instar 1.3.896 → 1.3.897

package/dist/core/MachineSshEndpoint.js

@@ -0,0 +1,221 @@
+import fs from 'node:fs';
+import net from 'node:net';
+import { verify } from 'node:crypto';
+import { Server, utils } from 'ssh2';
+/** Restricted SSH server: public-key auth plus the `instar-rpc` subsystem only. */
+export class MachineSshEndpoint {
+    options;
+    server = null;
+    sockets = new Set();
+    socketsByMachine = new Map();
+    handshakesBySource = new Map();
+    requestBuckets = new Map();
+    seenNonces = new Map();
+    constructor(options) {
+        this.options = options;
+    }
+    async listen(host, port) {
+        if (!isPrivateHost(host))
+            throw new Error('ssh-public-bind-refused');
+        const maxFrame = this.options.maxFrameBytes ?? 64 * 1024;
+        this.server = new Server({
+            hostKeys: (this.options.hostPrivateKeyPaths ?? [this.options.hostPrivateKeyPath]).map(file => fs.readFileSync(file)),
+            algorithms: {
+                serverHostKey: ['ssh-ed25519'],
+                kex: ['curve25519-sha256', 'curve25519-sha256@libssh.org'],
+                cipher: ['chacha20-poly1305@openssh.com', 'aes256-gcm@openssh.com', 'aes128-gcm@openssh.com'],
+            },
+        }, client => {
+            const source = String(client._sock?.remoteAddress ?? 'unknown');
+            const sourceHandshakes = this.handshakesBySource.get(source) ?? 0;
+            if (this.sockets.size >= 32 || sourceHandshakes >= 4) {
+                client.end();
+                return;
+            }
+            this.handshakesBySource.set(source, sourceHandshakes + 1);
+            let admission = null;
+            let attempts = 0;
+            const deadline = setTimeout(() => client.end(), 10_000);
+            let idle = setTimeout(() => client.end(), 30_000);
+            const touch = () => { clearTimeout(idle); idle = setTimeout(() => client.end(), 30_000); };
+            this.sockets.add(client);
+            client.on('authentication', ctx => {
+                attempts += 1;
+                if (attempts > 3 || ctx.method !== 'publickey')
+                    return ctx.reject();
+                const candidate = this.options.admissionStore.authenticate(ctx.key.data);
+                if (!candidate)
+                    return ctx.reject();
+                if (ctx.signature) {
+                    const signature = ctx.signature;
+                    const blob = ctx.blob;
+                    if (!blob)
+                        return ctx.reject();
+                    const parsed = utils.parseKey(ctx.key.data);
+                    if (parsed instanceof Error || !verify(null, blob, parsed.getPublicPEM(), signature))
+                        return ctx.reject();
+                }
+                admission = candidate;
+                const active = this.socketsByMachine.get(candidate.machineId)?.size ?? 0;
+                if (active >= 2)
+                    return ctx.reject();
+                ctx.accept();
+            });
+            client.on('ready', () => {
+                clearTimeout(deadline);
+                touch();
+                if (admission) {
+                    const set = this.socketsByMachine.get(admission.machineId) ?? new Set();
+                    set.add(client);
+                    this.socketsByMachine.set(admission.machineId, set);
+                }
+                client.on('session', accept => {
+                    const session = accept();
+                    session.on('pty', (_accept, reject) => reject());
+                    session.on('shell', (_accept, reject) => reject());
+                    session.on('exec', (_accept, reject) => reject());
+                    session.on('env', (_accept, reject) => reject());
+                    session.on('sftp', (_accept, reject) => reject());
+                    session.on('subsystem', (acceptSubsystem, reject, info) => {
+                        if (info.name !== 'instar-rpc' || !admission || !this.options.admissionStore.authenticate(Buffer.from(admission.publicKey.trim().split(/\s+/)[1] ?? '', 'base64')))
+                            return reject();
+                        const stream = acceptSubsystem();
+                        let data = Buffer.alloc(0);
+                        stream.on('data', (chunk) => {
+                            touch();
+                            data = Buffer.concat([data, chunk]);
+                            if (data.length > maxFrame) {
+                                stream.end();
+                                client.end();
+                                return;
+                            }
+                            const newline = data.indexOf(10);
+                            if (newline < 0)
+                                return;
+                            try {
+                                const challenge = validateChallenge(JSON.parse(data.subarray(0, newline).toString('utf8')));
+                                if (challenge.pairingEpoch !== admission.pairingEpoch || challenge.clientGeneration !== admission.clientGeneration || challenge.observerBootId !== admission.observerBootId)
+                                    throw new Error('stale-challenge');
+                                this.pruneNonces();
+                                if (this.seenNonces.has(challenge.nonce))
+                                    throw new Error('replayed-challenge');
+                                if (!this.takeRequestToken(admission.machineId))
+                                    throw new Error('ssh-request-rate-limited');
+                                this.seenNonces.set(challenge.nonce, Date.now() + 300_000);
+                                const response = this.options.respond(challenge, admission);
+                                const encoded = `${JSON.stringify(response)}\n`;
+                                if (Buffer.byteLength(encoded) > 256 * 1024)
+                                    throw new Error('ssh-response-too-large');
+                                stream.end(encoded);
+                            }
+                            catch {
+                                // @silent-fallback-ok — malformed/replayed restricted RPC frames
+                                // are rejected by closing the stream; no command is executed.
+                                stream.end();
+                            }
+                        });
+                    });
+                });
+            });
+            let removed = false;
+            const remove = () => {
+                if (removed)
+                    return;
+                removed = true;
+                clearTimeout(deadline);
+                clearTimeout(idle);
+                this.sockets.delete(client);
+                const remaining = Math.max(0, (this.handshakesBySource.get(source) ?? 1) - 1);
+                if (remaining === 0)
+                    this.handshakesBySource.delete(source);
+                else
+                    this.handshakesBySource.set(source, remaining);
+                if (admission) {
+                    const set = this.socketsByMachine.get(admission.machineId);
+                    set?.delete(client);
+                    if (set?.size === 0)
+                        this.socketsByMachine.delete(admission.machineId);
+                }
+            };
+            client.on('close', remove);
+            client.on('error', remove);
+        });
+        await new Promise((resolve, reject) => this.server.once('error', reject).listen(port, host, resolve));
+        const address = this.server.address();
+        return { host, port: typeof address === 'object' && address ? address.port : port };
+    }
+    async close() {
+        for (const socket of this.sockets)
+            socket.end();
+        await new Promise(resolve => this.server?.close(() => resolve()) ?? resolve());
+        this.server = null;
+        this.socketsByMachine.clear();
+    }
+    /** Revocation is effective for both new authentication and live sessions. */
+    revoke(machineId) {
+        this.options.admissionStore.revoke(machineId);
+        for (const connection of this.socketsByMachine.get(machineId) ?? [])
+            connection.end();
+        this.socketsByMachine.delete(machineId);
+    }
+    activeSessionCount(machineId) {
+        if (machineId)
+            return this.socketsByMachine.get(machineId)?.size ?? 0;
+        return [...this.socketsByMachine.values()].reduce((sum, set) => sum + set.size, 0);
+    }
+    pruneNonces(now = Date.now()) {
+        for (const [nonce, expires] of this.seenNonces)
+            if (expires <= now)
+                this.seenNonces.delete(nonce);
+    }
+    takeRequestToken(machineId, now = Date.now()) {
+        const current = this.requestBuckets.get(machineId) ?? { tokens: 10, refilledAt: now };
+        const refill = Math.floor((now - current.refilledAt) / 1_000);
+        if (refill > 0) {
+            current.tokens = Math.min(10, current.tokens + refill);
+            current.refilledAt = now;
+        }
+        if (current.tokens < 1) {
+            this.requestBuckets.set(machineId, current);
+            return false;
+        }
+        current.tokens -= 1;
+        this.requestBuckets.set(machineId, current);
+        return true;
+    }
+}
+export function canonicalSshResponse(response) {
+    return JSON.stringify({
+        nonce: response.nonce,
+        pairingEpoch: response.pairingEpoch,
+        observerBootId: response.observerBootId,
+        clientGeneration: response.clientGeneration,
+        hostGeneration: response.hostGeneration,
+        machineId: response.machineId,
+        sourceClientKeyFingerprint: response.sourceClientKeyFingerprint,
+        machineFingerprint: response.machineFingerprint,
+    });
+}
+function validateChallenge(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('invalid-challenge');
+    const row = value;
+    if (typeof row.nonce !== 'string' || row.nonce.length < 16 || row.nonce.length > 256)
+        throw new Error('invalid-nonce');
+    for (const key of ['pairingEpoch', 'clientGeneration', 'hostGeneration'])
+        if (!Number.isSafeInteger(row[key]) || Number(row[key]) < 1)
+            throw new Error(`invalid-${key}`);
+    if (typeof row.observerBootId !== 'string' || row.observerBootId.length > 128)
+        throw new Error('invalid-observer');
+    return row;
+}
+function isPrivateHost(host) {
+    if (host === 'localhost' || host === '::1' || host.startsWith('127.'))
+        return true;
+    if (net.isIP(host) === 4) {
+        const [a, b] = host.split('.').map(Number);
+        return a === 10 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 100 && b >= 64 && b <= 127);
+    }
+    return false;
+}
+//# sourceMappingURL=MachineSshEndpoint.js.map

