agent-comms 8.4.1 → 8.5.0

package/dist/core/gateway-trust-actions.js

@@ -1,3 +1,21 @@
+/**
+ * CommsTool's gateway-trust action handlers (agent-comms#156, extended by agent-comms#187's principal-keyed allowlist, agent-comms#193's tool-level `principal` flag and agent-comms#343's `machine` flag), split out of tool.ts to keep that file under the repo's max-lines cap, the same reason agent-registry.ts, delivery-engine.ts, and their siblings were split from mesh-store.ts. Free functions over MeshOnlyFeatures's own gateway-trust methods rather than class methods, since CommsTool owns no state of its own for this concern: every one of these is a pure translation from a CommsAction to a CommsResult against whatever store methods are present.
+ */
+import { isDeviceIdHex } from "./room-path.js";
+/** The result for an id named as both a principal and a machine: the two are different kinds of issuer, so one id is at most one of them. */
+function principalOrMachine() {
+    return {
+        content: "Pass principal or machine, not both.",
+        isError: true,
+    };
+}
+/** The result for an id that is not a full device-id. Trusting one would persist an entry that matches no real device, principal or machine, yet still count towards hasAny and so start this side advertising on the hub. */
+function notADeviceId(device) {
+    return {
+        content: `${JSON.stringify(device)} is not a device-id: pass the full 64-character hex id (whoami prints this side's).`,
+        isError: true,
+    };
+}
 /** Uniform "gateway trust isn't available on this store" result, mirroring tool.ts's own notMeshBacked helper for the other MeshOnlyFeatures methods. */
 function gatewayTrustUnavailable() {
     return {
@@ -5,8 +23,23 @@ function gatewayTrustUnavailable() {
         isError: true,
     };
 }
-/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
+/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, as a machine (GatewayTrust.addMachine, agent-comms#343) when action.machine is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
 export function gatewayTrust(store, action) {
+    if (action.principal === true && action.machine === true) {
+        return principalOrMachine();
+    }
+    if (!isDeviceIdHex(action.device.toLowerCase())) {
+        return notADeviceId(action.device);
+    }
+    if (action.machine === true) {
+        if (!store.addTrustedGatewayMachine)
+            return gatewayTrustUnavailable();
+        store.addTrustedGatewayMachine(action.device);
+        return {
+            content: `Trusted remote machine ${action.device}: every device it vouches for is now reachable.`,
+            isError: false,
+        };
+    }
     if (action.principal === true) {
         if (!store.addTrustedGatewayPrincipal)
             return gatewayTrustUnavailable();
@@ -24,8 +57,24 @@ export function gatewayTrust(store, action) {
         isError: false,
     };
 }
-/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
+/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, from the machine allowlist (GatewayTrust.removeMachine, agent-comms#343, revoking every device it vouches for at once) when action.machine is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
 export function gatewayUntrust(store, action) {
+    if (action.principal === true && action.machine === true) {
+        return principalOrMachine();
+    }
+    if (!isDeviceIdHex(action.device.toLowerCase()) &&
+        !listedForUntrust(store, action)) {
+        return notADeviceId(action.device);
+    }
+    if (action.machine === true) {
+        if (!store.removeTrustedGatewayMachine)
+            return gatewayTrustUnavailable();
+        store.removeTrustedGatewayMachine(action.device);
+        return {
+            content: `Untrusted remote machine ${action.device}: no device is reachable through it any more.`,
+            isError: false,
+        };
+    }
     if (action.principal === true) {
         if (!store.removeTrustedGatewayPrincipal)
             return gatewayTrustUnavailable();
@@ -43,29 +92,44 @@ export function gatewayUntrust(store, action) {
         isError: false,
     };
 }
-/** Reports every currently trusted remote device-id and every currently trusted principal device-id (agent-comms#187) together -- listing is never mutually exclusive between the two sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no `principal` flag of its own. */
+/** Whether action.device is already in the set gateway_untrust would remove it from, so an entry an earlier version persisted without checking its shape can still be withdrawn through the tool. */
+function listedForUntrust(store, action) {
+    const listed = action.machine === true
+        ? store.listTrustedGatewayMachines?.()
+        : action.principal === true
+            ? store.listTrustedGatewayPrincipals?.()
+            : store.listTrustedGateways?.();
+    return listed?.includes(action.device.toLowerCase()) === true;
+}
+/** Reports every currently trusted remote device-id, principal (agent-comms#187) and machine (agent-comms#343) together, and the devices reachable through a trusted principal or machine. Listing is never mutually exclusive between the sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no flag of its own. */
 export function gatewayListTrusted(store) {
     if (!store.listTrustedGateways)
         return gatewayTrustUnavailable();
     const devices = store.listTrustedGateways();
     const principals = store.listTrustedGatewayPrincipals?.() ?? [];
+    const machines = store.listTrustedGatewayMachines?.() ?? [];
     const members = store.listVerifiedMembers?.() ?? [];
-    if (devices.length === 0 && principals.length === 0 && members.length === 0) {
+    const sections = [];
+    const section = (title, lines) => {
+        if (lines.length > 0) {
+            sections.push(`${title}:\n${lines.map((line) => `  ${line}`).join("\n")}`);
+        }
+    };
+    section("Trusted remote gateway devices", devices);
+    section("Trusted remote gateway principals", principals);
+    section("Trusted remote machines", machines);
+    section("Devices trusted through a principal", members
+        .filter((member) => member.kind === "principal")
+        .map((member) => `${member.device} (vouched for by ${member.issuer})`));
+    section("Devices trusted through a machine", members
+        .filter((member) => member.kind === "machine")
+        .map((member) => `${member.device} (runs on ${member.issuer})`));
+    if (sections.length === 0) {
         return {
-            content: "No remote gateway devices or principals are trusted.",
+            content: "No remote gateway devices, principals or machines are trusted.",
             isError: false,
         };
     }
-    const sections = [];
-    if (devices.length > 0) {
-        sections.push(`Trusted remote gateway devices:\n${devices.map((device) => `  ${device}`).join("\n")}`);
-    }
-    if (principals.length > 0) {
-        sections.push(`Trusted remote gateway principals:\n${principals.map((principal) => `  ${principal}`).join("\n")}`);
-    }
-    if (members.length > 0) {
-        sections.push(`Devices trusted through a principal:\n${members.map((member) => `  ${member.device} (vouched for by ${member.principal})`).join("\n")}`);
-    }
     return {
         content: sections.join("\n"),
         isError: false,

