agent-comms 8.4.1 → 8.6.0

package/dist/core/directory-admission.d.ts

@@ -1,7 +1,7 @@
 /**
- * Which gossiped directory entries from the hub a gateway merges (agent-comms#156, widened by #187 and #266). Split out of WireMeshTransport, which hands it the two collaborators it needs.
+ * Which gossiped directory entries from the hub a gateway merges (agent-comms#156, widened by #187, #266 and #343). Split out of WireMeshTransport, which hands it the two collaborators it needs.
  *
- * A membership proof shows that a trusted principal vouches for a device id. It does not show that whoever sent the advert is that device: the id and the proof both arrive in the same unauthenticated advert, and anyone who has read one can repeat it. So it earns only what GatewayTrust.isReachable grants (a directory entry and a route), never isTrusted, and everything a request to such a device carries is authenticated by the end-to-end session inside the relay. Verifying a proof is cryptography, so the work is bounded here: verdicts are remembered, a batch verifies only so many new proofs, and a verifier that throws refuses the entry rather than breaking the merge.
+ * A membership proof shows that a trusted principal or machine vouches for a device id. It does not show that whoever sent the advert is that device: the id and the proof both arrive in the same unauthenticated advert, and anyone who has read one can repeat it. So it earns only what GatewayTrust.isReachable grants (a directory entry and a route), never isTrusted, and everything a request to such a device carries is authenticated by the end-to-end session inside the relay. Verifying a proof is cryptography, so the work is bounded here: verdicts are remembered, a batch verifies only so many new proofs, and a verifier that throws refuses the entry rather than breaking the merge.
  */
 import type { DirectoryEntry } from "wire-mesh-core/domain/mesh-session";
 import type { GatewayTrustReader } from "./gateway-trust.js";
@@ -15,6 +15,8 @@ export interface DirectoryAdmissionDeps {
     /** Absent when this side cannot verify proofs, in which case a proof is never enough. */
     verifyMembership: WireMeshTransportOptions["verifyMembership"];
 }
-/** Builds the admission check for a transport's directory merge: given a batch of entries, the ones to merge. An entry is merged if its device is trusted by id, is itself a trusted principal's own device, or carries a proof that a trusted principal vouches for it; a verified device is recorded in gatewayTrust until the proof lapses or its principal stops being trusted. A device's newer proof is verified as it arrives, which is how its trust is renewed before the old one lapses. */
+/** Whether an entry this side has already merged from the hub would still be admitted now, with no new proof to judge: its device is reachable (trusted by id, or vouched for by a proof that has not lapsed from an issuer still trusted) or is itself a trusted principal's own device. The read-time counterpart of directoryAdmission, which KnownDevices uses to drop a device as soon as the trust that let it in is withdrawn or lapses. */
+export declare function staysAdmitted(gatewayTrust: Readonly<Pick<GatewayTrustReader, "isReachable" | "isTrustedPrincipal">>, deviceHex: string): boolean;
+/** Builds the admission check for a transport's directory merge: given a batch of entries, the ones to merge. An entry is merged if its device is trusted by id, is itself a trusted principal's own device, or carries a proof that a trusted principal or machine vouches for it; each proof an entry carries is judged on its own, and every one that verifies records the device in gatewayTrust under that kind until the proof lapses or its issuer stops being trusted. A remembered good verdict is reused only while that kind's record is still live, and a device's newer proof is verified as it arrives, which is how its trust is renewed before the old one lapses. */
 export declare function directoryAdmission(deps: Readonly<DirectoryAdmissionDeps>): (entries: readonly DirectoryEntry[]) => Promise<DirectoryEntry[]>;
 //# sourceMappingURL=directory-admission.d.ts.map

package/dist/core/directory-admission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"directory-admission.d.ts","sourceRoot":"","sources":["../../src/core/directory-admission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,mOAAmO;AACnO,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAI7C,qOAAqO;AACrO,eAAO,MAAM,uBAAuB,QACU,CAAC;AAK/C,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC3C,yFAAyF;IACzF,gBAAgB,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;CAChE;AASD,seAAse;AACte,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GACrC,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CA6EnE"}
+{"version":3,"file":"directory-admission.d.ts","sourceRoot":"","sources":["../../src/core/directory-admission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAa,MAAM,oBAAoB,CAAC;AAKxE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,mOAAmO;AACnO,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAI7C,qOAAqO;AACrO,eAAO,MAAM,uBAAuB,QACU,CAAC;AAc/C,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAC3C,yFAAyF;IACzF,gBAAgB,EAAE,wBAAwB,CAAC,kBAAkB,CAAC,CAAC;CAChE;AASD,mbAAmb;AACnb,wBAAgB,aAAa,CAC3B,YAAY,EAAE,QAAQ,CACpB,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,oBAAoB,CAAC,CAC/D,EACD,SAAS,EAAE,MAAM,GAChB,OAAO,CAKT;AAED,spBAAspB;AACtpB,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GACrC,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,cAAc,EAAE,CAAC,CA2FnE"}

