agent-comms 3.6.0 → 3.8.0

package/dist/core/version-check.js

@@ -0,0 +1,118 @@
+/**
+ * Detects when a newer agent-comms release exists on npm than the one currently running -- see issue #166. A stale checkout (e.g. a manually pulled git checkout left behind while npm moves on) surfaces its own drift via CommsTool's whoami/update output (see tool.ts) rather than silently splitting mesh generations. Every failure mode (offline, registry down, timeout, malformed response) is swallowed here: a bridge with no network access behaves exactly as if no newer release were known, never as an error.
+ */
+const NPM_REGISTRY_LATEST_VERSION_URL = "https://registry.npmjs.org/agent-comms/latest";
+/** How long a single npm registry lookup may take before it's treated as a failure -- generous for a slow connection, short enough that a hung request can never pile up across successive interval checks. */
+const REGISTRY_FETCH_TIMEOUT_MS = 5000;
+const MS_PER_SECOND = 1000;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_HOUR = 60;
+const CHECK_INTERVAL_HOURS = 6;
+/** How often VersionDriftChecker re-checks npm once started. Deliberately slow: this is a background courtesy warning that piggybacks on whoami/update output (see tool.ts), not a thing any caller waits on, so there's no benefit to checking more often than a bridge process is likely to stay running for. */
+export const DEFAULT_CHECK_INTERVAL_MS = CHECK_INTERVAL_HOURS * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+function isNpmRegistryLatestResponse(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if (!("version" in value))
+        return false;
+    return typeof value.version === "string";
+}
+/** Fetches the "latest" dist-tag version currently published to npm, or undefined on any failure (offline, timeout, non-2xx, malformed body) -- callers never need their own try/catch around this. */
+export async function fetchLatestPublishedVersion(registryUrl = NPM_REGISTRY_LATEST_VERSION_URL, fetchImpl = fetch) {
+    try {
+        const response = await fetchImpl(registryUrl, {
+            signal: AbortSignal.timeout(REGISTRY_FETCH_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return undefined;
+        const body = await response.json();
+        if (!isNpmRegistryLatestResponse(body))
+            return undefined;
+        return body.version;
+    }
+    catch {
+        return undefined;
+    }
+}
+const VERSION_CORE_PART_COUNT = 3;
+/** Parses a "x.y.z[-prerelease][+build]" version string's numeric major/minor/patch parts, ignoring any prerelease/build suffix -- agent-comms releases are always plain x.y.z (semantic-release's own default), so a fuller semver-precedence comparator (prerelease ordering, build-metadata rules) would be speculative generality with no real input that needs it. Returns undefined for a string that isn't three dot-separated non-negative integers. */
+function parseVersionCore(version) {
+    const core = version.split(/[+-]/, 1)[0] ?? "";
+    const parts = core.split(".");
+    if (parts.length !== VERSION_CORE_PART_COUNT)
+        return undefined;
+    const major = Number(parts[0]);
+    const minor = Number(parts[1]);
+    const patch = Number(parts[2]);
+    const isValid = [major, minor, patch].every((part) => Number.isInteger(part) && part >= 0);
+    if (!isValid)
+        return undefined;
+    return [major, minor, patch];
+}
+/** True when latest is a strictly greater release than current, by major.minor.patch precedence. Returns false for either string that doesn't parse as a plain x.y.z version -- a malformed comparison has no safe "yes, warn" answer. */
+export function isNewerVersion(current, latest) {
+    const currentCore = parseVersionCore(current);
+    const latestCore = parseVersionCore(latest);
+    if (currentCore === undefined || latestCore === undefined)
+        return false;
+    const [currentMajor, currentMinor, currentPatch] = currentCore;
+    const [latestMajor, latestMinor, latestPatch] = latestCore;
+    if (latestMajor !== currentMajor)
+        return latestMajor > currentMajor;
+    if (latestMinor !== currentMinor)
+        return latestMinor > currentMinor;
+    return latestPatch > currentPatch;
+}
+/**
+ * Periodically (and once immediately on start()) compares the running version against npm's published "latest" dist-tag, caching the most recent successful lookup so CommsTool's whoami/update output can surface a "newer release available" note without either of them ever waiting on a network call. A failed check leaves the previously cached result untouched -- see this file's own header for why a failure is never surfaced as an error.
+ */
+export class VersionDriftChecker {
+    currentVersion;
+    intervalMs;
+    fetchLatestVersion;
+    latestKnownVersion;
+    timer;
+    constructor(options) {
+        this.currentVersion = options.currentVersion;
+        this.intervalMs = options.intervalMs ?? DEFAULT_CHECK_INTERVAL_MS;
+        this.fetchLatestVersion =
+            options.fetchLatestVersion ?? (async () => fetchLatestPublishedVersion());
+    }
+    /** Runs one check immediately (fire-and-forget -- start() itself never waits on the network) and schedules a recurring check every intervalMs. The interval is unref'd so it can never keep a bridge process alive on its own. No-op if already started. */
+    start() {
+        if (this.timer !== undefined)
+            return;
+        void this.check();
+        this.timer = setInterval(() => {
+            void this.check();
+        }, this.intervalMs);
+        this.timer.unref();
+    }
+    /** Stops the recurring check, if running. Safe to call even if start() was never called. */
+    stop() {
+        if (this.timer !== undefined) {
+            clearInterval(this.timer);
+            this.timer = undefined;
+        }
+    }
+    /** The most recently observed newer release, or undefined when none is known -- either no successful check has completed yet, or the running version is already current (or ahead). */
+    getNewerVersionIfAny() {
+        if (this.latestKnownVersion === undefined)
+            return undefined;
+        return isNewerVersion(this.currentVersion, this.latestKnownVersion)
+            ? this.latestKnownVersion
+            : undefined;
+    }
+    /** Runs a single check, tolerating a rejection from a caller-supplied fetchLatestVersion as well as the soft-failure (undefined) contract fetchLatestPublishedVersion's own default already guarantees -- start()'s own fire-and-forget call, and the recurring interval callback, both rely on this never throwing regardless of which fetch implementation is wired in. */
+    async check() {
+        try {
+            const latest = await this.fetchLatestVersion();
+            if (latest !== undefined)
+                this.latestKnownVersion = latest;
+        }
+        catch {
+            // Swallowed deliberately -- see this file's own header on failing soft.
+        }
+    }
+}
+//# sourceMappingURL=version-check.js.map

