agent-comms 8.4.1 → 8.6.0

package/dist/core/machine-grouping.js

@@ -0,0 +1,102 @@
+/**
+ * Which machine each listed agent runs on (agent-comms#343), for list_agents' machine-grouped output. This device's own machine is known directly; every other device's is read from the machine proof in its gossiped agent/self advert and identified cryptographically (membership-proof.ts's identifyMembershipProofIssuer), so a device is grouped under a machine only when that machine's key signed a current proof for it. A device with no such proof (a hidden agent, which sends no agent/self advert, or a bridge that predates machine proofs) has no machine here.
+ *
+ * The same pass reads each machine's self display name claim (agent-comms#345) from the adverts of the devices it vouches for, and keeps a name only when the claim is signed by that very machine's key: the issuer is authentic, the content is the machine's own choice.
+ *
+ * Grouping is display, not trust: a proof names who vouches for a device id, not that the device gossiping it is that device, so nothing here is used to authorise anything. Identifying a proof is cryptography, so verdicts are remembered per proof text until the proof lapses, and the cache is bounded. For the same reason a failure to identify one proof is reported and leaves that device unplaced rather than failing the listing it feeds.
+ */
+import { readMachineNameClaim, readMembershipProof, } from "./gossip-directory.js";
+/** The most proofs, and separately the most name claims, whose verdict is remembered. */
+const VERDICT_CACHE_LIMIT = 1024;
+export class MachineGrouping {
+    deps;
+    verdicts = new Map();
+    names = new Map();
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The machine (hex) of each device this side can place on one, keyed by device id: this device's own, and every gossiped device with a current, valid machine proof. */
+    async machinesByDevice() {
+        const machines = new Map();
+        const own = this.deps.getMachineId();
+        // Without an identity attached there is no clock or revocation view to identify a proof against, and no own machine either.
+        if (own === undefined)
+            return machines;
+        machines.set(this.deps.getPeerId(), own);
+        for (const { deviceId, advert } of this.deps.listKnownDevices()) {
+            if (machines.has(deviceId))
+                continue;
+            const proof = readMembershipProof(advert, "machine");
+            if (proof === undefined)
+                continue;
+            const machine = await this.machineFor(proof, deviceId);
+            if (machine !== undefined)
+                machines.set(deviceId, machine);
+        }
+        return machines;
+    }
+    /** The self display name of each machine this side can place a device on, keyed by machine id: this host's own from its file, every other one from a claim its own key signed, gossiped by a device it vouches for. */
+    async machineNames() {
+        const names = new Map();
+        const machines = await this.machinesByDevice();
+        const own = this.deps.getMachineId();
+        const ownName = this.deps.getOwnMachineName();
+        if (own !== undefined && ownName !== undefined)
+            names.set(own, ownName);
+        for (const { deviceId, advert } of this.deps.listKnownDevices()) {
+            const machine = machines.get(deviceId);
+            if (machine === undefined || names.has(machine))
+                continue;
+            const claim = readMachineNameClaim(advert);
+            if (claim === undefined)
+                continue;
+            const name = await this.nameFor(claim, machine);
+            if (name !== undefined)
+                names.set(machine, name);
+        }
+        return names;
+    }
+    async nameFor(claim, subject) {
+        const cached = this.names.get(claim);
+        if (cached?.subject === subject && cached.until > Date.now()) {
+            return cached.name;
+        }
+        const verdict = await this.deps.verifyName({ claim, subject });
+        remember(this.names, claim, verdict.ok
+            ? { subject, name: verdict.name, until: verdict.expires }
+            : { subject, name: undefined, until: Number.POSITIVE_INFINITY });
+        return verdict.ok ? verdict.name : undefined;
+    }
+    async machineFor(proof, deviceHex) {
+        const cached = this.verdicts.get(proof);
+        if (cached?.deviceHex === deviceHex && cached.until > Date.now()) {
+            return cached.machine;
+        }
+        let verdict;
+        try {
+            verdict = await this.deps.identify({ proof, deviceHex });
+        }
+        catch (err) {
+            // Not remembered: the failure is in this side's own view (a revocation view that threw, say), not a verdict on the proof, so the next listing tries again.
+            this.deps.onError(new Error(`could not identify the machine proof of ${deviceHex}`, {
+                cause: err,
+            }));
+            return undefined;
+        }
+        remember(this.verdicts, proof, verdict.ok
+            ? { deviceHex, machine: verdict.issuerHex, until: verdict.expires }
+            : { deviceHex, machine: undefined, until: Number.POSITIVE_INFINITY });
+        return verdict.ok ? verdict.issuerHex : undefined;
+    }
+}
+/** Records verdict under key, evicting the oldest entry once the cache holds more than VERDICT_CACHE_LIMIT. */
+function remember(cache, key, verdict) {
+    cache.delete(key);
+    cache.set(key, verdict);
+    if (cache.size > VERDICT_CACHE_LIMIT) {
+        const oldest = cache.keys().next();
+        if (oldest.done !== true)
+            cache.delete(oldest.value);
+    }
+}
+//# sourceMappingURL=machine-grouping.js.map

