch joins it (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4): the
+            // verb is reachable by any registered peer, but its HANDLER is the real
+            // gate — it serves a private view body ONLY when the carried user-auth
+            // ASSERTION verifies (audience-bound to this holder + this view + this
+            // method, single-use, signed by the authenticated sender) AND the
+            // holder's own per-view authorization passes. The probeOnly shape
+            // discloses only existence (not the body) to a registered peer.
             return { ok: true, reason: 'ok' };
         default:
             return { ok: false, reason: 'claim-unauthorized' };

package/dist/core/MeshRpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"MeshRpc.js","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA2HH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,CAA2F;IAE3F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,KAAyH,EACzH,IAAmC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAwB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3C,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1F,+DAA+D;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1H,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvF,mCAAmC;IACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,kCAAkC;IAClC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,MAAiB,EAAE,IAAc;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,MAAM,CAAC;IAChD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB;YACnB,iFAAiF;YACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrF,KAAK,OAAO;YACV,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,mBAAmB;YACnB,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7F,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uFAAuF;YACvF,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1F,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,6DAA6D;YAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,mBAAmB;YACtB,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,cAAc;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,6DAA6D;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,UAA8B,EAC9B,QAAkB;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAyBD,uGAAuG;AACvG,SAAS,eAAe,CAAC,MAAc;IACrC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,CAAC,CAAwB;IAC1C,YAAY,IAA2B;QACrC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAiB;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"MeshRpc.js","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAmJH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,CAA2F;IAE3F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,KAAyH,EACzH,IAAmC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAwB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3C,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1F,+DAA+D;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1H,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvF,mCAAmC;IACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,kCAAkC;IAClC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAkBD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,MAAiB,EAAE,IAAc;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,MAAM,CAAC;IAChD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB;YACnB,iFAAiF;YACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrF,KAAK,OAAO;YACV,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,mBAAmB;YACnB,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7F,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uFAAuF;YACvF,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1F,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,6DAA6D;YAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,mBAAmB;YACtB,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc;YACjB,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,6DAA6D;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,UAA8B,EAC9B,QAAkB;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAyBD,uGAAuG;AACvG,SAAS,eAAe,CAAC,MAAc;IACrC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB;YACvB,OAAO,GAAG,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,CAAC,CAAwB;IAC1C,YAAY,IAA2B;QACrC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAiB;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/core/PoolLinkAssertion.d.ts

@@ -0,0 +1,164 @@
+/**
+ * PoolLinkAssertion — the cross-machine user-authentication assertion for WS4.4
+ * (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4 "Links that survive machine
+ * boundaries"). SECURITY-SENSITIVE.
+ *
+ * When a tunnel-fronting machine proxies a `/view/:id` (or dashboard asset)
+ * request to the machine that actually HOLDS the content, it must tell the
+ * holder "I, the fronting machine, validated the END USER's credential (their
+ * PIN session / view token)" — WITHOUT forwarding the raw credential. Each
+ * machine's PIN secret and authToken NEVER cross the boundary (spec §WS4.4 b/e):
+ * the holder makes its own authorization decision, but it needs to trust that
+ * the user really authenticated at the edge.
+ *
+ * This module is PURE LOGIC — the canonical assertion bytes, the construction,
+ * and the verification gate. Crypto (Ed25519 sign/verify, reusing
+ * MachineIdentity.sign/verify), the single-use jti store, the peer-key lookup,
+ * and the clock are injected as seams so the dangerous parts (audience-binding,
+ * replay, expiry) are unit-testable with in-memory fakes. The HTTP transport +
+ * production wiring sit on top and call these functions.
+ *
+ * Three independent properties protect every assertion (spec §WS4.4 e):
+ *   (1) AUDIENCE-BOUND — the signed bytes name the EXPECTED holder fingerprint,
+ *       the SPECIFIC view id, and the HTTP method. A capture cannot be replayed
+ *       against another resource, another holder, or another verb.
+ *   (2) SIGNED by the fronting machine's mesh key — the holder verifies the
+ *       signature against the EXPECTED fronting machine's REGISTERED public key,
+ *       so only a registered peer can mint a valid assertion.
+ *   (3) SINGLE-USE within a short TTL — the jti is recorded by the holder on
+ *       first accept; a replay inside the window is rejected, and the TTL bounds
+ *       the window beyond which the assertion is stale regardless.
+ *
+ * The fronting machine is a DUMB RELAY: it validates the user credential locally
+ * (its own concern), mints THIS assertion, and forwards it. It substitutes NO
+ * machine/mesh credential for the user credential at the holder — the assertion
+ * only attests "a user authenticated at the edge for this exact resource", and
+ * the holder still applies its own per-view authorization on top.
