agent-comms 3.15.0 → 3.16.0

package/dist/test/connection-code-tool.test.js

@@ -0,0 +1,296 @@
+/**
+ * CommsTool's gateway_generate_connection_code/gateway_redeem_connection_code actions (agent-comms#188), mirroring gateway-trust-tool.test.ts's own pattern for the sibling gateway-trust actions -- an end-to-end pass through CommsTool.handle, MeshStore, and ConnectionCodeLedger, ending in a real gatewayTrust.add on successful redemption.
+ */
+import { test, describe, expect } from "vitest";
+import * as openpgp from "openpgp";
+import { MeshStore } from "../core/mesh-store.js";
+import { CommsTool } from "../core/tool.js";
+import { buildAction } from "../core/bridge.js";
+import { wireTestTransport } from "./test-transport.js";
+const TEST_PORT = 0;
+/** A generic "far enough in the future"/"far enough in the past" offset, used wherever a test needs an expired or not-yet-expired timestamp without caring about the exact margin. */
+const ONE_MINUTE_MS = 60_000;
+async function registerAgent(store, name) {
+    return store.registerAgent({
+        name,
+        harness: "test",
+        cwd: "/test",
+        pid: process.pid,
+        visibility: "visible",
+        tags: [],
+    });
+}
+describe("CommsTool connection-code actions", () => {
+    test("gateway_generate_connection_code returns a bare code vouching for this store's own device-id", async () => {
+        const store = new MeshStore(TEST_PORT);
+        await wireTestTransport(store);
+        await store.init();
+        const agent = await registerAgent(store, "connection-code-generate-test");
+        const tool = new CommsTool(store);
+        const result = await tool.handle({ agentId: agent.id, harness: "test", cwd: "/test", pid: process.pid }, { action: "gateway_generate_connection_code" });
+        expect(result.isError, result.content).toBe(false);
+        expect(result.content).toContain("unsigned");
+        expect(result.content).toContain(`"deviceId":"${store.peerId}"`);
+        await store.shutdown();
+    });
+    test("gateway_redeem_connection_code trusts the vouched-for device on success", async () => {
+        const issuerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(issuerStore);
+        await issuerStore.init();
+        const issuerTool = new CommsTool(issuerStore);
+        const issuerAgent = await registerAgent(issuerStore, "issuer");
+        const generateResult = await issuerTool.handle({
+            agentId: issuerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, { action: "gateway_generate_connection_code" });
+        const code = JSON.parse(generateResult.content.split("\n").at(-1) ?? "{}");
+        const redeemerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(redeemerStore);
+        await redeemerStore.init();
+        const redeemerTool = new CommsTool(redeemerStore);
+        const redeemerAgent = await registerAgent(redeemerStore, "redeemer");
+        const redeemResult = await redeemerTool.handle({
+            agentId: redeemerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, {
+            action: "gateway_redeem_connection_code",
+            code: code.code,
+            expiresAt: code.expiresAt,
+            device: code.deviceId,
+        });
+        expect(redeemResult.isError, redeemResult.content).toBe(false);
+        expect(redeemerStore.listTrustedGateways()).toEqual([issuerStore.peerId]);
+        await issuerStore.shutdown();
+        await redeemerStore.shutdown();
+    });
+    test("gateway_redeem_connection_code rejects an expired code without trusting anything", async () => {
+        const store = new MeshStore(TEST_PORT);
+        await wireTestTransport(store);
+        await store.init();
+        const tool = new CommsTool(store);
+        const agent = await registerAgent(store, "expired-redeem-test");
+        const result = await tool.handle({ agentId: agent.id, harness: "test", cwd: "/test", pid: process.pid }, {
+            action: "gateway_redeem_connection_code",
+            code: "some-nonce",
+            expiresAt: new Date(Date.now() - ONE_MINUTE_MS).toISOString(),
+            device: "aabbcc",
+        });
+        expect(result.isError, result.content).toBe(true);
+        expect(result.content).toContain("expired");
+        expect(store.listTrustedGateways()).toEqual([]);
+        await store.shutdown();
+    });
+    test("gateway_generate_connection_code signs the code when a private key is supplied", async () => {
