agent-comms 5.2.5 → 7.0.0

package/dist/core/hub-forwarding.d.ts

@@ -1,16 +1,10 @@
 /**
- * hub-forwarding -- agent-comms#155's gateway forwarding, split from wire-mesh-transport.ts under the repo's max-lines cap. Outbound: filters a directory of gossiped local devices down to the ones eligible for cross-machine advertisement (an agent/self-bearing entry, meaning only ever a "visible" agent -- see AGENT_SELF_GOSSIP_KEY's own doc for why no separate visibility check is needed here) and pushes them onto a connected HubSession, best-effort. Local-to-remote routing: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
+ * hub-forwarding -- local-to-remote routing, split from wire-mesh-transport.ts under the repo's max-lines cap: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
  */
-import type { CapabilityScope, CapabilityToken, ManageCommand, PeerAdvert } from "wire-mesh-core/generated/protocol";
-import type { AcceptedMeshSession, DirectoryEntry, ManageOutcome } from "wire-mesh-core/domain/mesh-session";
+import type { CapabilityScope, CapabilityToken, ManageCommand } from "wire-mesh-core/generated/protocol";
+import type { ManageOutcome } from "wire-mesh-core/domain/mesh-session";
 import type { HubSession } from "./hub-session.js";
-/** Forwards every directory entry carrying an agent/self extension onto hub, if hub currently holds a live connection AND at least one remote gateway is currently trusted -- a no-op otherwise. The trust gate (agent-comms#156, GatewayTrust.hasAny's own doc) is coarse by necessity: wire-mesh-core's relay-hub broadcasts a gossip frame to every connected peer with no per-recipient targeting, so "advertise only to allowlisted remote gateways" can only be approximated as "advertise nothing at all until the operator has trusted someone" -- it is not a per-recipient filter. Called both from WireMeshTransport's own watchForDisconnect (as each local peer session's directory changes) and from connectHub's own initial catch-up push, so this side's already-known local devices reach the hub immediately on taking over the gateway role rather than waiting for their own next periodic gossip tick. Forwards unconditionally on every call once past the gates above (no caching or dedup against a previous call), mirroring relay-hub.ts's own "forward every gossip frame, as received" philosophy: an advert's own snapshot-seconds/addresses are meant to keep propagating as a liveness heartbeat, so suppressing a "duplicate" would silently stop legitimate freshness updates from reaching remote gateways. A forward that fails is reported via onError and swallowed, matching every other best-effort gossip send in this codebase. */
-export declare function forwardAdvertsToHub(hub: Readonly<Pick<HubSession, "isConnected" | "advertiseDevices">>, directory: readonly DirectoryEntry[], onError: ((error: Error) => void) | undefined, hasAnyTrustedGateway: () => boolean): void;
-/** Catches the hub up with every local device already known at the moment this side becomes the gateway (connectHub's own trailing call, right after hub.connect resolves) -- without this, a device whose own last gossip arrived before this coordinator took over the gateway role would never be (re-)advertised until its own next periodic gossip tick (hub-side state is rebuilt from scratch on every takeover, per coordinator-gateway.ts's own class doc). Reuses forwardAdvertsToHub's own eligibility filter and trust gate, so only ever a visible, agent/self-bearing device is pushed, and only once a remote gateway is trusted, exactly as an ordinary directory-change forward would. */
-export declare function pushHubCatchUp(hub: Readonly<Pick<HubSession, "isConnected" | "advertiseDevices" | "peers">>, knownDevices: ReadonlyMap<string, Readonly<PeerAdvert>>, onError: ((error: Error) => void) | undefined, hasAnyTrustedGateway: () => boolean): void;
-/** Builds a forwardToLocalPeer callback closing over peerSessions -- a factory rather than a plain function taking peerSessions as its own first parameter, so the returned callback's shape matches HubSessionDeps.forwardToLocalPeer's own fixed external contract exactly (deviceHex, command, scope, token?) with no positional-binding tricks needed at the call site. Sends a room-domain manage-request to a LOCAL peer session only, never falling back to hub routing -- HubSession's own toDevice-forwarding leg (agent-comms#184: a hub-relayed request explicitly addressed to a non-gateway local peer this gateway also fronts). Returns undefined when no local session exists for that device-id, in which case HubSession falls back to dispatching the request against this gateway's own local state instead. */
-export declare function makeSendToLocalPeer(peerSessions: ReadonlyMap<string, Readonly<Pick<AcceptedMeshSession, "sendManageRequest">>>): (memberId: string, command: ManageCommand, scope: Readonly<CapabilityScope>, token?: CapabilityToken) => Promise<ManageOutcome> | undefined;
-/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only via this machine's gateway connection (agent-comms#155's local-to-remote leg). WireMeshTransport.sendRoomRequest itself gates memberId against the gateway trust boundary (agent-comms#156) before ever calling this, so by the time this runs memberId is already known-trusted -- this function stays focused on the hub-connectivity outcome alone. Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side isn't currently the gateway. */
+/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only through the hub this store is connected to (agent-comms#155's local-to-remote leg). WireMeshTransport.sendRoomRequest itself gates memberId against the gateway trust boundary (agent-comms#156) before ever calling this, so by the time this runs memberId is already known-trusted -- this function stays focused on the hub-connectivity outcome alone. Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side holds no hub session, which is a store that has no agent yet, has a ghost agent, or whose machine trusts nobody. */
 export declare function routeRoomRequestViaHub(options: {
     hub: Readonly<Pick<HubSession, "isConnected" | "sendRoomRequest">>;
     memberId: string;
@@ -18,12 +12,4 @@ export declare function routeRoomRequestViaHub(options: {
     scope: Readonly<CapabilityScope>;
     token?: CapabilityToken | undefined;
 }): Promise<ManageOutcome>;
-/** Dials the hub and immediately pushes a catch-up of every already-known local device onto it (agent-comms#154's own hub-connection-establishment sequence, kept together here rather than split across two call-site statements in WireMeshTransport.connectHub) -- without the trailing catch-up, a device whose own last gossip arrived before this coordinator took over the gateway role would stay invisible on the hub until its own next periodic gossip tick. */
-export declare function connectHubGateway(options: {
-    hub: Readonly<Pick<HubSession, "isConnected" | "advertiseDevices" | "connect" | "peers">>;
-    url: string;
-    knownDevices: ReadonlyMap<string, Readonly<PeerAdvert>>;
-    onError: ((error: Error) => void) | undefined;
-    hasAnyTrustedGateway: () => boolean;
-}): Promise<void>;
 //# sourceMappingURL=hub-forwarding.d.ts.map

