agent-comms 3.7.0 → 3.9.0

package/dist/test/cc-peer-front.test.js

@@ -0,0 +1,109 @@
+/**
+ * Unit tests for the cc-peer front's pure decision logic (bridges/cc-peer/front.ts) -- roster filtering, slot computation, and inbound message routing, all tested purely over data with no real cc-peer/MeshStore/filesystem involved.
+ */
+import { describe, expect, it } from "vitest";
+import { isCcPeerLibraryPeer, computeFrontSlot, selectSessionsToFront, matchInboundMessageSession, } from "../bridges/cc-peer/front.js";
+function rosterEntry(overrides = {}) {
+    return {
+        pid: 111,
+        cwd: "/tmp/project",
+        version: "2.1.269",
+        messagingSocketPath: "/tmp/sock-111",
+        ...overrides,
+    };
+}
+/** A pid standing in for a real live agent-comms bridge holding a slot's lock -- arbitrary beyond "a plausible process id", used only to prove selectSessionsToFront treats "probe returned a pid" as "already fronted", not to assert anything about the value itself. */
+const LIVE_LOCK_HOLDER_PID = 4242;
+describe("isCcPeerLibraryPeer", () => {
+    it("is true for an entry carrying cc-peer's own literal version marker", () => {
+        expect(isCcPeerLibraryPeer(rosterEntry({ version: "cc-peer" }))).toBe(true);
+    });
+    it("is false for an entry reporting a real Claude Code version", () => {
+        expect(isCcPeerLibraryPeer(rosterEntry({ version: "2.1.269" }))).toBe(false);
+    });
+});
+describe("computeFrontSlot", () => {
+    it("uses the claude-code harness, matching the real claude-code bridge's own slot", () => {
+        expect(computeFrontSlot("/tmp/project")).toEqual({
+            harness: "claude-code",
+            cwd: "/tmp/project",
+        });
+    });
+    it("is distinct per cwd", () => {
+        expect(computeFrontSlot("/tmp/a")).not.toEqual(computeFrontSlot("/tmp/b"));
+    });
+});
+describe("selectSessionsToFront", () => {
+    it("excludes cc-peer-library peers regardless of slot state", () => {
+        const libraryPeer = rosterEntry({ pid: 1, version: "cc-peer" });
+        const selected = selectSessionsToFront([libraryPeer], () => undefined);
+        expect(selected).toEqual([]);
+    });
+    it("excludes a real session whose own slot is already held by a live bridge", () => {
+        const alreadyFronted = rosterEntry({ pid: 2, cwd: "/tmp/self-fronted" });
+        const selected = selectSessionsToFront([alreadyFronted], (slot) => slot.cwd === "/tmp/self-fronted" ? LIVE_LOCK_HOLDER_PID : undefined);
+        expect(selected).toEqual([]);
+    });
+    it("selects a real session whose own slot is unheld", () => {
+        const unfronted = rosterEntry({ pid: 3, cwd: "/tmp/unfronted" });
+        const selected = selectSessionsToFront([unfronted], () => undefined);
+        expect(selected).toEqual([unfronted]);
+    });
+    it("probes the slot computed from the entry's own cwd, not an unrelated one", () => {
+        const entry = rosterEntry({ pid: 4, cwd: "/tmp/watched" });
+        let probedSlot;
+        selectSessionsToFront([entry], (slot) => {
+            probedSlot = slot;
+            return undefined;
+        });
+        expect(probedSlot).toEqual({ harness: "claude-code", cwd: "/tmp/watched" });
+    });
+    it("handles a mixed roster, keeping only the unfronted real sessions", () => {
+        const libraryPeer = rosterEntry({ pid: 1, version: "cc-peer" });
+        const selfFronted = rosterEntry({ pid: 2, cwd: "/tmp/self-fronted" });
+        const unfronted = rosterEntry({ pid: 3, cwd: "/tmp/unfronted" });
+        const selected = selectSessionsToFront([libraryPeer, selfFronted, unfronted], (slot) => slot.cwd === "/tmp/self-fronted" ? LIVE_LOCK_HOLDER_PID : undefined);
+        expect(selected).toEqual([unfronted]);
+    });
+});
+describe("matchInboundMessageSession", () => {
+    it("matches a fronted session by the uds:<socketPath> envelope convention", () => {
+        const a = {
+            messagingSocketPath: "/tmp/sock-a",
+            label: "a",
+        };
+        const b = {
+            messagingSocketPath: "/tmp/sock-b",
+            label: "b",
+        };
+        const match = matchInboundMessageSession([a, b], {
+            from: "uds:/tmp/sock-b",
+        });
+        expect(match).toBe(b);
+    });
+    it("returns undefined when no fronted session's socket matches", () => {
+        const a = {
+            messagingSocketPath: "/tmp/sock-a",
+            label: "a",
+        };
+        const match = matchInboundMessageSession([a], {
+            from: "uds:/tmp/sock-unknown",
+        });
+        expect(match).toBeUndefined();
+    });
+    it("returns undefined when the message carries no from field at all", () => {
+        const a = {
+            messagingSocketPath: "/tmp/sock-a",
+            label: "a",
+        };
+        expect(matchInboundMessageSession([a], {})).toBeUndefined();
+    });
+    it("never matches a from value missing the uds: prefix, even with an otherwise identical path", () => {
+        const a = {
+            messagingSocketPath: "/tmp/sock-a",
+            label: "a",
+        };
+        expect(matchInboundMessageSession([a], { from: "/tmp/sock-a" })).toBeUndefined();
+    });
+});
+//# sourceMappingURL=cc-peer-front.test.js.map