+        const store = new MeshStore(TEST_PORT);
+        await wireTestTransport(store);
+        await store.init();
+        const tool = new CommsTool(store);
+        const agent = await registerAgent(store, "signed-generate-test");
+        const { privateKey } = await openpgp.generateKey({
+            type: "ecc",
+            curve: "curve25519Legacy",
+            userIDs: [{ name: "Alice", email: "alice@example.com" }],
+            format: "armored",
+        });
+        const result = await tool.handle({ agentId: agent.id, harness: "test", cwd: "/test", pid: process.pid }, { action: "gateway_generate_connection_code", privateKey });
+        expect(result.isError, result.content).toBe(false);
+        expect(result.content).toContain("PGP-signed");
+        await store.shutdown();
+    });
+    test("gateway_redeem_connection_code verifies a signature against a pasted public key", async () => {
+        const { privateKey, publicKey } = await openpgp.generateKey({
+            type: "ecc",
+            curve: "curve25519Legacy",
+            userIDs: [{ name: "Alice", email: "alice@example.com" }],
+            format: "armored",
+        });
+        const issuerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(issuerStore);
+        await issuerStore.init();
+        const issuerTool = new CommsTool(issuerStore);
+        const issuerAgent = await registerAgent(issuerStore, "signed-issuer");
+        const generateResult = await issuerTool.handle({
+            agentId: issuerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, { action: "gateway_generate_connection_code", privateKey });
+        const code = JSON.parse(generateResult.content.split("\n").at(-1) ?? "{}");
+        const redeemerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(redeemerStore);
+        await redeemerStore.init();
+        const redeemerTool = new CommsTool(redeemerStore);
+        const redeemerAgent = await registerAgent(redeemerStore, "signed-redeemer");
+        const redeemResult = await redeemerTool.handle({
+            agentId: redeemerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, {
+            action: "gateway_redeem_connection_code",
+            code: code.code,
+            expiresAt: code.expiresAt,
+            device: code.deviceId,
+            signature: code.signature,
+            publicKey,
+        });
+        expect(redeemResult.isError, redeemResult.content).toBe(false);
+        expect(redeemResult.content).toContain("signature verified");
+        expect(redeemerStore.listTrustedGateways()).toEqual([issuerStore.peerId]);
+        await issuerStore.shutdown();
+        await redeemerStore.shutdown();
+    });
+    test("gateway_redeem_connection_code fetches the public key from a keyserver when only a fingerprint is supplied", async () => {
+        const { privateKey, publicKey } = await openpgp.generateKey({
+            type: "ecc",
+            curve: "curve25519Legacy",
+            userIDs: [{ name: "Alice", email: "alice@example.com" }],
+            format: "armored",
+        });
+        const readKey = await openpgp.readKey({ armoredKey: publicKey });
+        const fingerprint = readKey.getFingerprint();
+        const issuerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(issuerStore);
+        await issuerStore.init();
+        const issuerTool = new CommsTool(issuerStore);
+        const issuerAgent = await registerAgent(issuerStore, "keyserver-issuer");
+        const generateResult = await issuerTool.handle({
+            agentId: issuerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, { action: "gateway_generate_connection_code", privateKey });
+        const code = JSON.parse(generateResult.content.split("\n").at(-1) ?? "{}");
+        const redeemerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(redeemerStore);
+        await redeemerStore.init();
+        const fetchPgpPublicKeyByFingerprintImpl = async (requestedFingerprint) => {
+            expect(requestedFingerprint).toBe(fingerprint);
+            return publicKey;
+        };
+        const redeemerTool = new CommsTool(redeemerStore, undefined, undefined, fetchPgpPublicKeyByFingerprintImpl);
+        const redeemerAgent = await registerAgent(redeemerStore, "keyserver-redeemer");
+        const redeemResult = await redeemerTool.handle({
+            agentId: redeemerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, {
+            action: "gateway_redeem_connection_code",
+            code: code.code,