package/dist/core/hub-forwarding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hub-forwarding.d.ts","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACb,UAAU,EACX,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACd,aAAa,EACd,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD,64CAA64C;AAC74C,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,kBAAkB,CAAC,CAAC,EACnE,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAC7C,oBAAoB,EAAE,MAAM,OAAO,GAClC,IAAI,CAUN;AAED,2qBAA2qB;AAC3qB,wBAAgB,cAAc,CAC5B,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,kBAAkB,GAAG,OAAO,CAAC,CAAC,EAC7E,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,EACvD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,EAC7C,oBAAoB,EAAE,MAAM,OAAO,GAClC,IAAI,CAON;AAED,oyBAAoyB;AACpyB,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,WAAW,CACvB,MAAM,EACN,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC,CACzD,GACA,CACD,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,KACpB,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAYtC;AAED,otBAAotB;AACptB,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,aAAa,CAAC,CAIzB;AAED,2cAA2c;AAC3c,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,GAAG,EAAE,QAAQ,CACX,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,kBAAkB,GAAG,SAAS,GAAG,OAAO,CAAC,CAC3E,CAAC;IACF,GAAG,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,oBAAoB,EAAE,MAAM,OAAO,CAAC;CACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhB"}
+{"version":3,"file":"hub-forwarding.d.ts","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,6yBAA6yB;AAC7yB,wBAAsB,sBAAsB,CAAC,OAAO,EAAE;IACpD,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACnE,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,aAAa,CAAC;IACvB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,eAAe,GAAG,SAAS,CAAC;CACrC,GAAG,OAAO,CAAC,aAAa,CAAC,CAIzB"}

package/dist/core/hub-forwarding.js

@@ -1,50 +1,11 @@
 /**
- * hub-forwarding -- agent-comms#155's gateway forwarding, split from wire-mesh-transport.ts under the repo's max-lines cap. Outbound: filters a directory of gossiped local devices down to the ones eligible for cross-machine advertisement (an agent/self-bearing entry, meaning only ever a "visible" agent -- see AGENT_SELF_GOSSIP_KEY's own doc for why no separate visibility check is needed here) and pushes them onto a connected HubSession, best-effort. Local-to-remote routing: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
+ * hub-forwarding -- local-to-remote routing, split from wire-mesh-transport.ts under the repo's max-lines cap: falls a room-domain request back through the hub's own relay-connect/relay-data pairing when its target isn't a local peer session.
  */
-import { AGENT_SELF_GOSSIP_KEY } from "./gossip-extensions.js";
-/** Forwards every directory entry carrying an agent/self extension onto hub, if hub currently holds a live connection AND at least one remote gateway is currently trusted -- a no-op otherwise. The trust gate (agent-comms#156, GatewayTrust.hasAny's own doc) is coarse by necessity: wire-mesh-core's relay-hub broadcasts a gossip frame to every connected peer with no per-recipient targeting, so "advertise only to allowlisted remote gateways" can only be approximated as "advertise nothing at all until the operator has trusted someone" -- it is not a per-recipient filter. Called both from WireMeshTransport's own watchForDisconnect (as each local peer session's directory changes) and from connectHub's own initial catch-up push, so this side's already-known local devices reach the hub immediately on taking over the gateway role rather than waiting for their own next periodic gossip tick. Forwards unconditionally on every call once past the gates above (no caching or dedup against a previous call), mirroring relay-hub.ts's own "forward every gossip frame, as received" philosophy: an advert's own snapshot-seconds/addresses are meant to keep propagating as a liveness heartbeat, so suppressing a "duplicate" would silently stop legitimate freshness updates from reaching remote gateways. A forward that fails is reported via onError and swallowed, matching every other best-effort gossip send in this codebase. */
-export function forwardAdvertsToHub(hub, directory, onError, hasAnyTrustedGateway) {
-    if (!hub.isConnected)
-        return;
-    if (!hasAnyTrustedGateway())
-        return;
-    const eligible = directory.filter((entry) => entry.advert[AGENT_SELF_GOSSIP_KEY] !== undefined);
-    if (eligible.length === 0)
-        return;
-    hub.advertiseDevices(eligible).catch((error) => {
-        onError?.(error instanceof Error ? error : new Error(String(error)));
-    });
-}
-/** Catches the hub up with every local device already known at the moment this side becomes the gateway (connectHub's own trailing call, right after hub.connect resolves) -- without this, a device whose own last gossip arrived before this coordinator took over the gateway role would never be (re-)advertised until its own next periodic gossip tick (hub-side state is rebuilt from scratch on every takeover, per coordinator-gateway.ts's own class doc). Reuses forwardAdvertsToHub's own eligibility filter and trust gate, so only ever a visible, agent/self-bearing device is pushed, and only once a remote gateway is trusted, exactly as an ordinary directory-change forward would. */
-export function pushHubCatchUp(hub, knownDevices, onError, hasAnyTrustedGateway) {
-    // knownDevices also holds every remote device learned from this same hub, and the hub already has those adverts from their own senders. Handing one back would register it against this gateway's connection if it were ever fresher than the hub's copy, and is otherwise dropped by the hub's freshness rule, so only the devices this side fronts are advertised.
-    const learnedFromHub = new Set(hub.peers());
-    const catchUp = [...knownDevices.entries()]
-        .filter(([deviceHex]) => !learnedFromHub.has(deviceHex))
-        .map(([, advert]) => ({ device: advert.device, advert }));
-    forwardAdvertsToHub(hub, catchUp, onError, hasAnyTrustedGateway);
-}
-/** Builds a forwardToLocalPeer callback closing over peerSessions -- a factory rather than a plain function taking peerSessions as its own first parameter, so the returned callback's shape matches HubSessionDeps.forwardToLocalPeer's own fixed external contract exactly (deviceHex, command, scope, token?) with no positional-binding tricks needed at the call site. Sends a room-domain manage-request to a LOCAL peer session only, never falling back to hub routing -- HubSession's own toDevice-forwarding leg (agent-comms#184: a hub-relayed request explicitly addressed to a non-gateway local peer this gateway also fronts). Returns undefined when no local session exists for that device-id, in which case HubSession falls back to dispatching the request against this gateway's own local state instead. */
-export function makeSendToLocalPeer(peerSessions) {
-    // Deliberately not `async`: the "no local session" signal is a synchronous `undefined` (HubSession branches on `forwarded !== undefined` to decide whether to fall back to local dispatch), and an async wrapper would turn it into a Promise that is always defined.
-    return (memberId, command, scope, token) => {
-        const session = peerSessions.get(memberId);
-        if (session === undefined)
-            return undefined;
-        return session.sendManageRequest(command, scope, undefined, token);
-    };
-}
-/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only via this machine's gateway connection (agent-comms#155's local-to-remote leg). WireMeshTransport.sendRoomRequest itself gates memberId against the gateway trust boundary (agent-comms#156) before ever calling this, so by the time this runs memberId is already known-trusted -- this function stays focused on the hub-connectivity outcome alone. Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side isn't currently the gateway. */
+/** Routes a room-domain request through the hub's relay-connect/relay-data pairing when memberId isn't a local peer session -- WireMeshTransport.sendRoomRequest's own fallback, since the member may be a remote agent reachable only through the hub this store is connected to (agent-comms#155's local-to-remote leg). WireMeshTransport.sendRoomRequest itself gates memberId against the gateway trust boundary (agent-comms#156) before ever calling this, so by the time this runs memberId is already known-trusted -- this function stays focused on the hub-connectivity outcome alone. Resolves the same not_connected outcome sendRoomRequest already returned before the hub existed at all when this side holds no hub session, which is a store that has no agent yet, has a ghost agent, or whose machine trusts nobody. */
 export async function routeRoomRequestViaHub(options) {
     const { hub, memberId, command, scope, token } = options;
     if (!hub.isConnected)
         return { result: "error", code: "not_connected" };
     return hub.sendRoomRequest(memberId, command, scope, token);
 }
-/** Dials the hub and immediately pushes a catch-up of every already-known local device onto it (agent-comms#154's own hub-connection-establishment sequence, kept together here rather than split across two call-site statements in WireMeshTransport.connectHub) -- without the trailing catch-up, a device whose own last gossip arrived before this coordinator took over the gateway role would stay invisible on the hub until its own next periodic gossip tick. */
-export async function connectHubGateway(options) {
-    const { hub, url, knownDevices, onError, hasAnyTrustedGateway } = options;
-    await hub.connect(url);
-    pushHubCatchUp(hub, knownDevices, onError, hasAnyTrustedGateway);
-}
 //# sourceMappingURL=hub-forwarding.js.map