package/dist/core/version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-check.js","sourceRoot":"","sources":["../../src/core/version-check.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,MAAM,+BAA+B,GACnC,+CAA+C,CAAC;AAElD,+MAA+M;AAC/M,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAC5B,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAE/B,mTAAmT;AACnT,MAAM,CAAC,MAAM,yBAAyB,GACpC,oBAAoB,GAAG,gBAAgB,GAAG,kBAAkB,GAAG,aAAa,CAAC;AAM/E,SAAS,2BAA2B,CAClC,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC;AAC3C,CAAC;AAED,uMAAuM;AACvM,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,cAAsB,+BAA+B,EACrD,YAAuB,KAAK;IAE5B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE;YAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,yBAAyB,CAAC;SACvD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACzD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,MAAM,uBAAuB,GAAG,CAAC,CAAC;AAElC,gcAAgc;AAChc,SAAS,gBAAgB,CACvB,OAAe;IAEf,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,uBAAuB;QAAE,OAAO,SAAS,CAAC;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,KAAK,CACzC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAC9C,CAAC;IACF,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED,0OAA0O;AAC1O,MAAM,UAAU,cAAc,CAAC,OAAe,EAAE,MAAc;IAC5D,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,WAAW,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxE,MAAM,CAAC,YAAY,EAAE,YAAY,EAAE,YAAY,CAAC,GAAG,WAAW,CAAC;IAC/D,MAAM,CAAC,WAAW,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,UAAU,CAAC;IAC3D,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,WAAW,GAAG,YAAY,CAAC;IACpE,IAAI,WAAW,KAAK,YAAY;QAAE,OAAO,WAAW,GAAG,YAAY,CAAC;IACpE,OAAO,WAAW,GAAG,YAAY,CAAC;AACpC,CAAC;AAQD;;GAEG;AACH,MAAM,OAAO,mBAAmB;IACb,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,kBAAkB,CAAoC;IAC/D,kBAAkB,CAAqB;IACvC,KAAK,CAA6C;IAE1D,YAAY,OAA6C;QACvD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC;QAC7C,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,yBAAyB,CAAC;QAClE,IAAI,CAAC,kBAAkB;YACrB,OAAO,CAAC,kBAAkB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,2BAA2B,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,4PAA4P;IAC5P,KAAK;QACH,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;YAAE,OAAO;QACrC,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,4FAA4F;IAC5F,IAAI;QACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAC7B,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACzB,CAAC;IACH,CAAC;IAED,uLAAuL;IACvL,oBAAoB;QAClB,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5D,OAAO,cAAc,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,kBAAkB,CAAC;YACjE,CAAC,CAAC,IAAI,CAAC,kBAAkB;YACzB,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAED,6WAA6W;IACrW,KAAK,CAAC,KAAK;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC/C,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC;QAC7D,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;CACF"}