+            expiresAt: code.expiresAt,
+            device: code.deviceId,
+            signature: code.signature,
+            fingerprint,
+        });
+        expect(redeemResult.isError, redeemResult.content).toBe(false);
+        expect(redeemerStore.listTrustedGateways()).toEqual([issuerStore.peerId]);
+        await issuerStore.shutdown();
+        await redeemerStore.shutdown();
+    });
+    test("gateway_redeem_connection_code reports a keyserver lookup failure without trusting anything", async () => {
+        const redeemerStore = new MeshStore(TEST_PORT);
+        await wireTestTransport(redeemerStore);
+        await redeemerStore.init();
+        const failingFetch = async () => {
+            throw new Error("HTTP 404");
+        };
+        const redeemerTool = new CommsTool(redeemerStore, undefined, undefined, failingFetch);
+        const redeemerAgent = await registerAgent(redeemerStore, "keyserver-failure-redeemer");
+        const redeemResult = await redeemerTool.handle({
+            agentId: redeemerAgent.id,
+            harness: "test",
+            cwd: "/test",
+            pid: process.pid,
+        }, {
+            action: "gateway_redeem_connection_code",
+            code: "some-nonce",
+            expiresAt: new Date(Date.now() + ONE_MINUTE_MS).toISOString(),
+            device: "aabbcc",
+            signature: "-----BEGIN PGP SIGNATURE-----\nfake\n-----END PGP SIGNATURE-----",
+            fingerprint: "0000000000000000000000000000000000000000",
+        });
+        expect(redeemResult.isError, redeemResult.content).toBe(true);
+        expect(redeemResult.content).toContain("Failed to fetch PGP public key");
+        expect(redeemerStore.listTrustedGateways()).toEqual([]);
+        await redeemerStore.shutdown();
+    });
+});
+describe("buildAction connection-code parsing", () => {
+    test("buildAction parses gateway_generate_connection_code with no fields", () => {
+        const action = buildAction({ action: "gateway_generate_connection_code" });
+        expect(action.action).toBe("gateway_generate_connection_code");
+    });
+    test("buildAction parses gateway_generate_connection_code's optional fields", () => {
+        const action = buildAction({
+            action: "gateway_generate_connection_code",
+            ttlMs: ONE_MINUTE_MS,
+            privateKey: "armored-key",
+            passphrase: "secret",
+        });
+        expect(action.action).toBe("gateway_generate_connection_code");
+        if (action.action === "gateway_generate_connection_code") {
+            expect(action.ttlMs).toBe(ONE_MINUTE_MS);
+            expect(action.privateKey).toBe("armored-key");
+            expect(action.passphrase).toBe("secret");
+        }
+    });
+    test("buildAction parses gateway_redeem_connection_code's required fields", () => {
+        const action = buildAction({
+            action: "gateway_redeem_connection_code",
+            code: "nonce",
+            expiresAt: "2026-01-01T00:00:00.000Z",
+            device: "aabbcc",
+        });
+        expect(action.action).toBe("gateway_redeem_connection_code");
+        if (action.action === "gateway_redeem_connection_code") {
+            expect(action.code).toBe("nonce");
+            expect(action.expiresAt).toBe("2026-01-01T00:00:00.000Z");
+            expect(action.device).toBe("aabbcc");
+            expect(action.signature).toBeUndefined();
+        }
+    });
+    test("buildAction parses gateway_redeem_connection_code's optional signature/publicKey/fingerprint", () => {
+        const action = buildAction({
+            action: "gateway_redeem_connection_code",
+            code: "nonce",
+            expiresAt: "2026-01-01T00:00:00.000Z",
+            device: "aabbcc",
+            signature: "sig",
+            publicKey: "pubkey",
+            fingerprint: "fpr",
+        });
+        expect(action.action).toBe("gateway_redeem_connection_code");
+        if (action.action === "gateway_redeem_connection_code") {
+            expect(action.signature).toBe("sig");
+            expect(action.publicKey).toBe("pubkey");
+            expect(action.fingerprint).toBe("fpr");
+        }
+    });
+    test("buildAction throws for gateway_redeem_connection_code without code", () => {
+        expect(() => buildAction({
+            action: "gateway_redeem_connection_code",
+            expiresAt: "2026-01-01T00:00:00.000Z",
+            device: "aabbcc",
+        })).toThrow(/code/);
+    });