package/dist/core/hub-forwarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"hub-forwarding.js","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAcH,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,64CAA64C;AAC74C,MAAM,UAAU,mBAAmB,CACjC,GAAmE,EACnE,SAAoC,EACpC,OAA6C,EAC7C,oBAAmC;IAEnC,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO;IAC7B,IAAI,CAAC,oBAAoB,EAAE;QAAE,OAAO;IACpC,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAC/B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,SAAS,CAC7D,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAClC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACtD,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2qBAA2qB;AAC3qB,MAAM,UAAU,cAAc,CAC5B,GAA6E,EAC7E,YAAuD,EACvD,OAA6C,EAC7C,oBAAmC;IAEnC,qWAAqW;IACrW,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,GAAG,YAAY,CAAC,OAAO,EAAE,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SACvD,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5D,mBAAmB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACnE,CAAC;AAED,oyBAAoyB;AACpyB,MAAM,UAAU,mBAAmB,CACjC,YAGC;IAOD,sQAAsQ;IACtQ,OAAO,CACL,QAAQ,EACR,OAAO,EACP,KAAK,EACL,KAAK,EAC+B,EAAE;QACtC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC5C,OAAO,OAAO,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC,CAAC;AACJ,CAAC;AAED,otBAAotB;AACptB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAM5C;IACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACxE,OAAO,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC;AAED,2cAA2c;AAC3c,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAQvC;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,EAAE,GAAG,OAAO,CAAC;IAC1E,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"hub-forwarding.js","sourceRoot":"","sources":["../../src/core/hub-forwarding.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,6yBAA6yB;AAC7yB,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAM5C;IACC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC;IACzD,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACxE,OAAO,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC9D,CAAC"}

package/dist/core/hub-link.d.ts

@@ -0,0 +1,58 @@
+/**
+ * HubLink keeps one store's own session on the relay hub alive while the store should have one: it dials in the background, waits for the session to end, and dials again after a delay that doubles up to a ceiling while the hub stays unreachable. Every store owns one (agent-comms#293), because reachability from another machine has to belong to the device itself and not to whichever store on the machine happens to hold the local coordinator role.
+ *
+ * The store decides through shouldConnect whether it wants a session at all, and a change of mind, made in this process or by another one editing the shared trust file, is picked up within a poll interval, or at once through reconsider(). A store with nothing to say to another machine (nothing trusted, no agent, or a ghost agent) holds no session, so it puts nothing on the hub, not even its device id.
+ *
+ * The dial never blocks the caller: a bridge starting up offline must not wait out a connect timeout before it can serve its tools, and a hub that is down or restarting is an ordinary, recoverable state. Failures reach onError and the loop carries on.
+ */
+import type { HubSession } from "./hub-session.js";
+/** Delay before the first redial after a failed dial or a lost session. */
+export declare const HUB_RECONNECT_INITIAL_DELAY_MS = 1000;
+/** Ceiling the redial delay doubles up to while the hub stays unreachable, so an outage is retried about once a minute rather than backing off without bound. */
+export declare const HUB_RECONNECT_MAX_DELAY_MS = 60000;
+/** How often a link re-evaluates shouldConnect while it has nothing to react to: a store that wants no session notices it now wants one, and a store holding one notices it no longer should, without anyone calling reconsider(). Bounds how long a trust change made by another process on the machine takes to show. */
+export declare const HUB_LINK_POLL_INTERVAL_MS = 5000;
+/** The parts of a HubSession a HubLink drives. */
+export type HubLinkSession = Pick<HubSession, "connect" | "disconnect" | "isConnected" | "whenDisconnected">;
+export interface HubLinkOptions {
+    hub: Readonly<HubLinkSession>;
+    /** The hub to hold a session on. */
+    url: string;
+    /** Whether the store wants a hub session right now. Read every poll interval and on reconsider(); a session held when this turns false is dropped, and none is dialled while it is false. */
+    shouldConnect: () => boolean;
+    /** Called each time a session is established, after the dial resolves. WireMeshTransport uses it to advertise this store's presence at once instead of waiting for the next presence tick. */
+    onConnected: () => void;
+    /** Reports a failed dial. Never called for anything else. */
+    onError: (error: Error) => void;
+    /** Overrides HUB_RECONNECT_INITIAL_DELAY_MS, for a test that must not wait a second per redial. */
+    initialDelayMs?: number;
+    /** Overrides HUB_RECONNECT_MAX_DELAY_MS. */
+    maxDelayMs?: number;
+    /** Overrides HUB_LINK_POLL_INTERVAL_MS. */
+    pollIntervalMs?: number;
+}
+export declare class HubLink {
+    private readonly options;
+    private readonly initialDelayMs;
+    private readonly maxDelayMs;
+    private readonly pollIntervalMs;
+    private stopped;
+    private running;
+    /** Cancels the wait between dials, so stop() does not sit out a delay. */
+    private wake;
+    constructor(options: Readonly<HubLinkOptions>);
+    /** Begins running in the background and returns at once. A second call while running does nothing. */
+    start(): void;
+    /** Re-evaluates shouldConnect now instead of at the next poll, and cuts short any wait, including the delay before a redial. Call it when something shouldConnect reads has changed. */
+    reconsider(): void;
+    /** Stops, drops the live session, and resolves once the loop has ended. */
+    stop(): Promise<void>;
+    /** A method call rather than a direct property read, so TypeScript's control-flow narrowing does not treat the flag as staying false across the awaits in run(), during which stop() can set it. */
+    private isStopped;
+    private run;
+    /** Holds the live session until the hub ends it, resolving true, or until the store stops wanting it, when it drops the session itself and resolves false. */
+    private holdWhileWanted;
+    /** Waits ms, or until reconsider() or stop() cuts it short. Each wait clears the wake handle only if it is still its own, since holdWhileWanted leaves a losing wait pending and its late end must not wipe the handle of the wait that replaced it. */
+    private sleep;
+}
+//# sourceMappingURL=hub-link.d.ts.map