package/dist/core/directory-admission.js

@@ -1,44 +1,58 @@
 /**
- * Which gossiped directory entries from the hub a gateway merges (agent-comms#156, widened by #187 and #266). Split out of WireMeshTransport, which hands it the two collaborators it needs.
+ * Which gossiped directory entries from the hub a gateway merges (agent-comms#156, widened by #187, #266 and #343). Split out of WireMeshTransport, which hands it the two collaborators it needs.
  *
- * A membership proof shows that a trusted principal vouches for a device id. It does not show that whoever sent the advert is that device: the id and the proof both arrive in the same unauthenticated advert, and anyone who has read one can repeat it. So it earns only what GatewayTrust.isReachable grants (a directory entry and a route), never isTrusted, and everything a request to such a device carries is authenticated by the end-to-end session inside the relay. Verifying a proof is cryptography, so the work is bounded here: verdicts are remembered, a batch verifies only so many new proofs, and a verifier that throws refuses the entry rather than breaking the merge.
+ * A membership proof shows that a trusted principal or machine vouches for a device id. It does not show that whoever sent the advert is that device: the id and the proof both arrive in the same unauthenticated advert, and anyone who has read one can repeat it. So it earns only what GatewayTrust.isReachable grants (a directory entry and a route), never isTrusted, and everything a request to such a device carries is authenticated by the end-to-end session inside the relay. Verifying a proof is cryptography, so the work is bounded here: verdicts are remembered, a batch verifies only so many new proofs, and a verifier that throws refuses the entry rather than breaking the merge.
  */
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
-import { readMembershipProof } from "./gossip-directory.js";
+import { readMembershipProof, } from "./gossip-directory.js";
 /** How many new proofs one batch of entries may verify. Trusted devices and proofs already judged cost nothing against it, so a flood of fresh adverts costs a bounded amount of work per batch and the rest wait for the next. */
 export const MAX_VERIFICATIONS_PER_BATCH = 8;
 const MS_PER_SECOND = 1000;
 const NEGATIVE_VERDICT_TTL_SECONDS = 60;
 /** How long a refused proof is remembered before it is worth checking again: long enough that a repeated bad proof is not re-verified on every frame, short enough that a principal trusted a moment later takes effect promptly. */
 export const NEGATIVE_VERDICT_TTL_MS = NEGATIVE_VERDICT_TTL_SECONDS * MS_PER_SECOND;
-/** The most devices whose last verdict is remembered. */
+/** The most proofs whose last verdict is remembered. */
 const VERDICT_CACHE_LIMIT = 1024;
-/** Builds the admission check for a transport's directory merge: given a batch of entries, the ones to merge. An entry is merged if its device is trusted by id, is itself a trusted principal's own device, or carries a proof that a trusted principal vouches for it; a verified device is recorded in gatewayTrust until the proof lapses or its principal stops being trusted. A device's newer proof is verified as it arrives, which is how its trust is renewed before the old one lapses. */
+/** Each advert field that can carry a proof, and the kind of issuer whose trusted set it is checked against. */
+const PROOF_SOURCES = [
+    { field: "membership", kind: "principal" },
+    { field: "machine", kind: "machine" },
+];
+/** Whether an entry this side has already merged from the hub would still be admitted now, with no new proof to judge: its device is reachable (trusted by id, or vouched for by a proof that has not lapsed from an issuer still trusted) or is itself a trusted principal's own device. The read-time counterpart of directoryAdmission, which KnownDevices uses to drop a device as soon as the trust that let it in is withdrawn or lapses. */
+export function staysAdmitted(gatewayTrust, deviceHex) {
+    return (gatewayTrust.isReachable(deviceHex) ||
+        gatewayTrust.isTrustedPrincipal(deviceHex));
+}
+/** Builds the admission check for a transport's directory merge: given a batch of entries, the ones to merge. An entry is merged if its device is trusted by id, is itself a trusted principal's own device, or carries a proof that a trusted principal or machine vouches for it; each proof an entry carries is judged on its own, and every one that verifies records the device in gatewayTrust under that kind until the proof lapses or its issuer stops being trusted. A remembered good verdict is reused only while that kind's record is still live, and a device's newer proof is verified as it arrives, which is how its trust is renewed before the old one lapses. */
 export function directoryAdmission(deps) {
     const { gatewayTrust, verifyMembership } = deps;
+    /** Keyed by kind and device, since a device can carry one proof of each kind. */
     const verdicts = new Map();
-    const remember = (deviceHex, verdict) => {
-        verdicts.delete(deviceHex);
-        verdicts.set(deviceHex, verdict);
+    const remember = (key, verdict) => {
+        verdicts.delete(key);
+        verdicts.set(key, verdict);
         if (verdicts.size > VERDICT_CACHE_LIMIT) {
             const oldest = verdicts.keys().next();
             if (oldest.done !== true)
                 verdicts.delete(oldest.value);
         }
     };
-    /** The expiry of the first trusted principal's verdict that vouches for the proof, or undefined. A principal the verifier throws on (a malformed id, or no identity attached yet) is skipped, so one bad principal never blocks the others. */
-    const vouchedFor = async (proof, deviceHex) => {
+    const trustedIssuers = (kind) => kind === "principal"
+        ? gatewayTrust.listPrincipals()
+        : gatewayTrust.listMachines();
+    /** The first trusted issuer of the given kind that vouches for the proof, with the proof's expiry, or undefined. An issuer the verifier throws on (a malformed id, or no identity attached yet) is skipped, so one bad issuer never blocks the others. */
+    const vouchedFor = async (proof, deviceHex, kind) => {
         if (verifyMembership === undefined)
             return undefined;
-        for (const principal of gatewayTrust.listPrincipals()) {
+        for (const issuer of trustedIssuers(kind)) {
             try {
                 const verdict = await verifyMembership({
                     proof,
                     deviceHex,
-                    principalHex: principal,
+                    issuerHex: issuer,
                 });
                 if (verdict.ok)
-                    return { principal, expires: verdict.expires };
+                    return { issuer, expires: verdict.expires };
             }
             catch {
                 continue;
@@ -56,31 +70,40 @@ export function directoryAdmission(deps) {
                 admitted.push(entry);
                 continue;
             }
-            const proof = readMembershipProof(entry.advert);
-            if (proof === undefined || verifyMembership === undefined)
+            if (verifyMembership === undefined)
                 continue;
-            const known = verdicts.get(deviceHex);
-            if (known?.proof === proof) {
-                if (known.ok && gatewayTrust.isReachable(deviceHex)) {
-                    admitted.push(entry);
+            // Every proof the entry carries is judged, not just the first that passes, so a device vouched for by both a trusted principal and a trusted machine holds a record of each and stays reachable when either issuer is untrusted.
+            let vouched = false;
+            for (const { field, kind } of PROOF_SOURCES) {
+                const proof = readMembershipProof(entry.advert, field);
+                if (proof === undefined)
                     continue;
+                const key = `${kind}:${deviceHex}`;
+                const known = verdicts.get(key);
+                if (known?.proof === proof) {
+                    if (known.ok && gatewayTrust.isVouchedBy(deviceHex, kind)) {
+                        vouched = true;
+                        continue;
+                    }
+                    if (!known.ok && known.until > Date.now())
+                        continue;
                 }
-                if (!known.ok && known.until > Date.now())
+                if (budget === 0)
                     continue;
+                budget -= 1;
+                const vouch = await vouchedFor(proof, deviceHex, kind);
+                remember(key, {
+                    proof,
+                    ok: vouch !== undefined,
+                    until: Date.now() + NEGATIVE_VERDICT_TTL_MS,
+                });
+                if (vouch !== undefined) {
+                    gatewayTrust.noteVerifiedMember(deviceHex, { kind, issuer: vouch.issuer }, vouch.expires);
+                    vouched = true;
+                }
             }
-            if (budget === 0)
-                continue;
-            budget -= 1;
-            const vouch = await vouchedFor(proof, deviceHex);
-            remember(deviceHex, {
-                proof,
-                ok: vouch !== undefined,
-                until: Date.now() + NEGATIVE_VERDICT_TTL_MS,
-            });
-            if (vouch !== undefined) {
-                gatewayTrust.noteVerifiedMember(deviceHex, vouch.principal, vouch.expires);
+            if (vouched)
                 admitted.push(entry);
-            }
         }
         return admitted;
     };