package/dist/core/gateway-trust-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust-actions.js","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAkBA,yJAAyJ;AACzJ,SAAS,uBAAuB;IAC9B,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,8MAA8M;AAC9M,MAAM,UAAU,YAAY,CAC1B,KAAkC,EAClC,MAAiD;IAEjD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,0BAA0B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxE,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,oCAAoC,MAAM,CAAC,MAAM,GAAG;YAC7D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAC/D,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,GAAG;QAC1D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,4OAA4O;AAC5O,MAAM,UAAU,cAAc,CAC5B,KAAkC,EAClC,MAAmD;IAEnD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,6BAA6B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QAC3E,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,sCAAsC,MAAM,CAAC,MAAM,GAAG;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAClE,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,GAAG;QAC5D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,wRAAwR;AACxR,MAAM,UAAU,kBAAkB,CAChC,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,OAAO,EAAE,sDAAsD;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,oCAAoC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,uCAAuC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,yCAAyC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,oBAAoB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzI,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gateway-trust-actions.js","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAmB/C,6IAA6I;AAC7I,SAAS,kBAAkB;IACzB,OAAO;QACL,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,8NAA8N;AAC9N,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,qFAAqF;QACvH,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,yJAAyJ;AACzJ,SAAS,uBAAuB;IAC9B,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,mSAAmS;AACnS,MAAM,UAAU,YAAY,CAC1B,KAAkC,EAClC,MAAiD;IAEjD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,wBAAwB;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACtE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,iDAAiD;YACjG,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,0BAA0B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxE,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,oCAAoC,MAAM,CAAC,MAAM,GAAG;YAC7D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAC/D,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,GAAG;QAC1D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,gYAAgY;AAChY,MAAM,UAAU,cAAc,CAC5B,KAAkC,EAClC,MAAmD;IAEnD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IACE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAChC,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACzE,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,4BAA4B,MAAM,CAAC,MAAM,+CAA+C;YACjG,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,6BAA6B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QAC3E,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,sCAAsC,MAAM,CAAC,MAAM,GAAG;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAClE,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,GAAG;QAC5D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,qMAAqM;AACrM,SAAS,gBAAgB,CACvB,KAAkC,EAClC,MAAmD;IAEnD,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,IAAI;QACrB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE;QACtC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;YACzB,CAAC,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE;YACxC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;IACtC,OAAO,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,iUAAiU;AACjU,MAAM,UAAU,kBAAkB,CAChC,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAwB,EAAQ,EAAE;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,OAAO,CAAC,gCAAgC,EAAE,OAAO,CAAC,CAAC;IACnD,OAAO,CAAC,mCAAmC,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IAC7C,OAAO,CACL,qCAAqC,EACrC,OAAO;SACJ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;SAC/C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,oBAAoB,MAAM,CAAC,MAAM,GAAG,CAAC,CACzE,CAAC;IACF,OAAO,CACL,mCAAmC,EACnC,OAAO;SACJ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;SAC7C,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,aAAa,MAAM,CAAC,MAAM,GAAG,CAAC,CAClE,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,gEAAgE;YACzE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}

package/dist/core/gateway-trust.d.ts

@@ -5,15 +5,28 @@
  *
  * Keyed by individual device-id, not by "one entry per remote machine": wire-mesh-core's relay-hub protocol (relay-hub.ts, gossip-frame, relay-data-frame) carries no field identifying which remote gateway connection a given directory entry or relayed request actually originated from -- only the entry/request's own device-id, which may be an ordinary local peer forwarded on a remote machine's behalf rather than that machine's own coordinator. Gating per individual device-id is therefore the finest-grained, and only wire-protocol-honest, trust boundary actually implementable without a wire-mesh-core protocol change (deliberately out of scope here, matching agent-comms#156's own "gating the hub itself is out of scope" framing) -- confirmed as the intended granularity by hub-session.ts's own pre-existing isStateMutatingMessage doc comment, which already named this exact gap as "agent-comms#156's own future deliverable" of "per-peer" admission control. An operator who wants every local peer on a remote machine reachable trusts each of that machine's device-ids individually, not just its coordinator's.
  *
+ * Machine-keyed trust (agent-comms#343) is the same shape as the principal's: a machine is another grouping issuer (machine-identity.ts), so trusting one makes every device its gossiped proofs vouch for reachable, and untrusting it cuts all of them off at once, which is how every bridge one account runs on a host is revoked in one act (the key is per OS account, machine-identity.ts). Principals and machines are separate sets because they answer different questions (whose device, which host), and a device may be vouched for by one of each.
+ *
  * Principal-keyed trust (agent-comms#187): alongside the bare-device allowlist above, an operator may also trust a user-principal device-id (user-identity.ts) directly -- the root a remote peer's own dm:send-style delegation chain can terminate at, verified the same way device-membership-verification.ts already verifies a device's own group:member chain (`verifyCapabilityToken`'s chain-walk and its `rootIssuer` output). This is purely a second, parallel allowlist: `isTrusted`/`add`/`remove`/`list` keep checking only the bare-device set, unchanged, for a peer with no principal at all -- `isTrustedFor` is the additive entrypoint a caller who has already chain-verified a token uses to decide trust from that verified bearer and chain-root pair, accepting either a directly trusted device or a bearer rooted at a trusted principal. Persisted alongside the bare-device set (agent-comms#186's own persistence, extended here per that issue's own "agent-comms#187 covers what gets stored" framing): loadGatewayTrust/saveGatewayTrust now carry both sets.
  */
 import type { IdentitySlot } from "./identity-store.js";
 /** The read-only slice of GatewayTrust every consumer of the trust boundary actually needs (WireMeshTransport, HubSession, hub-forwarding.ts) -- named so call sites that only ever read trust decisions, never mutate them, don't repeat the same `Pick<GatewayTrust, "isTrusted" | "hasAny" | "isTrustedPrincipal" | "isTrustedFor">` inline at every field/parameter that takes one. */
-export type GatewayTrustReader = Pick<GatewayTrust, "isTrusted" | "isReachable" | "hasAny" | "isTrustedPrincipal" | "isTrustedFor" | "listPrincipals" | "noteVerifiedMember">;
+export type GatewayTrustReader = Pick<GatewayTrust, "isTrusted" | "isReachable" | "isVouchedBy" | "hasAny" | "isTrustedPrincipal" | "isTrustedFor" | "listPrincipals" | "listMachines" | "noteVerifiedMember">;
+/** Which kind of grouping issuer vouches for a device: its user principal or its machine. */
+export type GroupKind = "principal" | "machine";
+/** A grouping issuer that vouched for a device: its kind and its device-id (lowercase hex). */
+export interface Voucher {
+    kind: GroupKind;
+    issuer: string;
+}
+/** A device reachable only because a trusted issuer vouches for it, and that issuer. */
+export interface VerifiedMember extends Voucher {
+    device: string;
+}
 export declare class GatewayTrust {
     private readonly trusted;
-    private readonly trustedPrincipals;
-    /** Devices whose gossiped membership proof was verified against a trusted principal, with that principal and when the proof lapses. In memory only: a proof is short-lived and re-verified from the next advert, so nothing here is worth persisting. */
+    private readonly trustedIssuers;
+    /** Devices whose gossiped membership proof was verified against a trusted issuer, keyed by memberKey (a device can hold one of each kind), with that issuer and when the proof lapses. In memory only: a proof is short-lived and re-verified from the next advert, so nothing here is worth persisting. */
     private readonly verifiedMembers;
     private readonly location;
     /** gatewayTrustStamp as of the last load or write this instance made, so refresh() can tell when another process has replaced the file since. */
@@ -26,38 +39,46 @@ export declare class GatewayTrust {
     private refresh;
     /** Marks a remote device-id (hex, case-insensitive) as trusted: this side will merge its gossiped directory entries, dispatch its relayed requests, and route outbound hub requests to it. Idempotent. Persists the updated set when this instance was constructed with a location. */
     add(deviceHex: string): void;