+    test("buildAction throws for gateway_redeem_connection_code without expiresAt", () => {
+        expect(() => buildAction({
+            action: "gateway_redeem_connection_code",
+            code: "nonce",
+            device: "aabbcc",
+        })).toThrow(/expiresAt/);
+    });
+    test("buildAction throws for gateway_redeem_connection_code without device", () => {
+        expect(() => buildAction({
+            action: "gateway_redeem_connection_code",
+            code: "nonce",
+            expiresAt: "2026-01-01T00:00:00.000Z",
+        })).toThrow(/device/);
+    });
+});
+//# sourceMappingURL=connection-code-tool.test.js.map

package/dist/test/connection-code-tool.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-code-tool.test.js","sourceRoot":"","sources":["../../src/test/connection-code-tool.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChD,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,sLAAsL;AACtL,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,KAAK,UAAU,aAAa,CAAC,KAAgB,EAAE,IAAY;IACzD,OAAO,KAAK,CAAC,aAAa,CAAC;QACzB,IAAI;QACJ,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;AACL,CAAC;AAED,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;IACjD,IAAI,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC9G,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,+BAA+B,CAAC,CAAC;QAC1E,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACtE,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAC/C,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,eAAe,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAEjE,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,WAAW,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAE/D,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,WAAW,CAAC,EAAE;YACvB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAC/C,CAAC;QACF,MAAM,IAAI,GACR,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAEhE,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QAErE,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,aAAa,CAAC,EAAE;YACzB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD;YACE,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,QAAQ;SACtB,CACF,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1E,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC;QAEhE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACtE;YACE,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;YAC7D,MAAM,EAAE,QAAQ;SACjB,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAEhD,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC,CAAC;QACjE,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YAC/C,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACxD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAC9B,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EACtE,EAAE,MAAM,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAC3D,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAE/C,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YAC1D,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACxD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;QAEtE,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,WAAW,CAAC,EAAE;YACvB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD,EAAE,MAAM,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAC3D,CAAC;QACF,MAAM,IAAI,GAKN,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,SAAS,CAAC,aAAa,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAC;QAE5E,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,aAAa,CAAC,EAAE;YACzB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD;YACE,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS;SACV,CACF,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QAC7D,MAAM,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1E,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4GAA4G,EAAE,KAAK,IAAI,EAAE;QAC5H,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;YAC1D,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;YACxD,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;QACjE,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;QAE7C,MAAM,WAAW,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,iBAAiB,CAAC,WAAW,CAAC,CAAC;QACrC,MAAM,WAAW,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,UAAU,GAAG,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;QAC9C,MAAM,WAAW,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAEzE,MAAM,cAAc,GAAG,MAAM,UAAU,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,WAAW,CAAC,EAAE;YACvB