package/dist/core/directory-admission.js.map

@@ -1 +1 @@
-{"version":3,"file":"directory-admission.js","sourceRoot":"","sources":["../../src/core/directory-admission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,mOAAmO;AACnO,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,qOAAqO;AACrO,MAAM,CAAC,MAAM,uBAAuB,GAClC,4BAA4B,GAAG,aAAa,CAAC;AAE/C,yDAAyD;AACzD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAejC,seAAse;AACte,MAAM,UAAU,kBAAkB,CAChC,IAAsC;IAEtC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,MAAM,QAAQ,GAAG,CAAC,SAAiB,EAAE,OAA0B,EAAQ,EAAE;QACvE,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACjC,IAAI,QAAQ,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC;IAEF,+OAA+O;IAC/O,MAAM,UAAU,GAAG,KAAK,EACtB,KAAa,EACb,SAAiB,EAC4C,EAAE;QAC/D,IAAI,gBAAgB,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrD,KAAK,MAAM,SAAS,IAAI,YAAY,CAAC,cAAc,EAAE,EAAE,CAAC;YACtD,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;oBACrC,KAAK;oBACL,SAAS;oBACT,YAAY,EAAE,SAAS;iBACxB,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,2BAA2B,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,IACE,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC;gBACjC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAC1C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAChD,IAAI,KAAK,KAAK,SAAS,IAAI,gBAAgB,KAAK,SAAS;gBAAE,SAAS;YAEpE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACtC,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,IAAI,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;oBACpD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACrB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;oBAAE,SAAS;YACtD,CAAC;YACD,IAAI,MAAM,KAAK,CAAC;gBAAE,SAAS;YAC3B,MAAM,IAAI,CAAC,CAAC;YAEZ,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACjD,QAAQ,CAAC,SAAS,EAAE;gBAClB,KAAK;gBACL,EAAE,EAAE,KAAK,KAAK,SAAS;gBACvB,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB;aAC5C,CAAC,CAAC;YACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,YAAY,CAAC,kBAAkB,CAC7B,SAAS,EACT,KAAK,CAAC,SAAS,EACf,KAAK,CAAC,OAAO,CACd,CAAC;gBACF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"directory-admission.js","sourceRoot":"","sources":["../../src/core/directory-admission.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EACL,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAG/B,mOAAmO;AACnO,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,4BAA4B,GAAG,EAAE,CAAC;AACxC,qOAAqO;AACrO,MAAM,CAAC,MAAM,uBAAuB,GAClC,4BAA4B,GAAG,aAAa,CAAC;AAE/C,wDAAwD;AACxD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAEjC,gHAAgH;AAChH,MAAM,aAAa,GAGb;IACJ,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE;IAC1C,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;CACtC,CAAC;AAeF,mbAAmb;AACnb,MAAM,UAAU,aAAa,CAC3B,YAEC,EACD,SAAiB;IAEjB,OAAO,CACL,YAAY,CAAC,WAAW,CAAC,SAAS,CAAC;QACnC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAC3C,CAAC;AACJ,CAAC;AAED,spBAAspB;AACtpB,MAAM,UAAU,kBAAkB,CAChC,IAAsC;IAEtC,MAAM,EAAE,YAAY,EAAE,gBAAgB,EAAE,GAAG,IAAI,CAAC;IAChD,iFAAiF;IACjF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE5C,MAAM,QAAQ,GAAG,CAAC,GAAW,EAAE,OAA0B,EAAQ,EAAE;QACjE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC3B,IAAI,QAAQ,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;gBAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,cAAc,GAAG,CAAC,IAAe,EAAY,EAAE,CACnD,IAAI,KAAK,WAAW;QAClB,CAAC,CAAC,YAAY,CAAC,cAAc,EAAE;QAC/B,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,CAAC;IAElC,0PAA0P;IAC1P,MAAM,UAAU,GAAG,KAAK,EACtB,KAAa,EACb,SAAiB,EACjB,IAAe,EAC2C,EAAE;QAC5D,IAAI,gBAAgB,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QACrD,KAAK,MAAM,MAAM,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC;oBACrC,KAAK;oBACL,SAAS;oBACT,SAAS,EAAE,MAAM;iBAClB,CAAC,CAAC;gBACH,IAAI,OAAO,CAAC,EAAE;oBAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IAEF,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAqB,EAAE,CAAC;QACtC,IAAI,MAAM,GAAG,2BAA2B,CAAC;QACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC9C,IACE,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC;gBACjC,YAAY,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAC1C,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;YACD,IAAI,gBAAgB,KAAK,SAAS;gBAAE,SAAS;YAC7C,iOAAiO;YACjO,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,KAAK,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,aAAa,EAAE,CAAC;gBAC5C,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,KAAK,KAAK,SAAS;oBAAE,SAAS;gBAElC,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,SAAS,EAAE,CAAC;gBACnC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChC,IAAI,KAAK,EAAE,KAAK,KAAK,KAAK,EAAE,CAAC;oBAC3B,IAAI,KAAK,CAAC,EAAE,IAAI,YAAY,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;wBAC1D,OAAO,GAAG,IAAI,CAAC;wBACf,SAAS;oBACX,CAAC;oBACD,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE;wBAAE,SAAS;gBACtD,CAAC;gBACD,IAAI,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAC3B,MAAM,IAAI,CAAC,CAAC;gBAEZ,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACvD,QAAQ,CAAC,GAAG,EAAE;oBACZ,KAAK;oBACL,EAAE,EAAE,KAAK,KAAK,SAAS;oBACvB,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,uBAAuB;iBAC5C,CAAC,CAAC;gBACH,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,YAAY,CAAC,kBAAkB,CAC7B,SAAS,EACT,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,EAC9B,KAAK,CAAC,OAAO,CACd,CAAC;oBACF,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;YACD,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC"}