package/dist/core/hub-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-link.d.ts","sourceRoot":"","sources":["../../src/core/hub-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,2EAA2E;AAC3E,eAAO,MAAM,8BAA8B,OAAO,CAAC;AAEnD,iKAAiK;AACjK,eAAO,MAAM,0BAA0B,QAAS,CAAC;AAEjD,2TAA2T;AAC3T,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAK9C,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,IAAI,CAC/B,UAAU,EACV,SAAS,GAAG,YAAY,GAAG,aAAa,GAAG,kBAAkB,CAC9D,CAAC;AAEF,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,QAAQ,CAAC,cAAc,CAAC,CAAC;IAC9B,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,6LAA6L;IAC7L,aAAa,EAAE,MAAM,OAAO,CAAC;IAC7B,8LAA8L;IAC9L,WAAW,EAAE,MAAM,IAAI,CAAC;IACxB,6DAA6D;IAC7D,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IAChC,mGAAmG;IACnG,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,qBAAa,OAAO;IASN,OAAO,CAAC,QAAQ,CAAC,OAAO;IARpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,OAAO,CAA4B;IAC3C,0EAA0E;IAC1E,OAAO,CAAC,IAAI,CAA2B;gBAEV,OAAO,EAAE,QAAQ,CAAC,cAAc,CAAC;IAO9D,sGAAsG;IACtG,KAAK,IAAI,IAAI;IAKb,wLAAwL;IACxL,UAAU,IAAI,IAAI;IAIlB,2EAA2E;IACrE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAO3B,oMAAoM;IACpM,OAAO,CAAC,SAAS;YAIH,GAAG;IA+BjB,8JAA8J;YAChJ,eAAe;IAmB7B,wPAAwP;YAC1O,KAAK;CAapB"}

package/dist/core/hub-link.js

@@ -0,0 +1,118 @@
+/**
+ * HubLink keeps one store's own session on the relay hub alive while the store should have one: it dials in the background, waits for the session to end, and dials again after a delay that doubles up to a ceiling while the hub stays unreachable. Every store owns one (agent-comms#293), because reachability from another machine has to belong to the device itself and not to whichever store on the machine happens to hold the local coordinator role.
+ *
+ * The store decides through shouldConnect whether it wants a session at all, and a change of mind, made in this process or by another one editing the shared trust file, is picked up within a poll interval, or at once through reconsider(). A store with nothing to say to another machine (nothing trusted, no agent, or a ghost agent) holds no session, so it puts nothing on the hub, not even its device id.
+ *
+ * The dial never blocks the caller: a bridge starting up offline must not wait out a connect timeout before it can serve its tools, and a hub that is down or restarting is an ordinary, recoverable state. Failures reach onError and the loop carries on.
+ */
+/** Delay before the first redial after a failed dial or a lost session. */
+export const HUB_RECONNECT_INITIAL_DELAY_MS = 1000;
+/** Ceiling the redial delay doubles up to while the hub stays unreachable, so an outage is retried about once a minute rather than backing off without bound. */
+export const HUB_RECONNECT_MAX_DELAY_MS = 60_000;
+/** How often a link re-evaluates shouldConnect while it has nothing to react to: a store that wants no session notices it now wants one, and a store holding one notices it no longer should, without anyone calling reconsider(). Bounds how long a trust change made by another process on the machine takes to show. */
+export const HUB_LINK_POLL_INTERVAL_MS = 5000;
+/** Factor the redial delay grows by after each failed dial. */
+const RECONNECT_DELAY_GROWTH_FACTOR = 2;
+export class HubLink {
+    options;
+    initialDelayMs;
+    maxDelayMs;
+    pollIntervalMs;
+    stopped = false;
+    running;
+    /** Cancels the wait between dials, so stop() does not sit out a delay. */
+    wake;
+    constructor(options) {
+        this.options = options;
+        this.initialDelayMs =
+            options.initialDelayMs ?? HUB_RECONNECT_INITIAL_DELAY_MS;
+        this.maxDelayMs = options.maxDelayMs ?? HUB_RECONNECT_MAX_DELAY_MS;
+        this.pollIntervalMs = options.pollIntervalMs ?? HUB_LINK_POLL_INTERVAL_MS;
+    }
+    /** Begins running in the background and returns at once. A second call while running does nothing. */
+    start() {
+        if (this.running !== undefined || this.stopped)
+            return;
+        this.running = this.run();
+    }
+    /** Re-evaluates shouldConnect now instead of at the next poll, and cuts short any wait, including the delay before a redial. Call it when something shouldConnect reads has changed. */
+    reconsider() {
+        this.wake?.();
+    }
+    /** Stops, drops the live session, and resolves once the loop has ended. */
+    async stop() {
+        this.stopped = true;
+        this.wake?.();
+        await this.options.hub.disconnect();
+        await this.running;
+    }
+    /** A method call rather than a direct property read, so TypeScript's control-flow narrowing does not treat the flag as staying false across the awaits in run(), during which stop() can set it. */
+    isStopped() {
+        return this.stopped;
+    }
+    async run() {
+        let delayMs = this.initialDelayMs;
+        while (!this.isStopped()) {
+            if (!this.options.shouldConnect()) {
+                await this.sleep(this.pollIntervalMs);
+                continue;
+            }
+            let sessionEnded = false;
+            try {
+                await this.options.hub.connect(this.options.url);
+                if (this.options.hub.isConnected) {
+                    delayMs = this.initialDelayMs;
+                    this.options.onConnected();
+                    sessionEnded = await this.holdWhileWanted();
+                }
+            }
+            catch (error) {
+                this.options.onError(error instanceof Error ? error : new Error(String(error)));
+                sessionEnded = true;
+            }
+            if (this.isStopped())
+                return;
+            if (!sessionEnded)
+                continue;
+            await this.sleep(delayMs);
+            delayMs = Math.min(delayMs * RECONNECT_DELAY_GROWTH_FACTOR, this.maxDelayMs);
+        }
+    }
+    /** Holds the live session until the hub ends it, resolving true, or until the store stops wanting it, when it drops the session itself and resolves false. */
+    async holdWhileWanted() {
+        const hubEnded = this.options.hub
+            .whenDisconnected()
+            .then(() => "ended");
+        while (!this.isStopped()) {
+            const outcome = await Promise.race([
+                hubEnded,
+                this.sleep(this.pollIntervalMs).then(() => "woke"),
+            ]);
+            if (outcome === "ended")
+                return true;
+            if (this.isStopped())
+                return false;
+            if (!this.options.shouldConnect()) {
+                await this.options.hub.disconnect();
+                return false;
+            }
+        }
+        return false;
+    }
+    /** Waits ms, or until reconsider() or stop() cuts it short. Each wait clears the wake handle only if it is still its own, since holdWhileWanted leaves a losing wait pending and its late end must not wipe the handle of the wait that replaced it. */
+    async sleep(ms) {
+        let wakeThis;
+        await new Promise((resolve) => {
+            const timer = setTimeout(resolve, ms);
+            timer.unref();
+            wakeThis = () => {
+                clearTimeout(timer);
+                resolve();
+            };
+            this.wake = wakeThis;
+        });
+        if (this.wake === wakeThis)
+            this.wake = undefined;
+    }
+}
+//# sourceMappingURL=hub-link.js.map