package/dist/test/cc-peer-front.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cc-peer-front.test.js","sourceRoot":"","sources":["../../src/test/cc-peer-front.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,qBAAqB,EACrB,0BAA0B,GAE3B,MAAM,6BAA6B,CAAC;AAErC,SAAS,WAAW,CAClB,YAAsD,EAAE;IAExD,OAAO;QACL,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,cAAc;QACnB,OAAO,EAAE,SAAS;QAClB,mBAAmB,EAAE,eAAe;QACpC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,2QAA2Q;AAC3Q,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CACnE,KAAK,CACN,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,aAAa;YACtB,GAAG,EAAE,cAAc;SACpB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qBAAqB,EAAE,GAAG,EAAE;QAC7B,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,cAAc,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAChE,IAAI,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CACpE,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrE,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3D,IAAI,UAAwD,CAAC;QAC7D,qBAAqB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE;YACtC,UAAU,GAAG,IAAI,CAAC;YAClB,OAAO,SAAS,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,WAAW,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAG,qBAAqB,CACpC,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,EACrC,CAAC,IAAI,EAAE,EAAE,CACP,IAAI,CAAC,GAAG,KAAK,mBAAmB,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS,CACtE,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAOH,QAAQ,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC1C,EAAE,CAAC,uEAAuE,EAAE,GAAG,EAAE;QAC/E,MAAM,CAAC,GAAsB;YAC3B,mBAAmB,EAAE,aAAa;YAClC,KAAK,EAAE,GAAG;SACX,CAAC;QACF,MAAM,CAAC,GAAsB;YAC3B,mBAAmB,EAAE,aAAa;YAClC,KAAK,EAAE,GAAG;SACX,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE;YAC/C,IAAI,EAAE,iBAAiB;SACxB,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,GAAsB;YAC3B,mBAAmB,EAAE,aAAa;YAClC,KAAK,EAAE,GAAG;SACX,CAAC;QACF,MAAM,KAAK,GAAG,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE;YAC5C,IAAI,EAAE,uBAAuB;SAC9B,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,CAAC,aAAa,EAAE,CAAC;IAChC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,GAAsB;YAC3B,mBAAmB,EAAE,aAAa;YAClC,KAAK,EAAE,GAAG;SACX,CAAC;QACF,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;QACnG,MAAM,CAAC,GAAsB;YAC3B,mBAAmB,EAAE,aAAa;YAClC,KAAK,EAAE,GAAG;SACX,CAAC;QACF,MAAM,CACJ,0BAA0B,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CACzD,CAAC,aAAa,EAAE,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/delegation-policy.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Unit tests for the issuer-side delegation policy (core/delegation-policy, agent-comms#163): deciding which capability verbs an issuer never lets a bearer redelegate, and how a caller narrows that decision per bearer.
+ */
+export {};
+//# sourceMappingURL=delegation-policy.test.d.ts.map

package/dist/test/delegation-policy.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-policy.test.d.ts","sourceRoot":"","sources":["../../src/test/delegation-policy.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/test/delegation-policy.test.js