-    /** Withdraws a previously trusted device-id (hex, case-insensitive). A no-op if it was never trusted. Mirrors FederationManager.removeTrustedFingerprint's own precedent: already-merged directory entries and in-flight requests are unaffected -- this governs future traffic only. Persists the updated set when this instance was constructed with a location. */
+    /** Withdraws a previously trusted device-id (hex, case-insensitive). A no-op if it was never trusted. Requests already in flight are unaffected; a directory entry merged from the hub because of this trust alone leaves the transport's view on its next read (KnownDevices, gossip-directory.ts). Persists the updated set when this instance was constructed with a location. */
     remove(deviceHex: string): void;
-    /** Writes the complete current trusted device and principal sets back to the shared trust file, if this instance was constructed with a location. A no-op for the in-memory-only case. */
+    /** Writes the complete current trusted device, principal and machine sets back to the shared trust file, if this instance was constructed with a location. A no-op for the in-memory-only case. */
     private persist;
     /** Every currently trusted device-id, lowercase hex, in insertion order. */
     list(): string[];
-    /** Whether the given device-id (hex, case-insensitive) is trusted by id: on the bare-device allowlist. A device trusted only because a principal vouches for it (noteVerifiedMember) is not, on purpose: its proof is a claim that anyone who has read the device's gossiped advert can repeat, so it earns only what isReachable grants. */
+    /** Whether the given device-id (hex, case-insensitive) is trusted by id: on the bare-device allowlist. A device trusted only because a principal or machine vouches for it (noteVerifiedMember) is not, on purpose: its proof is a claim that anyone who has read the device's gossiped advert can repeat, so it earns only what isReachable grants. */
     isTrusted(deviceHex: string): boolean;
-    /** Whether this side may merge the device's gossiped directory entry and route requests to it: trusted by id, or a verified member of a trusted principal. Requests routed to a device are still authenticated end to end by the session inside the relay, so a false claim can misroute one (which then fails its handshake) but not read or forge one. */
+    /** Whether this side may merge the device's gossiped directory entry and route requests to it: trusted by id, or a verified member of a trusted principal or machine. Requests routed to a device are still authenticated end to end by the session inside the relay, so a false claim can misroute one (which then fails its handshake) but not read or forge one. */
     isReachable(deviceHex: string): boolean;
-    /** Records that deviceHex presented a membership proof, valid until expiresAt (epoch ms), verified against principalHex (agent-comms#266). From then until the proof lapses, or principalHex stops being trusted, isReachable treats the device as reachable. A later proof never shortens an earlier one's window. The caller has already verified the proof: this class does no cryptography. */
-    noteVerifiedMember(deviceHex: string, principalHex: string, expiresAt: number): void;
-    /** Every device currently reachable only because a trusted principal vouches for it, with that principal. Excludes proofs that have lapsed and members whose principal is no longer trusted. */
-    listVerifiedMembers(): {
-        device: string;
-        principal: string;
-    }[];
+    /** Whether the device (hex, case-insensitive) is currently a verified member through a trusted issuer of the given kind: its proof of that kind has not lapsed and its issuer is still trusted. Unlike isReachable, this answers for one kind alone, so a device reachable through its principal is not taken to hold a live machine record too. */
+    isVouchedBy(deviceHex: string, kind: GroupKind): boolean;
+    /** Records that deviceHex presented a membership proof, valid until expiresAt (epoch ms), verified against voucher (agent-comms#266, agent-comms#343). From then until the proof lapses, or the voucher's issuer stops being trusted, isReachable treats the device as reachable. A later proof from the same kind of issuer never shortens an earlier one's window. The caller has already verified the proof: this class does no cryptography. */
+    noteVerifiedMember(deviceHex: string, voucher: Readonly<Voucher>, expiresAt: number): void;
+    /** Every device currently reachable because a trusted principal or machine vouches for it, once per vouching issuer. Excludes proofs that have lapsed and members whose issuer is no longer trusted. */
+    listVerifiedMembers(): VerifiedMember[];
     private isVerifiedMember;
-    /** Marks a remote user-principal device-id (hex, case-insensitive; user-identity.ts) as trusted (agent-comms#187): a peer presenting a token whose delegation chain roots at this principal is trusted via `isTrustedFor` below, without that peer's own bare device-id ever needing individual trust. Idempotent, and entirely independent of the bare-device allowlist `add` manages. Persists the updated set when this instance was constructed with a location. */
+    private addIssuer;
+    /** Withdraws trust from one issuer and, in the same act, from every device reachable only through it; the transport's directory drops those devices on its next read (KnownDevices, gossip-directory.ts). */
+    private removeIssuer;
+    /** Marks a remote user-principal device-id (hex, case-insensitive; user-identity.ts) as trusted (agent-comms#187): a peer presenting a token whose delegation chain roots at this principal is trusted via `isTrustedFor` below, without that peer's own bare device-id ever needing individual trust, and a device whose gossiped proof this principal vouches for becomes reachable. Idempotent, and entirely independent of the bare-device allowlist `add` manages. Persists the updated set when this instance was constructed with a location. */
     addPrincipal(deviceHex: string): void;
-    /** Withdraws a previously trusted principal (hex, case-insensitive). A no-op if it was never trusted. Governs future chain checks only, mirroring `remove`'s own already-merged-traffic-is-unaffected posture. Persists the updated set when this instance was constructed with a location. */
+    /** Withdraws a previously trusted principal (hex, case-insensitive), and every device reachable only through it. A no-op if it was never trusted. Persists the updated set when this instance was constructed with a location. */
     removePrincipal(deviceHex: string): void;
     /** Every currently trusted principal device-id, lowercase hex, in insertion order. */
     listPrincipals(): string[];
     /** Whether the given device-id (hex, case-insensitive) is currently trusted as a user principal. */
     isTrustedPrincipal(deviceHex: string): boolean;
+    /** Marks a remote machine device-id (hex, case-insensitive; machine-identity.ts) as trusted (agent-comms#343): every device whose gossiped proof this machine vouches for becomes reachable, without being trusted individually. Idempotent. Persists the updated set when this instance was constructed with a location. */
+    addMachine(deviceHex: string): void;
+    /** Withdraws a previously trusted machine (hex, case-insensitive), and in the same act every device reachable only because that machine vouched for it, revoking that machine key's bridges on the host. A device also trusted by id or through a trusted principal stays reachable by that route. A no-op if the machine was never trusted. Persists the updated set when this instance was constructed with a location. */
+    removeMachine(deviceHex: string): void;
+    /** Every currently trusted machine device-id, lowercase hex, in insertion order. */
+    listMachines(): string[];
     /**
      * Whether a peer is trusted, given a token's own bearer and chain-root device-ids (hex, case-insensitive) a caller has already chain-verified via `verifyCapabilityToken` (the same `rootIssuer` output device-membership-verification.ts's own chain check already relies on). Passes when the bearer itself is directly trusted (the existing bare-device path, unmodified for a peer with no principal at all), OR when the chain's root is a trusted principal -- so a device sub-delegated from an admitted principal (mirroring agent-comms#161's own "principal admits its own devices" pattern) is trusted without ever being individually allowlisted. This class performs no cryptographic verification itself; the caller supplies already-verified device-ids, keeping GatewayTrust the same plain allowlist it always was.