package/dist/core/display-name.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The one display convention for anything identified by a device-id (agent-comms#345): your own petname for it first, then the name it asserts for itself, then a short id. Every surface that shows an agent, a machine, a principal or a trusted device formats it here, so the CLI, the tool output and the dashboard read the same; wire-mesh's web console follows the same order (ExaDev/wire-mesh#295).
+ *
+ * A petname is yours: set locally, never gossiped, so it needs no trust decision and has no collision problem. A self-asserted name is whatever the subject's own key signed (an agent's registered name, a machine's name claim), so it is shown quoted, as the subject's claim rather than a fact. Where the full id is already printed beside the name, formatNames gives the names alone, since the short id would only repeat its start. The short id is the stable reference when neither name exists, and the fallback that tells two same-named subjects apart. It is a prefix of the full id, never a replacement for it: every tool action takes the full id, so a surface whose entries are acted on also prints the full id.
+ *
+ * Pure and dependency-free, so the browser bundle imports it as it is.
+ */
+/** How many leading hex characters of a device-id the short id keeps: 48 bits, enough that two devices a person deals with never share one by chance, and short enough to read and compare at a glance. */
+export declare const SHORT_ID_LENGTH = 12;
+/** Everything a display name is built from. Both names are optional; the id never is. */
+export interface DisplayNameParts {
+    /** The full device-id (hex). */
+    id: string;
+    /** The viewer's own label for this id, if they set one. */
+    petname?: string | undefined;
+    /** The name the subject asserts for itself, if it has one. */
+    selfName?: string | undefined;
+}
+/** The leading SHORT_ID_LENGTH characters of id. */
+export declare function shortId(id: string): string;
+/** The names in parts, in display order: the petname, then the self-asserted name quoted (left out when it only repeats the petname), separated by a space, or the empty string when neither is set. Each name is checked with parseDisplayName first and left out when it fails, so a name that slipped past every other check (a hand-edited file, a peer that does not validate) still never reaches a terminal; the self-asserted name is quoted as a JSON string, so a quote inside it is escaped and cannot close the quotes early to pass the rest off as a separate, unquoted label. */
+export declare function formatNames(parts: Readonly<DisplayNameParts>): string;
+/** parts in display order: formatNames, then the short id. */
+export declare function formatDisplayName(parts: Readonly<DisplayNameParts>): string;
+/** The longest display name, petname or self-asserted, that is accepted: room for a descriptive label ("Joe's work laptop, office"), short enough that one never swamps a listing row. */
+export declare const MAX_DISPLAY_NAME_LENGTH = 64;
+/** raw trimmed, when it is usable as a display name: not empty, at most MAX_DISPLAY_NAME_LENGTH characters, and free of control characters. Undefined otherwise. Applied to a petname as it is set, to an agent's name as it is registered or received in an advert, to a machine's name claim as it is verified, and once more by formatNames as any name is shown, so none can carry anything a terminal would interpret. */
+export declare function parseDisplayName(raw: string): string | undefined;
+//# sourceMappingURL=display-name.d.ts.map