+ */
+export type MachineFingerprint = string;
+/**
+ * The audience-binding triple — the exact (holder, resource, method) this
+ * assertion is valid for. Any mismatch at the holder is a rejection.
+ */
+export interface PoolLinkAudience {
+    /** The machine fingerprint (machineId) of the EXPECTED holder of the view. */
+    holderFingerprint: MachineFingerprint;
+    /** The specific view id this assertion authorizes (no wildcard). */
+    viewId: string;
+    /** The HTTP method this assertion authorizes (e.g. 'GET'). Upper-cased. */
+    method: string;
+}
+/**
+ * The assertion payload. `iss` (the fronting machine) is included in the signed
+ * bytes AND used by the holder to pick which registered public key to verify
+ * against — so an assertion signed by machine X cannot claim to come from Y.
+ */
+export interface PoolLinkAssertion {
+    /** Issuer — the fronting machine fingerprint that signed this. */
+    iss: MachineFingerprint;
+    /** Audience — the (holder, view, method) this is bound to. */
+    aud: PoolLinkAudience;
+    /** Single-use id (replay control). Recorded by the holder on first accept. */
+    jti: string;
+    /** Issued-at, ms epoch. */
+    iat: number;
+    /** Expiry, ms epoch. The holder rejects at/after this. */
+    exp: number;
+    /**
+     * The kind of end-user credential the fronting machine validated. NOT the
+     * credential itself — the raw PIN / view token NEVER appears here (spec
+     * §WS4.4 b). Purely informational for the holder's audit trail.
+     */
+    userAuth: 'pin-session' | 'view-sig' | 'view-pin';
+    /** Ed25519 signature (base64) over the canonical bytes. */
+    signature: string;
+}
+/** The canonical bytes the signature covers — field-ordered, audience included.
+ *  Excludes `signature` itself. Stable ordering so sign/verify agree. */
+export declare function canonicalizePoolLinkAssertion(a: Omit<PoolLinkAssertion, 'signature'>): string;
+/** Default assertion lifetime (ms). Short by design — the proxy hop is sub-second. */
+export declare const DEFAULT_POOL_LINK_TTL_MS = 30000;
+/**
+ * Hard ceiling (ms) on the TTL SPAN (`exp - iat`) a holder will honor, regardless
+ * of what the issuer minted. A misbehaving (but registered) peer could otherwise
+ * mint a far-future `exp` and pin its jti in the holder's single-use store for
+ * that whole span — an unbounded-retention DoS. The holder rejects any span over
+ * this ceiling as `ttl-too-long` BEFORE the jti is ever recorded. 5 min is far
+ * above the sub-second proxy hop + the default 30s mint, so it never rejects a
+ * legitimate assertion. (P19 — bounded by construction.)
+ */
+export declare const DEFAULT_POOL_LINK_MAX_TTL_MS: number;
+export interface MintPoolLinkAssertionDeps {
+    /** This (fronting) machine's fingerprint — becomes `iss`. */
+    selfFingerprint: MachineFingerprint;
+    /** Sign the canonical bytes with THIS machine's Ed25519 signing key. */
+    sign: (canonical: string) => string;
+    /** Mint a fresh, unguessable jti (crypto-random in prod; deterministic in tests). */
+    mintJti: () => string;
+    now: () => number;
+    /** Assertion lifetime (ms). Default DEFAULT_POOL_LINK_TTL_MS. */
+    ttlMs?: number;
+}
+/**
+ * Build + sign a pool-link assertion naming THIS fronting machine as issuer and
+ * binding it to the (holder, view, method) audience. The method is upper-cased
+ * so the audience-binding is case-insensitive on the verb (HTTP methods are
+ * case-insensitive by spec, but we canonicalize to avoid an accidental mismatch).
+ */
+export declare function mintPoolLinkAssertion(audience: {
+    holderFingerprint: MachineFingerprint;
+    viewId: string;
+    method: string;
+}, userAuth: PoolLinkAssertion['userAuth'], deps: MintPoolLinkAssertionDeps): PoolLinkAssertion;
+export type PoolLinkVerifyReason = 'ok' | 'malformed' | 'wrong-holder' | 'wrong-view' | 'wrong-method' | 'unexpected-issuer' | 'unknown-issuer' | 'signature-invalid' | 'expired' | 'not-yet-valid' | 'ttl-too-long' | 'replayed';
+export interface VerifyPoolLinkAssertionDeps {
+    /** THIS (holder) machine's fingerprint — `aud.holderFingerprint` MUST equal it. */
+    selfFingerprint: MachineFingerprint;
+    /**
+     * The fronting machine the holder EXPECTS this assertion to come from. The
+     * fronting machine identity is proven independently by the mesh transport
+     * (the machine-authed request carries the sender id); the holder passes that
+     * authenticated id here so `iss` must match it — a captured assertion cannot
+     * be replayed by a DIFFERENT machine. Pass null to skip (not recommended).
