agent-comms 3.15.0 → 3.16.0

package/dist/test/dm-send-capability-admission.integration.test.js

@@ -1,12 +1,24 @@
 /**
  * Integration test for receiver-side DM gating with a user-issued capability (agent-comms#162): a receiver's own user principal can admit an agent into its DM-communication scope by minting a dm:send grant, which the agent then presents alongside its DM join request to auto-admit without needing a fresh human decision each time -- the durable admission list this issue adds, distinct from (and additive to) dm-admission.integration.test.ts's own two-round human-consent flow, which remains the fallback when no dm:send grant is presented at all.
  */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { tmpdir } from "node:os";
 import { test, expect } from "vitest";
-import { deviceIdFromHex } from "wire-mesh-core/domain/device-id";
+import { deviceIdFromHex, deviceIdToHex, } from "wire-mesh-core/domain/device-id";
+import { mintCapabilityToken } from "wire-mesh-core/domain/tokens";
+import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
 import { MeshStore } from "../core/mesh-store.js";
+import { generateIdentity } from "../core/identity.js";
+import { toIdentityPort } from "../core/wire-mesh-identity.js";
+import { randomId } from "../core/random-id.js";
+import { loadOrCreateUserIdentity } from "../core/user-identity.js";
+import { DM_SEND_CAPABILITY } from "../core/dm-token-verification.js";
 import { waitFor, wireTestTransport } from "./test-transport.js";
 /** A device-id, hex-encoded, is always exactly this many characters (32 raw bytes). */
 const DEVICE_ID_HEX_LENGTH = 64;
+/** Expiry window for a delegated dm:send token minted directly in these tests (agent-comms#187) -- comfortably longer than any single test run, matching device-membership.test.ts's own TOKEN_TTL_MS convention. */
+const DELEGATED_TOKEN_TTL_MS = 60_000;
 let nextPort = 20_990;
 function freshPort() {
     nextPort += 1;
@@ -87,4 +99,73 @@ test("revoking a bearer that was never admitted is a harmless no-op", async () =
         await a.shutdown();
     }
 });
+/** B's own user-principal identity, loaded from a directory this test controls directly (rather than the throwaway one wireTestTransport would otherwise generate internally and never disclose), so a test can compute the exact "user" scope path (B's own principal device-id, hex) a dm:send grant B mints is rooted at -- agent-comms#187's own principal-keyed admission tests need this to construct a further delegation whose scope actually narrows the grant it chains from. */
+function tempUserIdentityDir() {
+    return {
+        dir: fs.mkdtempSync(path.join(tmpdir(), "agent-comms-b-user-identity-test-")),
+    };
+}
+test("admitting a bearer with a positive delegationsRemaining lets that bearer itself mint a further dm:send delegation (agent-comms#187)", async () => {
+    const bUserIdentityOptions = tempUserIdentityDir();
+    const bPrincipalHex = deviceIdToHex((await toIdentityPort(loadOrCreateUserIdentity(bUserIdentityOptions)))
+        .deviceId);
+    const clock = createSystemClock();
+    const b = new MeshStore(freshPort());
+    await wireTestTransport(b, undefined, undefined, undefined, bUserIdentityOptions);
+    await b.init();
+    try {
+        // The admitted bearer is a real principal identity here, not just a bare hex string -- only the entity actually holding bearerId's own key can mint a delegation of the grant, since mintCapabilityToken's own parent-narrowing requires the child's issuer to equal the parent's bearer.
+        const principal = await toIdentityPort(generateIdentity());
+        const bearerHex = deviceIdToHex(principal.deviceId);
+        const grant = await b.admitAgentForDm(bearerHex, 1);
+        const device = await toIdentityPort(generateIdentity());
+        const delegated = await mintCapabilityToken({
+            identity: principal,
+            clock,
+            tokenId: randomId(),
+            bearer: device.deviceId,
+            capability: DM_SEND_CAPABILITY,
+            scope: { kind: "user", path: bPrincipalHex },
+            expires: clock.now() + DELEGATED_TOKEN_TTL_MS,
+            delegationsRemaining: 0,
+            parent: grant,
+        });
+        expect(delegated.ok, `expected the delegation to succeed, got ${JSON.stringify(delegated)}`).toBe(true);
+    }
+    finally {
+        await b.shutdown();
+    }
+});
+test("admitting a bearer with no delegationsRemaining given stays non-delegable, exactly like the existing bare-device path", async () => {
+    const bUserIdentityOptions = tempUserIdentityDir();
+    const bPrincipalHex = deviceIdToHex((await toIdentityPort(loadOrCreateUserIdentity(bUserIdentityOptions)))
+        .deviceId);
+    const clock = createSystemClock();
+    const b = new MeshStore(freshPort());
+    await wireTestTransport(b, undefined, undefined, undefined, bUserIdentityOptions);
+    await b.init();
+    try {
+        const principal = await toIdentityPort(generateIdentity());
+        const bearerHex = deviceIdToHex(principal.deviceId);
+        const grant = await b.admitAgentForDm(bearerHex);
+        const device = await toIdentityPort(generateIdentity());
+        const delegated = await mintCapabilityToken({
+            identity: principal,
+            clock,
+            tokenId: randomId(),
+            bearer: device.deviceId,
+            capability: DM_SEND_CAPABILITY,
+            scope: { kind: "user", path: bPrincipalHex },
+            expires: clock.now() + DELEGATED_TOKEN_TTL_MS,
+            delegationsRemaining: 0,
+            parent: grant,
+        });
+        expect(delegated.ok).toBe(false);
+        if (!delegated.ok)
+            expect(delegated.reason).toBe("delegation_exceeds_parent");
+    }
+    finally {
+        await b.shutdown();
+    }
+});
 //# sourceMappingURL=dm-send-capability-admission.integration.test.js.map