package/dist/core/hub-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hub-link.js","sourceRoot":"","sources":["../../src/core/hub-link.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,2EAA2E;AAC3E,MAAM,CAAC,MAAM,8BAA8B,GAAG,IAAI,CAAC;AAEnD,iKAAiK;AACjK,MAAM,CAAC,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAEjD,2TAA2T;AAC3T,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,+DAA+D;AAC/D,MAAM,6BAA6B,GAAG,CAAC,CAAC;AA0BxC,MAAM,OAAO,OAAO;IASW;IARZ,cAAc,CAAS;IACvB,UAAU,CAAS;IACnB,cAAc,CAAS;IAChC,OAAO,GAAG,KAAK,CAAC;IAChB,OAAO,CAA4B;IAC3C,0EAA0E;IAClE,IAAI,CAA2B;IAEvC,YAA6B,OAAiC;QAAjC,YAAO,GAAP,OAAO,CAA0B;QAC5D,IAAI,CAAC,cAAc;YACjB,OAAO,CAAC,cAAc,IAAI,8BAA8B,CAAC;QAC3D,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,0BAA0B,CAAC;QACnE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,yBAAyB,CAAC;IAC5E,CAAC;IAED,sGAAsG;IACtG,KAAK;QACH,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACvD,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,CAAC;IAED,wLAAwL;IACxL,UAAU;QACR,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IAChB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAI;QACR,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACd,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,oMAAoM;IAC5L,SAAS;QACf,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,GAAG;QACf,IAAI,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;QAClC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,YAAY,GAAG,KAAK,CAAC;YACzB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACjD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;oBACjC,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC;oBAC9B,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;oBAC3B,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC9C,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,OAAO,CAClB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;gBACF,YAAY,GAAG,IAAI,CAAC;YACtB,CAAC;YACD,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO;YAC7B,IAAI,CAAC,YAAY;gBAAE,SAAS;YAC5B,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC1B,OAAO,GAAG,IAAI,CAAC,GAAG,CAChB,OAAO,GAAG,6BAA6B,EACvC,IAAI,CAAC,UAAU,CAChB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,8JAA8J;IACtJ,KAAK,CAAC,eAAe;QAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG;aAC9B,gBAAgB,EAAE;aAClB,IAAI,CAAC,GAAG,EAAE,CAAC,OAAgB,CAAC,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACzB,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjC,QAAQ;gBACR,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,MAAe,CAAC;aAC5D,CAAC,CAAC;YACH,IAAI,OAAO,KAAK,OAAO;gBAAE,OAAO,IAAI,CAAC;YACrC,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,KAAK,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;gBAClC,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpC,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,wPAAwP;IAChP,KAAK,CAAC,KAAK,CAAC,EAAU;QAC5B,IAAI,QAAkC,CAAC;QACvC,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAClC,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACtC,KAAK,CAAC,KAAK,EAAE,CAAC;YACd,QAAQ,GAAG,GAAG,EAAE;gBACd,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC,CAAC;YACF,IAAI,CAAC,IAAI,GAAG,QAAQ,CAAC;QACvB,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;YAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACpD,CAAC;CACF"}