package/dist/core/MachineSshEndpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineSshEndpoint.js","sourceRoot":"","sources":["../../src/core/MachineSshEndpoint.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,GAAG,MAAM,UAAU,CAAC;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAmB,MAAM,MAAM,CAAC;AA6BtD,mFAAmF;AACnF,MAAM,OAAO,kBAAkB;IAOA;IANrB,MAAM,GAAkB,IAAI,CAAC;IAC7B,OAAO,GAAG,IAAI,GAAG,EAAc,CAAC;IAChC,gBAAgB,GAAG,IAAI,GAAG,EAA2B,CAAC;IACtD,kBAAkB,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,cAAc,GAAG,IAAI,GAAG,EAAkD,CAAC;IAC3E,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,YAA6B,OAAkC;QAAlC,YAAO,GAAP,OAAO,CAA2B;IAAG,CAAC;IAEnE,KAAK,CAAC,MAAM,CAAC,IAAY,EAAE,IAAY;QACrC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,CAAC;QACzD,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC;YACvB,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;YACpH,UAAU,EAAE;gBACV,aAAa,EAAE,CAAC,aAAa,CAAC;gBAC9B,GAAG,EAAE,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;gBAC1D,MAAM,EAAE,CAAC,+BAA+B,EAAE,wBAAwB,EAAE,wBAAwB,CAAC;aAC9F;SACF,EAAE,MAAM,CAAC,EAAE;YACV,MAAM,MAAM,GAAG,MAAM,CAAE,MAA4D,CAAC,KAAK,EAAE,aAAa,IAAI,SAAS,CAAC,CAAC;YACvH,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;gBAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gBAAC,OAAO;YAAC,CAAC;YAC/E,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,gBAAgB,GAAG,CAAC,CAAC,CAAC;YAC1D,IAAI,SAAS,GAA4B,IAAI,CAAC;YAC9C,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YACxD,IAAI,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,GAAG,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3F,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACzB,MAAM,CAAC,EAAE,CAAC,gBAAgB,EAAE,GAAG,CAAC,EAAE;gBAChC,QAAQ,IAAI,CAAC,CAAC;gBACd,IAAI,QAAQ,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;oBAAE,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACzE,IAAI,CAAC,SAAS;oBAAE,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpC,IAAI,GAAG,CAAC,SAAS,EAAE,CAAC;oBAClB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;oBAChC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;oBACtB,IAAI,CAAC,IAAI;wBAAE,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;oBAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBAC5C,IAAI,MAAM,YAAY,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,YAAY,EAAE,EAAE,SAAS,CAAC;wBAAE,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC5G,CAAC;gBACD,SAAS,GAAG,SAAS,CAAC;gBACtB,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;gBACzE,IAAI,MAAM,IAAI,CAAC;oBAAE,OAAO,GAAG,CAAC,MAAM,EAAE,CAAC;gBACrC,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,CAAC,CAAC,CAAC;YACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,KAAK,EAAE,CAAC;gBACR,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,GAAG,EAAc,CAAC;oBACpF,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;oBAChB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;gBACtD,CAAC;gBACD,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE;oBAC5B,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC;oBACzB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;oBACnD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;oBAClD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;oBACjD,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;oBAClD,OAAO,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;wBACxD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;4BAAE,OAAO,MAAM,EAAE,CAAC;wBACpL,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;wBACjC,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;wBAC3B,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;4BAClC,KAAK,EAAE,CAAC;4BACR,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;4BACpC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;gCAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gCAAC,MAAM,CAAC,GAAG,EAAE,CAAC;gCAAC,OAAO;4BAAC,CAAC;4BACnE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;4BACjC,IAAI,OAAO,GAAG,CAAC;gCAAE,OAAO;4BACxB,IAAI,CAAC;gCACH,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;gCAC5F,IAAI,SAAS,CAAC,YAAY,KAAK,SAAU,CAAC,YAAY,IAAI,SAAS,CAAC,gBAAgB,KAAK,SAAU,CAAC,gBAAgB,IAAI,SAAS,CAAC,cAAc,KAAK,SAAU,CAAC,cAAc;oCAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;gCACnN,IAAI,CAAC,WAAW,EAAE,CAAC;gCACnB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC;oCAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;gCAChF,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,SAAU,CAAC,SAAS,CAAC;oCAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gCAC9F,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;gCAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,SAAU,CAAC,CAAC;gCAC7D,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC;gCAChD,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,GAAG,GAAG,IAAI;oCAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;gCACvF,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;4BACtB,CAAC;4BAAC,MAAM,CAAC;gCACP,iEAAiE;gCACjE,8DAA8D;gCAC9D,MAAM,CAAC,GAAG,EAAE,CAAC;4BACf,CAAC;wBACH,CAAC,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,MAAM,GAAG,GAAG,EAAE;gBAClB,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,QAAQ,CAAC,CAAC;gBACvB,YAAY,CAAC,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC9E,IAAI,SAAS,KAAK,CAAC;oBAAE,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;;oBAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBACjH,IAAI,SAAS,EAAE,CAAC;oBACd,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;oBAC3D,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACpB,IAAI,GAAG,EAAE,IAAI,KAAK,CAAC;wBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QAC7G,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACtC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,CAAC;IAED,KAAK,CAAC,KAAK;QACT,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,GAAG,EAAE,CAAC;QAChD,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,6EAA6E;IAC7E,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,UAAU,CAAC,GAAG,EAAE,CAAC;QACtF,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,kBAAkB,CAAC,SAAkB;QACnC,IAAI,SAAS;YAAE,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,IAAI,CAAC,CAAC;QACtE,OAAO,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACrF,CAAC;IAEO,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAClC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU;YAAE,IAAI,OAAO,IAAI,GAAG;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpG,CAAC;IAEO,gBAAgB,CAAC,SAAiB,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QAC1D,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;YAAC,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;QAAC,CAAC;QACrG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QACtF,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA2C;IAC9E,OAAO,IAAI,CAAC,SAAS,CAAC;QACpB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;QAC3C,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;QAC/D,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;KAChD,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC;IACvH,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,gBAAgB,CAAC;QAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC;IACzK,IAAI,OAAO,GAAG,CAAC,cAAc,KAAK,QAAQ,IAAI,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACnH,OAAO,GAAiC,CAAC;AAC3C,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACnF,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/core/MachineSshIdentity.d.ts