+     */
+    expectedIssuer: MachineFingerprint | null;
+    /** Resolve `iss`'s REGISTERED Ed25519 public key (PEM), or null if unknown. */
+    resolveIssuerPublicKeyPem: (iss: MachineFingerprint) => string | null;
+    /** Verify the Ed25519 signature over `canonical` against `publicKeyPem`. */
+    verify: (canonical: string, signature: string, publicKeyPem: string) => boolean;
+    /**
+     * Has this jti been seen (replay guard)? Single-use store, persisted on the
+     * holder. Returns true if already recorded.
+     */
+    seenJti: (jti: string) => boolean;
+    now: () => number;
+    /** Tolerance for a slightly-future iat (clock skew), ms. Default 5000. */
+    clockSkewToleranceMs?: number;
+    /**
+     * Hard ceiling on the accepted TTL span (`exp - iat`), ms. An assertion whose
+     * span exceeds this is rejected as `ttl-too-long` before the jti is recorded —
+     * so a misbehaving peer cannot pin a far-future jti in the holder's store.
+     * Default DEFAULT_POOL_LINK_MAX_TTL_MS (5 min).
+     */
+    maxTtlMs?: number;
+}
+/**
+ * Verify an assertion at the HOLDER, evaluated IN ORDER (spec §WS4.4 e). PURE:
+ * it does NOT record the jti — the caller records it ONLY on a fully-accepted
+ * assertion (so a rejected one never burns a jti, and a replay is caught by the
+ * EXPECTED `requested` audience matching the stored jti). The `requested`
+ * argument is the audience derived from the ACTUAL incoming request (this
+ * machine's own fingerprint, the view id in the URL, the request method) — the
+ * assertion's `aud` must match it exactly, which is what makes the binding real:
+ * a captured assertion presented for a different view/method is rejected.
+ */
+export declare function verifyPoolLinkAssertion(assertion: PoolLinkAssertion, requested: {
+    viewId: string;
+    method: string;
+}, deps: VerifyPoolLinkAssertionDeps): {
+    ok: boolean;
+    reason: PoolLinkVerifyReason;
+};
+/** HTTP status for each verify reason — auth failures 401/403, freshness/replay 409. */
+export declare function statusForPoolLinkReason(reason: PoolLinkVerifyReason): number;
+//# sourceMappingURL=PoolLinkAssertion.d.ts.map

package/dist/core/PoolLinkAssertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PoolLinkAssertion.d.ts","sourceRoot":"","sources":["../../src/core/PoolLinkAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,8EAA8E;IAC9E,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,2EAA2E;IAC3E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,kEAAkE;IAClE,GAAG,EAAE,kBAAkB,CAAC;IACxB,8DAA8D;IAC9D,GAAG,EAAE,gBAAgB,CAAC;IACtB,8EAA8E;IAC9E,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ;;;;OAIG;IACH,QAAQ,EAAE,aAAa,GAAG,UAAU,GAAG,UAAU,CAAC;IAClD,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;yEACyE;AACzE,wBAAgB,6BAA6B,CAC3C,CAAC,EAAE,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,GACtC,MAAM,CAWR;AAED,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD,MAAM,WAAW,yBAAyB;IACxC,6DAA6D;IAC7D,eAAe,EAAE,kBAAkB,CAAC;IACpC,wEAAwE;IACxE,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,qFAAqF;IACrF,OAAO,EAAE,MAAM,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE;IAAE,iBAAiB,EAAE,kBAAkB,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EACnF,QAAQ,EAAE,iBAAiB,CAAC,UAAU,CAAC,EACvC,IAAI,EAAE,yBAAyB,GAC9B,iBAAiB,CAiBnB;AAED,MAAM,MAAM,oBAAoB,GAC5B,IAAI,GACJ,WAAW,GACX,cAAc,GACd,YAAY,GACZ,cAAc,GACd,mBAAmB,GACnB,gBAAgB,GAChB,mBAAmB,GACnB,SAAS,GACT,eAAe,GACf,cAAc,GACd,UAAU,CAAC;AAEf,MAAM,WAAW,2BAA2B;IAC1C,mFAAmF;IACnF,eAAe,EAAE,kBAAkB,CAAC;IACpC;;;;;;OAMG;IACH,cAAc,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC1C,+EAA+E;IAC/E,yBAAyB,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,MAAM,GAAG,IAAI,CAAC;IACtE,4EAA4E;IAC5E,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC;IAChF;;;OAGG;IACH,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAClC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,0EAA0E;IAC1E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,iBAAiB,EAC5B,SAAS,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAC7C,IAAI,EAAE,2BAA2B,GAChC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,oBAAoB,CAAA;CAAE,CA+D/C;AAED,wFAAwF;AACxF,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAmB5E"}

package/dist/core/PoolLinkAssertion.js

@@ -0,0 +1,184 @@
+/**
+ * PoolLinkAssertion — the cross-machine user-authentication assertion for WS4.4
+ * (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4 "Links that survive machine
+ * boundaries"). SECURITY-SENSITIVE.