@@ -0,0 +1,52 @@
+/**
+ * Unit tests for the issuer-side delegation policy (core/delegation-policy, agent-comms#163): deciding which capability verbs an issuer never lets a bearer redelegate, and how a caller narrows that decision per bearer.
+ */
+import { test, expect } from "vitest";
+import { resolveDelegationsRemaining } from "../core/delegation-policy.js";
+const ALICE = "alice-device-id";
+const BOB = "bob-device-id";
+const REQUESTED_DELEGATIONS_REMAINING = 5;
+const NO_DELEGATIONS_REMAINING = 0;
+test("a capability on the policy's default nonDelegable set is always minted with delegationsRemaining 0", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+    };
+    expect(resolveDelegationsRemaining(policy, "room:member", ALICE, REQUESTED_DELEGATIONS_REMAINING)).toBe(NO_DELEGATIONS_REMAINING);
+});
+test("a capability absent from the default nonDelegable set passes the requested value through unchanged", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+    };
+    expect(resolveDelegationsRemaining(policy, "dm:send", ALICE, REQUESTED_DELEGATIONS_REMAINING)).toBe(REQUESTED_DELEGATIONS_REMAINING);
+});
+test("an undefined requested value passes through unchanged for a delegable capability", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+    };
+    expect(resolveDelegationsRemaining(policy, "dm:send", ALICE, undefined)).toBeUndefined();
+});
+test("a per-agent override entirely replaces the default nonDelegable set for that bearer, never merges with it", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+        perAgentOverrides: new Map([[ALICE, new Set(["dm:send"])]]),
+    };
+    // Alice's own override names dm:send, not room:member -- so room:member, present only in the policy's default set, no longer applies to her once her own override is in effect.
+    expect(resolveDelegationsRemaining(policy, "room:member", ALICE, REQUESTED_DELEGATIONS_REMAINING)).toBe(REQUESTED_DELEGATIONS_REMAINING);
+    expect(resolveDelegationsRemaining(policy, "dm:send", ALICE, REQUESTED_DELEGATIONS_REMAINING)).toBe(NO_DELEGATIONS_REMAINING);
+});
+test("a per-agent override for one bearer never affects a different bearer's own resolution", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+        perAgentOverrides: new Map([[ALICE, new Set(["dm:send"])]]),
+    };
+    expect(resolveDelegationsRemaining(policy, "room:member", BOB, REQUESTED_DELEGATIONS_REMAINING)).toBe(NO_DELEGATIONS_REMAINING);
+    expect(resolveDelegationsRemaining(policy, "dm:send", BOB, REQUESTED_DELEGATIONS_REMAINING)).toBe(REQUESTED_DELEGATIONS_REMAINING);
+});
+test("an empty per-agent override set makes every capability delegable for that bearer", () => {
+    const policy = {
+        nonDelegable: new Set(["room:member"]),
+        perAgentOverrides: new Map([[ALICE, new Set()]]),
+    };
+    expect(resolveDelegationsRemaining(policy, "room:member", ALICE, REQUESTED_DELEGATIONS_REMAINING)).toBe(REQUESTED_DELEGATIONS_REMAINING);
+});
+//# sourceMappingURL=delegation-policy.test.js.map