      */
     isTrustedFor(bearerHex: string, rootIssuerHex: string): boolean;
     /**
-     * Whether at least one remote device or principal is currently trusted -- the outbound gossip gate. wire-mesh-core's relay-hub broadcasts a gossiped advert to every connected hub peer with no per-recipient targeting (RelayHub.handleConnection's own "re-broadcasts each gossip frame to every other connected client"), so "advertise local agents only to allowlisted remote gateways" can only be approximated at the coarse granularity this side actually controls: don't advertise anything at all until the operator has opted in by trusting at least one remote device or principal. Once true, an advertisement still reaches every hub-connected peer, trusted or not -- the per-device isTrusted()/isTrustedFor() checks above are what keep this side from ACTING on anything an untrusted peer sends back, which is the boundary that actually matters.
+     * Whether at least one remote device, principal or machine is currently trusted: the outbound gossip gate. wire-mesh-core's relay-hub broadcasts a gossiped advert to every connected hub peer with no per-recipient targeting (RelayHub.handleConnection's own "re-broadcasts each gossip frame to every other connected client"), so "advertise local agents only to allowlisted remote gateways" can only be approximated at the coarse granularity this side actually controls: don't advertise anything at all until the operator has opted in by trusting at least one remote device, principal or machine. Once true, an advertisement still reaches every hub-connected peer, trusted or not; the per-device isTrusted()/isTrustedFor() checks above are what keep this side from ACTING on anything an untrusted peer sends back, which is the boundary that actually matters.
      */
     hasAny(): boolean;
 }

package/dist/core/gateway-trust.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust.d.ts","sourceRoot":"","sources":["../../src/core/gateway-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAOxD,2XAA2X;AAC3X,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,YAAY,EACV,WAAW,GACX,aAAa,GACb,QAAQ,GACR,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,oBAAoB,CACvB,CAAC;AAEF,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAqB;IACvD,yPAAyP;IACzP,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkD;IAC3E,iJAAiJ;IACjJ,OAAO,CAAC,KAAK,CAAqB;IAElC,kXAAkX;gBACtW,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAK1D,kQAAkQ;IAClQ,OAAO,CAAC,IAAI;IAcZ,wMAAwM;IACxM,OAAO,CAAC,OAAO;IAKf,uRAAuR;IACvR,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM5B,sWAAsW;IACtW,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM/B,0LAA0L;IAC1L,OAAO,CAAC,OAAO;IAUf,4EAA4E;IAC5E,IAAI,IAAI,MAAM,EAAE;IAKhB,6UAA6U;IAC7U,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAKrC,4VAA4V;IAC5V,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAMvC,mYAAmY;IACnY,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,IAAI;IAaP,gMAAgM;IAChM,mBAAmB,IAAI;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EAAE;IAO9D,OAAO,CAAC,gBAAgB;IASxB,wcAAwc;IACxc,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAMrC,+RAA+R;IAC/R,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUxC,sFAAsF;IACtF,cAAc,IAAI,MAAM,EAAE;IAK1B,oGAAoG;IACpG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAK9C;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAI/D;;OAEG;IACH,MAAM,IAAI,OAAO;CAIlB"}
+{"version":3,"file":"gateway-trust.d.ts","sourceRoot":"","sources":["../../src/core/gateway-trust.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,YAAY,EAAsB,MAAM,qBAAqB,CAAC;AAO5E,2XAA2X;AAC3X,MAAM,MAAM,kBAAkB,GAAG,IAAI,CACnC,YAAY,EACV,WAAW,GACX,aAAa,GACb,aAAa,GACb,QAAQ,GACR,oBAAoB,GACpB,cAAc,GACd,gBAAgB,GAChB,cAAc,GACd,oBAAoB,CACvB,CAAC;AAEF,6FAA6F;AAC7F,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,SAAS,CAAC;AAEhD,+FAA+F;AAC/F,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wFAAwF;AACxF,MAAM,WAAW,cAAe,SAAQ,OAAO;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAqB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAG7B;IACF,4SAA4S;IAC5S,OAAO,CAAC,QAAQ,CAAC,eAAe,CAG5B;IACJ,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkD;IAC3E,iJAAiJ;IACjJ,OAAO,CAAC,KAAK,CAAqB;IAElC,kXAAkX;gBACtW,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAK1D,kQAAkQ;IAClQ,OAAO,CAAC,IAAI;IAkBZ,wMAAwM;IACxM,OAAO,CAAC,OAAO;IAKf,uRAAuR;IACvR,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM5B,qXAAqX;IACrX,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAM/B,mMAAmM;IACnM,OAAO,CAAC,OAAO;IAWf,4EAA4E;IAC5E,IAAI,IAAI,MAAM,EAAE;IAKhB,wVAAwV;IACxV,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAKrC,uWAAuW;IACvW,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAUvC,oVAAoV;IACpV,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO;IAKxD,obAAob;IACpb,kBAAkB,CAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,EAC1B,SAAS,EAAE,MAAM,GAChB,IAAI;IAgBP,wMAAwM;IACxM,mBAAmB,IAAI,cAAc,EAAE;IAOvC,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,SAAS;IAMjB,6MAA6M;IAC7M,OAAO,CAAC,YAAY;IAYpB,whBAAwhB;IACxhB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIrC,kOAAkO;IAClO,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC,sFAAsF;IACtF,cAAc,IAAI,MAAM,EAAE;IAK1B,oGAAoG;IACpG,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAK9C,6TAA6T;IAC7T,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC,6ZAA6Z;IAC7Z,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAItC,oFAAoF;IACpF,YAAY,IAAI,MAAM,EAAE;IAKxB;;OAEG;IACH,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO;IAI/D;;OAEG;IACH,MAAM,IAAI,OAAO;CAQlB"}

package/dist/core/gateway-trust.js

@@ -1,8 +1,11 @@
 import { gatewayTrustStamp, loadGatewayTrust, saveGatewayTrust, } from "./identity-store.js";
 export class GatewayTrust {
     trusted = new Set();
-    trustedPrincipals = new Set();
-    /** Devices whose gossiped membership proof was verified against a trusted principal, with that principal and when the proof lapses. In memory only: a proof is short-lived and re-verified from the next advert, so nothing here is worth persisting. */
+    trustedIssuers = {
+        principal: new Set(),
+        machine: new Set(),
+    };
+    /** Devices whose gossiped membership proof was verified against a trusted issuer, keyed by memberKey (a device can hold one of each kind), with that issuer and when the proof lapses. In memory only: a proof is short-lived and re-verified from the next advert, so nothing here is worth persisting. */
     verifiedMembers = new Map();
     location;
     /** gatewayTrustStamp as of the last load or write this instance made, so refresh() can tell when another process has replaced the file since. */
@@ -19,12 +22,16 @@ export class GatewayTrust {
         this.stamp = gatewayTrustStamp(this.location);
         const loaded = loadGatewayTrust(this.location);
         this.trusted.clear();
-        this.trustedPrincipals.clear();
+        this.trustedIssuers.principal.clear();
+        this.trustedIssuers.machine.clear();
         for (const deviceHex of loaded.devices) {
             this.trusted.add(deviceHex);
         }
         for (const principalHex of loaded.principals) {
-            this.trustedPrincipals.add(principalHex);
+            this.trustedIssuers.principal.add(principalHex);
+        }
+        for (const machineHex of loaded.machines) {
+            this.trustedIssuers.machine.add(machineHex);
         }
     }