+ *
+ * When a tunnel-fronting machine proxies a `/view/:id` (or dashboard asset)
+ * request to the machine that actually HOLDS the content, it must tell the
+ * holder "I, the fronting machine, validated the END USER's credential (their
+ * PIN session / view token)" — WITHOUT forwarding the raw credential. Each
+ * machine's PIN secret and authToken NEVER cross the boundary (spec §WS4.4 b/e):
+ * the holder makes its own authorization decision, but it needs to trust that
+ * the user really authenticated at the edge.
+ *
+ * This module is PURE LOGIC — the canonical assertion bytes, the construction,
+ * and the verification gate. Crypto (Ed25519 sign/verify, reusing
+ * MachineIdentity.sign/verify), the single-use jti store, the peer-key lookup,
+ * and the clock are injected as seams so the dangerous parts (audience-binding,
+ * replay, expiry) are unit-testable with in-memory fakes. The HTTP transport +
+ * production wiring sit on top and call these functions.
+ *
+ * Three independent properties protect every assertion (spec §WS4.4 e):
+ *   (1) AUDIENCE-BOUND — the signed bytes name the EXPECTED holder fingerprint,
+ *       the SPECIFIC view id, and the HTTP method. A capture cannot be replayed
+ *       against another resource, another holder, or another verb.
+ *   (2) SIGNED by the fronting machine's mesh key — the holder verifies the
+ *       signature against the EXPECTED fronting machine's REGISTERED public key,
+ *       so only a registered peer can mint a valid assertion.
+ *   (3) SINGLE-USE within a short TTL — the jti is recorded by the holder on
+ *       first accept; a replay inside the window is rejected, and the TTL bounds
+ *       the window beyond which the assertion is stale regardless.
+ *
+ * The fronting machine is a DUMB RELAY: it validates the user credential locally
+ * (its own concern), mints THIS assertion, and forwards it. It substitutes NO
+ * machine/mesh credential for the user credential at the holder — the assertion
+ * only attests "a user authenticated at the edge for this exact resource", and
+ * the holder still applies its own per-view authorization on top.
+ */
+/** The canonical bytes the signature covers — field-ordered, audience included.
+ *  Excludes `signature` itself. Stable ordering so sign/verify agree. */
+export function canonicalizePoolLinkAssertion(a) {
+    return JSON.stringify([
+        a.iss,
+        a.aud.holderFingerprint,
+        a.aud.viewId,
+        a.aud.method,
+        a.jti,
+        a.iat,
+        a.exp,
+        a.userAuth,
+    ]);
+}
+/** Default assertion lifetime (ms). Short by design — the proxy hop is sub-second. */
+export const DEFAULT_POOL_LINK_TTL_MS = 30_000;
+/**
+ * Hard ceiling (ms) on the TTL SPAN (`exp - iat`) a holder will honor, regardless
+ * of what the issuer minted. A misbehaving (but registered) peer could otherwise
+ * mint a far-future `exp` and pin its jti in the holder's single-use store for
+ * that whole span — an unbounded-retention DoS. The holder rejects any span over
+ * this ceiling as `ttl-too-long` BEFORE the jti is ever recorded. 5 min is far
+ * above the sub-second proxy hop + the default 30s mint, so it never rejects a
+ * legitimate assertion. (P19 — bounded by construction.)
+ */
+export const DEFAULT_POOL_LINK_MAX_TTL_MS = 5 * 60_000;
+/**
+ * Build + sign a pool-link assertion naming THIS fronting machine as issuer and
+ * binding it to the (holder, view, method) audience. The method is upper-cased
+ * so the audience-binding is case-insensitive on the verb (HTTP methods are
+ * case-insensitive by spec, but we canonicalize to avoid an accidental mismatch).