@@ -0,0 +1,26 @@
+export interface MachineSshIdentityRecord {
+    agentId: string;
+    machineId: string;
+    clientGeneration: number;
+    hostGeneration: number;
+    clientPrivateKeyPath: string;
+    clientPublicKey: string;
+    hostPrivateKeyPath: string;
+    hostPublicKey: string;
+    previousHostPrivateKeyPath?: string;
+    previousHostPublicKey?: string;
+}
+/** Owns only Instar's dedicated keys. It never reads or writes ~/.ssh. */
+export declare class MachineSshIdentity {
+    private readonly agentId;
+    private readonly machineId;
+    private readonly root;
+    constructor(stateDir: string, agentId: string, machineId: string);
+    ensure(options?: {
+        forceClientRotation?: boolean;
+        forceHostRotation?: boolean;
+    }): MachineSshIdentityRecord;
+    private ensurePair;
+    static fingerprint(publicKey: string): string;
+}
+//# sourceMappingURL=MachineSshIdentity.d.ts.map

package/dist/core/MachineSshIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineSshIdentity.d.ts","sourceRoot":"","sources":["../../src/core/MachineSshIdentity.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,CAAC;IACtB,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAkBD,0EAA0E;AAC1E,qBAAa,kBAAkB;IAGC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF1F,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;gBAElB,QAAQ,EAAE,MAAM,EAAmB,OAAO,EAAE,MAAM,EAAmB,SAAS,EAAE,MAAM;IAIlG,MAAM,CAAC,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;QAAC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAAO,GAAG,wBAAwB;IAsC9G,OAAO,CAAC,UAAU;IAkBlB,MAAM,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;CAI9C"}

