fix: bound pending admin challenges and sign every value an op acts on

Any member could make a node hold unbounded challenge requests; a
connection now keeps at most 8, 64 KiB each. root_add, group_attach,
invite_create and tmdb_config signed less than they did; their subjects
are now canonical JSON of every value (the TMDB token by SHA-256).
MNP 5.0, floor kept at 4.0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 64 insertions, 64 deletions

diff --git a/packages/meshbay-node/tests/golden/dispatch.json b/packages/meshbay-node/tests/golden/dispatch.json
index 4767996..a7bb543 100644
--- a/packages/meshbay-node/tests/golden/dispatch.json
+++ b/packages/meshbay-node/tests/golden/dispatch.json
@@ -2068,7 +2068,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2391,7 +2391,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2410,7 +2410,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2429,7 +2429,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2448,7 +2448,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2718,7 +2718,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2732,7 +2732,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2746,7 +2746,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2760,7 +2760,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2774,7 +2774,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2788,7 +2788,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2802,7 +2802,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -2816,7 +2816,7 @@
      "messages": [],
      "req_id": 4242,
      "type": "chat_hist_resp",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8535,7 +8535,7 @@
      "subject": "gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8554,7 +8554,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8573,7 +8573,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8592,7 +8592,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8924,10 +8924,10 @@
      "op": "group_attach",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "['x']",
+     "subject": "{\"name\":\"['x']\",\"shared_dir\":\"['x']\",\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8943,10 +8943,10 @@
      "op": "group_attach",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "7",
+     "subject": "{\"name\":\"7\",\"shared_dir\":\"7\",\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -8962,10 +8962,10 @@
      "op": "group_attach",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "x",
+     "subject": "{\"name\":\"x\",\"shared_dir\":\"x\",\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -9300,7 +9300,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -9319,7 +9319,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -9338,7 +9338,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -11641,7 +11641,7 @@
      "subject": "link:gggggggggggggggggggggggggggggggg",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -13740,7 +13740,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -13759,7 +13759,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -13778,7 +13778,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -14113,7 +14113,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -14132,7 +14132,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -14151,7 +14151,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16212,7 +16212,7 @@
      "req_id": 4242,
      "token": null,
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16227,7 +16227,7 @@
       "x"
      ],
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16240,7 +16240,7 @@
      "req_id": 4242,
      "token": 7,
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16253,7 +16253,7 @@
      "req_id": 4242,
      "token": "x",
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16266,7 +16266,7 @@
      "req_id": 4242,
      "token": null,
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16281,7 +16281,7 @@
       "x"
      ],
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16294,7 +16294,7 @@
      "req_id": 4242,
      "token": 7,
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16307,7 +16307,7 @@
      "req_id": 4242,
      "token": "x",
      "type": "pong",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16639,10 +16639,10 @@
      "op": "root_add",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "['x']",
+     "subject": "{\"kind\":\"['x']\",\"name\":\"['x']\",\"path\":\"['x']\",\"removable\":true,\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16658,10 +16658,10 @@
      "op": "root_add",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "7",
+     "subject": "{\"kind\":\"7\",\"name\":\"7\",\"path\":\"7\",\"removable\":true,\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -16677,10 +16677,10 @@
      "op": "root_add",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "x",
+     "subject": "{\"kind\":\"x\",\"name\":\"x\",\"path\":\"x\",\"removable\":true,\"writable\":true}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17015,7 +17015,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17034,7 +17034,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17053,7 +17053,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17388,7 +17388,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17407,7 +17407,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17426,7 +17426,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17761,7 +17761,7 @@
      "subject": "['x']",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17780,7 +17780,7 @@
      "subject": "7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -17799,7 +17799,7 @@
      "subject": "x",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -18134,7 +18134,7 @@
      "subject": "['x']:rw=on,rem=on",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -18153,7 +18153,7 @@
      "subject": "7:rw=on,rem=on",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -18172,7 +18172,7 @@
      "subject": "x:rw=on,rem=on",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -21116,10 +21116,10 @@
      "op": "tmdb_config",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "custom_token=no,language=default",
+     "subject": "{\"language\":null,\"token\":null}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -21159,10 +21159,10 @@
      "op": "tmdb_config",
      "op_id": "<volatile>",
      "req_id": 4242,
-     "subject": "custom_token=yes,language=x",
+     "subject": "{\"language\":\"x\",\"token\":\"sha256:2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881\"}",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []
@@ -23049,7 +23049,7 @@
      "subject": "d=7,u=7",
      "ts": "<volatile>",
      "type": "admin_challenge",
-     "v": "4.0"
+     "v": "5.0"
     }
    ],
    "spawned": []