+ */
+export function mintPoolLinkAssertion(audience, userAuth, deps) {
+    const iat = deps.now();
+    const exp = iat + (deps.ttlMs ?? DEFAULT_POOL_LINK_TTL_MS);
+    const aud = {
+        holderFingerprint: audience.holderFingerprint,
+        viewId: audience.viewId,
+        method: audience.method.toUpperCase(),
+    };
+    const unsigned = {
+        iss: deps.selfFingerprint,
+        aud,
+        jti: deps.mintJti(),
+        iat,
+        exp,
+        userAuth,
+    };
+    return { ...unsigned, signature: deps.sign(canonicalizePoolLinkAssertion(unsigned)) };
+}
+/**
+ * Verify an assertion at the HOLDER, evaluated IN ORDER (spec §WS4.4 e). PURE:
+ * it does NOT record the jti — the caller records it ONLY on a fully-accepted
+ * assertion (so a rejected one never burns a jti, and a replay is caught by the
+ * EXPECTED `requested` audience matching the stored jti). The `requested`
+ * argument is the audience derived from the ACTUAL incoming request (this
+ * machine's own fingerprint, the view id in the URL, the request method) — the
+ * assertion's `aud` must match it exactly, which is what makes the binding real:
+ * a captured assertion presented for a different view/method is rejected.
+ */
+export function verifyPoolLinkAssertion(assertion, requested, deps) {
+    // (0) shape
+    if (!assertion ||
+        typeof assertion.iss !== 'string' ||
+        !assertion.aud ||
+        typeof assertion.aud.holderFingerprint !== 'string' ||
+        typeof assertion.aud.viewId !== 'string' ||
+        typeof assertion.aud.method !== 'string' ||
+        typeof assertion.jti !== 'string' ||
+        typeof assertion.iat !== 'number' ||
+        typeof assertion.exp !== 'number' ||
+        typeof assertion.signature !== 'string') {
+        return { ok: false, reason: 'malformed' };
+    }
+    // (1) audience-bound: holder fingerprint must be THIS machine.
+    if (assertion.aud.holderFingerprint !== deps.selfFingerprint) {
+        return { ok: false, reason: 'wrong-holder' };
+    }
+    // (2) audience-bound: the assertion's view must match the REQUESTED view,
+    //     and both must match the incoming URL — no wildcard, no cross-resource.
+    if (assertion.aud.viewId !== requested.viewId) {
+        return { ok: false, reason: 'wrong-view' };
+    }
+    // (3) audience-bound: method match (case-insensitive via canonicalization).
+    if (assertion.aud.method !== requested.method.toUpperCase()) {
+        return { ok: false, reason: 'wrong-method' };
+    }
+    // (4) the authenticated transport sender must equal the claimed issuer — a
+    //     captured assertion cannot be presented by a different machine.
+    if (deps.expectedIssuer !== null && assertion.iss !== deps.expectedIssuer) {
+        return { ok: false, reason: 'unexpected-issuer' };
+    }
+    // (5) signature valid for the claimed issuer's REGISTERED key.
+    const pem = deps.resolveIssuerPublicKeyPem(assertion.iss);
+    if (!pem)
+        return { ok: false, reason: 'unknown-issuer' };
+    const canonical = canonicalizePoolLinkAssertion({
+        iss: assertion.iss,
+        aud: assertion.aud,
+        jti: assertion.jti,
+        iat: assertion.iat,
+        exp: assertion.exp,
+        userAuth: assertion.userAuth,
+    });
+    if (!deps.verify(canonical, assertion.signature, pem)) {
+        return { ok: false, reason: 'signature-invalid' };
+    }
+    // (6) freshness: TTL-span ceiling + expiry + not-yet-valid (small skew tolerance).
+    const now = deps.now();
+    const skew = deps.clockSkewToleranceMs ?? 5000;
+    // (6a) span ceiling FIRST — reject an absurd exp regardless of the current
+    //      clock, so a far-future-exp assertion can never reach the jti store and
+    //      pin a record there (unbounded-retention DoS). P19 — bounded span.
+    const maxTtl = deps.maxTtlMs ?? DEFAULT_POOL_LINK_MAX_TTL_MS;
+    if (assertion.exp - assertion.iat > maxTtl)
+        return { ok: false, reason: 'ttl-too-long' };
+    if (now >= assertion.exp)
+        return { ok: false, reason: 'expired' };
+    if (assertion.iat - now > skew)
+        return { ok: false, reason: 'not-yet-valid' };
+    // (7) single-use: jti unseen within the window.