package/dist/test/delegation-policy.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegation-policy.test.js","sourceRoot":"","sources":["../../src/test/delegation-policy.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAG3E,MAAM,KAAK,GAAG,iBAAiB,CAAC;AAChC,MAAM,GAAG,GAAG,eAAe,CAAC;AAC5B,MAAM,+BAA+B,GAAG,CAAC,CAAC;AAC1C,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAEnC,IAAI,CAAC,oGAAoG,EAAE,GAAG,EAAE;IAC9G,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;KACvC,CAAC;IAEF,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,aAAa,EACb,KAAK,EACL,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oGAAoG,EAAE,GAAG,EAAE;IAC9G,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;KACvC,CAAC;IAEF,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,SAAS,EACT,KAAK,EACL,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;KACvC,CAAC;IAEF,MAAM,CACJ,2BAA2B,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC,CACjE,CAAC,aAAa,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,2GAA2G,EAAE,GAAG,EAAE;IACrH,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QACtC,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5D,CAAC;IAEF,gLAAgL;IAChL,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,aAAa,EACb,KAAK,EACL,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACxC,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,SAAS,EACT,KAAK,EACL,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;AACnC,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,uFAAuF,EAAE,GAAG,EAAE;IACjG,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QACtC,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;KAC5D,CAAC;IAEF,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,aAAa,EACb,GAAG,EACH,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACjC,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,SAAS,EACT,GAAG,EACH,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kFAAkF,EAAE,GAAG,EAAE;IAC5F,MAAM,MAAM,GAAqB;QAC/B,YAAY,EAAE,IAAI,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC;QACtC,iBAAiB,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;KACjD,CAAC;IAEF,MAAM,CACJ,2BAA2B,CACzB,MAAM,EACN,aAAa,EACb,KAAK,EACL,+BAA+B,CAChC,CACF,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;AAC1C,CAAC,CAAC,CAAC"}

package/dist/test/device-membership-verification.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-membership-verification.test.d.ts.map

package/dist/test/device-membership-verification.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-membership-verification.test.d.ts","sourceRoot":"","sources":["../../src/test/device-membership-verification.test.ts"],"names":[],"mappings":""}