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD,EAAE,MAAM,EAAE,kCAAkC,EAAE,UAAU,EAAE,CAC3D,CAAC;QACF,MAAM,IAAI,GAKN,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC;QAElE,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,kCAAkC,GAAG,KAAK,EAC9C,oBAA4B,EACX,EAAE;YACnB,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YAC/C,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,SAAS,CAChC,aAAa,EACb,SAAS,EACT,SAAS,EACT,kCAAkC,CACnC,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,aAAa,EACb,oBAAoB,CACrB,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,aAAa,CAAC,EAAE;YACzB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD;YACE,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,QAAQ;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW;SACZ,CACF,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAE1E,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC7B,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;QAC7G,MAAM,aAAa,GAAG,IAAI,SAAS,CAAC,SAAS,CAAC,CAAC;QAC/C,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;QACvC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,KAAK,IAAqB,EAAE;YAC/C,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC;QAC9B,CAAC,CAAC;QACF,MAAM,YAAY,GAAG,IAAI,SAAS,CAChC,aAAa,EACb,SAAS,EACT,SAAS,EACT,YAAY,CACb,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,aAAa,CACvC,aAAa,EACb,4BAA4B,CAC7B,CAAC;QAEF,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,MAAM,CAC5C;YACE,OAAO,EAAE,aAAa,CAAC,EAAE;YACzB,OAAO,EAAE,MAAM;YACf,GAAG,EAAE,OAAO;YACZ,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,EACD;YACE,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,CAAC,WAAW,EAAE;YAC7D,MAAM,EAAE,QAAQ;YAChB,SAAS,EACP,kEAAkE;YACpE,WAAW,EAAE,0CAA0C;SACxD,CACF,CAAC;QAEF,MAAM,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,gCAAgC,CAAC,CAAC;QACzE,MAAM,CAAC,aAAa,CAAC,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAExD,MAAM,aAAa,CAAC,QAAQ,EAAE,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC9E,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uEAAuE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,EAAE,kCAAkC;YAC1C,KAAK,EAAE,aAAa;YACpB,UAAU,EAAE,aAAa;YACzB,UAAU,EAAE,QAAQ;SACrB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QAC/D,IAAI,MAAM,CAAC,MAAM,KAAK,kCAAkC,EAAE,CAAC;YACzD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACzC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC/E,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,0BAA0B;YACrC,MAAM,EAAE,QAAQ;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8FAA8F,EAAE,GAAG,EAAE;QACxG,MAAM,MAAM,GAAG,WAAW,CAAC;YACzB,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,0BAA0B;YACrC,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,QAAQ;YACnB,WAAW,EAAE,KAAK;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,gCAAgC,EAAE,CAAC;YACvD,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACxC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC9E,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,gCAAgC;YACxC,SAAS,EAAE,0BAA0B;YACrC,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,QAAQ;SACjB,CAAC,CACH,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAChF,MAAM,CAAC,GAAG,EAAE,CACV,WAAW,CAAC;YACV,MAAM,EAAE,gCAAgC;YACxC,IAAI,EAAE,OAAO;YACb,SAAS,EAAE,0BAA0B;SACtC,CAAC,CACH,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/connection-code.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for ConnectionCodeLedger (agent-comms#188): the generate/redeem pair backing gateway_generate_connection_code/gateway_redeem_connection_code. Covers the always-checked nonce/expiry path standalone from the optional PGP-signature path, mirroring gateway-trust.test.ts's own split between plain-trust and slot-persistence describe blocks for the sibling allowlist class.
+ */
+export {};
+//# sourceMappingURL=connection-code.test.d.ts.map

package/dist/test/connection-code.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-code.test.d.ts","sourceRoot":"","sources":["../../src/test/connection-code.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/test/connection-code.test.js

@@ -0,0 +1,236 @@
+/**
+ * Unit tests for ConnectionCodeLedger (agent-comms#188): the generate/redeem pair backing gateway_generate_connection_code/gateway_redeem_connection_code. Covers the always-checked nonce/expiry path standalone from the optional PGP-signature path, mirroring gateway-trust.test.ts's own split between plain-trust and slot-persistence describe blocks for the sibling allowlist class.