package/dist/core/hub-session.d.ts

@@ -22,6 +22,8 @@ export interface HubSessionDeps {
     onFrame: (connection: Readonly<Connection>, frame: Readonly<Frame>) => void | Promise<void>;
     /** Tracks the session for shutdown -- every session the transport ever creates, always. */
     trackForShutdown: (session: AcceptedMeshSession) => void;
+    /** Stops tracking a session that has ended, so a store that redials the hub for as long as it runs does not accumulate dead sessions the transport would keep gossiping to. */
+    untrack: (session: AcceptedMeshSession) => void;
     /** Fires with every remote (non-self) directory entry the hub's own gossip/catch-up surfaces, every time the session's directory changes (agent-comms#155's own remote-directory-merge leg) -- the transport merges these into its own mesh-wide knownDevices the same way it already merges a local peer session's directory, so a hub-learned agent surfaces in listAgents/getAgent with no separate lookup path. */
     onDirectory: (entries: readonly DirectoryEntry[]) => void;
     /** Dispatches an already-received, non-legacy-frame request (a real core/room verb: room.send, room.notify, room.join, ...) to WireMeshTransport's own roomRouter through its relayed-request entry point, which shares the room-verb dispatch a local peer session's own drainSession uses but never routes a legacy frame -- the outbound half of agent-comms#155's "remote to local" routing leg. Deferred the same lazy-`this`-capture way DeliveryEngine's own sendRoomRequestToMember closure is, since roomRouter is constructed after this class's own instance in WireMeshTransport's constructor. Declared with the identical (request, handle, origin?) shape RoomRouter.handleRequest itself has (agent-comms#216) so WireMeshTransport can keep wiring this dep as a direct method reference rather than a wrapper -- dispatchHubRequest below is what actually supplies a non-empty origin, carrying this side's own dialled hub address. */
@@ -30,17 +32,15 @@ export interface HubSessionDeps {
     isTrusted: (deviceHex: string) => boolean;
     /** Whether a gossiped directory entry may be merged (agent-comms#156, widened by #187 and #266): its device is trusted by id, or is itself a trusted principal's own device (agent-comms#192), or carries a membership proof a trusted principal vouches for. A gossiped advert is self-asserted, so the proof is what makes trusting a principal cover its devices; verifying one is cryptography, hence asynchronous. */
     admitEntries: (entries: readonly DirectoryEntry[]) => Promise<DirectoryEntry[]>;
-    /** Forwards a room-domain manage-request on to a specific LOCAL peer session (one this gateway is directly connected to over the ordinary local mesh, keyed by device-id hex) rather than dispatching it against this gateway's own local state -- consume()'s own toDevice disambiguation (agent-comms#184, wire-mesh-core 1.48.1's IncomingManageRequest.toDevice). Returns undefined when no local session exists for that device-id, in which case consume() falls back to handleRoomRequest exactly as it always has. */
-    forwardToLocalPeer: (deviceHex: string, command: ManageCommand, scope: Readonly<CapabilityScope>, token?: CapabilityToken) => Promise<ManageOutcome> | undefined;
 }
 export declare class HubSession {
     private readonly deps;
     private session;
-    /** The raw connection underlying `session` -- MeshSession's own sendGossipUpdate only ever advertises this side's own single device, so advertising OTHER (local mesh) devices onto the hub (agent-comms#155's outbound leg) needs a raw gossip frame sent directly, bypassing that per-session single-self-advert limit. */
-    private connection;
     /** The URL this side itself dialled to reach the hub -- tracePath's own local.hubAddress (agent-comms#199), the equivalent of wire-mesh-core's own TracePathOptions.localHubAddress. */
     private url;
     private readonly hubPeersKnown;
+    /** Resolvers of every whenDisconnected() call still waiting for the live session to end. */
+    private readonly disconnectWaiters;
     constructor(deps: Readonly<HubSessionDeps>);
     /** This node's own device-id, hex-encoded -- the identifier hub peers address it by. */
     ownDeviceHex(): Promise<string>;
@@ -48,6 +48,10 @@ export declare class HubSession {
     get isConnected(): boolean;
     /** Whether the given session object is this side's own currently-held hub session -- lets WireMeshTransport distinguish the hub's session from an ordinary local-peer session within its own allSessions bookkeeping (agent-comms#156's own readvertiseGossip gate needs this) without this class ever exposing the raw session object itself. */
     ownsSession(session: AcceptedMeshSession): boolean;
+    /** Resolves once no hub session is live: at once when none is, otherwise when the current one ends, whether the hub closed it or disconnect() dropped it. HubLink waits on this to know when to dial again. */
+    whenDisconnected(): Promise<void>;
+    /** Forgets the held session and releases everyone waiting in whenDisconnected(). */
+    private clearSession;
     /** Drops the held hub connection. A no-op if none is live (connect() was never called, disconnect() already ran, or the hub itself already closed the session). */
     disconnect(): Promise<void>;
     /** The device ids (hex) of peers discovered through the hub's gossiped directory. */
@@ -57,36 +61,31 @@ export declare class HubSession {
     /**
      * The single consumer of one hub session's own event stream: merges the hub's directory (its catch-up arrives as the first event, and it is refreshed on every subsequent one) and, once the session ends, drops the held connection so isConnected answers honestly.
      *
-     * Single is the operative word. wire-mesh-core delivers each event to exactly one waiting reader, so two concurrent loops over the same stream split it between them: the closed event reaches whichever of them happened to be waiting first. When that was the directory loop, the connection stayed recorded as live for the rest of the process, and every later advertiseDevices threw on a socket that was already gone -- once per directory change, which is what filled a replacement coordinator's stderr with "connection is closed" after the previous coordinator was killed.
+     * Single is the operative word. wire-mesh-core delivers each event to exactly one waiting reader, so two concurrent loops over the same stream split it between them, and the closed event reaches whichever happened to be waiting first. If that is the directory loop, the connection stays recorded as live for the rest of the process.
      *
      * Every trusted remote entry is surfaced via onDirectory, so the transport can merge it into its own mesh-wide knownDevices (agent-comms#155's remote-directory-merge leg). Filtered to admitEntries (agent-comms#156, widened by agent-comms#187's principal allowlist per agent-comms#192 and by #266's membership proofs) before either hubPeersKnown tracking or onDirectory sees it: an untrusted device's gossiped presence is not merely withheld from listAgents, it is never even recorded as "known" here, so nothing downstream can act on it via any path this class exposes.
      */
     private consumeEvents;
-    /** Consumes one hub session's inbound relayed manage-requests until it ends, dispatching each in arrival order to dispatchHubRequest -- see that function's own doc for the actual per-request trust decision. Split out purely so the decision itself is directly unit-testable against fake requests/deps (hub-session-dispatch.test.ts), the same reason hub-forwarding.ts's own forwardAdvertsToHub/pushHubCatchUp are standalone functions rather than private methods. Passes this.url through as dispatchHubRequest's own hubAddress -- this side's own dialled address for the hub every request on this specific session arrived over (agent-comms#216), the answering-side equivalent of tracePath's own local.hubAddress above. */
+    /** Consumes one hub session's inbound relayed manage-requests until it ends, dispatching each in arrival order to dispatchHubRequest -- see that function's own doc for the actual per-request trust decision. Split out purely so the decision itself is directly unit-testable against fake requests/deps (hub-session-dispatch.test.ts), the same reason hub-forwarding.ts's own routeRoomRequestViaHub is a standalone function rather than a private method. Passes this.url through as dispatchHubRequest's own hubAddress -- this side's own dialled address for the hub every request on this specific session arrived over (agent-comms#216), the answering-side equivalent of tracePath's own local.hubAddress above. */
     private consume;