package/dist/core/display-name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-name.d.ts","sourceRoot":"","sources":["../../src/core/display-name.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2MAA2M;AAC3M,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,yFAAyF;AACzF,MAAM,WAAW,gBAAgB;IAC/B,gCAAgC;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,8DAA8D;IAC9D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,oDAAoD;AACpD,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE1C;AAED,gkBAAgkB;AAChkB,wBAAgB,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,MAAM,CASrE;AAED,8DAA8D;AAC9D,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAI3E;AAMD,0LAA0L;AAC1L,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAW1C,+ZAA+Z;AAC/Z,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUhE"}

package/dist/core/display-name.js

@@ -0,0 +1,57 @@
+/**
+ * The one display convention for anything identified by a device-id (agent-comms#345): your own petname for it first, then the name it asserts for itself, then a short id. Every surface that shows an agent, a machine, a principal or a trusted device formats it here, so the CLI, the tool output and the dashboard read the same; wire-mesh's web console follows the same order (ExaDev/wire-mesh#295).
+ *
+ * A petname is yours: set locally, never gossiped, so it needs no trust decision and has no collision problem. A self-asserted name is whatever the subject's own key signed (an agent's registered name, a machine's name claim), so it is shown quoted, as the subject's claim rather than a fact. Where the full id is already printed beside the name, formatNames gives the names alone, since the short id would only repeat its start. The short id is the stable reference when neither name exists, and the fallback that tells two same-named subjects apart. It is a prefix of the full id, never a replacement for it: every tool action takes the full id, so a surface whose entries are acted on also prints the full id.
+ *
+ * Pure and dependency-free, so the browser bundle imports it as it is.
+ */
+/** How many leading hex characters of a device-id the short id keeps: 48 bits, enough that two devices a person deals with never share one by chance, and short enough to read and compare at a glance. */
+export const SHORT_ID_LENGTH = 12;
+/** The leading SHORT_ID_LENGTH characters of id. */
+export function shortId(id) {
+    return id.slice(0, SHORT_ID_LENGTH);
+}
+/** The names in parts, in display order: the petname, then the self-asserted name quoted (left out when it only repeats the petname), separated by a space, or the empty string when neither is set. Each name is checked with parseDisplayName first and left out when it fails, so a name that slipped past every other check (a hand-edited file, a peer that does not validate) still never reaches a terminal; the self-asserted name is quoted as a JSON string, so a quote inside it is escaped and cannot close the quotes early to pass the rest off as a separate, unquoted label. */
+export function formatNames(parts) {
+    const petname = usableName(parts.petname);
+    const selfName = usableName(parts.selfName);
+    const labels = [];
+    if (petname !== undefined)
+        labels.push(petname);
+    if (selfName !== undefined && selfName !== petname) {
+        labels.push(JSON.stringify(selfName));
+    }
+    return labels.join(" ");
+}
+/** parts in display order: formatNames, then the short id. */
+export function formatDisplayName(parts) {
+    const names = formatNames(parts);
+    const id = shortId(parts.id);
+    return names === "" ? id : `${names} ${id}`;
+}
+function usableName(raw) {
+    return raw === undefined ? undefined : parseDisplayName(raw);
+}
+/** The longest display name, petname or self-asserted, that is accepted: room for a descriptive label ("Joe's work laptop, office"), short enough that one never swamps a listing row. */
+export const MAX_DISPLAY_NAME_LENGTH = 64;
+/** The last C0 control character; everything at or below it, DEL, and the C1 range are refused, since a name is printed straight into terminals and a control sequence in one could rewrite what the viewer sees. */
+const LAST_C0_CONTROL = 0x1f;
+const DEL = 0x7f;
+const LAST_C1_CONTROL = 0x9f;
+function isControlCharacter(code) {
+    return code <= LAST_C0_CONTROL || (code >= DEL && code <= LAST_C1_CONTROL);
+}
+/** raw trimmed, when it is usable as a display name: not empty, at most MAX_DISPLAY_NAME_LENGTH characters, and free of control characters. Undefined otherwise. Applied to a petname as it is set, to an agent's name as it is registered or received in an advert, to a machine's name claim as it is verified, and once more by formatNames as any name is shown, so none can carry anything a terminal would interpret. */
+export function parseDisplayName(raw) {
+    const name = raw.trim();
+    if (name.length === 0 || name.length > MAX_DISPLAY_NAME_LENGTH) {
+        return undefined;
+    }
+    for (const char of name) {
+        const code = char.codePointAt(0);
+        if (code !== undefined && isControlCharacter(code))
+            return undefined;
+    }
+    return name;
+}
+//# sourceMappingURL=display-name.js.map

package/dist/core/display-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-name.js","sourceRoot":"","sources":["../../src/core/display-name.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,2MAA2M;AAC3M,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAYlC,oDAAoD;AACpD,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;AACtC,CAAC;AAED,gkBAAgkB;AAChkB,MAAM,UAAU,WAAW,CAAC,KAAiC;IAC3D,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1B,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,KAAiC;IACjE,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7B,OAAO,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,UAAU,CAAC,GAAuB;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,0LAA0L;AAC1L,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,qNAAqN;AACrN,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,GAAG,GAAG,IAAI,CAAC;AACjB,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,IAAI,IAAI,eAAe,IAAI,CAAC,IAAI,IAAI,GAAG,IAAI,IAAI,IAAI,eAAe,CAAC,CAAC;AAC7E,CAAC;AAED,+ZAA+Z;AAC/Z,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC/D,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/core/gateway-trust-actions.d.ts