+ */
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import * as openpgp from "openpgp";
+import { describe, expect, it, beforeAll } from "vitest";
+import { ConnectionCodeLedger, } from "../core/connection-code.js";
+function tempSlot(harness) {
+    const dir = fs.mkdtempSync(path.join(tmpdir(), "agent-comms-connection-code-test-"));
+    return { harness, cwd: "/tmp/project", dir };
+}
+const DEVICE_HEX = "aabbccdd";
+/** A short TTL used throughout the expiry tests below -- long enough to distinguish "before" from "at/after" expiry, short enough to keep every test's own arithmetic obvious. */
+const SHORT_TTL_MS = 1000;
+/** Comfortably past SHORT_TTL_MS, used wherever a test needs "well after expiry" rather than "at the exact instant". */
+const WELL_PAST_EXPIRY_MS = 2000;
+/** A gap comfortably larger than SHORT_TTL_MS, used by the pruning test to land after the first code has expired. */
+const PRUNE_GAP_MS = 10_000;
+let signingKey;
+let otherKey;
+beforeAll(async () => {
+    const generated = await openpgp.generateKey({
+        type: "ecc",
+        curve: "curve25519Legacy",
+        userIDs: [{ name: "Alice", email: "alice@example.com" }],
+        format: "armored",
+    });
+    signingKey = generated;
+    const other = await openpgp.generateKey({
+        type: "ecc",
+        curve: "curve25519Legacy",
+        userIDs: [{ name: "Mallory", email: "mallory@example.com" }],
+        format: "armored",
+    });
+    otherKey = other;
+});
+describe("ConnectionCodeLedger -- generation", () => {
+    it("generates a bare code with no signature when no private key is supplied", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX);
+        expect(code.deviceId).toBe(DEVICE_HEX);
+        expect(code.signature).toBeUndefined();
+        expect(typeof code.code).toBe("string");
+        expect(code.code.length).toBeGreaterThan(0);
+        expect(Date.parse(code.expiresAt)).toBeGreaterThan(Date.now());
+    });
+    it("generates a fresh nonce on every call", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const a = await ledger.generate(DEVICE_HEX);
+        const b = await ledger.generate(DEVICE_HEX);
+        expect(a.code).not.toBe(b.code);
+    });
+    it("honours an explicit ttlMs", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        const code = await ledger.generate(DEVICE_HEX, { ttlMs: 60_000, now });
+        expect(code.expiresAt).toBe("2026-01-01T00:01:00.000Z");
+    });
+    it("signs the code when a private key is supplied, producing a signature verifiable against the matching public key", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        expect(code.signature).toBeDefined();
+        const result = await ledger.redeem(code, {
+            publicKeyArmored: signingKey.publicKey,
+        });
+        expect(result.deviceId).toBe(DEVICE_HEX);
+        expect(result.fingerprint).toBeDefined();
+    });
+});
+describe("ConnectionCodeLedger -- redemption freshness/liveness (always checked)", () => {
+    it("redeems a fresh, unsigned code", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX);
+        const result = await ledger.redeem(code);
+        expect(result).toEqual({ deviceId: DEVICE_HEX });
+    });
+    it("rejects an expired code", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        const code = await ledger.generate(DEVICE_HEX, {
+            ttlMs: SHORT_TTL_MS,
+            now,
+        });
+        await expect(ledger.redeem(code, { now: now + WELL_PAST_EXPIRY_MS })).rejects.toMatchObject({ reason: "expired" });
+    });
+    it("rejects a code at the exact instant it expires", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        const code = await ledger.generate(DEVICE_HEX, {
+            ttlMs: SHORT_TTL_MS,
+            now,
+        });
+        await expect(ledger.redeem(code, { now: now + SHORT_TTL_MS })).rejects.toMatchObject({ reason: "expired" });
+    });
+    it("rejects a second redemption of the same code (single-use)", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX);
+        await ledger.redeem(code);
+        await expect(ledger.redeem(code)).rejects.toMatchObject({
+            reason: "already_redeemed",
+        });
+    });
+    it("rejects a code whose fields have been tampered with even though the nonce matches something once issued", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX);
+        const tampered = { ...code, deviceId: "112233" };
+        // Tampering the deviceId of an unsigned code can't be detected by this ledger (there is nothing to check it against) -- redemption still succeeds, but against the tampered deviceId, proving the caller's own copy of the code is what's trusted, not some hidden ledger-side truth.