package/dist/core/MachineSshIdentity.js

@@ -0,0 +1,97 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { withSyncOp } from './InFlightSyncOpMarker.js';
+const PRIVATE_MODE = 0o600;
+function readPublic(file) {
+    return fs.readFileSync(file, 'utf8').trim();
+}
+function matchingPair(privatePath, publicPath) {
+    try {
+        const derived = withSyncOp(() => execFileSync('ssh-keygen', ['-y', '-f', privatePath], { encoding: 'utf8' })).trim().split(/\s+/).slice(0, 2).join(' ');
+        const installed = readPublic(publicPath).split(/\s+/).slice(0, 2).join(' ');
+        return installed.startsWith(`${derived} `) || installed === derived;
+    }
+    catch {
+        return false;
+    }
+}
+/** Owns only Instar's dedicated keys. It never reads or writes ~/.ssh. */
+export class MachineSshIdentity {
+    agentId;
+    machineId;
+    root;
+    constructor(stateDir, agentId, machineId) {
+        this.agentId = agentId;
+        this.machineId = machineId;
+        this.root = path.join(stateDir, 'machine-ssh');
+    }
+    ensure(options = {}) {
+        fs.mkdirSync(this.root, { recursive: true, mode: 0o700 });
+        if (fs.lstatSync(this.root).isSymbolicLink())
+            throw new Error('ssh-identity-root-symlink-refused');
+        fs.chmodSync(this.root, 0o700);
+        const metadataPath = path.join(this.root, 'identity.json');
+        let metadata = { clientGeneration: 1, hostGeneration: 1 };
+        const established = fs.existsSync(metadataPath);
+        if (established) {
+            try {
+                metadata = { ...metadata, ...JSON.parse(fs.readFileSync(metadataPath, 'utf8')) };
+            }
+            catch {
+                throw new Error('ssh-identity-metadata-invalid');
+            }
+            if (!Number.isSafeInteger(metadata.clientGeneration) || metadata.clientGeneration < 1 || !Number.isSafeInteger(metadata.hostGeneration) || metadata.hostGeneration < 1)
+                throw new Error('ssh-identity-metadata-invalid');
+        }
+        const client = this.ensurePair('client', metadata.clientGeneration, () => { metadata.clientGeneration += 1; }, options.forceClientRotation === true, established);
+        const host = this.ensurePair('host', metadata.hostGeneration, () => { metadata.hostGeneration += 1; }, options.forceHostRotation === true, established);
+        const metadataTmp = `${metadataPath}.${process.pid}.tmp`;
+        fs.writeFileSync(metadataTmp, `${JSON.stringify(metadata, null, 2)}\n`, { mode: PRIVATE_MODE });
+        fs.renameSync(metadataTmp, metadataPath);
+        fs.chmodSync(metadataPath, PRIVATE_MODE);
+        const previousHostPrivateKeyPath = metadata.hostGeneration > 1 ? path.join(this.root, `host-ed25519-g${metadata.hostGeneration - 1}`) : undefined;
+        const previousHostPublicPath = previousHostPrivateKeyPath ? `${previousHostPrivateKeyPath}.pub` : undefined;
+        return {
+            agentId: this.agentId,
+            machineId: this.machineId,
+            clientGeneration: metadata.clientGeneration,
+            hostGeneration: metadata.hostGeneration,
+            clientPrivateKeyPath: client.privatePath,
+            clientPublicKey: readPublic(client.publicPath),
+            hostPrivateKeyPath: host.privatePath,
+            hostPublicKey: readPublic(host.publicPath),
+            ...(previousHostPrivateKeyPath && previousHostPublicPath && fs.existsSync(previousHostPrivateKeyPath) && fs.existsSync(previousHostPublicPath)
+                && !fs.lstatSync(previousHostPrivateKeyPath).isSymbolicLink() && !fs.lstatSync(previousHostPublicPath).isSymbolicLink()
+                && (fs.statSync(previousHostPrivateKeyPath).mode & 0o777) === PRIVATE_MODE && matchingPair(previousHostPrivateKeyPath, previousHostPublicPath)
+                ? { previousHostPrivateKeyPath, previousHostPublicKey: readPublic(previousHostPublicPath) }
+                : {}),
+        };
+    }
+    ensurePair(kind, generation, rotate, force = false, established = false) {
+        let current = generation;
+        let privatePath = path.join(this.root, `${kind}-ed25519-g${current}`);
+        let publicPath = `${privatePath}.pub`;
+        const valid = !force && fs.existsSync(privatePath) && fs.existsSync(publicPath)
+            && !fs.lstatSync(privatePath).isSymbolicLink() && !fs.lstatSync(publicPath).isSymbolicLink()
+            && (fs.statSync(privatePath).mode & 0o777) === PRIVATE_MODE
+            && matchingPair(privatePath, publicPath);
+        if (!valid) {
+            if (established || fs.existsSync(privatePath) || fs.existsSync(publicPath)) {
+                rotate();
+                current += 1;
+            }
+            privatePath = path.join(this.root, `${kind}-ed25519-g${current}`);
+            publicPath = `${privatePath}.pub`;
+            withSyncOp(() => execFileSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `instar:${this.agentId}:${this.machineId}:${current}`, '-f', privatePath], { stdio: 'ignore' }));
+            fs.chmodSync(privatePath, PRIVATE_MODE);
+        }
+        return { privatePath, publicPath };
+    }
+    static fingerprint(publicKey) {
+        const body = publicKey.trim().split(/\s+/)[1] ?? '';
+        return `SHA256:${createHash('sha256').update(Buffer.from(body, 'base64')).digest('base64').replace(/=+$/, '')}`;
+    }
+}
+//# sourceMappingURL=MachineSshIdentity.js.map