     /** Reloads from disk when another process has replaced the file since this instance last looked. Called first by every method that reads the sets, so a trust decision is never older than the file. */
@@ -40,17 +47,22 @@ export class GatewayTrust {
         this.trusted.add(deviceHex.toLowerCase());
         this.persist();
     }
-    /** Withdraws a previously trusted device-id (hex, case-insensitive). A no-op if it was never trusted. Mirrors FederationManager.removeTrustedFingerprint's own precedent: already-merged directory entries and in-flight requests are unaffected -- this governs future traffic only. Persists the updated set when this instance was constructed with a location. */
+    /** Withdraws a previously trusted device-id (hex, case-insensitive). A no-op if it was never trusted. Requests already in flight are unaffected; a directory entry merged from the hub because of this trust alone leaves the transport's view on its next read (KnownDevices, gossip-directory.ts). Persists the updated set when this instance was constructed with a location. */
     remove(deviceHex) {
         this.refresh();
         this.trusted.delete(deviceHex.toLowerCase());
         this.persist();
     }
-    /** Writes the complete current trusted device and principal sets back to the shared trust file, if this instance was constructed with a location. A no-op for the in-memory-only case. */
+    /** Writes the complete current trusted device, principal and machine sets back to the shared trust file, if this instance was constructed with a location. A no-op for the in-memory-only case. */
     persist() {
         if (this.location === undefined)
             return;
-        saveGatewayTrust(this.location, [...this.trusted], [...this.trustedPrincipals]);
+        const trust = {
+            devices: [...this.trusted],
+            principals: [...this.trustedIssuers.principal],
+            machines: [...this.trustedIssuers.machine],
+        };
+        saveGatewayTrust(this.location, trust);
         this.stamp = gatewayTrustStamp(this.location);
     }
     /** Every currently trusted device-id, lowercase hex, in insertion order. */
@@ -58,70 +70,101 @@ export class GatewayTrust {
         this.refresh();
         return [...this.trusted];
     }
-    /** Whether the given device-id (hex, case-insensitive) is trusted by id: on the bare-device allowlist. A device trusted only because a principal vouches for it (noteVerifiedMember) is not, on purpose: its proof is a claim that anyone who has read the device's gossiped advert can repeat, so it earns only what isReachable grants. */
+    /** Whether the given device-id (hex, case-insensitive) is trusted by id: on the bare-device allowlist. A device trusted only because a principal or machine vouches for it (noteVerifiedMember) is not, on purpose: its proof is a claim that anyone who has read the device's gossiped advert can repeat, so it earns only what isReachable grants. */
     isTrusted(deviceHex) {
         this.refresh();
         return this.trusted.has(deviceHex.toLowerCase());
     }
-    /** Whether this side may merge the device's gossiped directory entry and route requests to it: trusted by id, or a verified member of a trusted principal. Requests routed to a device are still authenticated end to end by the session inside the relay, so a false claim can misroute one (which then fails its handshake) but not read or forge one. */
+    /** Whether this side may merge the device's gossiped directory entry and route requests to it: trusted by id, or a verified member of a trusted principal or machine. Requests routed to a device are still authenticated end to end by the session inside the relay, so a false claim can misroute one (which then fails its handshake) but not read or forge one. */
     isReachable(deviceHex) {
         this.refresh();
         const key = deviceHex.toLowerCase();
-        return this.trusted.has(key) || this.isVerifiedMember(key);
+        return (this.trusted.has(key) ||
+            this.isVerifiedMember(key, "principal") ||
+            this.isVerifiedMember(key, "machine"));
     }
-    /** Records that deviceHex presented a membership proof, valid until expiresAt (epoch ms), verified against principalHex (agent-comms#266). From then until the proof lapses, or principalHex stops being trusted, isReachable treats the device as reachable. A later proof never shortens an earlier one's window. The caller has already verified the proof: this class does no cryptography. */
-    noteVerifiedMember(deviceHex, principalHex, expiresAt) {
-        const key = deviceHex.toLowerCase();
+    /** Whether the device (hex, case-insensitive) is currently a verified member through a trusted issuer of the given kind: its proof of that kind has not lapsed and its issuer is still trusted. Unlike isReachable, this answers for one kind alone, so a device reachable through its principal is not taken to hold a live machine record too. */
+    isVouchedBy(deviceHex, kind) {
+        this.refresh();
+        return this.isVerifiedMember(deviceHex.toLowerCase(), kind);
+    }
+    /** Records that deviceHex presented a membership proof, valid until expiresAt (epoch ms), verified against voucher (agent-comms#266, agent-comms#343). From then until the proof lapses, or the voucher's issuer stops being trusted, isReachable treats the device as reachable. A later proof from the same kind of issuer never shortens an earlier one's window. The caller has already verified the proof: this class does no cryptography. */
+    noteVerifiedMember(deviceHex, voucher, expiresAt) {
+        const device = deviceHex.toLowerCase();
         const now = Date.now();
-        for (const [device, member] of this.verifiedMembers) {
+        for (const [key, member] of this.verifiedMembers) {
             if (member.expiresAt <= now)
-                this.verifiedMembers.delete(device);
+                this.verifiedMembers.delete(key);
         }
+        const key = memberKey(device, voucher.kind);
         const existing = this.verifiedMembers.get(key);
         this.verifiedMembers.set(key, {
-            principal: principalHex.toLowerCase(),
+            device,
+            kind: voucher.kind,
+            issuer: voucher.issuer.toLowerCase(),
             expiresAt: Math.max(expiresAt, existing?.expiresAt ?? 0),
         });
     }
-    /** Every device currently reachable only because a trusted principal vouches for it, with that principal. Excludes proofs that have lapsed and members whose principal is no longer trusted. */
+    /** Every device currently reachable because a trusted principal or machine vouches for it, once per vouching issuer. Excludes proofs that have lapsed and members whose issuer is no longer trusted. */
     listVerifiedMembers() {
         this.refresh();
-        return [...this.verifiedMembers]
-            .filter(([device]) => this.isVerifiedMember(device))
-            .map(([device, member]) => ({ device, principal: member.principal }));
+        return [...this.verifiedMembers.values()]
+            .filter((member) => this.isVerifiedMember(member.device, member.kind))
+            .map(({ device, kind, issuer }) => ({ device, kind, issuer }));
     }
-    isVerifiedMember(deviceKey) {
-        const member = this.verifiedMembers.get(deviceKey);
+    isVerifiedMember(device, kind) {
+        const member = this.verifiedMembers.get(memberKey(device, kind));