package/dist/test/bridge-mesh-version-drift.test.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Unit tests proving createBridgeMesh wires a VersionDriftChecker into the CommsTool it builds (agent-comms#166) -- every real bridge (pi, claude-code, codex, mcp, opencode, cc-peer) constructs its store/tool through this one factory, so this is the single place that needs to prove the wiring works rather than duplicating the assertion per bridge.
+ *
+ * fetchLatestVersion is injected in every test here specifically so this file never makes a real network call to the npm registry -- see bridge-mesh.ts's own header on why that parameter exists.
+ */
+export {};
+//# sourceMappingURL=bridge-mesh-version-drift.test.d.ts.map

package/dist/test/bridge-mesh-version-drift.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-mesh-version-drift.test.d.ts","sourceRoot":"","sources":["../../src/test/bridge-mesh-version-drift.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG"}

package/dist/test/bridge-mesh-version-drift.test.js

@@ -0,0 +1,98 @@
+/**
+ * Unit tests proving createBridgeMesh wires a VersionDriftChecker into the CommsTool it builds (agent-comms#166) -- every real bridge (pi, claude-code, codex, mcp, opencode, cc-peer) constructs its store/tool through this one factory, so this is the single place that needs to prove the wiring works rather than duplicating the assertion per bridge.
+ *
+ * fetchLatestVersion is injected in every test here specifically so this file never makes a real network call to the npm registry -- see bridge-mesh.ts's own header on why that parameter exists.
+ */
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { test, expect } from "vitest";
+import { createBridgeMesh } from "../core/bridge-mesh.js";
+import { getOwnPackageVersion } from "../core/package-version.js";
+import { buildAction } from "../core/bridge.js";
+function tempSlot(harness) {
+    const dir = fs.mkdtempSync(path.join(tmpdir(), "agent-comms-bridge-mesh-version-drift-test-"));
+    return { harness, cwd: "/tmp/project", dir };
+}
+// Never rely on the default coordinator port (19876) in a test -- this machine routinely runs other, real agent-comms bridges (this very session's own MCP tool included) that are genuinely listening there, and a solo test store becoming a peer of that unrelated live mesh rather than its own coordinator hangs indefinitely on the first round trip that expects a same-test peer to answer. Matches the ephemeral port range bridge-mesh.test.ts's own multi-peer test already uses for the identical reason.
+const TEST_COORDINATOR_PORT_BASE = 21_100;
+const TEST_COORDINATOR_PORT_RANGE = 100;
+function testCoordinatorPort() {
+    return (TEST_COORDINATOR_PORT_BASE +
+        Math.floor(Math.random() * TEST_COORDINATOR_PORT_RANGE));
+}
+const POLL_TIMEOUT_MS = 5000;
+const POLL_INTERVAL_MS = 20;
+/**
+ * Re-runs whoami until its content includes match or timeoutMs elapses -- VersionDriftChecker's own start() check is fire-and-forget (see version-check.ts), so there's no signal other than tool.handle's own output for when the checker's first check has actually landed.
+ */
+async function whoamiUntilContains(tool, ctx, match) {
+    const deadline = Date.now() + POLL_TIMEOUT_MS;
+    for (;;) {
+        const result = await tool.handle(ctx, buildAction({ action: "whoami" }));
+        if (result.content.includes(match))
+            return result.content;
+        if (Date.now() >= deadline) {
+            throw new Error(`Timed out after ${String(POLL_TIMEOUT_MS)}ms waiting for whoami output to include "${match}". Last content:\n${result.content}`);
+        }
+        await new Promise((resolve) => {
+            setTimeout(resolve, POLL_INTERVAL_MS);
+        });
+    }
+}
+test("createBridgeMesh's tool reports an available update when the injected version checker finds a newer release", async () => {
+    const slot = tempSlot("test-harness-drift");
+    const newerVersion = "9999.0.0";
+    const { store, tool } = await createBridgeMesh(slot, testCoordinatorPort(), undefined, async () => Promise.resolve(newerVersion));
+    try {
+        await store.init();
+        const agent = await store.registerAgent({
+            name: "drift-test-agent",
+            harness: "test-harness-drift",
+            cwd: "/tmp/project",
+            pid: process.pid,
+            visibility: "visible",
+            tags: [],
+        });
+        const ctx = {
+            agentId: agent.id,
+            harness: "test-harness-drift",
+            cwd: "/tmp/project",
+            pid: process.pid,
+        };
+        const content = await whoamiUntilContains(tool, ctx, "Update available");
+        expect(content).toContain(`Version: ${getOwnPackageVersion()}`);
+        expect(content).toContain(`Update available: ${newerVersion}`);
+    }
+    finally {
+        await store.shutdown();
+    }
+});
+test("createBridgeMesh's tool reports its own version with no update line when no newer release is known", async () => {
+    const slot = tempSlot("test-harness-no-drift");
+    const { store, tool } = await createBridgeMesh(slot, testCoordinatorPort(), undefined, async () => Promise.resolve(undefined));
+    try {
+        await store.init();
+        const agent = await store.registerAgent({
+            name: "no-drift-test-agent",
+            harness: "test-harness-no-drift",
+            cwd: "/tmp/project",
+            pid: process.pid,
+            visibility: "visible",
+            tags: [],
+        });
+        const ctx = {
+            agentId: agent.id,
+            harness: "test-harness-no-drift",
+            cwd: "/tmp/project",
+            pid: process.pid,
+        };
+        const result = await tool.handle(ctx, buildAction({ action: "whoami" }));
+        expect(result.content).toContain(`Version: ${getOwnPackageVersion()}`);
+        expect(result.content).not.toContain("Update available");
+    }
+    finally {
+        await store.shutdown();
+    }
+});
+//# sourceMappingURL=bridge-mesh-version-drift.test.js.map