package/dist/test/dm-send-capability-admission.integration.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"dm-send-capability-admission.integration.test.js","sourceRoot":"","sources":["../../src/test/dm-send-capability-admission.integration.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,IAAI,QAAQ,GAAG,MAAM,CAAC;AACtB,SAAS,SAAS;IAChB,QAAQ,IAAI,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,MAAM,OAAO,CACX,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAClD,kBAAkB,CACnB,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,IAAI,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEzC,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;IAC1H,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,8FAA8F;QAC9F,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxE,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,eAAe,CACjD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;QAEF,MAAM,MAAM,CACV,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CACjD,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEjC,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9D,aAAa,CACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC"}
+{"version":3,"file":"dm-send-capability-admission.integration.test.js","sourceRoot":"","sources":["../../src/test/dm-send-capability-admission.integration.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,uFAAuF;AACvF,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC,qNAAqN;AACrN,MAAM,sBAAsB,GAAG,MAAM,CAAC;AAEtC,IAAI,QAAQ,GAAG,MAAM,CAAC;AACtB,SAAS,SAAS;IAChB,QAAQ,IAAI,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,IAAY;IAEZ,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,GAAG;QACT,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,MAAM,OAAO,CACX,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAClD,kBAAkB,CACnB,CAAC;IACF,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,IAAI,CAAC,sGAAsG,EAAE,KAAK,IAAI,EAAE;IACtH,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEhD,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAEzC,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0GAA0G,EAAE,KAAK,IAAI,EAAE;IAC1H,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,8FAA8F;QAC9F,MAAM,aAAa,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACxE,MAAM,mBAAmB,GAAG,MAAM,CAAC,CAAC,eAAe,CACjD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAC3C,CAAC;QAEF,MAAM,MAAM,CACV,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,CACjD,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAEjC,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;IAC1F,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAEtC,MAAM,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAC9D,aAAa,CACd,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;IAC/E,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,MAAM,iBAAiB,CAAC,SAAS,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;IACzE,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,2dAA2d;AAC3d,SAAS,mBAAmB;IAC1B,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,WAAW,CACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,mCAAmC,CAAC,CACzD;KACF,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,qIAAqI,EAAE,KAAK,IAAI,EAAE;IACrJ,MAAM,oBAAoB,GAAG,mBAAmB,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,aAAa,CACjC,CAAC,MAAM,cAAc,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC,CAAC;SACnE,QAAQ,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAElC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACrC,MAAM,iBAAiB,CACrB,CAAC,EACD,SAAS,EACT,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;IACF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAEf,IAAI,CAAC;QACH,0RAA0R;QAC1R,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC1C,QAAQ,EAAE,SAAS;YACnB,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,UAAU,EAAE,kBAAkB;YAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;YAC5C,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,sBAAsB;YAC7C,oBAAoB,EAAE,CAAC;YACvB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,MAAM,CACJ,SAAS,CAAC,EAAE,EACZ,2CAA2C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uHAAuH,EAAE,KAAK,IAAI,EAAE;IACvI,MAAM,oBAAoB,GAAG,mBAAmB,EAAE,CAAC;IACnD,MAAM,aAAa,GAAG,aAAa,CACjC,CAAC,MAAM,cAAc,CAAC,wBAAwB,CAAC,oBAAoB,CAAC,CAAC,CAAC;SACnE,QAAQ,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;IAElC,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACrC,MAAM,iBAAiB,CACrB,CAAC,EACD,SAAS,EACT,SAAS,EACT,SAAS,EACT,oBAAoB,CACrB,CAAC;IACF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAEf,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC;YAC1C,QAAQ,EAAE,SAAS;YACnB,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,UAAU,EAAE,kBAAkB;YAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;YAC5C,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,sBAAsB;YAC7C,oBAAoB,EAAE,CAAC;YACvB,MAAM,EAAE,KAAK;SACd,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,CAAC,EAAE;YACf,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC/D,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/test/dm-send-delegation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dm-send-delegation.test.d.ts.map

package/dist/test/dm-send-delegation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-send-delegation.test.d.ts","sourceRoot":"","sources":["../../src/test/dm-send-delegation.test.ts"],"names":[],"mappings":""}

package/dist/test/dm-send-delegation.test.js

@@ -0,0 +1,146 @@
+/**
+ * Unit tests for core/dm-send-delegation: delegateDmSendToDevice, the primitive that lets a user principal already admitted into a remote user's DM-communication scope (room-lifecycle.ts's admitAgentForDm, minted with delegationsRemaining \> 0) sub-delegate that admission to one of its own devices (agent-comms#187) -- the dm:send counterpart to device-membership.test.ts's own admitDevice/removeDevice coverage.