@@ -1,18 +1,16 @@
-/**
- * CommsTool's gateway-trust action handlers (agent-comms#156, extended by agent-comms#187's principal-keyed allowlist and agent-comms#193's tool-level `principal` flag) -- split out of tool.ts purely to keep that file under the repo's max-lines cap, the same reason agent-registry.ts, delivery-engine.ts, and their siblings were split from mesh-store.ts. Free functions over MeshOnlyFeatures's own gateway-trust methods rather than class methods, since CommsTool owns no state of its own for this concern -- every one of these is a pure translation from a CommsAction to a CommsResult against whatever store methods are present.
- */
 import type { CommsAction } from "./types.js";
 import type { CommsResult, MeshOnlyFeatures } from "./tool.js";
-/** The slice of MeshOnlyFeatures the three functions below actually need, named so this file doesn't repeat the same six-method Pick inline at every signature. */
-export type GatewayTrustStore = Pick<MeshOnlyFeatures, "addTrustedGateway" | "removeTrustedGateway" | "listTrustedGateways" | "addTrustedGatewayPrincipal" | "removeTrustedGatewayPrincipal" | "listTrustedGatewayPrincipals" | "listVerifiedMembers">;
-/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
+import { type Namer } from "./naming.js";
+/** The slice of MeshOnlyFeatures the three functions below actually need, named so this file doesn't repeat the same Pick inline at every signature. */
+export type GatewayTrustStore = Pick<MeshOnlyFeatures, "addTrustedGateway" | "removeTrustedGateway" | "listTrustedGateways" | "addTrustedGatewayPrincipal" | "removeTrustedGatewayPrincipal" | "listTrustedGatewayPrincipals" | "addTrustedGatewayMachine" | "removeTrustedGatewayMachine" | "listTrustedGatewayMachines" | "listVerifiedMembers">;
+/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, as a machine (GatewayTrust.addMachine, agent-comms#343) when action.machine is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
 export declare function gatewayTrust(store: Readonly<GatewayTrustStore>, action: CommsAction & {
     action: "gateway_trust";
 }): CommsResult;
-/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
+/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, from the machine allowlist (GatewayTrust.removeMachine, agent-comms#343, revoking every device it vouches for at once) when action.machine is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
 export declare function gatewayUntrust(store: Readonly<GatewayTrustStore>, action: CommsAction & {
     action: "gateway_untrust";
 }): CommsResult;
-/** Reports every currently trusted remote device-id and every currently trusted principal device-id (agent-comms#187) together -- listing is never mutually exclusive between the two sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no `principal` flag of its own. */
-export declare function gatewayListTrusted(store: Readonly<GatewayTrustStore>): CommsResult;
+/** Reports every currently trusted remote device-id, principal (agent-comms#187) and machine (agent-comms#343) together, and the devices reachable through a trusted principal or machine. Listing is never mutually exclusive between the sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no flag of its own. Each entry shows the full id, which gateway_untrust takes, then the display name namer gives it (agent-comms#345). */
+export declare function gatewayListTrusted(store: Readonly<GatewayTrustStore>, namer: Namer): CommsResult;
 //# sourceMappingURL=gateway-trust-actions.d.ts.map

package/dist/core/gateway-trust-actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust-actions.d.ts","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAE/D,mKAAmK;AACnK,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,gBAAgB,EACd,mBAAmB,GACnB,sBAAsB,GACtB,qBAAqB,GACrB,4BAA4B,GAC5B,+BAA+B,GAC/B,8BAA8B,GAC9B,qBAAqB,CACxB,CAAC;AAUF,8MAA8M;AAC9M,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAClC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAChD,WAAW,CAeb;AAED,4OAA4O;AAC5O,wBAAgB,cAAc,CAC5B,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAClC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAClD,WAAW,CAeb;AAED,wRAAwR;AACxR,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,GACjC,WAAW,CA+Bb"}
+{"version":3,"file":"gateway-trust-actions.d.ts","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAe,KAAK,KAAK,EAAE,MAAM,aAAa,CAAC;AAEtD,wJAAwJ;AACxJ,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAClC,gBAAgB,EACd,mBAAmB,GACnB,sBAAsB,GACtB,qBAAqB,GACrB,4BAA4B,GAC5B,+BAA+B,GAC/B,8BAA8B,GAC9B,0BAA0B,GAC1B,6BAA6B,GAC7B,4BAA4B,GAC5B,qBAAqB,CACxB,CAAC;AA0BF,mSAAmS;AACnS,wBAAgB,YAAY,CAC1B,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAClC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,GAChD,WAAW,CA6Bb;AAED,gYAAgY;AAChY,wBAAgB,cAAc,CAC5B,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAClC,MAAM,EAAE,WAAW,GAAG;IAAE,MAAM,EAAE,iBAAiB,CAAA;CAAE,GAClD,WAAW,CAgCb;AAgBD,obAAob;AACpb,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAClC,KAAK,EAAE,KAAK,GACX,WAAW,CA6Cb"}