         return (member !== undefined &&
             member.expiresAt > Date.now() &&
-            this.trustedPrincipals.has(member.principal));
+            this.trustedIssuers[kind].has(member.issuer));
     }
-    /** Marks a remote user-principal device-id (hex, case-insensitive; user-identity.ts) as trusted (agent-comms#187): a peer presenting a token whose delegation chain roots at this principal is trusted via `isTrustedFor` below, without that peer's own bare device-id ever needing individual trust. Idempotent, and entirely independent of the bare-device allowlist `add` manages. Persists the updated set when this instance was constructed with a location. */
-    addPrincipal(deviceHex) {
+    addIssuer(kind, deviceHex) {
         this.refresh();
-        this.trustedPrincipals.add(deviceHex.toLowerCase());
+        this.trustedIssuers[kind].add(deviceHex.toLowerCase());
         this.persist();
     }
-    /** Withdraws a previously trusted principal (hex, case-insensitive). A no-op if it was never trusted. Governs future chain checks only, mirroring `remove`'s own already-merged-traffic-is-unaffected posture. Persists the updated set when this instance was constructed with a location. */
-    removePrincipal(deviceHex) {
+    /** Withdraws trust from one issuer and, in the same act, from every device reachable only through it; the transport's directory drops those devices on its next read (KnownDevices, gossip-directory.ts). */
+    removeIssuer(kind, deviceHex) {
         this.refresh();
-        const key = deviceHex.toLowerCase();
-        this.trustedPrincipals.delete(key);
-        for (const [device, member] of this.verifiedMembers) {
-            if (member.principal === key)
-                this.verifiedMembers.delete(device);
+        const issuer = deviceHex.toLowerCase();
+        this.trustedIssuers[kind].delete(issuer);
+        for (const [key, member] of this.verifiedMembers) {
+            if (member.kind === kind && member.issuer === issuer) {
+                this.verifiedMembers.delete(key);
+            }
         }
         this.persist();
     }
+    /** Marks a remote user-principal device-id (hex, case-insensitive; user-identity.ts) as trusted (agent-comms#187): a peer presenting a token whose delegation chain roots at this principal is trusted via `isTrustedFor` below, without that peer's own bare device-id ever needing individual trust, and a device whose gossiped proof this principal vouches for becomes reachable. Idempotent, and entirely independent of the bare-device allowlist `add` manages. Persists the updated set when this instance was constructed with a location. */
+    addPrincipal(deviceHex) {
+        this.addIssuer("principal", deviceHex);
+    }
+    /** Withdraws a previously trusted principal (hex, case-insensitive), and every device reachable only through it. A no-op if it was never trusted. Persists the updated set when this instance was constructed with a location. */
+    removePrincipal(deviceHex) {
+        this.removeIssuer("principal", deviceHex);
+    }
     /** Every currently trusted principal device-id, lowercase hex, in insertion order. */
     listPrincipals() {
         this.refresh();
-        return [...this.trustedPrincipals];
+        return [...this.trustedIssuers.principal];
     }
     /** Whether the given device-id (hex, case-insensitive) is currently trusted as a user principal. */
     isTrustedPrincipal(deviceHex) {
         this.refresh();
-        return this.trustedPrincipals.has(deviceHex.toLowerCase());
+        return this.trustedIssuers.principal.has(deviceHex.toLowerCase());
+    }
+    /** Marks a remote machine device-id (hex, case-insensitive; machine-identity.ts) as trusted (agent-comms#343): every device whose gossiped proof this machine vouches for becomes reachable, without being trusted individually. Idempotent. Persists the updated set when this instance was constructed with a location. */
+    addMachine(deviceHex) {
+        this.addIssuer("machine", deviceHex);
+    }
+    /** Withdraws a previously trusted machine (hex, case-insensitive), and in the same act every device reachable only because that machine vouched for it, revoking that machine key's bridges on the host. A device also trusted by id or through a trusted principal stays reachable by that route. A no-op if the machine was never trusted. Persists the updated set when this instance was constructed with a location. */
+    removeMachine(deviceHex) {
+        this.removeIssuer("machine", deviceHex);
+    }
+    /** Every currently trusted machine device-id, lowercase hex, in insertion order. */
+    listMachines() {
+        this.refresh();
+        return [...this.trustedIssuers.machine];
     }
     /**
      * Whether a peer is trusted, given a token's own bearer and chain-root device-ids (hex, case-insensitive) a caller has already chain-verified via `verifyCapabilityToken` (the same `rootIssuer` output device-membership-verification.ts's own chain check already relies on). Passes when the bearer itself is directly trusted (the existing bare-device path, unmodified for a peer with no principal at all), OR when the chain's root is a trusted principal -- so a device sub-delegated from an admitted principal (mirroring agent-comms#161's own "principal admits its own devices" pattern) is trusted without ever being individually allowlisted. This class performs no cryptographic verification itself; the caller supplies already-verified device-ids, keeping GatewayTrust the same plain allowlist it always was.
@@ -130,11 +173,17 @@ export class GatewayTrust {
         return this.isTrusted(bearerHex) || this.isTrustedPrincipal(rootIssuerHex);
     }
     /**
-     * Whether at least one remote device or principal is currently trusted -- the outbound gossip gate. wire-mesh-core's relay-hub broadcasts a gossiped advert to every connected hub peer with no per-recipient targeting (RelayHub.handleConnection's own "re-broadcasts each gossip frame to every other connected client"), so "advertise local agents only to allowlisted remote gateways" can only be approximated at the coarse granularity this side actually controls: don't advertise anything at all until the operator has opted in by trusting at least one remote device or principal. Once true, an advertisement still reaches every hub-connected peer, trusted or not -- the per-device isTrusted()/isTrustedFor() checks above are what keep this side from ACTING on anything an untrusted peer sends back, which is the boundary that actually matters.
+     * Whether at least one remote device, principal or machine is currently trusted: the outbound gossip gate. wire-mesh-core's relay-hub broadcasts a gossiped advert to every connected hub peer with no per-recipient targeting (RelayHub.handleConnection's own "re-broadcasts each gossip frame to every other connected client"), so "advertise local agents only to allowlisted remote gateways" can only be approximated at the coarse granularity this side actually controls: don't advertise anything at all until the operator has opted in by trusting at least one remote device, principal or machine. Once true, an advertisement still reaches every hub-connected peer, trusted or not; the per-device isTrusted()/isTrustedFor() checks above are what keep this side from ACTING on anything an untrusted peer sends back, which is the boundary that actually matters.