package/dist/test/bridge-mesh-version-drift.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge-mesh-version-drift.test.js","sourceRoot":"","sources":["../../src/test/bridge-mesh-version-drift.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,SAAS,QAAQ,CAAC,OAAe;IAC/B,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CACxB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,6CAA6C,CAAC,CACnE,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC;AAC/C,CAAC;AAED,sfAAsf;AACtf,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,SAAS,mBAAmB;IAC1B,OAAO,CACL,0BAA0B;QAC1B,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,2BAA2B,CAAC,CACxD,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAE5B;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAChC,IAAe,EACf,GAA6E,EAC7E,KAAa;IAEb,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;IAC9C,SAAS,CAAC;QACR,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QACzE,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,CAAC,eAAe,CAAC,4CAA4C,KAAK,qBAAqB,MAAM,CAAC,OAAO,EAAE,CACjI,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC5B,UAAU,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,IAAI,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;IAC7H,MAAM,IAAI,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,UAAU,CAAC;IAChC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAC5C,IAAI,EACJ,mBAAmB,EAAE,EACrB,SAAS,EACT,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAC1C,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;YACtC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,oBAAoB;YAC7B,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,OAAO,EAAE,oBAAoB;YAC7B,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAEzE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,YAAY,EAAE,CAAC,CAAC;IACjE,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,KAAK,IAAI,EAAE;IACpH,MAAM,IAAI,GAAG,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,gBAAgB,CAC5C,IAAI,EACJ,mBAAmB,EAAE,EACrB,SAAS,EACT,KAAK,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CACvC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;YACtC,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,uBAAuB;YAChC,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU,EAAE,SAAS;YACrB,IAAI,EAAE,EAAE;SACT,CAAC,CAAC;QACH,MAAM,GAAG,GAAG;YACV,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,OAAO,EAAE,uBAAuB;YAChC,GAAG,EAAE,cAAc;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;QAEzE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,oBAAoB,EAAE,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC3D,CAAC;YAAS,CAAC;QACT,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/test/capability-bubble-up.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=capability-bubble-up.test.d.ts.map

package/dist/test/capability-bubble-up.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-bubble-up.test.d.ts","sourceRoot":"","sources":["../../src/test/capability-bubble-up.test.ts"],"names":[],"mappings":""}