+ */
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { describe, it, expect } from "vitest";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { mintCapabilityToken } from "wire-mesh-core/domain/tokens";
+import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
+import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
+import { generateIdentity } from "../core/identity.js";
+import { toIdentityPort } from "../core/wire-mesh-identity.js";
+import { randomId } from "../core/random-id.js";
+import { loadIssuedDmGrant, loadOrCreateUserIdentity, } from "../core/user-identity.js";
+import { DM_SEND_CAPABILITY, DM_SEND_SCOPE_KIND, verifyDmSendToken, } from "../core/dm-token-verification.js";
+import { delegateDmSendToDevice } from "../core/dm-send-delegation.js";
+const TOKEN_TTL_MS = 60_000;
+const NON_DELEGABLE = 0;
+const ONE_HOP_DELEGABLE = 1;
+function tempDir() {
+    return fs.mkdtempSync(path.join(tmpdir(), "agent-comms-dm-delegation-test-"));
+}
+/** A real, persisted user-principal identity -- delegateDmSendToDevice writes through to the same user-identity.json this identity's own key material lives in, so the fixture must actually create that file first, the same way device-membership.test.ts's own makeUser() does. */
+async function makeUser() {
+    const dir = tempDir();
+    const identity = await toIdentityPort(loadOrCreateUserIdentity({ dir }));
+    return { identity, userIdentityOptions: { dir } };
+}
+/** Alice's own root-level dm:send grant naming bearer as the admitted party -- the same shape room-lifecycle.ts's admitAgentForDm mints, built directly here so this file's own tests don't need a full MeshStore. Takes an explicit expires (rather than deriving one from clock.now() itself) so a caller can mint a child token sharing the identical expiry -- a real wall clock advances between two calls, and a child's own expires must never exceed its parent's. */
+async function mintRootGrant(admitter, bearer, clock, delegationsRemaining, expires) {
+    const verdict = await mintCapabilityToken({
+        identity: admitter,
+        clock,
+        tokenId: randomId(),
+        bearer,
+        capability: DM_SEND_CAPABILITY,
+        scope: { kind: DM_SEND_SCOPE_KIND, path: deviceIdToHex(admitter.deviceId) },
+        expires,
+        delegationsRemaining,
+    });
+    if (!verdict.ok)
+        throw new Error("expected root grant to mint");
+    return verdict.token;
+}
+describe("delegateDmSendToDevice", () => {
+    it("mints a dm:send token bearing the device, chaining back to the remote admitting principal", async () => {
+        const alice = await toIdentityPort(generateIdentity());
+        const { identity: bobPrincipal, userIdentityOptions } = await makeUser();
+        const bobDevice = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const expires = clock.now() + TOKEN_TTL_MS;
+        const grant = await mintRootGrant(alice, bobPrincipal.deviceId, clock, ONE_HOP_DELEGABLE, expires);
+        const verdict = await delegateDmSendToDevice({
+            userIdentity: bobPrincipal,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            parent: grant,
+            deviceId: bobDevice.deviceId,
+            remoteUserPrincipalDeviceId: alice.deviceId,
+            expires,
+        });
+        expect(verdict.ok, `expected delegation to succeed, got ${JSON.stringify(verdict)}`).toBe(true);
+        if (!verdict.ok)
+            return;
+        const checked = await verifyDmSendToken(verdict.token, {
+            identity: alice,
+            clock,
+            revocation: createRevocationView(),
+            expectedBearer: bobDevice.deviceId,
+            userPrincipalDeviceId: alice.deviceId,
+        });
+        expect(checked.ok, JSON.stringify(checked)).toBe(true);
+    });
+    it("records the delegated grant's token-id under the delegating principal's own store, keyed by device hex", async () => {
+        const alice = await toIdentityPort(generateIdentity());
+        const { identity: bobPrincipal, userIdentityOptions } = await makeUser();
+        const bobDevice = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const tokenId = randomId();
+        const expires = clock.now() + TOKEN_TTL_MS;
+        const grant = await mintRootGrant(alice, bobPrincipal.deviceId, clock, ONE_HOP_DELEGABLE, expires);
+        const verdict = await delegateDmSendToDevice({
+            userIdentity: bobPrincipal,
+            userIdentityOptions,
+            clock,
+            tokenId,
+            parent: grant,
+            deviceId: bobDevice.deviceId,
+            remoteUserPrincipalDeviceId: alice.deviceId,
+            expires,
+        });
+        expect(verdict.ok).toBe(true);
+        const deviceHex = deviceIdToHex(bobDevice.deviceId);
+        expect(loadIssuedDmGrant(userIdentityOptions, deviceHex)).toEqual(tokenId);
+    });
+    it("refuses when the parent grant carries no further delegation depth, and records nothing", async () => {
+        const alice = await toIdentityPort(generateIdentity());
+        const { identity: bobPrincipal, userIdentityOptions } = await makeUser();
+        const bobDevice = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const expires = clock.now() + TOKEN_TTL_MS;
+        // The original, non-delegable admission -- exactly what admitAgentForDm mints by default.