      */
     hasAny() {
         this.refresh();
-        return this.trusted.size > 0 || this.trustedPrincipals.size > 0;
+        return (this.trusted.size > 0 ||
+            this.trustedIssuers.principal.size > 0 ||
+            this.trustedIssuers.machine.size > 0);
     }
 }
+/** verifiedMembers' key: one entry per device per kind of issuer. */
+function memberKey(device, kind) {
+    return `${kind}:${device}`;
+}
 //# sourceMappingURL=gateway-trust.js.map

package/dist/core/gateway-trust.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust.js","sourceRoot":"","sources":["../../src/core/gateway-trust.ts"],"names":[],"mappings":"AAUA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAc7B,MAAM,OAAO,YAAY;IACN,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;IACvD,yPAAyP;IACxO,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,QAAQ,CAAkD;IAC3E,iJAAiJ;IACzI,KAAK,CAAqB;IAElC,kXAAkX;IAClX,YAAY,QAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,kQAAkQ;IAC1P,IAAI;QACV,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;QAC/B,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAED,wMAAwM;IAChM,OAAO;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,uRAAuR;IACvR,GAAG,CAAC,SAAiB;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,sWAAsW;IACtW,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,0LAA0L;IAClL,OAAO;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,gBAAgB,CACd,IAAI,CAAC,QAAQ,EACb,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,EACjB,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAC5B,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,4EAA4E;IAC5E,IAAI;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,6UAA6U;IAC7U,SAAS,CAAC,SAAiB;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,4VAA4V;IAC5V,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,mYAAmY;IACnY,kBAAkB,CAChB,SAAiB,EACjB,YAAoB,EACpB,SAAiB;QAEjB,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE;YAC5B,SAAS,EAAE,YAAY,CAAC,WAAW,EAAE;YACrC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,gMAAgM;IAChM,mBAAmB;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,gBAAgB,CAAC,SAAiB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CACL,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAC7C,CAAC;IACJ,CAAC;IAED,wcAAwc;IACxc,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,+RAA+R;IAC/R,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACpC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACpD,IAAI,MAAM,CAAC,SAAS,KAAK,GAAG;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpE,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,sFAAsF;IACtF,cAAc;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACrC,CAAC;IAED,oGAAoG;IACpG,kBAAkB,CAAC,SAAiB;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB,EAAE,aAAqB;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,CAAC;IAClE,CAAC;CACF"}
+{"version":3,"file":"gateway-trust.js","sourceRoot":"","sources":["../../src/core/gateway-trust.ts"],"names":[],"mappings":"AAYA,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AA8B7B,MAAM,OAAO,YAAY;IACN,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAC5B,cAAc,GAA6C;QAC1E,SAAS,EAAE,IAAI,GAAG,EAAU;QAC5B,OAAO,EAAE,IAAI,GAAG,EAAU;KAC3B,CAAC;IACF,4SAA4S;IAC3R,eAAe,GAAG,IAAI,GAAG,EAGvC,CAAC;IACa,QAAQ,CAAkD;IAC3E,iJAAiJ;IACzI,KAAK,CAAqB;IAElC,kXAAkX;IAClX,YAAY,QAA8C;QACxD,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,kQAAkQ;IAC1P,IAAI;QACV,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACtC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,MAAM,SAAS,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QACD,KAAK,MAAM,YAAY,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,wMAAwM;IAChM,OAAO;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,IAAI,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,uRAAuR;IACvR,GAAG,CAAC,SAAiB;QACnB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,qXAAqX;IACrX,MAAM,CAAC,SAAiB;QACtB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,mMAAmM;IAC3L,OAAO;QACb,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS;YAAE,OAAO;QACxC,MAAM,KAAK,GAAuB;YAChC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YAC1B,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;YAC9C,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC;SAC3C,CAAC;QACF,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,4EAA4E;IAC5E,IAAI;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,wVAAwV;IACxV,SAAS,CAAC,SAAiB;QACzB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,uWAAuW;IACvW,WAAW,CAAC,SAAiB;QAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACpC,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YACrB,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,WAAW,CAAC;YACvC,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,SAAS,CAAC,CACtC,CAAC;IACJ,CAAC;IAED,oVAAoV;IACpV,WAAW,CAAC,SAAiB,EAAE,IAAe;QAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,obAAob;IACpb,kBAAkB,CAChB,SAAiB,EACjB,OAA0B,EAC1B,SAAiB;QAEjB,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;gBAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,EAAE;YAC5B,MAAM;YACN,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;YACpC,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,CAAC,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,wMAAwM;IACxM,mBAAmB;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;aACtC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;aACrE,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC;IAEO,gBAAgB,CAAC,MAAc,EAAE,IAAe;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;QACjE,OAAO,CACL,MAAM,KAAK,SAAS;YACpB,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAC7C,CAAC;IACJ,CAAC;IAEO,SAAS,CAAC,IAAe,EAAE,SAAiB;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,6MAA6M;IACrM,YAAY,CAAC,IAAe,EAAE,SAAiB;QACrD,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACvC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACrD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;IACjB,CAAC;IAED,whBAAwhB;IACxhB,YAAY,CAAC,SAAiB;QAC5B,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IACzC,CAAC;IAED,kOAAkO;IAClO,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,sFAAsF;IACtF,cAAc;QACZ,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,oGAAoG;IACpG,kBAAkB,CAAC,SAAiB;QAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,6TAA6T;IAC7T,UAAU,CAAC,SAAiB;QAC1B,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACvC,CAAC;IAED,6ZAA6Z;IAC7Z,aAAa,CAAC,SAAiB;QAC7B,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC1C,CAAC;IAED,oFAAoF;IACpF,YAAY;QACV,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED;;OAEG;IACH,YAAY,CAAC,SAAiB,EAAE,aAAqB;QACnD,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,OAAO,CACL,IAAI,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC;YACrB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC;YACtC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CACrC,CAAC;IACJ,CAAC;CACF;AAED,qEAAqE;AACrE,SAAS,SAAS,CAAC,MAAc,EAAE,IAAe;IAChD,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/dist/core/gossip-directory.d.ts

@@ -9,8 +9,26 @@ import { type AgentSelfAdvert, type HostedRoomAdvert } from "./gossip-extensions
 import type { HubSession } from "./hub-session.js";
 /** Merges one session event's own directory into the mesh-wide knownDevices view (mutated in place), keeping the newer advert (by snapshot-seconds) whenever a device-id is already known from an earlier event or a different session. An equal snapshot replaces the held advert, unlike the relay hub, which lets an advert take a device's registration over from a different connection only when it is strictly newer: the hub is guarding a route against a replayed advert, whereas every entry here has already been verified by the session that produced it, so an equal one carries the same content and the freshest copy is the one to keep. */
 export declare function mergeKnownDevices(knownDevices: Map<string, PeerAdvert>, directory: readonly DirectoryEntry[]): void;
+/**
+ * The mesh-wide gossip directory a transport reads (agent-comms#48): the latest advert of every device it has heard of, from its local peer sessions and from the hub, kept across disconnects so a device's last-known advert stays queryable while its session is down.
+ *
+ * A device heard of through a local peer session is kept for good, since the local mesh admits its peers by its own approval rather than by gateway trust. A device heard of only through the hub is kept only while the hub would still admit it (admitted, the same decision directoryAdmission makes), and that is checked on every read (agent-comms#343): withdrawing trust from a device, principal or machine, in this process or in another that shares the trust file, removes from the view every device that trust alone let in, and so does a membership proof lapsing. Nothing re-adds such a device unless the hub admits it again.