package/dist/test/capability-bubble-up.test.js

@@ -0,0 +1,350 @@
+import { webcrypto } from "node:crypto";
+import { describe, it, expect, vi } from "vitest";
+import { createNodeIdentity } from "wire-mesh-core/adapters/node-identity";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { mintCapabilityToken } from "wire-mesh-core/domain/tokens";
+import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
+import { verifyCapabilityToken } from "wire-mesh-core/domain/tokens";
+import { resolveBubbleUpRoute, createBubbleUpCapabilityRequestHandler, } from "../core/capability-bubble-up.js";
+const ES256 = -7;
+const HOUR_MS = 3_600_000;
+const NOW_MS = 1_893_456_000_000;
+const EXPIRES_MS = NOW_MS + HOUR_MS;
+const CAPABILITY = "exec:pty";
+const SCOPE = { kind: "folder" };
+function buf(bytes) {
+    return Uint8Array.from(bytes);
+}
+async function generateEs256Identity() {
+    const keyPair = await webcrypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const publicKeyBytes = new Uint8Array(await webcrypto.subtle.exportKey("raw", keyPair.publicKey));
+    return createNodeIdentity(keyPair.privateKey, publicKeyBytes, ES256);
+}
+function fixedClock(atMs) {
+    return { now: () => atMs };
+}
+let issuedTokenIds = 0;
+function nextTokenId() {
+    issuedTokenIds += 1;
+    return buf([issuedTokenIds]);
+}
+async function mint(issuer, bearer, options = {}) {
+    const verdict = await mintCapabilityToken({
+        identity: issuer,
+        clock: fixedClock(options.mintedAt ?? NOW_MS),
+        tokenId: nextTokenId(),
+        bearer: bearer.deviceId,
+        capability: options.capability ?? CAPABILITY,
+        scope: options.scope ?? SCOPE,
+        expires: options.expires ?? EXPIRES_MS,
+        ...(options.delegationsRemaining !== undefined
+            ? { delegationsRemaining: options.delegationsRemaining }
+            : {}),
+        ...(options.parent !== undefined ? { parent: options.parent } : {}),
+    });
+    if (!verdict.ok)
+        throw new Error(`mint failed: ${verdict.reason}`);
+    return verdict.token;
+}
+describe("resolveBubbleUpRoute", () => {
+    it("grants directly when the held token has depth remaining that narrows the request", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const heldToken = await mint(root, holder, { delegationsRemaining: 2 });
+        const route = await resolveBubbleUpRoute({
+            heldToken,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: SCOPE,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 1,
+        });
+        expect(route.kind).toBe("grant");
+        if (route.kind === "grant") {
+            expect(route.token).toBe(heldToken);
+        }
+    });
+    it("forwards to the held token's own issuer when its delegation depth is exhausted", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
+        const route = await resolveBubbleUpRoute({
+            heldToken,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: SCOPE,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 0,
+        });
+        expect(route.kind).toBe("forward");
+        if (route.kind === "forward") {
+            expect(deviceIdToHex(route.target)).toBe(deviceIdToHex(root.deviceId));
+        }
+    });
+    it("forwards to the held token's own issuer when the requested scope does not narrow", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const heldToken = await mint(root, holder, {
+            scope: { kind: "room", path: "abc/general" },
+            delegationsRemaining: 3,
+        });
+        const route = await resolveBubbleUpRoute({
+            heldToken,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: { kind: "room", path: "abc/other" },
+            expires: EXPIRES_MS,
+            delegationsRemaining: 1,
+        });
+        expect(route.kind).toBe("forward");
+        if (route.kind === "forward") {
+            expect(deviceIdToHex(route.target)).toBe(deviceIdToHex(root.deviceId));
+        }
+    });
+    it("reports no-route when this device holds no token for the capability at all", async () => {
+        const holder = await generateEs256Identity();
+        const route = await resolveBubbleUpRoute({
+            heldToken: undefined,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: SCOPE,
+            expires: EXPIRES_MS,
+        });
+        expect(route).toEqual({ kind: "no-route", reason: "no-held-token" });
+    });
+    it("reports no-route when the held token has already expired", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const heldToken = await mint(root, holder, {
+            mintedAt: NOW_MS - HOUR_MS,
+            expires: NOW_MS - 1,
+            delegationsRemaining: 2,
+        });
+        const route = await resolveBubbleUpRoute({
+            heldToken,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: SCOPE,
+            expires: NOW_MS,
+            delegationsRemaining: 1,
+        });
+        expect(route).toEqual({ kind: "no-route", reason: "held-token-invalid" });
+    });
+    it("reports no-route rather than forwarding to itself when its held token is self-issued", async () => {
+        const holder = await generateEs256Identity();
+        const heldToken = await mint(holder, holder, { delegationsRemaining: 0 });
+        const route = await resolveBubbleUpRoute({
+            heldToken,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            capability: CAPABILITY,
+            scope: SCOPE,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 0,
+        });
+        expect(route).toEqual({ kind: "no-route", reason: "self-issued" });