+        const grant = await mintRootGrant(alice, bobPrincipal.deviceId, clock, NON_DELEGABLE, expires);
+        const verdict = await delegateDmSendToDevice({
+            userIdentity: bobPrincipal,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            parent: grant,
+            deviceId: bobDevice.deviceId,
+            remoteUserPrincipalDeviceId: alice.deviceId,
+            expires,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("delegation_exceeds_parent");
+        const deviceHex = deviceIdToHex(bobDevice.deviceId);
+        expect(loadIssuedDmGrant(userIdentityOptions, deviceHex)).toBeUndefined();
+    });
+    it("refuses when the caller's identity is not the parent grant's own bearer", async () => {
+        const alice = await toIdentityPort(generateIdentity());
+        const { identity: bobPrincipal, userIdentityOptions } = await makeUser();
+        const someoneElse = await toIdentityPort(generateIdentity());
+        const bobDevice = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const expires = clock.now() + TOKEN_TTL_MS;
+        const grant = await mintRootGrant(alice, bobPrincipal.deviceId, clock, ONE_HOP_DELEGABLE, expires);
+        const verdict = await delegateDmSendToDevice({
+            // someoneElse never received this grant -- only bobPrincipal (the parent's own bearer) may mint a delegation of it.
+            userIdentity: someoneElse,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            parent: grant,
+            deviceId: bobDevice.deviceId,
+            remoteUserPrincipalDeviceId: alice.deviceId,
+            expires,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("parent_bearer_mismatch");
+    });
+});
+//# sourceMappingURL=dm-send-delegation.test.js.map

package/dist/test/dm-send-delegation.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-send-delegation.test.js","sourceRoot":"","sources":["../../src/test/dm-send-delegation.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAEvE,MAAM,YAAY,GAAG,MAAM,CAAC;AAC5B,MAAM,aAAa,GAAG,CAAC,CAAC;AACxB,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,SAAS,OAAO;IACd,OAAO,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,sRAAsR;AACtR,KAAK,UAAU,QAAQ;IAIrB,MAAM,GAAG,GAAG,OAAO,EAAE,CAAC;IACtB,MAAM,QAAQ,GAAG,MAAM,cAAc,CAAC,wBAAwB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,QAAQ,EAAE,mBAAmB,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,8cAA8c;AAC9c,KAAK,UAAU,aAAa,CAC1B,QAAoD,EACpD,MAA8D,EAC9D,KAAqD,EACrD,oBAA4B,EAC5B,OAAe;IAEf,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,QAAQ;QAClB,KAAK;QACL,OAAO,EAAE,QAAQ,EAAE;QACnB,MAAM;QACN,UAAU,EAAE,kBAAkB;QAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAC3E,OAAO;QACP,oBAAoB;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2FAA2F,EAAE,KAAK,IAAI,EAAE;QACzG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE3C,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,KAAK,EACL,YAAY,CAAC,QAAQ,EACrB,KAAK,EACL,iBAAiB,EACjB,OAAO,CACR,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,YAAY,EAAE,YAAY;YAC1B,mBAAmB;YACnB,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,2BAA2B,EAAE,KAAK,CAAC,QAAQ;YAC3C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,CACJ,OAAO,CAAC,EAAE,EACV,uCAAuC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CACjE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,OAAO;QAExB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE;YACrD,QAAQ,EAAE,KAAK;YACf,KAAK;YACL,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;YAClC,qBAAqB,EAAE,KAAK,CAAC,QAAQ;SACtC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wGAAwG,EAAE,KAAK,IAAI,EAAE;QACtH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE3C,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,KAAK,EACL,YAAY,CAAC,QAAQ,EACrB,KAAK,EACL,iBAAiB,EACjB,OAAO,CACR,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,YAAY,EAAE,YAAY;YAC1B,mBAAmB;YACnB,KAAK;YACL,OAAO;YACP,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,2BAA2B,EAAE,KAAK,CAAC,QAAQ;YAC3C,OAAO;SACR,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAE9B,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE3C,0FAA0F;QAC1F,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,KAAK,EACL,YAAY,CAAC,QAAQ,EACrB,KAAK,EACL,aAAa,EACb,OAAO,CACR,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,YAAY,EAAE,YAAY;YAC1B,mBAAmB;YACnB,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,2BAA2B,EAAE,KAAK,CAAC,QAAQ;YAC3C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAC1E,MAAM,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,iBAAiB,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACvD,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC7D,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC3D,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;QAE3C,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,KAAK,EACL,YAAY,CAAC,QAAQ,EACrB,KAAK,EACL,iBAAiB,EACjB,OAAO,CACR,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC;YAC3C,oHAAoH;YACpH,YAAY,EAAE,WAAW;YACzB,mBAAmB;YACnB,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,2BAA2B,EAAE,KAAK,CAAC,QAAQ;YAC3C,OAAO;SACR,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/dm-send-principal-delegation.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=dm-send-principal-delegation.integration.test.d.ts.map

package/dist/test/dm-send-principal-delegation.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-send-principal-delegation.integration.test.d.ts","sourceRoot":"","sources":["../../src/test/dm-send-principal-delegation.integration.test.ts"],"names":[],"mappings":""}

package/dist/test/dm-send-principal-delegation.integration.test.js

@@ -0,0 +1,89 @@
+/**
+ * End-to-end integration test for agent-comms#187: a user principal admitted into another user's DM-communication scope with room delegation depth (admitAgentForDm) mints, via delegateDmSendToDevice, a further dm:send token naming one of its own devices as bearer -- and that device's own requestDmAccess, presenting only the delegated token, auto-admits exactly the way a directly-admitted bare device already does in dm-send-capability-admission.integration.test.ts. Proves the full "trust this whole person, not just one of their devices" flow the issue names, end to end over a real wire connection.