package/dist/core/gateway-trust-actions.js

@@ -1,3 +1,22 @@
+/**
+ * CommsTool's gateway-trust action handlers (agent-comms#156, extended by agent-comms#187's principal-keyed allowlist, agent-comms#193's tool-level `principal` flag and agent-comms#343's `machine` flag), split out of tool.ts to keep that file under the repo's max-lines cap, the same reason agent-registry.ts, delivery-engine.ts, and their siblings were split from mesh-store.ts. Free functions over MeshOnlyFeatures's own gateway-trust methods rather than class methods, since CommsTool owns no state of its own for this concern: every one of these is a pure translation from a CommsAction to a CommsResult against whatever store methods are present.
+ */
+import { isDeviceIdHex } from "./room-path.js";
+import { idWithNames } from "./naming.js";
+/** The result for an id named as both a principal and a machine: the two are different kinds of issuer, so one id is at most one of them. */
+function principalOrMachine() {
+    return {
+        content: "Pass principal or machine, not both.",
+        isError: true,
+    };
+}
+/** The result for an id that is not a full device-id. Trusting one would persist an entry that matches no real device, principal or machine, yet still count towards hasAny and so start this side advertising on the hub. */
+function notADeviceId(device) {
+    return {
+        content: `${JSON.stringify(device)} is not a device-id: pass the full 64-character hex id (whoami prints this side's).`,
+        isError: true,
+    };
+}
 /** Uniform "gateway trust isn't available on this store" result, mirroring tool.ts's own notMeshBacked helper for the other MeshOnlyFeatures methods. */
 function gatewayTrustUnavailable() {
     return {
@@ -5,8 +24,23 @@ function gatewayTrustUnavailable() {
         isError: true,
     };
 }
-/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
+/** Trusts action.device: as a user principal (GatewayTrust.addPrincipal, agent-comms#187) when action.principal is true, as a machine (GatewayTrust.addMachine, agent-comms#343) when action.machine is true, or as a bare remote device-id (the original agent-comms#156 behaviour) otherwise. */
 export function gatewayTrust(store, action) {
+    if (action.principal === true && action.machine === true) {
+        return principalOrMachine();
+    }
+    if (!isDeviceIdHex(action.device.toLowerCase())) {
+        return notADeviceId(action.device);
+    }
+    if (action.machine === true) {
+        if (!store.addTrustedGatewayMachine)
+            return gatewayTrustUnavailable();
+        store.addTrustedGatewayMachine(action.device);
+        return {
+            content: `Trusted remote machine ${action.device}: every device it vouches for is now reachable.`,
+            isError: false,
+        };
+    }
     if (action.principal === true) {
         if (!store.addTrustedGatewayPrincipal)
             return gatewayTrustUnavailable();
@@ -24,8 +58,24 @@ export function gatewayTrust(store, action) {
         isError: false,
     };
 }
-/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
+/** Withdraws trust from action.device: from the principal allowlist (GatewayTrust.removePrincipal, agent-comms#187) when action.principal is true, from the machine allowlist (GatewayTrust.removeMachine, agent-comms#343, revoking every device it vouches for at once) when action.machine is true, or from the bare-device allowlist (the original agent-comms#156 behaviour) otherwise. */
 export function gatewayUntrust(store, action) {
+    if (action.principal === true && action.machine === true) {
+        return principalOrMachine();
+    }
+    if (!isDeviceIdHex(action.device.toLowerCase()) &&
+        !listedForUntrust(store, action)) {
+        return notADeviceId(action.device);
+    }
+    if (action.machine === true) {
+        if (!store.removeTrustedGatewayMachine)
+            return gatewayTrustUnavailable();
+        store.removeTrustedGatewayMachine(action.device);
+        return {
+            content: `Untrusted remote machine ${action.device}: no device is reachable through it any more.`,
+            isError: false,
+        };
+    }
     if (action.principal === true) {
         if (!store.removeTrustedGatewayPrincipal)
             return gatewayTrustUnavailable();
@@ -43,29 +93,45 @@ export function gatewayUntrust(store, action) {
         isError: false,
     };
 }
-/** Reports every currently trusted remote device-id and every currently trusted principal device-id (agent-comms#187) together -- listing is never mutually exclusive between the two sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no `principal` flag of its own. */
-export function gatewayListTrusted(store) {
+/** Whether action.device is already in the set gateway_untrust would remove it from, so an entry an earlier version persisted without checking its shape can still be withdrawn through the tool. */
+function listedForUntrust(store, action) {
+    const listed = action.machine === true
+        ? store.listTrustedGatewayMachines?.()
+        : action.principal === true
+            ? store.listTrustedGatewayPrincipals?.()
+            : store.listTrustedGateways?.();
+    return listed?.includes(action.device.toLowerCase()) === true;
+}
+/** Reports every currently trusted remote device-id, principal (agent-comms#187) and machine (agent-comms#343) together, and the devices reachable through a trusted principal or machine. Listing is never mutually exclusive between the sets, so, unlike gatewayTrust/gatewayUntrust above, this needs no flag of its own. Each entry shows the full id, which gateway_untrust takes, then the display name namer gives it (agent-comms#345). */
+export function gatewayListTrusted(store, namer) {
     if (!store.listTrustedGateways)
         return gatewayTrustUnavailable();
     const devices = store.listTrustedGateways();
     const principals = store.listTrustedGatewayPrincipals?.() ?? [];
+    const machines = store.listTrustedGatewayMachines?.() ?? [];
     const members = store.listVerifiedMembers?.() ?? [];
-    if (devices.length === 0 && principals.length === 0 && members.length === 0) {
+    const sections = [];
+    const section = (title, lines) => {
+        if (lines.length > 0) {
+            sections.push(`${title}:\n${lines.map((line) => `  ${line}`).join("\n")}`);
+        }
+    };
+    const entry = (id) => idWithNames(id, namer);
+    section("Trusted remote gateway devices", devices.map(entry));
+    section("Trusted remote gateway principals", principals.map(entry));
+    section("Trusted remote machines", machines.map(entry));
+    section("Devices trusted through a principal", members
+        .filter((member) => member.kind === "principal")
+        .map((member) => `${entry(member.device)} (vouched for by ${namer(member.issuer)})`));
+    section("Devices trusted through a machine", members
+        .filter((member) => member.kind === "machine")
+        .map((member) => `${entry(member.device)} (runs on ${namer(member.issuer)})`));
+    if (sections.length === 0) {
         return {
-            content: "No remote gateway devices or principals are trusted.",
+            content: "No remote gateway devices, principals or machines are trusted.",
             isError: false,
         };
     }
-    const sections = [];
-    if (devices.length > 0) {
-        sections.push(`Trusted remote gateway devices:\n${devices.map((device) => `  ${device}`).join("\n")}`);
-    }
-    if (principals.length > 0) {
-        sections.push(`Trusted remote gateway principals:\n${principals.map((principal) => `  ${principal}`).join("\n")}`);
-    }
-    if (members.length > 0) {
-        sections.push(`Devices trusted through a principal:\n${members.map((member) => `  ${member.device} (vouched for by ${member.principal})`).join("\n")}`);
-    }
     return {
         content: sections.join("\n"),
         isError: false,