+    if (deps.seenJti(assertion.jti))
+        return { ok: false, reason: 'replayed' };
+    return { ok: true, reason: 'ok' };
+}
+/** HTTP status for each verify reason — auth failures 401/403, freshness/replay 409. */
+export function statusForPoolLinkReason(reason) {
+    switch (reason) {
+        case 'malformed':
+            return 400;
+        case 'wrong-holder':
+        case 'wrong-view':
+        case 'wrong-method':
+        case 'unexpected-issuer':
+        case 'unknown-issuer':
+        case 'signature-invalid':
+            return 401;
+        case 'expired':
+        case 'not-yet-valid':
+        case 'ttl-too-long':
+        case 'replayed':
+            return 409;
+        default:
+            return 400;
+    }
+}
+//# sourceMappingURL=PoolLinkAssertion.js.map

package/dist/core/PoolLinkAssertion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PoolLinkAssertion.js","sourceRoot":"","sources":["../../src/core/PoolLinkAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AA2CH;yEACyE;AACzE,MAAM,UAAU,6BAA6B,CAC3C,CAAuC;IAEvC,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,GAAG,CAAC,iBAAiB;QACvB,CAAC,CAAC,GAAG,CAAC,MAAM;QACZ,CAAC,CAAC,GAAG,CAAC,MAAM;QACZ,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,QAAQ;KACX,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,GAAG,MAAM,CAAC;AAcvD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAmF,EACnF,QAAuC,EACvC,IAA+B;IAE/B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,wBAAwB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAqB;QAC5B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;QAC7C,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,WAAW,EAAE;KACtC,CAAC;IACF,MAAM,QAAQ,GAAyC;QACrD,GAAG,EAAE,IAAI,CAAC,eAAe;QACzB,GAAG;QACH,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE;QACnB,GAAG;QACH,GAAG;QACH,QAAQ;KACT,CAAC;IACF,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;AACxF,CAAC;AAgDD;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAA4B,EAC5B,SAA6C,EAC7C,IAAiC;IAEjC,YAAY;IACZ,IACE,CAAC,SAAS;QACV,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,CAAC,SAAS,CAAC,GAAG;QACd,OAAO,SAAS,CAAC,GAAG,CAAC,iBAAiB,KAAK,QAAQ;QACnD,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ;QACxC,OAAO,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,QAAQ;QACxC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,OAAO,SAAS,CAAC,GAAG,KAAK,QAAQ;QACjC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,EACvC,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IAED,+DAA+D;IAC/D,IAAI,SAAS,CAAC,GAAG,CAAC,iBAAiB,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;QAC9C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC7C,CAAC;IACD,4EAA4E;IAC5E,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IACD,2EAA2E;IAC3E,qEAAqE;IACrE,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,IAAI,SAAS,CAAC,GAAG,KAAK,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,+DAA+D;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAC1D,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACzD,MAAM,SAAS,GAAG,6BAA6B,CAAC;QAC9C,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,GAAG,EAAE,SAAS,CAAC,GAAG;QAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IACpD,CAAC;IACD,mFAAmF;IACnF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAC/C,2EAA2E;IAC3E,8EAA8E;IAC9E,yEAAyE;IACzE,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,IAAI,4BAA4B,CAAC;IAC7D,IAAI,SAAS,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,GAAG,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACzF,IAAI,GAAG,IAAI,SAAS,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAClE,IAAI,SAAS,CAAC,GAAG,GAAG,GAAG,GAAG,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC9E,gDAAgD;IAChD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,uBAAuB,CAAC,MAA4B;IAClE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,OAAO,GAAG,CAAC;QACb,KAAK,cAAc,CAAC;QACpB,KAAK,YAAY,CAAC;QAClB,KAAK,cAAc,CAAC;QACpB,KAAK,mBAAmB,CAAC;QACzB,KAAK,gBAAgB,CAAC;QACtB,KAAK,mBAAmB;YACtB,OAAO,GAAG,CAAC;QACb,KAAK,SAAS,CAAC;QACf,KAAK,eAAe,CAAC;QACrB,KAAK,cAAc,CAAC;QACpB,KAAK,UAAU;YACb,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/core/PoolLinkJtiStore.d.ts

@@ -0,0 +1,48 @@
+export interface PoolLinkJtiStoreDeps {
+    /** Absolute path to the persistence file. */
+    filePath: string;
+    now: () => number;
+    /**
+     * How long a recorded jti is retained for replay rejection (ms). MUST be ≥ the
+     * assertion TTL so a captured assertion can never outlive its retention. Default 1h.
+     */
+    retentionMs?: number;
+    /**
+     * Hard ceiling on the number of recorded jtis. A registered-but-misbehaving
+     * peer could otherwise mint many distinct-jti assertions and grow this store
+     * unboundedly (memory + disk DoS). At the cap, the oldest-expiry records are
+     * evicted to make room (they are the closest to GC anyway) and a loss counter
+     * is bumped. Default 100_000. (P19 — bounded by construction.)