+ */
+import * as fs from "node:fs";
+import * as path from "node:path";
+import { tmpdir } from "node:os";
+import { test, expect } from "vitest";
+import { deviceIdFromHex, deviceIdToHex, } from "wire-mesh-core/domain/device-id";
+import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
+import { MeshStore } from "../core/mesh-store.js";
+import { loadOrCreateUserIdentity } from "../core/user-identity.js";
+import { toIdentityPort } from "../core/wire-mesh-identity.js";
+import { randomId } from "../core/random-id.js";
+import { delegateDmSendToDevice } from "../core/dm-send-delegation.js";
+import { waitFor, wireTestTransport } from "./test-transport.js";
+/** Delegated token expiry -- comfortably longer than a single test run, matching this file's sibling integration tests' own convention. */
+const DELEGATED_TOKEN_TTL_MS = 60_000;
+/** The admitted principal keeps exactly one further hop of delegation depth, enough to reach one of its own devices -- the minimal case the issue itself describes ("sub-delegate to its own devices"). */
+const ONE_HOP_DELEGABLE = 1;
+let nextPort = 20_970;
+function freshPort() {
+    nextPort += 1;
+    return nextPort;
+}
+function tempUserIdentityDir() {
+    return {
+        dir: fs.mkdtempSync(path.join(tmpdir(), "agent-comms-principal-delegation-test-")),
+    };
+}
+test("a principal's own device, holding only a delegated dm:send token, auto-admits into the admitting user's DM scope", async () => {
+    const port = freshPort();
+    // Alice's own user-principal identity is controlled directly (not the throwaway one wireTestTransport would otherwise generate and never disclose), so this test can compute the exact "user" scope path a delegated token must keep naming.
+    const aliceUserIdentityOptions = tempUserIdentityDir();
+    const alicePrincipal = await toIdentityPort(loadOrCreateUserIdentity(aliceUserIdentityOptions));
+    const a = new MeshStore(port);
+    await wireTestTransport(a, undefined, undefined, undefined, aliceUserIdentityOptions);
+    await a.init();
+    await a.registerAgent({
+        name: "alice",
+        harness: "test",
+        cwd: "/test/alice",
+        pid: process.pid,
+        visibility: "visible",
+        tags: [],
+    });
+    // Bob's own user-principal identity -- distinct from any bridge-slot device identity, and distinct from any of Bob's own devices below.
+    const bobUserIdentityOptions = tempUserIdentityDir();
+    const bobPrincipal = await toIdentityPort(loadOrCreateUserIdentity(bobUserIdentityOptions));
+    // One of Bob's own devices -- an ordinary bridge slot, wired and connected to Alice exactly like any other peer.
+    const d = new MeshStore(port);
+    await wireTestTransport(d);
+    await d.init();
+    await d.registerAgent({
+        name: "bobs-device",
+        harness: "test",
+        cwd: "/test/bobs-device",
+        pid: process.pid,
+        visibility: "visible",
+        tags: [],
+    });
+    await waitFor(() => a.serialise().agents[d.peerId] !== undefined, "alice sees bob's device");
+    try {
+        // Alice trusts Bob's own principal -- not this specific device -- with enough delegation depth for Bob to admit his own devices.
+        const grant = await a.admitAgentForDm(deviceIdToHex(bobPrincipal.deviceId), ONE_HOP_DELEGABLE);
+        // Bob's principal delegates that admission to this one device, out of band from Alice entirely -- Alice never learns this device's own device-id in advance.