-    /** Gossips a raw `gossip` frame carrying every given entry's own advert onto the hub, over the raw connection rather than sendGossipUpdate (which can only ever advertise this side's own single device) -- the outbound leg of agent-comms#155's gateway forwarding. relay-hub.ts registers each advert's own `device` field against the CONNECTION it arrives on, so every entry passed here becomes reachable, cross-machine, as "via this gateway" -- callers are responsible for only ever passing entries that are actually meant to be advertised (WireMeshTransport filters to local, visible-agent-bearing entries before calling this). Throws if this side isn't currently connected to a hub, matching sendToPeer's own contract -- callers gate on isConnected first. */
-    advertiseDevices(entries: readonly DirectoryEntry[]): Promise<void>;
     /** Sends a real core/room manage-request to a specific hub-reachable peer, through the hub's relay-connect/relay-data pairing -- the local-to-remote leg of agent-comms#155's routing, mirroring MeshTransport.sendRoomRequest's own not_connected/outcome contract so WireMeshTransport can fall back to this uniformly when memberId isn't a local peer session. Bounded by HUB_ROOM_REQUEST_TIMEOUT_MS (see its own doc) since an unreachable target-device is silently dropped by the hub with no error frame, unlike a local session's own connection-level failure. */
     sendRoomRequest(peerDeviceHex: string, command: ManageCommand, scope: Readonly<CapabilityScope>, token?: CapabilityToken): Promise<ManageOutcome>;
     /** Sends path.trace to a specific hub-reachable peer, through the hub's relay-connect/relay-data pairing -- WireMeshTransport.meshTrace's own hub-relayed fallback (agent-comms#199), mirroring sendRoomRequest's own not_connected contract and HUB_ROOM_REQUEST_TIMEOUT_MS default for the identical reason (an unreachable target-device is silently dropped by the hub, not answered with an error). Delegates the actual send/RTT-measurement/response-parsing to wire-mesh-core's own tracePath, reporting this.url (the address this side itself dialled to reach the hub) as local.hubAddress. */
     tracePath(peerDeviceHex: string, timeoutMs?: number): Promise<MeshTraceResult>;
 }
 /** The slice of HubSessionDeps dispatchHubRequest actually needs. Named so its own tests, and consume()'s call site, don't repeat the same Pick inline. */
-export type HubRequestDispatchDeps = Pick<HubSessionDeps, "isTrusted" | "handleRoomRequest" | "forwardToLocalPeer">;
+export type HubRequestDispatchDeps = Pick<HubSessionDeps, "isTrusted" | "handleRoomRequest">;
 /**
- * Decides what to do with one inbound relayed manage-request, keeping every downstream consumer's handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests) rather than by this gateway, exactly as it already did for the legacy opaque-frame path and now also for a real room-domain verb (agent-comms#155's "remote to local" leg).
+ * Decides what to do with one inbound relayed manage-request, keeping every downstream consumer's handle keyed by the SENDING device (request.fromDevice names it on relay-routed requests) rather than by the hub.
  *
- * A request with no fromDevice at all is refused before anything below sees it. A room-domain verb's own downstream handler (room-router.ts's resolveHandle, then a capability-token check such as verifyRoomToken) calls deviceIdFromHex on whatever handle.id it's given, which throws on anything that isn't valid hex rather than answering with an ordinary unauthorized outcome. Answering unauthorized here, before that, is what keeps this a clean, fast failure for the request's own caller instead of an unhandled rejection that would kill this session's whole drain loop.
+ * A request with no fromDevice at all is refused before anything below sees it. A room-domain verb's own downstream handler (a capability-token check such as verifyRoomToken) calls deviceIdFromHex on whatever handle.id it's given, which throws on anything that isn't valid hex rather than answering with an ordinary unauthorized outcome. Answering unauthorized here, before that, is what keeps this a clean, fast failure for the request's own caller instead of an unhandled rejection that would kill this session's whole drain loop.
  *
  * Only room-domain verbs are accepted over a relay at all. The legacy FRAME_VERB carriage (an opaque MeshMessage, which local peer sessions still use for mesh-state gossip) is refused here with unsupported_verb whoever sent it and whether or not that sender is trusted: a relayed sender has passed neither connect_request approval nor the coordinator's own membership, so it has no business feeding state_sync or state_update into this side's mesh state, and nothing on the relay path has any other use for a bare frame. Refusing the verb wholesale is the allow-list; there is no per-message-type list to keep in step with new MeshMessage variants (agent-comms#169, agent-comms#268). The router's own handleRelayedRequest refuses a frame too, so the local branch below cannot deliver one by construction; the check here is what stops a frame being forwarded on to a local peer session, whose own drain loop would otherwise treat it as an ordinary local frame.
  *
- * A real room-domain verb (room.send, room.join, room.notify, ...) is never gated on isTrusted at all (agent-comms#192): it is independently gated by its own room:member capability token, verified regardless of which transport path it arrived over, and already principal-aware since agent-comms#187 (device-membership-verification.ts's own chain-walk). Stacking the coarse bare-device allowlist in front of that check would be redundant, not protective, and for room.join specifically (the one deliberately ungated verb, whose own security model is a human decision) it would actively defeat the protocol's own intended design by never letting an untrusted device reach that approval step at all. onKnownPeer is still only called here for a sender isTrusted already recognises: reaching this branch has not yet had its own token verified (that happens inside handleRoomRequest/forwardToLocalPeer), so hubPeersKnown stays "gateway-trusted hub peers", never "every device that has sent a syntactically valid room-domain request".
- *
- * Multi-device gateway routing (agent-comms#184, wire-mesh-core 1.48.1's own IncomingManageRequest.toDevice, read directly from each relay-data frame's own to-device field rather than guessed from pairing state): when the request carries a toDevice naming a different device than ownDeviceHex, the command is first re-stamped with an on-behalf-of params field naming the true sender before forwardToLocalPeer forwards it on to that device's own local mesh session (one this gateway is directly connected to, never merely gossiped-about); room-router.ts's own resolveHandle reads that field back out on the receiving end, so the forwarded request is attributed to the true remote sender there, never to this gateway. Its outcome is relayed straight back. Only when forwardToLocalPeer finds no such local session (toDevice is absent, matches ownDeviceHex, or names a device this gateway doesn't actually front) does the request fall through to handleRoomRequest, dispatched against this side's own local mesh state, the same fallback a sender still on a pre-#184 wire-mesh-core (never stamping toDevice at all) already relied on -- and it's exactly that fallback call which carries hubAddress on to handleRoomRequest as origin.relayHubAddress (agent-comms#216), never the forwardToLocalPeer branch: a request forwarded on to a different local device is answered by that device's own session, not this gateway's hub session, so this gateway's own dialled hub address would be the wrong fact to attach to it.
+ * A real room-domain verb (room.send, room.join, room.notify, ...) is never gated on isTrusted at all (agent-comms#192): it is independently gated by its own room:member capability token, verified regardless of which transport path it arrived over, and already principal-aware since agent-comms#187 (device-membership-verification.ts's own chain-walk). Stacking the coarse bare-device allowlist in front of that check would be redundant, not protective, and for room.join specifically (the one deliberately ungated verb, whose own security model is a human decision) it would actively defeat the protocol's own intended design by never letting an untrusted device reach that approval step at all. onKnownPeer is still only called here for a sender isTrusted already recognises: reaching this branch has not yet had its own token verified (that happens inside handleRoomRequest), so hubPeersKnown stays "gateway-trusted hub peers", never "every device that has sent a syntactically valid room-domain request".
  */
 export declare function dispatchHubRequest(options: {
     request: IncomingManageRequest;
-    ownDeviceHex: string;
     deps: Readonly<HubRequestDispatchDeps>;
     onKnownPeer: (deviceHex: string) => void;
     hubAddress?: string | undefined;