package/dist/core/MachineSshIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MachineSshIdentity.js","sourceRoot":"","sources":["../../src/core/MachineSshIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAevD,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,UAAkB;IAC3D,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxJ,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,SAAS,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,IAAI,SAAS,KAAK,OAAO,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,MAAM,OAAO,kBAAkB;IAGkB;IAAkC;IAFhE,IAAI,CAAS;IAE9B,YAAY,QAAgB,EAAmB,OAAe,EAAmB,SAAiB;QAAnD,YAAO,GAAP,OAAO,CAAQ;QAAmB,cAAS,GAAT,SAAS,CAAQ;QAChG,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,CAAC,UAA0E,EAAE;QACjF,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QAC3D,IAAI,QAAQ,GAAG,EAAE,gBAAgB,EAAE,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;QAC1D,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAChD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBAAC,QAAQ,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;YAAC,CAAC;YACzF,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;YAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,QAAQ,CAAC,gBAAgB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,QAAQ,CAAC,cAAc,GAAG,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC3N,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,mBAAmB,KAAK,IAAI,EAAE,WAAW,CAAC,CAAC;QAClK,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,iBAAiB,KAAK,IAAI,EAAE,WAAW,CAAC,CAAC;QACxJ,MAAM,WAAW,GAAG,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACzD,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAChG,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QACzC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;QACzC,MAAM,0BAA0B,GAAG,QAAQ,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,QAAQ,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAClJ,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,CAAC,CAAC,GAAG,0BAA0B,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5G,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,oBAAoB,EAAE,MAAM,CAAC,WAAW;YACxC,eAAe,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC;YAC9C,kBAAkB,EAAE,IAAI,CAAC,WAAW;YACpC,aAAa,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;YAC1C,GAAG,CAAC,0BAA0B,IAAI,sBAAsB,IAAI,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC;mBACzI,CAAC,EAAE,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC,cAAc,EAAE;mBACpH,CAAC,EAAE,CAAC,QAAQ,CAAC,0BAA0B,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY,IAAI,YAAY,CAAC,0BAA0B,EAAE,sBAAsB,CAAC;gBAC9I,CAAC,CAAC,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,UAAU,CAAC,sBAAsB,CAAC,EAAE;gBAC3F,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,IAAuB,EAAE,UAAkB,EAAE,MAAkB,EAAE,KAAK,GAAG,KAAK,EAAE,WAAW,GAAG,KAAK;QACpH,IAAI,OAAO,GAAG,UAAU,CAAC;QACzB,IAAI,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;QACtE,IAAI,UAAU,GAAG,GAAG,WAAW,MAAM,CAAC;QACtC,MAAM,KAAK,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;eAC1E,CAAC,EAAE,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,cAAc,EAAE;eACzF,CAAC,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,YAAY;eACxD,YAAY,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,WAAW,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC,CAAC;YAAC,CAAC;YACvG,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,aAAa,OAAO,EAAE,CAAC,CAAC;YAClE,UAAU,GAAG,GAAG,WAAW,MAAM,CAAC;YAClC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;YACrL,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,WAAW,CAAC,SAAiB;QAClC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpD,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAClH,CAAC;CACF"}

package/dist/core/MeshRpc.d.ts

@@ -73,6 +73,12 @@ export type MeshCommand = {
 } | {
     type: 'secret-share';
     encrypted: string;
+} | {
+    type: 'ssh-bootstrap-advert';
+    advert: import('./SshBootstrapAdvert.js').SshBootstrapAdvert;
+} | {
+    type: 'ssh-proof-publish';
+    proof: import('./MutualSshVerifier.js').DirectionalSshProof;
 } | {
     type: 'slice-renew';
     mandateId: string;

package/dist/core/MeshRpc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IACE,gFAAgF;IAChF,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAiBE,IAAI,EAAE,gBAAgB,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAaE,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAeE,IAAI,EAAE,mCAAmC,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,iDAAiD,EAAE,eAAe,CAAC;CACrF,GAMD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAcE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,GAAG,OAAO,GAAG,YAAY,CAAC;QAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GACD;IAkBE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,0BAA0B,GAC1B,8BAA8B,GAC9B,6BAA6B,CAAC;AAElC,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IACzD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,SAAS,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,KAAK,OAAO,CAAC;IACd;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC;CACpE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAuH7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA2BpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}
+{"version":3,"file":"MeshRpc.d.ts","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,SAAS,CAAA;CAAE,GACtD;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GACxD;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACxG;IACE,gFAAgF;IAChF,IAAI,EAAE,mBAAmB,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB,GACD;IAWE,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,SAAS,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;CACxB,GACD;IAiBE,IAAI,EAAE,gBAAgB,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,OAAO,kBAAkB,EAAE,oBAAoB,CAAC;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAAE,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,cAAc,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,sBAAsB,CAAC;IAAC,MAAM,EAAE,OAAO,yBAAyB,EAAE,kBAAkB,CAAA;CAAE,GAC9F;IAAE,IAAI,EAAE,mBAAmB,CAAC;IAAC,KAAK,EAAE,OAAO,wBAAwB,EAAE,mBAAmB,CAAA;CAAE,GAC1F;IAaE,IAAI,EAAE,aAAa,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB,GACD;IAeE,IAAI,EAAE,mCAAmC,CAAC;IAC1C,8EAA8E;IAC9E,QAAQ,EAAE,OAAO,iDAAiD,EAAE,eAAe,CAAC;CACrF,GAMD;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC/C;IAOE,IAAI,EAAE,cAAc,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;IAClF,OAAO,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACjG,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAcE,IAAI,EAAE,gBAAgB,CAAC;IACvB,OAAO,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,OAAO,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACrD,GACD;IAQE,IAAI,EAAE,mBAAmB,CAAC;IAC1B,OAAO,EAAE;QACP,MAAM,EAAE,MAAM,CAAC;QACf,EAAE,EAAE,MAAM,CAAC;QACX,EAAE,EAAE,SAAS,GAAG,UAAU,GAAG,QAAQ,GAAG,cAAc,GAAG,OAAO,GAAG,YAAY,CAAC;QAChF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/B,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,EAAE,MAAM,CAAC;QACxB,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH,GACD;IAUE,IAAI,EAAE,oBAAoB,CAAC;IAC3B,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,GACD;IAOE,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC9C,GACD;IAkBE,IAAI,EAAE,iBAAiB,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,SAAS,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,OAAO,EAAE,WAAW,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAClC,CAAC,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,WAAW,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,GAAG,WAAW,CAAC,GAC1F,MAAM,CAER;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAC1B,KAAK,EAAE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,SAAS,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,EACzH,IAAI,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,GAClC,YAAY,CAEd;AAED,MAAM,MAAM,YAAY,GACpB,IAAI,GACJ,iBAAiB,GACjB,mBAAmB,GACnB,gBAAgB,GAChB,gBAAgB,GAChB,iBAAiB,CAAC;AAEtB,MAAM,WAAW,kBAAkB;IACjC,oEAAoE;IACpE,aAAa,EAAE,SAAS,CAAC;IACzB,uFAAuF;IACvF,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IAC7E,2DAA2D;IAC3D,gBAAgB,EAAE,CAAC,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC;IACjD,+EAA+E;IAC/E,SAAS,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;IACzD,+BAA+B;IAC/B,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAajH;AAED,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,YAAY,GACZ,oBAAoB,GACpB,sBAAsB,GACtB,oBAAoB,GACpB,0BAA0B,GAC1B,8BAA8B,GAC9B,6BAA6B,CAAC;AAElC,MAAM,WAAW,QAAQ;IACvB,qFAAqF;IACrF,YAAY,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC;IACrC,uDAAuD;IACvD,OAAO,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IAC/C,wFAAwF;IACxF,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,SAAS,GAAG,IAAI,CAAC;IACzD;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,CAAC,IAAI,EAAE;QAC3B,MAAM,EAAE,SAAS,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,KAAK,OAAO,CAAC;IACd;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,SAAS,CAAA;KAAE,KAAK,OAAO,CAAC;CACpE;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,GAAG;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,CAyH7H;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,UAAU,EAAE,kBAAkB,EAC9B,QAAQ,EAAE,QAAQ,GACjB;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,CAAA;CAAE,CAIpD;AAID;;mDAEmD;AACnD,MAAM,MAAM,kBAAkB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,YAAY,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;AAE5H,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,kBAAkB,CAAC;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,+EAA+E;IAC/E,WAAW,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,mIAAmI;IACnI,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAC,CAAC;IACnE,yDAAyD;IACzD,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAC;IACvD,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;CAChC;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAC7B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,GAAG,UAAU,GAAG,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AA2BpF;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAwB;gBAC9B,IAAI,EAAE,qBAAqB;IAIjC,QAAQ,CAAC,GAAG,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC;CAgB3D"}