+    });
+});
+let nextRequestId = 0;
+function fakeIncoming(params) {
+    nextRequestId += 1;
+    return {
+        requestId: nextRequestId,
+        command: { verb: CAPABILITY, params },
+        scope: SCOPE,
+        respond: vi.fn(async () => undefined),
+    };
+}
+describe("createBubbleUpCapabilityRequestHandler", () => {
+    it("mints a delegated child token when this device can grant from its own held depth", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const heldToken = await mint(root, holder, { delegationsRemaining: 2 });
+        const sendManageRequest = vi.fn();
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 1,
+            ownToken: () => heldToken,
+            session: { sendManageRequest },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: CAPABILITY,
+        });
+        await handler(incoming);
+        expect(sendManageRequest).not.toHaveBeenCalled();
+        expect(incoming.respond).toHaveBeenCalledTimes(1);
+        const outcome = incoming.respond.mock.calls[0]?.[0];
+        expect(outcome.result).toBe("ok");
+        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: requester.deviceId,
+        });
+        expect(verdict.ok).toBe(true);
+        if (verdict.ok) {
+            expect(deviceIdToHex(verdict.rootIssuer)).toBe(deviceIdToHex(root.deviceId));
+            expect(verdict.depth).toBe(1);
+        }
+    });
+    it("responds malformed for a request naming a different capability", async () => {
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            ownToken: () => undefined,
+            session: { sendManageRequest: vi.fn() },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: "room:member",
+        });
+        await handler(incoming);
+        expect(incoming.respond).toHaveBeenCalledWith({
+            result: "error",
+            code: "malformed",
+        });
+    });
+    it("responds expired for an already-stale ask", async () => {
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            ownToken: () => undefined,
+            session: { sendManageRequest: vi.fn() },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: CAPABILITY,
+            "valid-until": NOW_MS - 1,
+        });
+        await handler(incoming);
+        expect(incoming.respond).toHaveBeenCalledWith({
+            result: "error",
+            code: "expired",
+        });
+    });
+    it("forwards to the held token's own issuer and re-delegates the returned grant when its own depth is exhausted", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
+        const upstreamGrant = await mint(root, holder, { delegationsRemaining: 1 });
+        const sendManageRequest = vi.fn(async () => ({
+            result: "ok",
+            "granted-token": upstreamGrant,
+        }));
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 0,
+            ownToken: () => heldToken,
+            session: { sendManageRequest },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: CAPABILITY,
+        });
+        await handler(incoming);
+        expect(sendManageRequest).toHaveBeenCalledWith(expect.objectContaining({ verb: CAPABILITY }), SCOPE, root.deviceId, undefined, undefined);
+        const outcome = incoming.respond.mock.calls[0]?.[0];
+        expect(outcome.result).toBe("ok");
+        const verdict = await verifyCapabilityToken(outcome["granted-token"], {
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: requester.deviceId,
+        });
+        expect(verdict.ok).toBe(true);
+        if (verdict.ok) {
+            expect(deviceIdToHex(verdict.rootIssuer)).toBe(deviceIdToHex(root.deviceId));
+        }
+    });
+    it("relays the upstream denial unchanged when forwarding is refused", async () => {
+        const root = await generateEs256Identity();
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const heldToken = await mint(root, holder, { delegationsRemaining: 0 });
+        const sendManageRequest = vi.fn(async () => ({
+            result: "error",
+            code: "denied",
+            message: "no more depth to give",
+        }));
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            delegationsRemaining: 0,
+            ownToken: () => heldToken,
+            session: { sendManageRequest },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: CAPABILITY,
+        });
+        await handler(incoming);
+        expect(incoming.respond).toHaveBeenCalledWith({
+            result: "error",
+            code: "denied",
+            message: "no more depth to give",
+        });
+    });
+    it("responds denied when this device holds no token and has nothing to forward from", async () => {
+        const holder = await generateEs256Identity();
+        const requester = await generateEs256Identity();
+        const handler = createBubbleUpCapabilityRequestHandler({
+            capability: CAPABILITY,
+            identity: holder,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            bearerDevice: requester.deviceId,
+            expires: EXPIRES_MS,
+            ownToken: () => undefined,
+            session: { sendManageRequest: vi.fn() },
+        });
+        const incoming = fakeIncoming({
+            verb: "capability.request",
+            capability: CAPABILITY,
+        });
+        await handler(incoming);
+        const outcome = incoming.respond.mock.calls[0]?.[0];
+        expect(outcome.result).toBe("error");
+        expect(outcome.code).toBe("denied");
+    });
+});
+//# sourceMappingURL=capability-bubble-up.test.js.map