+     */
+    maxEntries?: number;
+    logger?: (line: string) => void;
+}
+export declare class PoolLinkJtiStore {
+    private readonly d;
+    private jtis;
+    private loaded;
+    /** Count of records evicted to stay under maxEntries — observability. */
+    private droppedForCap;
+    constructor(d: PoolLinkJtiStoreDeps);
+    private retention;
+    private maxEntries;
+    private ensureLoaded;
+    /** Has this jti already been seen (replay)? Read-only; does not record. */
+    seen(jti: string): boolean;
+    /**
+     * Record a jti as consumed, bound to the assertion's expiry. Idempotent: a
+     * second record of the same jti is a no-op (the first already blocks replay).
+     * Persists BEFORE returning so a crash mid-record cannot yield a second accept.
+     */
+    record(jti: string, assertionExpMs: number): void;
+    /** Evict oldest-expiry records until below the cap (leaving room for one insert). */
+    private enforceCap;
+    /** Count of currently-recorded jtis — tests/observability. */
+    size(): number;
+    /** Count of records evicted to stay under the size cap — tests/observability. */
+    droppedForCapCount(): number;
+    /** Drop records whose expiry is older than the retention window. */
+    private gc;
+    private persist;
+}
+//# sourceMappingURL=PoolLinkJtiStore.d.ts.map

package/dist/core/PoolLinkJtiStore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PoolLinkJtiStore.d.ts","sourceRoot":"","sources":["../../src/core/PoolLinkJtiStore.ts"],"names":[],"mappings":"AA4BA,MAAM,WAAW,oBAAoB;IACnC,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC;AAKD,qBAAa,gBAAgB;IAMf,OAAO,CAAC,QAAQ,CAAC,CAAC;IAL9B,OAAO,CAAC,IAAI,CAAgC;IAC5C,OAAO,CAAC,MAAM,CAAS;IACvB,yEAAyE;IACzE,OAAO,CAAC,aAAa,CAAK;gBAEG,CAAC,EAAE,oBAAoB;IAEpD,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,YAAY;IA0BpB,2EAA2E;IAC3E,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAS1B;;;;OAIG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAiBjD,qFAAqF;IACrF,OAAO,CAAC,UAAU;IAclB,8DAA8D;IAC9D,IAAI,IAAI,MAAM;IAKd,iFAAiF;IACjF,kBAAkB,IAAI,MAAM;IAI5B,oEAAoE;IACpE,OAAO,CAAC,EAAE;IAYV,OAAO,CAAC,OAAO;CAiBhB"}

package/dist/core/PoolLinkJtiStore.js

@@ -0,0 +1,149 @@
+/**
+ * PoolLinkJtiStore — the single-use replay defense for WS4.4 pool-link
+ * assertions (MULTI-MACHINE-SEAMLESSNESS-SPEC §WS4.4 e). SECURITY-SENSITIVE.
+ *
+ * Lives on the HOLDER machine. When a fronting machine proxies a `/view/:id`
+ * request with a signed, audience-bound assertion, the holder verifies it
+ * (PoolLinkAssertion.verifyPoolLinkAssertion) and then RECORDS its jti here so
+ * the SAME assertion can never be accepted twice. The recorded set is PERSISTED
+ * so a captured assertion cannot be replayed even across a holder restart,
+ * within its (short) TTL window.
+ *
+ * Mirrors StreamTicketStore's factoring: pure + injected (clock, fs path) so the
+ * record / replay-detect / expiry / replay-across-restart lifecycle is
+ * deterministically unit-testable.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+const DEFAULT_RETENTION_MS = 60 * 60 * 1000;
+const DEFAULT_MAX_ENTRIES = 100_000;
+export class PoolLinkJtiStore {
+    d;
+    jtis = new Map();
+    loaded = false;
+    /** Count of records evicted to stay under maxEntries — observability. */
+    droppedForCap = 0;
+    constructor(d) {
+        this.d = d;
+    }
+    retention() {
+        return this.d.retentionMs ?? DEFAULT_RETENTION_MS;
+    }
+    maxEntries() {
+        return this.d.maxEntries ?? DEFAULT_MAX_ENTRIES;
+    }
+    ensureLoaded() {
+        if (this.loaded)
+            return;
+        this.loaded = true;
+        try {
+            if (fs.existsSync(this.d.filePath)) {
+                const body = JSON.parse(fs.readFileSync(this.d.filePath, 'utf-8'));
+                if (body && body.jtis) {
+                    for (const [j, r] of Object.entries(body.jtis)) {
+                        if (r && typeof r.expiresAtMs === 'number') {
+                            this.jtis.set(j, { expiresAtMs: r.expiresAtMs });
+                        }
+                    }
+                }
+            }
+        }
+        catch (e) {
+            // @silent-fallback-ok: a corrupt store FAILS CLOSED on the replay window
+            // only (loses recorded jtis), never crashes the serve path. The widened
+            // window is bounded by the assertion TTL (a re-presented jti's assertion
+            // fails 'expired' anyway once its short exp passes). Mirrors
+            // StreamTicketStore; logged with context, not a DegradationReporter case.