package/dist/core/machine-grouping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-grouping.js","sourceRoot":"","sources":["../../src/core/machine-grouping.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAI/B,yFAAyF;AACzF,MAAM,mBAAmB,GAAG,IAAI,CAAC;AAwCjC,MAAM,OAAO,eAAe;IAIG;IAHZ,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAEvD,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;IAAG,CAAC;IAEpE,yKAAyK;IACzK,KAAK,CAAC,gBAAgB;QACpB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,4HAA4H;QAC5H,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACvC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,GAAG,CAAC,CAAC;QACzC,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAChE,IAAI,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACrC,MAAM,KAAK,GAAG,mBAAmB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,OAAO,KAAK,SAAS;gBAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,uNAAuN;IACvN,KAAK,CAAC,YAAY;QAChB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACxE,KAAK,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,CAAC;YAChE,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACvC,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,SAAS;YAC1D,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,SAAS;gBAAE,SAAS;YAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAChD,IAAI,IAAI,KAAK,SAAS;gBAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,KAAa,EACb,OAAe;QAEf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACrC,IAAI,MAAM,EAAE,OAAO,KAAK,OAAO,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7D,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/D,QAAQ,CACN,IAAI,CAAC,KAAK,EACV,KAAK,EACL,OAAO,CAAC,EAAE;YACR,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAClE,CAAC;QACF,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/C,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,MAAM,EAAE,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACjE,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QACD,IAAI,OAAkC,CAAC;QACvC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,2JAA2J;YAC3J,IAAI,CAAC,IAAI,CAAC,OAAO,CACf,IAAI,KAAK,CAAC,2CAA2C,SAAS,EAAE,EAAE;gBAChE,KAAK,EAAE,GAAG;aACX,CAAC,CACH,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,QAAQ,CACN,IAAI,CAAC,QAAQ,EACb,KAAK,EACL,OAAO,CAAC,EAAE;YACR,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE;YACnE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE,CACvE,CAAC;QACF,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;CACF;AAED,+GAA+G;AAC/G,SAAS,QAAQ,CAAI,KAAqB,EAAE,GAAW,EAAE,OAAU;IACjE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAClB,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACxB,IAAI,KAAK,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/core/machine-identity.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Persistent machine identity (agent-comms#343): one keypair per OS account per host, the third identity scope beside a bridge slot's device identity (identity-store.ts) and the account's user principal (user-identity.ts). It is structurally another grouping issuer, like the principal: it vouches for the devices living on this host with the same group:member proofs (membership-proof.ts), so a peer can group devices by machine and trust or stop trusting a whole host in one act.
+ *
+ * Stored at ~/.agent-comms/machine-identity.json (mode 0600), so it belongs to the OS account whose home directory holds it: every bridge that account runs on the host reads the same file and is vouched for by the same machine key, while another account on the same host mints a machine key of its own and appears as a separate machine. Until the principal becomes portable across hosts (agent-comms#344) this is the same scope as the user principal; a key naming the host across every account needs a signer outside any one account and is agent-comms#367. The key is generated locally on first use and never derived from hardware (issuer-identity-file.ts says why); re-homing a rebuilt host is a deliberate copy of this file.
+ */
+import type { PeerIdentity } from "./identity.js";
+export interface MachineIdentityOptions {
+    /** Directory override for tests; defaults to ~/.agent-comms, beside the user identity and every bridge slot. */
+    dir?: string;
+}
+/** The machine identity file for options. */
+export declare function machineIdentityFile(options?: Readonly<MachineIdentityOptions>): string;
+/** Loads this account's machine identity for this host, creating it on first use (exclusive create, renewal in place, an unusable file refused rather than regenerated). */
+export declare function loadOrCreateMachineIdentity(options?: Readonly<MachineIdentityOptions>): PeerIdentity;
+/** The name this machine asserts for itself, or undefined when it has none or the machine identity has not been created yet. Read from disk on every call, so a name set by any bridge on the host is seen by all of them. */
+export declare function loadMachineDisplayName(options?: Readonly<MachineIdentityOptions>): string | undefined;
+/** Sets (or, given undefined, clears) the name this machine asserts for itself, keeping the key material and every other field. Throws if the machine identity has not been created yet. */
+export declare function saveMachineDisplayName(options: Readonly<MachineIdentityOptions> | undefined, displayName: string | undefined): void;
+//# sourceMappingURL=machine-identity.d.ts.map