package/dist/core/MeshRpc.js

@@ -145,6 +145,8 @@ export function checkCommandRBAC(command, sender, deps) {
         case 'state-snapshot':
         case 'pool-view-fetch':
         case 'secret-share':
+        case 'ssh-bootstrap-advert':
+        case 'ssh-proof-publish':
         case 'a2a-inbox-deliver':
             // Registered-peer class — any caller here has already passed signed,
             // recipient-bound, replay-safe machine authentication. a2a-inbox-deliver

package/dist/core/MeshRpc.js.map

@@ -1 +1 @@
-{"version":3,"file":"MeshRpc.js","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA0OH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,CAA2F;IAE3F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,KAAyH,EACzH,IAAmC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAwB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3C,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1F,+DAA+D;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1H,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvF,mCAAmC;IACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,kCAAkC;IAClC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AA4CD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,MAAiB,EAAE,IAAc;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,MAAM,CAAC;IAChD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB;YACnB,iFAAiF;YACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrF,KAAK,OAAO;YACV,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,mBAAmB;YACnB,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7F,KAAK,gBAAgB;YACnB,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACtG,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uFAAuF;YACvF,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1F,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,6DAA6D;YAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,yEAAyE;YACzE,6EAA6E;YAC7E,yEAAyE;YACzE,8EAA8E;YAC9E,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACvC,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,IAAI,KAAK,CAAC;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,mCAAmC,CAAC,CAAC,CAAC;YACzC,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,2FAA2F;YAC3F,4FAA4F;YAC5F,6FAA6F;YAC7F,6DAA6D;YAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,KAAK,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACpG,CAAC;QACD,KAAK,mBAAmB;YACtB,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc,CAAC;QACpB,KAAK,mBAAmB;YACtB,qEAAqE;YACrE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,0CAA0C;YAC1C,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,6DAA6D;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,2EAA2E;YAC3E,0EAA0E;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,UAA8B,EAC9B,QAAkB;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAyBD,uGAAuG;AACvG,SAAS,eAAe,CAAC,MAAc;IACrC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB,CAAC;QAC1B,KAAK,0BAA0B,CAAC;QAChC,KAAK,8BAA8B,CAAC;QACpC,KAAK,6BAA6B;YAChC,OAAO,GAAG,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,CAAC,CAAwB;IAC1C,YAAY,IAA2B;QACrC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAiB;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;CACF"}
+{"version":3,"file":"MeshRpc.js","sourceRoot":"","sources":["../../src/core/MeshRpc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AA4OH,oFAAoF;AACpF,MAAM,UAAU,oBAAoB,CAClC,CAA2F;IAE3F,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;AAC3F,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAC1B,KAAyH,EACzH,IAAmC;IAEnC,OAAO,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAyBD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAiB,EAAE,IAAwB;IACxE,MAAM,GAAG,GAAG,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3C,uEAAuE;IACvE,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAC1F,+DAA+D;IAC/D,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;IAC1H,iDAAiD;IACjD,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACvF,mCAAmC;IACnC,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC1F,kCAAkC;IAClC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACpC,CAAC;AA4CD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAoB,EAAE,MAAiB,EAAE,IAAc;IACtF,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,MAAM,CAAC;IAChD,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,OAAO,CAAC;QACb,KAAK,UAAU,CAAC;QAChB,KAAK,gBAAgB;YACnB,iFAAiF;YACjF,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;QACrF,KAAK,OAAO;YACV,yEAAyE;YACzE,wEAAwE;YACxE,wEAAwE;YACxE,mBAAmB;YACnB,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QAC7F,KAAK,gBAAgB;YACnB,0EAA0E;YAC1E,sEAAsE;YACtE,0EAA0E;YAC1E,sEAAsE;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,OAAO,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,EAAE,CAAC;QACtG,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,uFAAuF;YACvF,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC1F,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,6DAA6D;YAC7D,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAChF,IAAI,QAAQ,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YAC7E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;QACvD,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACnB,yEAAyE;YACzE,6EAA6E;YAC7E,yEAAyE;YACzE,8EAA8E;YAC9E,+EAA+E;YAC/E,2EAA2E;YAC3E,6EAA6E;YAC7E,yEAAyE;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACvC,MAAM;gBACN,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;aACjD,CAAC,IAAI,KAAK,CAAC;YACZ,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAChG,CAAC;QACD,KAAK,mCAAmC,CAAC,CAAC,CAAC;YACzC,wFAAwF;YACxF,0FAA0F;YAC1F,wFAAwF;YACxF,2FAA2F;YAC3F,4FAA4F;YAC5F,6FAA6F;YAC7F,6DAA6D;YAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,uBAAuB,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,IAAI,KAAK,CAAC;YAClE,OAAO,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;QACpG,CAAC;QACD,KAAK,mBAAmB;YACtB,uEAAuE;YACvE,qEAAqE;YACrE,sEAAsE;YACtE,sEAAsE;YACtE,wEAAwE;YACxE,kEAAkE;YAClE,mCAAmC;YACnC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC,KAAK,iBAAiB,CAAC;QACvB,KAAK,gBAAgB,CAAC;QACtB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,cAAc,CAAC;QACpB,KAAK,kBAAkB,CAAC;QACxB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB,CAAC;QACvB,KAAK,cAAc,CAAC;QACpB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,mBAAmB,CAAC;QACzB,KAAK,mBAAmB;YACtB,qEAAqE;YACrE,yEAAyE;YACzE,0EAA0E;YAC1E,0EAA0E;YAC1E,0CAA0C;YAC1C,uEAAuE;YACvE,uEAAuE;YACvE,0EAA0E;YAC1E,sEAAsE;YACtE,sEAAsE;YACtE,mEAAmE;YACnE,mEAAmE;YACnE,uEAAuE;YACvE,6DAA6D;YAC7D,uEAAuE;YACvE,6DAA6D;YAC7D,oEAAoE;YACpE,sEAAsE;YACtE,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,kEAAkE;YAClE,kEAAkE;YAClE,gEAAgE;YAChE,qEAAqE;YACrE,uEAAuE;YACvE,oEAAoE;YACpE,qEAAqE;YACrE,+DAA+D;YAC/D,2EAA2E;YAC3E,0EAA0E;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpC;YACE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,UAA8B,EAC9B,QAAkB;IAElB,MAAM,CAAC,GAAG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,CAAC,CAAC;IACpB,OAAO,gBAAgB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAyBD,uGAAuG;AACvG,SAAS,eAAe,CAAC,MAAc;IACrC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,iBAAiB,CAAC;QACvB,KAAK,mBAAmB,CAAC;QACzB,KAAK,gBAAgB;YACnB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY,CAAC;QAClB,KAAK,oBAAoB,CAAC;QAC1B,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB,CAAC;QAC1B,KAAK,0BAA0B,CAAC;QAChC,KAAK,8BAA8B,CAAC;QACpC,KAAK,6BAA6B;YAChC,OAAO,GAAG,CAAC;QACb,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,GAAG,CAAC;QACb,KAAK,YAAY;YACf,OAAO,GAAG,CAAC;QACb;YACE,OAAO,GAAG,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,OAAO,iBAAiB;IACX,CAAC,CAAwB;IAC1C,YAAY,IAA2B;QACrC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAiB;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,uBAAuB,GAAG,CAAC,OAAO,EAAE,IAAI,SAAS,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACjG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtF,CAAC;QACD,8DAA8D;QAC9D,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC;QACpF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;CACF"}