package/dist/test/device-membership-verification.test.js

@@ -0,0 +1,214 @@
+/**
+ * Unit tests for core/device-membership-verification: the group:member capability, its scope path derivation, and verifyDeviceMembership's own obligations on top of verifyCapabilityToken (obligation-shaped the same way room-token-verification.test.ts already covers room:member -- capability match, scope kind/path match, and chain root).
+ */
+import { webcrypto } from "node:crypto";
+import { describe, it, expect } from "vitest";
+import { createNodeIdentity } from "wire-mesh-core/adapters/node-identity";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { mintCapabilityToken, mintRevocationEntry, } from "wire-mesh-core/domain/tokens";
+import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
+import { DEVICE_MEMBER_CAPABILITY, userGroupPath, verifyDeviceMembership, } from "../core/device-membership-verification.js";
+const ES256 = -7;
+const HOUR_MS = 3_600_000;
+function buf(bytes) {
+    return Uint8Array.from(bytes);
+}
+async function generateEs256Identity() {
+    const keyPair = await webcrypto.subtle.generateKey({ name: "ECDSA", namedCurve: "P-256" }, true, ["sign", "verify"]);
+    const publicKeyBytes = new Uint8Array(await webcrypto.subtle.exportKey("raw", keyPair.publicKey));
+    return createNodeIdentity(keyPair.privateKey, publicKeyBytes, ES256);
+}
+function fixedClock(atMs) {
+    return { now: () => atMs };
+}
+let issuedTokenIds = 0;
+function nextTokenId() {
+    issuedTokenIds += 1;
+    return buf([issuedTokenIds]);
+}
+const NOW_MS = 1_893_456_000_000;
+const EXPIRES_MS = NOW_MS + HOUR_MS;
+async function mintDeviceMemberToken(issuer, bearer, groupPath, tokenId = nextTokenId()) {
+    const verdict = await mintCapabilityToken({
+        identity: issuer,
+        clock: fixedClock(NOW_MS),
+        tokenId,
+        bearer: bearer.deviceId,
+        capability: DEVICE_MEMBER_CAPABILITY,
+        scope: { kind: "group", path: groupPath },
+        expires: EXPIRES_MS,
+        delegationsRemaining: 0,
+    });
+    if (!verdict.ok)
+        throw new Error(`mint failed: ${verdict.reason}`);
+    return verdict.token;
+}
+describe("DEVICE_MEMBER_CAPABILITY / userGroupPath", () => {
+    it("is the registered group:member capability string", () => {
+        expect(DEVICE_MEMBER_CAPABILITY).toBe("group:member");
+    });
+    it("derives the group path as the user principal's own device-id hex", async () => {
+        const user = await generateEs256Identity();
+        expect(userGroupPath(user.deviceId)).toBe(deviceIdToHex(user.deviceId));
+    });
+});
+describe("verifyDeviceMembership", () => {
+    it("accepts a token rooted at the user principal for that principal's own group", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const groupPath = userGroupPath(user.deviceId);
+        const token = await mintDeviceMemberToken(user, device, groupPath);
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(true);
+        if (verdict.ok) {
+            expect(verdict.claims.capability).toBe(DEVICE_MEMBER_CAPABILITY);
+            expect(verdict.claims.scope).toEqual({ kind: "group", path: groupPath });
+        }
+    });
+    it("refuses a token minted by someone other than the claimed user principal", async () => {
+        const user = await generateEs256Identity();
+        const impostor = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const groupPath = userGroupPath(user.deviceId);
+        // Minted by the impostor, scoped to claim it is the user's own group -- rootIssuer is the impostor, not the user, and must be refused.
+        const token = await mintDeviceMemberToken(impostor, device, groupPath);
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("wrong_chain_root");
+    });
+    it("refuses a token scoped to a different user's group", async () => {
+        const user = await generateEs256Identity();
+        const otherUser = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const token = await mintDeviceMemberToken(user, device, userGroupPath(otherUser.deviceId));
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("wrong_scope_path");
+    });
+    it("refuses a token with an unrelated capability even when scope kind/path line up", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const groupPath = userGroupPath(user.deviceId);
+        const verdict1 = await mintCapabilityToken({
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            tokenId: nextTokenId(),
+            bearer: device.deviceId,
+            capability: "exec:pty",
+            scope: { kind: "group", path: groupPath },
+            expires: EXPIRES_MS,
+        });
+        if (!verdict1.ok)
+            throw new Error(`mint failed: ${verdict1.reason}`);
+        const verdict = await verifyDeviceMembership(verdict1.token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("wrong_capability");
+    });
+    it("refuses a token with the right capability but the wrong scope kind", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const verdict1 = await mintCapabilityToken({
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            tokenId: nextTokenId(),
+            bearer: device.deviceId,
+            capability: DEVICE_MEMBER_CAPABILITY,
+            scope: { kind: "room", path: userGroupPath(user.deviceId) },
+            expires: EXPIRES_MS,
+        });
+        if (!verdict1.ok)
+            throw new Error(`mint failed: ${verdict1.reason}`);
+        const verdict = await verifyDeviceMembership(verdict1.token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("wrong_scope_kind");
+    });
+    it("refuses a token bearing a different device than the authenticated connection", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const impostorDevice = await generateEs256Identity();
+        const token = await mintDeviceMemberToken(user, device, userGroupPath(user.deviceId));
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation: createRevocationView(),
+            expectedBearer: impostorDevice.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("bearer_mismatch");
+    });
+    it("refuses an expired token", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const token = await mintDeviceMemberToken(user, device, userGroupPath(user.deviceId));
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(EXPIRES_MS + HOUR_MS),
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("expired");
+    });
+    it("refuses a revoked token", async () => {
+        const user = await generateEs256Identity();
+        const device = await generateEs256Identity();
+        const tokenId = nextTokenId();
+        const token = await mintDeviceMemberToken(user, device, userGroupPath(user.deviceId), tokenId);
+        const revocation = createRevocationView();
+        const entry = await mintRevocationEntry({
+            identity: user,
+            tokenId,
+            revokedAt: NOW_MS,
+        });
+        await revocation.record(entry, { identity: user });
+        const verdict = await verifyDeviceMembership(token, {
+            identity: user,
+            clock: fixedClock(NOW_MS),
+            revocation,
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("revoked");
+    });
+});
+//# sourceMappingURL=device-membership-verification.test.js.map