+ */
+export declare class KnownDevices {
+    private readonly admitted;
+    private readonly adverts;
+    private readonly heardLocally;
+    /** admitted answers whether the hub would still admit the device (hex) today. */
+    constructor(admitted: (deviceHex: string) => boolean);
+    /** Merges a local peer session's directory (see mergeKnownDevices). */
+    mergeLocal(directory: readonly DirectoryEntry[]): void;
+    /** Merges the hub session's admitted directory (see mergeKnownDevices). */
+    mergeHub(directory: readonly DirectoryEntry[]): void;
+    /** The current view, keyed by device-id hex, after dropping every hub-only device the hub would no longer admit. */
+    current(): ReadonlyMap<string, Readonly<PeerAdvert>>;
+}
 /** Merges a hub session's own admitted directory into knownDevices and announces each device in it as reachable. Every entry the hub hands over here has already passed admitEntries, so a device named in one is both present on the hub and trusted or vouched for by this side: exactly the moment a request queued for it becomes worth retrying, and the only such moment for a device that has no local peer session of its own to connect. */
-export declare function mergeAndAnnounceReachable(knownDevices: Map<string, PeerAdvert>, directory: readonly DirectoryEntry[], events: Readonly<Pick<TransportEvents, "onDeviceReachable">>): void;
+export declare function mergeAndAnnounceReachable(knownDevices: KnownDevices, directory: readonly DirectoryEntry[], events: Readonly<Pick<TransportEvents, "onDeviceReachable">>): void;
 /** Every device this side has ever heard gossip from, mesh-wide -- not just its own directly-connected peers -- with each one's own latest full advert (addresses, snapshot-seconds, and every open-extension field such as presence/status). The trivial array-conversion half of WireMeshTransport's own listKnownDevices, split out purely to keep that file under the repo's max-lines cap, the same reason mergeKnownDevices above already lives here rather than there. */
 export declare function listKnownDevicesEntries(knownDevices: ReadonlyMap<string, Readonly<PeerAdvert>>): readonly {
     deviceId: string;
@@ -18,8 +36,10 @@ export declare function listKnownDevicesEntries(knownDevices: ReadonlyMap<string
 }[];
 /** Reads a presence extension from one specific device's own gossiped self-advert, if this event's directory carries a fresh one for exactly that device-id -- never for any other device-id a multi-hop directory might mention, since only the session's own authenticated peer's advert is that session's business to report. Returns undefined for a missing presence/status key, or a value that isn't a recognised AgentStatus -- an advert simply not participating in this convention, not an error (the same verifier obligation peer-advert's own open extension tail is documented under). */
 export declare function findPresenceAdvert(deviceIdHex: string, directory: readonly DirectoryEntry[]): AgentStatus | undefined;
-/** The membership proof a peer gossiped in its agent/self advert, or undefined when it carries none. The advert is self-asserted by whichever peer sent it, so this only reads it; nothing about the proof is believed until it is verified. */
-export declare function readMembershipProof(advert: Readonly<PeerAdvert>): string | undefined;
+/** Which agent/self field carries which issuer's proof: `membership` the user principal's, `machine` the machine's. */
+export type MembershipProofField = "membership" | "machine";
+/** The membership proof a peer gossiped in its agent/self advert under field, or undefined when it carries none. The advert is self-asserted by whichever peer sent it, so this only reads it; nothing about the proof is believed until it is verified. */
+export declare function readMembershipProof(advert: Readonly<Record<string, unknown>>, field: MembershipProofField): string | undefined;
 /** The one thing gossip re-advertisement needs from a session: somewhere to send the extension bag. */
 export type GossipSession = Pick<AcceptedMeshSession, "sendGossipUpdate">;
 /** Which session, if any, is the hub's. */

package/dist/core/gossip-directory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gossip-directory.d.ts","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,8nBAA8nB;AAC9nB,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACrC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,IAAI,CAWN;AAED,qbAAqb;AACrb,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACrC,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,GAC3D,IAAI,CAKN;AAED,idAAid;AACjd,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,GACtD,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;CAAE,EAAE,CAK/D;AAED,ykBAAykB;AACzkB,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,WAAW,GAAG,SAAS,CAOzB;AAED,gPAAgP;AAChP,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,GAC3B,MAAM,GAAG,SAAS,CAKpB;AAED,uGAAuG;AACvG,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AAE1E,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC;CAC5D;AAED,kzEAAkzE;AAClzE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5B,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,kBAAkB,EAAE,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAChE,cAAc,EAAE,CAAC,MAAM,SAAS,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC;IAChE,kBAAkB,EAAE,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,mkBAAmkB;IACnkB,gBAAgB,EAAE,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CAC1D,GAAG,IAAI,CA4CP;AAED,0yBAA0yB;AAC1yB,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IAC/C,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,kBAAkB,EAAE,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAChE,cAAc,EAAE,CAAC,MAAM,SAAS,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC;IAChE,kBAAkB,EAAE,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,gBAAgB,EAAE,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACzD,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,SAAS,CAiC7C"}
+{"version":3,"file":"gossip-directory.d.ts","sourceRoot":"","sources":["../../src/core/gossip-directory.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAEtD,OAAO,KAAK,EACV,mBAAmB,EACnB,cAAc,EACf,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mCAAmC,CAAC;AACpE,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAML,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACtB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,8nBAA8nB;AAC9nB,wBAAgB,iBAAiB,CAC/B,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EACrC,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,IAAI,CAWN;AAED;;;;GAIG;AACH,qBAAa,YAAY;IAKX,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJrC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiC;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;IAElD,iFAAiF;gBACpD,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO;IAErE,uEAAuE;IACvE,UAAU,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAOtD,2EAA2E;IAC3E,QAAQ,CAAC,SAAS,EAAE,SAAS,cAAc,EAAE,GAAG,IAAI;IAIpD,oHAAoH;IACpH,OAAO,IAAI,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC;CAQrD;AAED,qbAAqb;AACrb,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,YAAY,EAC1B,SAAS,EAAE,SAAS,cAAc,EAAE,EACpC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,GAC3D,IAAI,CAKN;AAED,idAAid;AACjd,wBAAgB,uBAAuB,CACrC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,GACtD,SAAS;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;CAAE,EAAE,CAK/D;AAED,ykBAAykB;AACzkB,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,SAAS,cAAc,EAAE,GACnC,WAAW,GAAG,SAAS,CAOzB;AAED,uHAAuH;AACvH,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,SAAS,CAAC;AAE5D,4PAA4P;AAC5P,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACzC,KAAK,EAAE,oBAAoB,GAC1B,MAAM,GAAG,SAAS,CAWpB;AAED,uGAAuG;AACvG,MAAM,MAAM,aAAa,GAAG,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC;AAE1E,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,WAAW,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC;CAC5D;AAED,kzEAAkzE;AAClzE,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,GAAG,EAAE,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5B,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,kBAAkB,EAAE,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAChE,cAAc,EAAE,CAAC,MAAM,SAAS,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC;IAChE,kBAAkB,EAAE,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,mkBAAmkB;IACnkB,gBAAgB,EAAE,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;CAC1D,GAAG,IAAI,CA4CP;AAED,0yBAA0yB;AAC1yB,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,WAAW,EAAE,WAAW,CAAC,aAAa,CAAC,CAAC;IACxC,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC;IAC/C,oBAAoB,EAAE,MAAM,OAAO,CAAC;IACpC,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,kBAAkB,EAAE,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IAChE,cAAc,EAAE,CAAC,MAAM,SAAS,gBAAgB,EAAE,CAAC,GAAG,SAAS,CAAC;IAChE,kBAAkB,EAAE,CAAC,MAAM,eAAe,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACpE,gBAAgB,EAAE,CAAC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,SAAS,CAAC;IACzD,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,UAAU,CAAC,OAAO,WAAW,CAAC,GAAG,SAAS,CAiC7C"}