package/dist/core/MutualSshHealthController.d.ts

@@ -0,0 +1,33 @@
+import type { DirectionalSshProof, MutualSshVerifier, SshProbeTarget } from './MutualSshVerifier.js';
+export type MutualSshFailureClass = 'connect-refused' | 'timeout' | 'host-key-changed' | 'admission-refused' | 'identity-mismatch' | 'firewall-denied' | 'vpn-route-unavailable' | 'system-sleep' | 'port-collision' | 'unknown';
+export interface MutualSshPairHealth {
+    sourceMachineId: string;
+    targetMachineId: string;
+    mutual: boolean;
+    state: 'verified' | 'repairing' | 'blocked';
+    proof?: DirectionalSshProof;
+    lastFailureClass?: MutualSshFailureClass;
+    attempts: number;
+    breakerOpenUntil?: string;
+}
+export interface MutualSshRepairHooks {
+    refreshAdvert(target: SshProbeTarget): Promise<void>;
+    reconcileAdmission(target: SshProbeTarget): Promise<void>;
+    rotateSourceKey(target: SshProbeTarget): Promise<void>;
+    notifySecurity(target: SshProbeTarget, failure: MutualSshFailureClass): Promise<void>;
+    notifyExhausted(target: SshProbeTarget, failure: MutualSshFailureClass): Promise<void>;
+}
+/** Bounded detector/remediator. It emits proof signals and never chooses routing. */
+export declare class MutualSshHealthController {
+    private readonly verifier;
+    private readonly hooks;
+    private readonly concurrency;
+    private readonly state;
+    private running;
+    constructor(verifier: MutualSshVerifier, hooks: MutualSshRepairHooks, concurrency?: number);
+    static validateCapacity(machineCount: number, concurrency?: number, deadlineMs?: number, freshnessMs?: number): void;
+    check(target: SshProbeTarget, now?: number): Promise<DirectionalSshProof | null>;
+    health(targets: SshProbeTarget[], now?: number): MutualSshPairHealth[];
+}
+export declare function classifyMutualSshFailure(error: unknown): MutualSshFailureClass;
+//# sourceMappingURL=MutualSshHealthController.d.ts.map

package/dist/core/MutualSshHealthController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"MutualSshHealthController.d.ts","sourceRoot":"","sources":["../../src/core/MutualSshHealthController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAErG,MAAM,MAAM,qBAAqB,GAAG,iBAAiB,GAAG,SAAS,GAAG,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,uBAAuB,GAAG,cAAc,GAAG,gBAAgB,GAAG,SAAS,CAAC;AAEjO,MAAM,WAAW,mBAAmB;IAClC,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,UAAU,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5C,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1D,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,cAAc,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxF;AAID,qFAAqF;AAErF,qBAAa,yBAAyB;IAGxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAqB,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAwB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAFpI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgC;IACtD,OAAO,CAAC,OAAO,CAAK;gBACS,QAAQ,EAAE,iBAAiB,EAAmB,KAAK,EAAE,oBAAoB,EAAmB,WAAW,SAAI;IAIxI,MAAM,CAAC,gBAAgB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,SAAI,EAAE,UAAU,SAAQ,EAAE,WAAW,SAAU,GAAG,IAAI;IAKzG,KAAK,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,SAAa,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAmC1F,MAAM,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,GAAG,SAAa,GAAG,mBAAmB,EAAE;CAa3E;AAKD,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAc9E"}