+        const clock = createSystemClock();
+        const delegated = await delegateDmSendToDevice({
+            userIdentity: bobPrincipal,
+            userIdentityOptions: bobUserIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            parent: grant,
+            deviceId: deviceIdFromHex(d.peerId),
+            remoteUserPrincipalDeviceId: alicePrincipal.deviceId,
+            expires: clock.now() + DELEGATED_TOKEN_TTL_MS,
+        });
+        expect(delegated.ok, `expected the delegation to succeed, got ${JSON.stringify(delegated)}`).toBe(true);
+        if (!delegated.ok)
+            return;
+        await d.requestDmAccess(a.peerId, delegated.token);
+        expect(a.listPendingRoomJoins()).toEqual([]);
+        expect(d.listPendingRoomJoins()).toEqual([]);
+    }
+    finally {
+        await d.shutdown();
+        await a.shutdown();
+    }
+});
+//# sourceMappingURL=dm-send-principal-delegation.integration.test.js.map

package/dist/test/dm-send-principal-delegation.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dm-send-principal-delegation.integration.test.js","sourceRoot":"","sources":["../../src/test/dm-send-principal-delegation.integration.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAEjE,2IAA2I;AAC3I,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,2MAA2M;AAC3M,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B,IAAI,QAAQ,GAAG,MAAM,CAAC;AACtB,SAAS,SAAS;IAChB,QAAQ,IAAI,CAAC,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO;QACL,GAAG,EAAE,EAAE,CAAC,WAAW,CACjB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,wCAAwC,CAAC,CAC9D;KACF,CAAC;AACJ,CAAC;AAED,IAAI,CAAC,kHAAkH,EAAE,KAAK,IAAI,EAAE;IAClI,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IAEzB,6OAA6O;IAC7O,MAAM,wBAAwB,GAAG,mBAAmB,EAAE,CAAC;IACvD,MAAM,cAAc,GAAG,MAAM,cAAc,CACzC,wBAAwB,CAAC,wBAAwB,CAAC,CACnD,CAAC;IAEF,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CACrB,CAAC,EACD,SAAS,EACT,SAAS,EACT,SAAS,EACT,wBAAwB,CACzB,CAAC;IACF,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,aAAa;QAClB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,wIAAwI;IACxI,MAAM,sBAAsB,GAAG,mBAAmB,EAAE,CAAC;IACrD,MAAM,YAAY,GAAG,MAAM,cAAc,CACvC,wBAAwB,CAAC,sBAAsB,CAAC,CACjD,CAAC;IAEF,iHAAiH;IACjH,MAAM,CAAC,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACf,MAAM,CAAC,CAAC,aAAa,CAAC;QACpB,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,MAAM;QACf,GAAG,EAAE,mBAAmB;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,MAAM,OAAO,CACX,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,SAAS,EAClD,yBAAyB,CAC1B,CAAC;IAEF,IAAI,CAAC;QACH,iIAAiI;QACjI,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,eAAe,CACnC,aAAa,CAAC,YAAY,CAAC,QAAQ,CAAC,EACpC,iBAAiB,CAClB,CAAC;QAEF,6JAA6J;QAC7J,MAAM,KAAK,GAAG,iBAAiB,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC;YAC7C,YAAY,EAAE,YAAY;YAC1B,mBAAmB,EAAE,sBAAsB;YAC3C,KAAK;YACL,OAAO,EAAE,QAAQ,EAAE;YACnB,MAAM,EAAE,KAAK;YACb,QAAQ,EAAE,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC;YACnC,2BAA2B,EAAE,cAAc,CAAC,QAAQ;YACpD,OAAO,EAAE,KAAK,CAAC,GAAG,EAAE,GAAG,sBAAsB;SAC9C,CAAC,CAAC;QACH,MAAM,CACJ,SAAS,CAAC,EAAE,EACZ,2CAA2C,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CACvE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,IAAI,CAAC,SAAS,CAAC,EAAE;YAAE,OAAO;QAE1B,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC;QAEnD,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/test/gateway-trust.test.js

@@ -113,5 +113,97 @@ describe("GatewayTrust persistence (agent-comms#186)", () => {
         const restartedB = new GatewayTrust(slotB);
         expect(restartedB.list()).toEqual([]);
     });
+    // Principal persistence (agent-comms#187) -- extends #186's own device-only persistence to the second, parallel principal allowlist, per #186's own issue text naming #187 as the one that decides what gets stored.
+    it("persists a trusted principal, surviving a restart alongside the bare-device set", () => {
+        const slot = tempSlot("pi");
+        const first = new GatewayTrust(slot);
+        first.add("aabbcc");
+        first.addPrincipal("112233");
+        const restarted = new GatewayTrust(slot);
+        expect(restarted.list()).toEqual(["aabbcc"]);
+        expect(restarted.listPrincipals()).toEqual(["112233"]);
+    });
+    it("persists a principal removal independently of the bare-device set", () => {
+        const slot = tempSlot("pi");
+        const first = new GatewayTrust(slot);
+        first.addPrincipal("112233");
+        first.addPrincipal("445566");
+        first.removePrincipal("112233");
+        const restarted = new GatewayTrust(slot);
+        expect(restarted.listPrincipals()).toEqual(["445566"]);
+    });
+});
+describe("GatewayTrust -- principal-keyed trust (agent-comms#187)", () => {
+    it("trusts no principal by default", () => {
+        const trust = new GatewayTrust();
+        expect(trust.isTrustedPrincipal("aabbcc")).toBe(false);
+        expect(trust.listPrincipals()).toEqual([]);
+    });
+    it("trusts a principal once added, independently of the bare-device set", () => {
+        const trust = new GatewayTrust();
+        trust.addPrincipal("AABBCC");
+        expect(trust.isTrustedPrincipal("aabbcc")).toBe(true);
+        expect(trust.listPrincipals()).toEqual(["aabbcc"]);
+        expect(trust.isTrusted("aabbcc")).toBe(false);
+    });
+    it("normalises hex case for principals the same way it does for bare devices", () => {
+        const trust = new GatewayTrust();
+        trust.addPrincipal("AaBbCc");