package/dist/test/capability-bubble-up.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-bubble-up.test.js","sourceRoot":"","sources":["../../src/test/capability-bubble-up.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AAQrE,OAAO,EACL,oBAAoB,EACpB,sCAAsC,GACvC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;AACjB,MAAM,OAAO,GAAG,SAAS,CAAC;AAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AACpC,MAAM,UAAU,GAAG,UAAU,CAAC;AAC9B,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,QAAiB,EAAE,CAAC;AAE1C,SAAS,GAAG,CAAC,KAAqC;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAChD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,UAAU,CACnC,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAC3D,CAAC;IACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,SAAS,WAAW;IAClB,cAAc,IAAI,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,KAAK,UAAU,IAAI,CACjB,MAAoB,EACpB,MAAoB,EACpB,UAQI,EAAE;IAEN,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC;QAC7C,OAAO,EAAE,WAAW,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,UAAU;QAC5C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK;QAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,UAAU;QACtC,GAAG,CAAC,OAAO,CAAC,oBAAoB,KAAK,SAAS;YAC5C,CAAC,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YACzC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE;YAC5C,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE;YAC1C,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4EAA4E,EAAE,KAAK,IAAI,EAAE;QAC1F,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAE7C,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS,EAAE,SAAS;YACpB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE;YACzC,QAAQ,EAAE,MAAM,GAAG,OAAO;YAC1B,OAAO,EAAE,MAAM,GAAG,CAAC;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,MAAM;YACf,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;QACpG,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1E,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC;YACvC,SAAS;YACT,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;SACxB,CAAC,CAAC;QAEH,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAMH,IAAI,aAAa,GAAG,CAAC,CAAC;AACtB,SAAS,YAAY,CAAC,MAA+B;IACnD,aAAa,IAAI,CAAC,CAAC;IACnB,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE;QACrC,KAAK,EAAE,KAAK;QACZ,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC;KACtC,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,wCAAwC,EAAE,GAAG,EAAE;IACtD,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACjD,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAGjD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAElC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC5C,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SACxC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,aAAa;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SACxC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;YACtB,aAAa,EAAE,MAAM,GAAG,CAAC;SAC1B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6GAA6G,EAAE,KAAK,IAAI,EAAE;QAC3H,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAE5E,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAA4B,EAAE,CAAC,CAAC;YACnE,MAAM,EAAE,IAAI;YACZ,eAAe,EAAE,aAAa;SAC/B,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,iBAAiB,CAAC,CAAC,oBAAoB,CAC5C,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAC7C,KAAK,EACL,IAAI,CAAC,QAAQ,EACb,SAAS,EACT,SAAS,CACV,CAAC;QAEF,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAGjD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE;YACpE,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,SAAS,CAAC,QAAQ;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAC5C,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,oBAAoB,EAAE,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,iBAAiB,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAA4B,EAAE,CAAC,CAAC;YACnE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,oBAAoB,EAAE,CAAC;YACvB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE;SAC/B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC;YAC5C,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAEhD,MAAM,OAAO,GAAG,sCAAsC,CAAC;YACrD,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;YAChC,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,GAAG,EAAE,CAAC,SAAS;YACzB,OAAO,EAAE,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE;SACxC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,YAAY,CAAC;YAC5B,IAAI,EAAE,oBAAoB;YAC1B,UAAU,EAAE,UAAU;SACvB,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;QAExB,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAGjD,CAAC;QACF,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/delegation-policy.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for the issuer-side delegation policy (core/delegation-policy, agent-comms#163): deciding which capability verbs an issuer never lets a bearer redelegate, and how a caller narrows that decision per bearer.
+ */
+export {};
+//# sourceMappingURL=delegation-policy.test.d.ts.map

package/dist/test/delegation-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-policy.test.d.ts","sourceRoot":"","sources":["../../src/test/delegation-policy.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}