package/dist/core/MutualSshHealthController.js

@@ -0,0 +1,113 @@
+/** Bounded detector/remediator. It emits proof signals and never chooses routing. */
+/* @self-action-controller: mutual-ssh-repair-sweep */
+export class MutualSshHealthController {
+    verifier;
+    hooks;
+    concurrency;
+    state = new Map();
+    running = 0;
+    constructor(verifier, hooks, concurrency = 4) {
+        this.verifier = verifier;
+        this.hooks = hooks;
+        this.concurrency = concurrency;
+        if (concurrency < 1 || concurrency > 32)
+            throw new Error('mutual-ssh-concurrency-out-of-range');
+    }
+    static validateCapacity(machineCount, concurrency = 4, deadlineMs = 8_000, freshnessMs = 300_000) {
+        const sweepMs = machineCount * (machineCount - 1) * deadlineMs / concurrency;
+        if (sweepMs >= freshnessMs)
+            throw new Error(`mutual-ssh-capacity-invalid machines=${machineCount} sweepMs=${sweepMs} freshnessMs=${freshnessMs}`);
+    }
+    async check(target, now = Date.now()) {
+        const key = pairKey(target);
+        const current = this.state.get(key) ?? { failures: [], attempts: 0 };
+        current.failures = current.failures.filter(at => now - at < 15 * 60_000);
+        if ((current.breakerUntil ?? 0) > now || this.running >= this.concurrency)
+            return null;
+        const started = Date.now();
+        this.running += 1;
+        try {
+            for (let attempt = 1; attempt <= 4 && Date.now() - started < 120_000; attempt += 1) {
+                current.attempts = attempt;
+                try {
+                    if (attempt === 2)
+                        await this.hooks.refreshAdvert(target);
+                    if (attempt === 3)
+                        await this.hooks.reconcileAdmission(target);
+                    if (attempt === 4)
+                        await this.hooks.rotateSourceKey(target);
+                    const proof = await this.verifier.probe(target);
+                    current.proof = proof;
+                    current.failure = undefined;
+                    current.attempts = 0;
+                    this.state.set(key, current);
+                    return proof;
+                }
+                catch (error) {
+                    // @silent-fallback-ok — a failed bounded probe is the controller's
+                    // expected input: it is classified, retained in health state, and
+                    // ultimately surfaced through notifyExhausted/notifySecurity.
+                    current.failure = classifyMutualSshFailure(error);
+                    if (current.failure === 'host-key-changed') {
+                        await this.hooks.notifySecurity(target, current.failure);
+                        break;
+                    }
+                    if (attempt < 4)
+                        await delay(Math.min(8_000, 250 * (2 ** (attempt - 1))));
+                }
+            }
+            current.failures.push(now);
+            if (current.failures.length >= 3)
+                current.breakerUntil = now + 15 * 60_000;
+            await this.hooks.notifyExhausted(target, current.failure ?? 'unknown');
+            this.state.set(key, current);
+            return null;
+        }
+        finally {
+            this.running -= 1;
+        }
+    }
+    health(targets, now = Date.now()) {
+        return targets.map(target => {
+            const state = this.state.get(pairKey(target)) ?? { failures: [], attempts: 0 };
+            const reverse = this.state.get(`${target.targetMachineId}->${target.sourceMachineId}@${target.pairingEpoch}`);
+            const mutual = Boolean(state.proof && reverse?.proof && Date.parse(state.proof.expiresAt) > now && Date.parse(reverse.proof.expiresAt) > now);
+            return {
+                sourceMachineId: target.sourceMachineId, targetMachineId: target.targetMachineId, mutual,
+                state: mutual ? 'verified' : state.attempts > 0 ? 'repairing' : 'blocked', proof: state.proof,
+                lastFailureClass: state.failure, attempts: state.attempts,
+                breakerOpenUntil: state.breakerUntil ? new Date(state.breakerUntil).toISOString() : undefined,
+            };
+        });
+    }
+}
+function pairKey(target) {
+    return `${target.sourceMachineId}->${target.targetMachineId}@${target.pairingEpoch}`;
+}
+export function classifyMutualSshFailure(error) {
+    // Structural transport/error-code classification only. This never infers
+    // human intent, gates input, or reroutes a message.
+    const message = (error instanceof Error ? error.message : String(error)).toLowerCase();
+    if (hasAny(message, ['host', 'fingerprint', 'pinned']))
+        return 'host-key-changed';
+    if (hasAny(message, ['eaddrinuse', 'address already in use']))
+        return 'port-collision';
+    if (hasAny(message, ['eacces', 'eperm', 'firewall', 'administratively prohibited']))
+        return 'firewall-denied';
+    if (hasAny(message, ['enetunreach', 'ehostunreach', 'no route', 'vpn-route-unavailable']))
+        return 'vpn-route-unavailable';
+    if (hasAny(message, ['system-sleep', 'sleep-wake', 'suspended']))
+        return 'system-sleep';
+    if (message.includes('timeout'))
+        return 'timeout';
+    if (hasAny(message, ['auth', 'admission']))
+        return 'admission-refused';
+    if (message.includes('identity'))
+        return 'identity-mismatch';
+    if (hasAny(message, ['econnrefused', 'connect']))
+        return 'connect-refused';
+    return 'unknown';
+}
+function hasAny(value, needles) { return needles.some(needle => value.includes(needle)); }
+function delay(ms) { return new Promise(resolve => setTimeout(resolve, ms)); }
+//# sourceMappingURL=MutualSshHealthController.js.map