+        expect(trust.isTrustedPrincipal("aabbcc")).toBe(true);
+        expect(trust.isTrustedPrincipal("AABBCC")).toBe(true);
+    });
+    it("is idempotent: adding the same principal twice keeps it listed once", () => {
+        const trust = new GatewayTrust();
+        trust.addPrincipal("aabbcc");
+        trust.addPrincipal("AABBCC");
+        expect(trust.listPrincipals()).toEqual(["aabbcc"]);
+    });
+    it("stops trusting a principal once removed", () => {
+        const trust = new GatewayTrust();
+        trust.addPrincipal("aabbcc");
+        trust.removePrincipal("AABBCC");
+        expect(trust.isTrustedPrincipal("aabbcc")).toBe(false);
+        expect(trust.listPrincipals()).toEqual([]);
+    });
+    it("removing a principal that was never trusted is a safe no-op", () => {
+        const trust = new GatewayTrust();
+        expect(() => {
+            trust.removePrincipal("aabbcc");
+        }).not.toThrow();
+        expect(trust.listPrincipals()).toEqual([]);
+    });
+    it("hasAny becomes true once a principal is trusted, even with no bare device ever trusted", () => {
+        const trust = new GatewayTrust();
+        expect(trust.hasAny()).toBe(false);
+        trust.addPrincipal("aabbcc");
+        expect(trust.hasAny()).toBe(true);
+    });
+    it("hasAny falls back to false once both the device and principal sets are empty again", () => {
+        const trust = new GatewayTrust();
+        trust.addPrincipal("aabbcc");
+        trust.removePrincipal("aabbcc");
+        expect(trust.hasAny()).toBe(false);
+    });
+    describe("isTrustedFor -- deciding trust from a verified token's own bearer and chain root", () => {
+        it("passes a bearer that is itself directly trusted, regardless of its chain root", () => {
+            const trust = new GatewayTrust();
+            trust.add("aabbcc");
+            expect(trust.isTrustedFor("aabbcc", "ffffff")).toBe(true);
+        });
+        it("passes a bearer whose chain roots at a trusted principal, even though the bearer itself was never individually trusted", () => {
+            const trust = new GatewayTrust();
+            trust.addPrincipal("ffffff");
+            expect(trust.isTrustedFor("aabbcc", "ffffff")).toBe(true);
+        });
+        it("refuses a bearer that is neither directly trusted nor rooted at a trusted principal", () => {
+            const trust = new GatewayTrust();
+            expect(trust.isTrustedFor("aabbcc", "ffffff")).toBe(false);
+        });
+        it("is case-insensitive on both the bearer and the chain-root hex", () => {
+            const trust = new GatewayTrust();
+            trust.addPrincipal("FFFFFF");
+            expect(trust.isTrustedFor("AABBCC", "ffffff")).toBe(true);
+        });
+    });
 });
 //# sourceMappingURL=gateway-trust.test.js.map

package/dist/test/gateway-trust.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust.test.js","sourceRoot":"","sources":["../../src/test/gateway-trust.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CACvD,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE;YACV,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uHAAuH,EAAE,GAAG,EAAE;QAC/H,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+GAA+G,EAAE,GAAG,EAAE;QACvH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpB,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"gateway-trust.test.js","sourceRoot":"","sources":["../../src/test/gateway-trust.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAGxD,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iCAAiC,CAAC,CACvD,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE;YACV,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uHAAuH,EAAE,GAAG,EAAE;QAC/H,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;IAC1D,EAAE,CAAC,4EAA4E,EAAE,GAAG,EAAE;QACpF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+GAA+G,EAAE,GAAG,EAAE;QACvH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEpB,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAErC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEvB,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uFAAuF,EAAE,GAAG,EAAE;QAC/F,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAErC,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAC1F,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACtC,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAEtC,MAAM,UAAU,GAAG,IAAI,YAAY,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,qNAAqN;IACrN,EAAE,CAAC,iFAAiF,EAAE,GAAG,EAAE;QACzF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACpB,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE7B,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7C,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAEhC,MAAM,SAAS,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QAEzC,MAAM,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;QAC7E,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACrE,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,EAAE;YACV,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,GAAG,EAAE;QAChG,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oFAAoF,EAAE,GAAG,EAAE;QAC5F,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;QACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC7B,KAAK,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kFAAkF,EAAE,GAAG,EAAE;QAChG,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;YACvF,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;YACjC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wHAAwH,EAAE,GAAG,EAAE;YAChI,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;YACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qFAAqF,EAAE,GAAG,EAAE;YAC7F,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;YACjC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7D,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;YACvE,MAAM,KAAK,GAAG,IAAI,YAAY,EAAE,CAAC;YACjC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/identity-store.test.js