+        const result = await ledger.redeem(tampered);
+        expect(result.deviceId).toBe("112233");
+    });
+});
+describe("ConnectionCodeLedger -- optional PGP signature (only checked when present)", () => {
+    it("rejects a signed code redeemed with no public key supplied", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        await expect(ledger.redeem(code)).rejects.toMatchObject({
+            reason: "signature_required",
+        });
+    });
+    it("rejects a signed code verified against the wrong public key", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        await expect(ledger.redeem(code, { publicKeyArmored: otherKey.publicKey })).rejects.toMatchObject({ reason: "signature_invalid" });
+    });
+    it("rejects a signature over a tampered field even against the correct public key", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        const tampered = { ...code, deviceId: "112233" };
+        await expect(ledger.redeem(tampered, { publicKeyArmored: signingKey.publicKey })).rejects.toMatchObject({ reason: "signature_invalid" });
+    });
+    it("accepts a signature verified against the correct public key with no expected fingerprint pinned", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        const result = await ledger.redeem(code, {
+            publicKeyArmored: signingKey.publicKey,
+        });
+        expect(result.deviceId).toBe(DEVICE_HEX);
+    });
+    it("accepts a signature whose verified fingerprint matches the expected (trusted) fingerprint", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        const publicKey = await openpgp.readKey({
+            armoredKey: signingKey.publicKey,
+        });
+        const result = await ledger.redeem(code, {
+            publicKeyArmored: signingKey.publicKey,
+            expectedFingerprint: publicKey.getFingerprint(),
+        });
+        expect(result.fingerprint).toBe(publicKey.getFingerprint());
+    });
+    it("is tolerant of case and surrounding whitespace when comparing the expected fingerprint", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        const publicKey = await openpgp.readKey({
+            armoredKey: signingKey.publicKey,
+        });
+        const result = await ledger.redeem(code, {
+            publicKeyArmored: signingKey.publicKey,
+            expectedFingerprint: ` ${publicKey.getFingerprint().toUpperCase()} `,
+        });
+        expect(result.deviceId).toBe(DEVICE_HEX);
+    });
+    it("rejects a signature that verifies but against an unexpected fingerprint", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX, {
+            privateKeyArmored: signingKey.privateKey,
+        });
+        await expect(ledger.redeem(code, {
+            publicKeyArmored: signingKey.publicKey,
+            expectedFingerprint: "0000000000000000000000000000000000000000",
+        })).rejects.toMatchObject({ reason: "fingerprint_mismatch" });
+    });
+});
+describe("ConnectionCodeLedger -- persistence (agent-comms#188)", () => {
+    it("constructed with no slot, never touches disk", async () => {
+        const ledger = new ConnectionCodeLedger();
+        const code = await ledger.generate(DEVICE_HEX);
+        await expect(ledger.redeem(code)).resolves.toEqual({
+            deviceId: DEVICE_HEX,
+        });
+    });
+    it("survives a restart: an issued code recorded before restart is still recorded after", async () => {
+        const slot = tempSlot("test");
+        const first = new ConnectionCodeLedger(slot);
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        await first.generate(DEVICE_HEX, { ttlMs: 60_000, now });
+        const restarted = new ConnectionCodeLedger(slot);
+        // The restarted instance still knows about the redemption record it will create once this same code is redeemed through it -- proven indirectly below by confirming a redemption recorded before restart is not forgotten after it.
+        expect(restarted).toBeInstanceOf(ConnectionCodeLedger);
+    });
+    it("survives a restart: single-use enforcement holds across a restart within the code's validity window", async () => {
+        const slot = tempSlot("test");
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        const issuer = new ConnectionCodeLedger();
+        const code = await issuer.generate(DEVICE_HEX, { ttlMs: 60_000, now });
+        const redeemer = new ConnectionCodeLedger(slot);
+        await redeemer.redeem(code, { now });
+        const restartedRedeemer = new ConnectionCodeLedger(slot);
+        await expect(restartedRedeemer.redeem(code, { now: now + SHORT_TTL_MS })).rejects.toMatchObject({ reason: "already_redeemed" });
+    });
+    it("prunes an expired redeemed nonce so it does not accumulate forever", async () => {
+        const slot = tempSlot("test");
+        const now = Date.parse("2026-01-01T00:00:00.000Z");
+        const issuer = new ConnectionCodeLedger();
+        const code = await issuer.generate(DEVICE_HEX, {
+            ttlMs: SHORT_TTL_MS,
+            now,
+        });
+        const redeemer = new ConnectionCodeLedger(slot);
+        await redeemer.redeem(code, { now });
+        // Generating a second, unrelated code well after the first has expired triggers pruning; the first nonce is no longer tracked as redeemed.