package/dist/test/device-membership-verification.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-membership-verification.test.js","sourceRoot":"","sources":["../../src/test/device-membership-verification.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAI7E,OAAO,EACL,wBAAwB,EACxB,aAAa,EACb,sBAAsB,GACvB,MAAM,2CAA2C,CAAC;AAEnD,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC;AACjB,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,SAAS,GAAG,CAAC,KAAqC;IAChD,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,WAAW,CAChD,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,EAAE,QAAQ,CAAC,CACnB,CAAC;IACF,MAAM,cAAc,GAAG,IAAI,UAAU,CACnC,MAAM,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,CAC3D,CAAC;IACF,OAAO,kBAAkB,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7B,CAAC;AAED,IAAI,cAAc,GAAG,CAAC,CAAC;AACvB,SAAS,WAAW;IAClB,cAAc,IAAI,CAAC,CAAC;IACpB,OAAO,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,MAAM,GAAG,iBAAiB,CAAC;AACjC,MAAM,UAAU,GAAG,MAAM,GAAG,OAAO,CAAC;AAEpC,KAAK,UAAU,qBAAqB,CAClC,MAAoB,EACpB,MAAoB,EACpB,SAAiB,EACjB,UAAmC,WAAW,EAAE;IAEhD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;QACzB,OAAO;QACP,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,UAAU,EAAE,wBAAwB;QACpC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;QACzC,OAAO,EAAE,UAAU;QACnB,oBAAoB,EAAE,CAAC;KACxB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,OAAO,OAAO,CAAC,KAAK,CAAC;AACvB,CAAC;AAED,QAAQ,CAAC,0CAA0C,EAAE,GAAG,EAAE;IACxD,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,wBAAwB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,6EAA6E,EAAE,KAAK,IAAI,EAAE;QAC3F,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEnE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACjE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,uIAAuI;QACvI,MAAM,KAAK,GAAG,MAAM,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QAEvE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,SAAS,CAAC,QAAQ,CAAC,CAClC,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,WAAW,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,UAAU,EAAE,UAAU;YACtB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE;YACzC,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE;YAC3D,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC;YACzC,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,WAAW,EAAE;YACtB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,UAAU,EAAE,wBAAwB;YACpC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;YAC3D,OAAO,EAAE,UAAU;SACpB,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAErE,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,QAAQ,CAAC,KAAK,EAAE;YAC3D,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,MAAM,qBAAqB,EAAE,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,cAAc,CAAC,QAAQ;YACvC,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0BAA0B,EAAE,KAAK,IAAI,EAAE;QACxC,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC7B,CAAC;QAEF,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC;YACvC,UAAU,EAAE,oBAAoB,EAAE;YAClC,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,KAAK,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,qBAAqB,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,MAAM,qBAAqB,CACvC,IAAI,EACJ,MAAM,EACN,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAC5B,OAAO,CACR,CAAC;QAEF,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,MAAM,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAEnD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;YAClD,QAAQ,EAAE,IAAI;YACd,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;YACzB,UAAU;YACV,cAAc,EAAE,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,QAAQ;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,EAAE;YAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/test/device-membership.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=device-membership.test.d.ts.map

package/dist/test/device-membership.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-membership.test.d.ts","sourceRoot":"","sources":["../../src/test/device-membership.test.ts"],"names":[],"mappings":""}