@@ -246,35 +246,59 @@ test("deleteGroupToken is a no-op when nothing was saved for that group path", (
 });
 test("loadGatewayTrust is empty for a slot that has never saved a trusted set", () => {
     const { slot } = tempSlot("pi");
-    expect(loadGatewayTrust(slot)).toEqual([]);
+    expect(loadGatewayTrust(slot)).toEqual({ devices: [], principals: [] });
 });
 test("loadGatewayTrust does not require an identity to have been created first, unlike loadRoomTokens/loadGroupTokens", () => {
     const { slot } = tempSlot("pi");
     expect(() => {
-        saveGatewayTrust(slot, ["aabbcc"]);
+        saveGatewayTrust(slot, ["aabbcc"], []);
     }).not.toThrow();
-    expect(loadGatewayTrust(slot)).toEqual(["aabbcc"]);
+    expect(loadGatewayTrust(slot)).toEqual({
+        devices: ["aabbcc"],
+        principals: [],
+    });
 });
-test("saveGatewayTrust persists the trusted set, loadGatewayTrust reloads the same list", () => {
+test("saveGatewayTrust persists the trusted device and principal sets, loadGatewayTrust reloads the same lists", () => {
     const { slot } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc", "ddeeff"]);
-    expect(loadGatewayTrust(slot)).toEqual(["aabbcc", "ddeeff"]);
+    saveGatewayTrust(slot, ["aabbcc", "ddeeff"], ["112233"]);
+    expect(loadGatewayTrust(slot)).toEqual({
+        devices: ["aabbcc", "ddeeff"],
+        principals: ["112233"],
+    });
 });
-test("saveGatewayTrust overwrites the previously saved set rather than merging with it", () => {
+test("saveGatewayTrust overwrites the previously saved sets rather than merging with them", () => {
     const { slot } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc", "ddeeff"]);
-    saveGatewayTrust(slot, ["112233"]);
-    expect(loadGatewayTrust(slot)).toEqual(["112233"]);
+    saveGatewayTrust(slot, ["aabbcc", "ddeeff"], ["112233"]);
+    saveGatewayTrust(slot, ["112233"], ["445566"]);
+    expect(loadGatewayTrust(slot)).toEqual({
+        devices: ["112233"],
+        principals: ["445566"],
+    });
 });
-test("saveGatewayTrust persists an empty set, clearing whatever was saved before", () => {
+test("saveGatewayTrust persists empty sets, clearing whatever was saved before", () => {
     const { slot } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc"]);
-    saveGatewayTrust(slot, []);
-    expect(loadGatewayTrust(slot)).toEqual([]);
+    saveGatewayTrust(slot, ["aabbcc"], ["112233"]);
+    saveGatewayTrust(slot, [], []);
+    expect(loadGatewayTrust(slot)).toEqual({ devices: [], principals: [] });
+});
+test("loadGatewayTrust reads a pre-agent-comms#187 bare-array file as devices-only, with no principals", () => {
+    const { slot, dir } = tempSlot("pi");
+    // Create the real gateway-trust file at its actual path first (its exact slugified name is an implementation detail), then overwrite its content with the bare-array shape every file written before principal-keyed trust existed actually used.
+    saveGatewayTrust(slot, [], []);
+    const file = fs
+        .readdirSync(dir)
+        .find((f) => f.startsWith("gateway-trust-") && f.endsWith(".json"));
+    if (file === undefined)
+        throw new Error("expected a gateway-trust file");
+    fs.writeFileSync(path.join(dir, file), `${JSON.stringify(["aabbcc", "ddeeff"])}\n`);
+    expect(loadGatewayTrust(slot)).toEqual({
+        devices: ["aabbcc", "ddeeff"],
+        principals: [],
+    });
 });
 test("the gateway trust file is written with owner-only permissions", () => {
     const { slot, dir } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc"]);
+    saveGatewayTrust(slot, ["aabbcc"], []);
     const file = fs
         .readdirSync(dir)
         .find((f) => f.startsWith("gateway-trust-") && f.endsWith(".json"));
@@ -286,7 +310,7 @@ test("the gateway trust file is written with owner-only permissions", () => {
 });
 test("the gateway trust file is a sibling of the identity file, distinct per (harness, cwd)", () => {
     const { slot, dir } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc"]);
+    saveGatewayTrust(slot, ["aabbcc"], []);
     const file = fs
         .readdirSync(dir)
         .find((f) => f.startsWith("gateway-trust-") && f.endsWith(".json"));
@@ -298,13 +322,13 @@ test("the gateway trust file is a sibling of the identity file, distinct per (ha
 });
 test("loadGatewayTrust returns empty for a slot whose gateway trust file is corrupt", () => {
     const { slot, dir } = tempSlot("pi");
-    saveGatewayTrust(slot, ["aabbcc"]);
+    saveGatewayTrust(slot, ["aabbcc"], []);
     const file = fs
         .readdirSync(dir)
         .find((f) => f.startsWith("gateway-trust-") && f.endsWith(".json"));
     if (file === undefined)
         throw new Error("expected a gateway-trust file");
     fs.writeFileSync(path.join(dir, file), "not valid json{{{");
-    expect(loadGatewayTrust(slot)).toEqual([]);
+    expect(loadGatewayTrust(slot)).toEqual({ devices: [], principals: [] });
 });
 //# sourceMappingURL=identity-store.test.js.map