+        const laterCode = await issuer.generate(DEVICE_HEX, {
+            ttlMs: SHORT_TTL_MS,
+            now: now + PRUNE_GAP_MS,
+        });
+        const laterRedeemer = new ConnectionCodeLedger(slot);
+        await laterRedeemer.redeem(laterCode, { now: now + PRUNE_GAP_MS });
+    });
+});
+//# sourceMappingURL=connection-code.test.js.map

package/dist/test/connection-code.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-code.test.js","sourceRoot":"","sources":["../../src/test/connection-code.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EACL,oBAAoB,GAErB,MAAM,4BAA4B,CAAC;AAIpC,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CACzD,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,kLAAkL;AAClL,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,wHAAwH;AACxH,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,qHAAqH;AACrH,MAAM,YAAY,GAAG,MAAM,CAAC;AAE5B,IAAI,UAAqD,CAAC;AAC1D,IAAI,QAAmD,CAAC;AAExD,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QAC1C,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;QACxD,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IACH,UAAU,GAAG,SAAS,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC;QACtC,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAC5D,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IACH,QAAQ,GAAG,KAAK,CAAC;AACnB,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,KAAK,IAAI,EAAE;QACzC,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iHAAiH,EAAE,KAAK,IAAI,EAAE;QAC/H,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvC,gBAAgB,EAAE,UAAU,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wEAAwE,EAAE,GAAG,EAAE;IACtF,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;QAC9C,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,KAAK,EAAE,YAAY;YACnB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,mBAAmB,EAAE,CAAC,CACxD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,KAAK,EAAE,YAAY;YACnB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC,CACjD,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAE1B,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtD,MAAM,EAAE,kBAAkB;SAC3B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yGAAyG,EAAE,KAAK,IAAI,EAAE;QACvH,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAmB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAEjE,sRAAsR;QACtR,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4EAA4E,EAAE,GAAG,EAAE;IAC1F,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;YACtD,MAAM,EAAE,oBAAoB;SAC7B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,gBAAgB,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAC,CAC9D,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAmB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QAEjE,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,UAAU,CAAC,SAAS,EAAE,CAAC,CACpE,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,KAAK,IAAI,EAAE;QAC/G,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvC,gBAAgB,EAAE,UAAU,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACtC,UAAU,EAAE,UAAU,CAAC,SAAS;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvC,gBAAgB,EAAE,UAAU,CAAC,SAAS;YACtC,mBAAmB,EAAE,SAAS,CAAC,cAAc,EAAE;SAChD,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC;YACtC,UAAU,EAAE,UAAU,CAAC,SAAS;SACjC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YACvC,gBAAgB,EAAE,UAAU,CAAC,SAAS;YACtC,mBAAmB,EAAE,IAAI,SAAS,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,GAAG;SACrE,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,iBAAiB,EAAE,UAAU,CAAC,UAAU;SACzC,CAAC,CAAC;QAEH,MAAM,MAAM,CACV,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;YAClB,gBAAgB,EAAE,UAAU,CAAC,SAAS;YACtC,mBAAmB,EAAE,0CAA0C;SAChE,CAAC,CACH,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACrE,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACjD,QAAQ,EAAE,UAAU;SACrB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,KAAK,IAAI,EAAE;QAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,KAAK,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEzD,MAAM,SAAS,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACjD,oOAAoO;QACpO,MAAM,CAAC,SAAS,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qGAAqG,EAAE,KAAK,IAAI,EAAE;QACnH,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAEvE,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAErC,MAAM,iBAAiB,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,CACV,iBAAiB,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC,CAC5D,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAC7C,KAAK,EAAE,YAAY;YACnB,GAAG;SACJ,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAErC,2IAA2I;QAC3I,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,UAAU,EAAE;YAClD,KAAK,EAAE,YAAY;YACnB,GAAG,EAAE,GAAG,GAAG,YAAY;SACxB,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,GAAG,EAAE,GAAG,GAAG,YAAY,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}