+            this.d.logger?.(`[pool-link-jti] store unreadable, starting empty: ${e?.message ?? e}`);
+            this.jtis.clear();
+        }
+        this.gc();
+    }
+    /** Has this jti already been seen (replay)? Read-only; does not record. */
+    seen(jti) {
+        this.ensureLoaded();
+        const rec = this.jtis.get(jti);
+        if (!rec)
+            return false;
+        // A record past retention is GC-eligible but, while present, still blocks
+        // replay. (Its assertion is long-expired, so this is belt-and-suspenders.)
+        return true;
+    }
+    /**
+     * Record a jti as consumed, bound to the assertion's expiry. Idempotent: a
+     * second record of the same jti is a no-op (the first already blocks replay).
+     * Persists BEFORE returning so a crash mid-record cannot yield a second accept.
+     */
+    record(jti, assertionExpMs) {
+        this.ensureLoaded();
+        this.gc();
+        if (this.jtis.has(jti))
+            return;
+        // Clamp the retained expiry to now + retention. Defense-in-depth: even if a
+        // far-future `exp` slipped past the holder's TTL-span ceiling, gc() (which
+        // keys off expiresAtMs) reliably drops this record within the retention
+        // window instead of pinning it for the attacker-chosen span.
+        const maxExpiry = this.d.now() + this.retention();
+        const expiresAtMs = Math.min(assertionExpMs, maxExpiry);
+        // Enforce the size ceiling: at the cap, evict oldest-expiry records first
+        // (closest to GC anyway). Bounded by construction (P19).
+        this.enforceCap();
+        this.jtis.set(jti, { expiresAtMs });
+        this.persist();
+    }
+    /** Evict oldest-expiry records until below the cap (leaving room for one insert). */
+    enforceCap() {
+        const cap = this.maxEntries();
+        if (this.jtis.size < cap)
+            return;
+        const sorted = [...this.jtis.entries()].sort((a, b) => a[1].expiresAtMs - b[1].expiresAtMs);
+        const toDrop = this.jtis.size - cap + 1;
+        for (let i = 0; i < toDrop && i < sorted.length; i++) {
+            this.jtis.delete(sorted[i][0]);
+            this.droppedForCap++;
+        }
+        this.d.logger?.(`[pool-link-jti] size cap ${cap} reached — evicted ${toDrop} oldest record(s) (total dropped-for-cap: ${this.droppedForCap})`);
+    }
+    /** Count of currently-recorded jtis — tests/observability. */
+    size() {
+        this.ensureLoaded();
+        return this.jtis.size;
+    }
+    /** Count of records evicted to stay under the size cap — tests/observability. */
+    droppedForCapCount() {
+        return this.droppedForCap;
+    }
+    /** Drop records whose expiry is older than the retention window. */
+    gc() {
+        const cutoff = this.d.now() - this.retention();
+        let changed = false;
+        for (const [j, r] of this.jtis) {
+            if (r.expiresAtMs < cutoff) {
+                this.jtis.delete(j);
+                changed = true;
+            }
+        }
+        if (changed)
+            this.persist();
+    }
+    persist() {
+        try {
+            const dir = path.dirname(this.d.filePath);
+            fs.mkdirSync(dir, { recursive: true });
+            const jtis = {};
+            for (const [j, r] of this.jtis)
+                jtis[j] = r;
+            const body = { version: 1, jtis };
+            const tmp = `${this.d.filePath}.tmp-${process.pid}`;
+            fs.writeFileSync(tmp, JSON.stringify(body, null, 2));
+            fs.renameSync(tmp, this.d.filePath);
+        }
+        catch (e) {
+            // @silent-fallback-ok: a persistence failure degrades replay-across-restart
+            // protection for in-flight jtis only (all TTL-bounded); must not crash the
+            // serve path. The in-memory set still blocks replay within this process.
+            this.d.logger?.(`[pool-link-jti] persist failed: ${e?.message ?? e}`);
+        }
+    }
+}
+//# sourceMappingURL=PoolLinkJtiStore.js.map