package/dist/test/device-membership.test.js

@@ -0,0 +1,201 @@
+/**
+ * Unit tests for core/device-membership: admitDevice (mint + issued-grant bookkeeping) and removeDevice (revoke + forget the issued-grant record), the mint/revoke half of agent-comms#161 -- verifyDeviceMembership itself is covered separately in device-membership-verification.test.ts.
+ */
+import * as fs from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { describe, it, expect } from "vitest";
+import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
+import { createSystemClock } from "wire-mesh-core/adapters/system-clock";
+import { createRevocationView } from "wire-mesh-core/domain/revocation-view";
+import { generateIdentity } from "../core/identity.js";
+import { toIdentityPort } from "../core/wire-mesh-identity.js";
+import { randomId } from "../core/random-id.js";
+import { loadIssuedDeviceGrant, loadOrCreateUserIdentity, } from "../core/user-identity.js";
+import { admitDevice, removeDevice } from "../core/device-membership.js";
+import { DEVICE_MEMBER_CAPABILITY, userGroupPath, verifyDeviceMembership, } from "../core/device-membership-verification.js";
+const TOKEN_TTL_MS = 60_000;
+function tempDir() {
+    return fs.mkdtempSync(path.join(tmpdir(), "agent-comms-device-membership-test-"));
+}
+/** A real, persisted user-principal identity (not a bare in-memory keypair): admitDevice/removeDevice write through to the same user-identity.json this identity's own key material lives in, so the fixture must actually create that file first, the same way a real bridge process would via loadOrCreateUserIdentity. */
+async function makeUser() {
+    const dir = tempDir();
+    const identity = await toIdentityPort(loadOrCreateUserIdentity({ dir }));
+    return { identity, userIdentityOptions: { dir } };
+}
+describe("admitDevice", () => {
+    it("mints a group:member token bearing the device, rooted at the user principal", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const verdict = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        expect(verdict.ok, `expected mint to succeed, got ${JSON.stringify(verdict)}`).toBe(true);
+        if (!verdict.ok)
+            return;
+        const memberVerdict = await verifyDeviceMembership(verdict.token, {
+            identity: user,
+            clock,
+            revocation: createRevocationView(),
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(memberVerdict.ok).toBe(true);
+    });
+    it("records the issued grant's token-id under the user principal's own store, keyed by device hex", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const tokenId = randomId();
+        const verdict = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId,
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        expect(verdict.ok).toBe(true);
+        const deviceHex = deviceIdToHex(device.deviceId);
+        expect(loadIssuedDeviceGrant(userIdentityOptions, deviceHex)).toEqual(tokenId);
+    });
+    it("does not record an issued grant when the mint itself refuses", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const verdict = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            // Already expired -- mintCapabilityToken refuses outright.
+            expires: clock.now() - 1,
+        });
+        expect(verdict.ok).toBe(false);
+        const deviceHex = deviceIdToHex(device.deviceId);
+        expect(loadIssuedDeviceGrant(userIdentityOptions, deviceHex)).toBeUndefined();
+    });
+});
+describe("removeDevice", () => {
+    it("does nothing and returns undefined when this principal never admitted the device", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const entry = await removeDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            revocation: createRevocationView(),
+            deviceId: device.deviceId,
+        });
+        expect(entry).toBeUndefined();
+    });
+    it("revokes an admitted device's own grant, records it locally, and forgets the issued-grant record", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const admitVerdict = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        if (!admitVerdict.ok)
+            throw new Error("expected admission to succeed");
+        const revocation = createRevocationView();
+        const entry = await removeDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            revocation,
+            deviceId: device.deviceId,
+        });
+        expect(entry).not.toBeUndefined();
+        const deviceHex = deviceIdToHex(device.deviceId);
+        expect(loadIssuedDeviceGrant(userIdentityOptions, deviceHex)).toBeUndefined();
+        const verdict = await verifyDeviceMembership(admitVerdict.token, {
+            identity: user,
+            clock,
+            revocation,
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(false);
+        if (!verdict.ok)
+            expect(verdict.reason).toBe("revoked");
+    });
+    it("re-admitting after removal mints and records a genuinely fresh grant", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const first = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        if (!first.ok)
+            throw new Error("expected first admission to succeed");
+        const revocation = createRevocationView();
+        await removeDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            revocation,
+            deviceId: device.deviceId,
+        });
+        const second = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        if (!second.ok)
+            throw new Error("expected re-admission to succeed");
+        const verdict = await verifyDeviceMembership(second.token, {
+            identity: user,
+            clock,
+            revocation,
+            expectedBearer: device.deviceId,
+            userDeviceId: user.deviceId,
+        });
+        expect(verdict.ok).toBe(true);
+    });
+});
+describe("userGroupPath / DEVICE_MEMBER_CAPABILITY re-exports", () => {
+    it("are usable together to compute the scope a real admission grant carries", async () => {
+        const { identity: user, userIdentityOptions } = await makeUser();
+        const device = await toIdentityPort(generateIdentity());
+        const clock = createSystemClock();
+        const verdict = await admitDevice({
+            userIdentity: user,
+            userIdentityOptions,
+            clock,
+            tokenId: randomId(),
+            deviceId: device.deviceId,
+            expires: clock.now() + TOKEN_TTL_MS,
+        });
+        if (!verdict.ok)
+            throw new Error("expected admission to succeed");
+        const [, , payload] = verdict.token;
+        expect(payload).not.toBeNull();
+        // The token's own scope is not re-decoded here (that is verifyDeviceMembership's job, exercised above); this asserts admitDevice used the module's own exported helpers rather than a second, independently-typed copy of the same capability/scope shape.
+        expect(DEVICE_MEMBER_CAPABILITY).toBe("group:member");
+        expect(userGroupPath(user.deviceId)).toBe(deviceIdToHex(user.deviceId));
+    });
+});
+//# sourceMappingURL=device-membership.test.js.map