package/dist/core/hub-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hub-session.d.ts","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,KAAK,EACL,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,2fAA2f;AAE3f,MAAM,WAAW,cAAc;IAC7B,oIAAoI;IACpI,yBAAyB,EAAE,MAAM,CAAC;IAClC,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClC,yHAAyH;IACzH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,wEAAwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,sIAAsI;IACtI,OAAO,EAAE,CACP,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACzD,uZAAuZ;IACvZ,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;IAC1D,25BAA25B;IAC35B,iBAAiB,EAAE,CACjB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAClC,MAAM,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,oaAAoa;IACpa,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,2ZAA2Z;IAC3Z,YAAY,EAAE,CACZ,OAAO,EAAE,SAAS,cAAc,EAAE,KAC/B,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/B,8fAA8f;IAC9f,kBAAkB,EAAE,CAClB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,KACpB,OAAO,CAAC,aAAa,CAAC,GAAG,SAAS,CAAC;CACzC;AAED,qBAAa,UAAU;IAQT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,OAAO,CAAkC;IACjD,6TAA6T;IAC7T,OAAO,CAAC,UAAU,CAAyB;IAC3C,wLAAwL;IACxL,OAAO,CAAC,GAAG,CAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;gBAEtB,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC;IAE3D,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAKrC,kOAAkO;IAClO,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,kVAAkV;IAClV,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIlD,mKAAmK;IAC7J,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IASjC,qFAAqF;IACrF,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B,wGAAwG;IAClG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BzC;;;;;;OAMG;YACW,aAAa;IA2B3B,8sBAA8sB;IAC9sB,OAAO,CAAC,OAAO;IAiBf,svBAAsvB;IAChvB,gBAAgB,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAWzE,6iBAA6iB;IACviB,eAAe,CACnB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC;IAczB,0kBAA0kB;IACpkB,SAAS,CACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC;CAiB5B;AAUD,2JAA2J;AAC3J,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,cAAc,EACd,WAAW,GAAG,mBAAmB,GAAG,oBAAoB,CACzD,CAAC;AAEF;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACvC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDhB"}
+{"version":3,"file":"hub-session.d.ts","sourceRoot":"","sources":["../../src/core/hub-session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAC1B,KAAK,aAAa,EACnB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,KAAK,EACL,aAAa,EACd,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EACV,gBAAgB,EAChB,eAAe,EACf,eAAe,EAChB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAI1D,2fAA2f;AAE3f,MAAM,WAAW,cAAc;IAC7B,oIAAoI;IACpI,yBAAyB,EAAE,MAAM,CAAC;IAClC,yDAAyD;IACzD,aAAa,EAAE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IAC/C,MAAM,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IAClC,yHAAyH;IACzH,cAAc,EAAE,MAAM,OAAO,CAAC;IAC9B,wEAAwE;IACxE,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,sIAAsI;IACtI,OAAO,EAAE,CACP,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KACnB,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,2FAA2F;IAC3F,gBAAgB,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IACzD,+KAA+K;IAC/K,OAAO,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAChD,uZAAuZ;IACvZ,WAAW,EAAE,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,KAAK,IAAI,CAAC;IAC1D,25BAA25B;IAC35B,iBAAiB,EAAE,CACjB,OAAO,EAAE,qBAAqB,EAC9B,MAAM,EAAE,QAAQ,CAAC,gBAAgB,CAAC,EAClC,MAAM,CAAC,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KACjC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,oaAAoa;IACpa,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC1C,2ZAA2Z;IAC3Z,YAAY,EAAE,CACZ,OAAO,EAAE,SAAS,cAAc,EAAE,KAC/B,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;CAChC;AAED,qBAAa,UAAU;IAQT,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,OAAO,CAAC,OAAO,CAAkC;IACjD,wLAAwL;IACxL,OAAO,CAAC,GAAG,CAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqB;IACnD,4FAA4F;IAC5F,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAsB;gBAE3B,IAAI,EAAE,QAAQ,CAAC,cAAc,CAAC;IAE3D,wFAAwF;IAClF,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC;IAKrC,kOAAkO;IAClO,IAAI,WAAW,IAAI,OAAO,CAEzB;IAED,kVAAkV;IAClV,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO;IAIlD,+MAA+M;IACzM,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;IAOvC,oFAAoF;IACpF,OAAO,CAAC,YAAY;IAOpB,mKAAmK;IAC7J,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAOjC,qFAAqF;IACrF,KAAK,IAAI,SAAS,MAAM,EAAE;IAI1B,wGAAwG;IAClG,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BzC;;;;;;OAMG;YACW,aAAa;IAuB3B,msBAAmsB;IACnsB,OAAO,CAAC,OAAO;IAgBf,6iBAA6iB;IACviB,eAAe,CACnB,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,aAAa,EACtB,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,EAChC,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC,aAAa,CAAC;IAczB,0kBAA0kB;IACpkB,SAAS,CACb,aAAa,EAAE,MAAM,EACrB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC;CAiB5B;AAUD,2JAA2J;AAC3J,MAAM,MAAM,sBAAsB,GAAG,IAAI,CACvC,cAAc,EACd,WAAW,GAAG,mBAAmB,CAClC,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE;IAChD,OAAO,EAAE,qBAAqB,CAAC;IAC/B,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACvC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhB"}