package/dist/core/gateway-trust-actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"gateway-trust-actions.js","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAkBA,yJAAyJ;AACzJ,SAAS,uBAAuB;IAC9B,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,8MAA8M;AAC9M,MAAM,UAAU,YAAY,CAC1B,KAAkC,EAClC,MAAiD;IAEjD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,0BAA0B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxE,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,oCAAoC,MAAM,CAAC,MAAM,GAAG;YAC7D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAC/D,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,GAAG;QAC1D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,4OAA4O;AAC5O,MAAM,UAAU,cAAc,CAC5B,KAAkC,EAClC,MAAmD;IAEnD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,6BAA6B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QAC3E,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,sCAAsC,MAAM,CAAC,MAAM,GAAG;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAClE,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,GAAG;QAC5D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,wRAAwR;AACxR,MAAM,UAAU,kBAAkB,CAChC,KAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC;IACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5E,OAAO;YACL,OAAO,EAAE,sDAAsD;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,oCAAoC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CACX,uCAAuC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,yCAAyC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,oBAAoB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzI,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}
+{"version":3,"file":"gateway-trust-actions.js","sourceRoot":"","sources":["../../src/core/gateway-trust-actions.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAG/C,OAAO,EAAE,WAAW,EAAc,MAAM,aAAa,CAAC;AAiBtD,6IAA6I;AAC7I,SAAS,kBAAkB;IACzB,OAAO;QACL,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,8NAA8N;AAC9N,SAAS,YAAY,CAAC,MAAc;IAClC,OAAO;QACL,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,qFAAqF;QACvH,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,yJAAyJ;AACzJ,SAAS,uBAAuB;IAC9B,OAAO;QACL,OAAO,EAAE,+CAA+C;QACxD,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,mSAAmS;AACnS,MAAM,UAAU,YAAY,CAC1B,KAAkC,EAClC,MAAiD;IAEjD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAChD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,wBAAwB;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACtE,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,0BAA0B,MAAM,CAAC,MAAM,iDAAiD;YACjG,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,0BAA0B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACxE,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,oCAAoC,MAAM,CAAC,MAAM,GAAG;YAC7D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAC/D,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvC,OAAO;QACL,OAAO,EAAE,iCAAiC,MAAM,CAAC,MAAM,GAAG;QAC1D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,gYAAgY;AAChY,MAAM,UAAU,cAAc,CAC5B,KAAkC,EAClC,MAAmD;IAEnD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QACzD,OAAO,kBAAkB,EAAE,CAAC;IAC9B,CAAC;IACD,IACE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC3C,CAAC,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,EAChC,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,2BAA2B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QACzE,KAAK,CAAC,2BAA2B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,4BAA4B,MAAM,CAAC,MAAM,+CAA+C;YACjG,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,6BAA6B;YAAE,OAAO,uBAAuB,EAAE,CAAC;QAC3E,KAAK,CAAC,6BAA6B,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnD,OAAO;YACL,OAAO,EAAE,sCAAsC,MAAM,CAAC,MAAM,GAAG;YAC/D,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,oBAAoB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IAClE,KAAK,CAAC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO;QACL,OAAO,EAAE,mCAAmC,MAAM,CAAC,MAAM,GAAG;QAC5D,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC;AAED,qMAAqM;AACrM,SAAS,gBAAgB,CACvB,KAAkC,EAClC,MAAmD;IAEnD,MAAM,MAAM,GACV,MAAM,CAAC,OAAO,KAAK,IAAI;QACrB,CAAC,CAAC,KAAK,CAAC,0BAA0B,EAAE,EAAE;QACtC,CAAC,CAAC,MAAM,CAAC,SAAS,KAAK,IAAI;YACzB,CAAC,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE;YACxC,CAAC,CAAC,KAAK,CAAC,mBAAmB,EAAE,EAAE,CAAC;IACtC,OAAO,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,IAAI,CAAC;AAChE,CAAC;AAED,obAAob;AACpb,MAAM,UAAU,kBAAkB,CAChC,KAAkC,EAClC,KAAY;IAEZ,IAAI,CAAC,KAAK,CAAC,mBAAmB;QAAE,OAAO,uBAAuB,EAAE,CAAC;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,CAAC;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,CAAC;IAChE,MAAM,QAAQ,GAAG,KAAK,CAAC,0BAA0B,EAAE,EAAE,IAAI,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE,EAAE,IAAI,EAAE,CAAC;IACpD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,KAAwB,EAAQ,EAAE;QAChE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,MAAM,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5D,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC7D,OAAO,CAAC,gCAAgC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,mCAAmC,EAAE,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,OAAO,CAAC,yBAAyB,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,OAAO,CACL,qCAAqC,EACrC,OAAO;SACJ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC;SAC/C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CACT,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,oBAAoB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CACrE,CACJ,CAAC;IACF,OAAO,CACL,mCAAmC,EACnC,OAAO;SACJ,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;SAC7C,GAAG,CACF,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CACxE,CACJ,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,gEAAgE;YACzE,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,KAAK;KACf,CAAC;AACJ,CAAC"}