package/dist/core/machine-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-identity.d.ts","sourceRoot":"","sources":["../../src/core/machine-identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AASlD,MAAM,WAAW,sBAAsB;IACrC,gHAAgH;IAChH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,6CAA6C;AAC7C,wBAAgB,mBAAmB,CACjC,OAAO,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GACzC,MAAM,CAGR;AAED,4KAA4K;AAC5K,wBAAgB,2BAA2B,CACzC,OAAO,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GACzC,YAAY,CAKd;AAcD,8NAA8N;AAC9N,wBAAgB,sBAAsB,CACpC,OAAO,CAAC,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GACzC,MAAM,GAAG,SAAS,CAGpB;AAED,4LAA4L;AAC5L,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,SAAS,EACrD,WAAW,EAAE,MAAM,GAAG,SAAS,GAC9B,IAAI,CAYN"}

package/dist/core/machine-identity.js

@@ -0,0 +1,42 @@
+/**
+ * Persistent machine identity (agent-comms#343): one keypair per OS account per host, the third identity scope beside a bridge slot's device identity (identity-store.ts) and the account's user principal (user-identity.ts). It is structurally another grouping issuer, like the principal: it vouches for the devices living on this host with the same group:member proofs (membership-proof.ts), so a peer can group devices by machine and trust or stop trusting a whole host in one act.
+ *
+ * Stored at ~/.agent-comms/machine-identity.json (mode 0600), so it belongs to the OS account whose home directory holds it: every bridge that account runs on the host reads the same file and is vouched for by the same machine key, while another account on the same host mints a machine key of its own and appears as a separate machine. Until the principal becomes portable across hosts (agent-comms#344) this is the same scope as the user principal; a key naming the host across every account needs a signer outside any one account and is agent-comms#367. The key is generated locally on first use and never derived from hardware (issuer-identity-file.ts says why); re-homing a rebuilt host is a deliberate copy of this file.
+ */
+import * as os from "node:os";
+import * as path from "node:path";
+import { isStoredIssuerKey, loadOrCreateIssuerIdentity, readIssuerRecord, writeIssuerRecord, } from "./issuer-identity-file.js";
+/** The machine identity file for options. */
+export function machineIdentityFile(options) {
+    const dir = options?.dir ?? path.join(os.homedir(), ".agent-comms");
+    return path.join(dir, "machine-identity.json");
+}
+/** Loads this account's machine identity for this host, creating it on first use (exclusive create, renewal in place, an unusable file refused rather than regenerated). */
+export function loadOrCreateMachineIdentity(options) {
+    return loadOrCreateIssuerIdentity(machineIdentityFile(options), isStoredMachineIdentity);
+}
+function isStoredMachineIdentity(value) {
+    if (!isStoredIssuerKey(value))
+        return false;
+    return !("displayName" in value) || typeof value.displayName === "string";
+}
+/** The name this machine asserts for itself, or undefined when it has none or the machine identity has not been created yet. Read from disk on every call, so a name set by any bridge on the host is seen by all of them. */
+export function loadMachineDisplayName(options) {
+    return readIssuerRecord(machineIdentityFile(options), isStoredMachineIdentity)
+        ?.displayName;
+}
+/** Sets (or, given undefined, clears) the name this machine asserts for itself, keeping the key material and every other field. Throws if the machine identity has not been created yet. */
+export function saveMachineDisplayName(options, displayName) {
+    const file = machineIdentityFile(options);
+    const stored = readIssuerRecord(file, isStoredMachineIdentity);
+    if (stored === undefined) {
+        throw new Error(`no machine identity persisted yet; call loadOrCreateMachineIdentity first (${file})`);
+    }
+    const next = { ...stored };
+    if (displayName === undefined)
+        delete next.displayName;
+    else
+        next.displayName = displayName;
+    writeIssuerRecord(file, next);
+}
+//# sourceMappingURL=machine-identity.js.map

package/dist/core/machine-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-identity.js","sourceRoot":"","sources":["../../src/core/machine-identity.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,2BAA2B,CAAC;AAOnC,6CAA6C;AAC7C,MAAM,UAAU,mBAAmB,CACjC,OAA0C;IAE1C,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;IACpE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;AACjD,CAAC;AAED,4KAA4K;AAC5K,MAAM,UAAU,2BAA2B,CACzC,OAA0C;IAE1C,OAAO,0BAA0B,CAC/B,mBAAmB,CAAC,OAAO,CAAC,EAC5B,uBAAuB,CACxB,CAAC;AACJ,CAAC;AAOD,SAAS,uBAAuB,CAC9B,KAAc;IAEd,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CAAC,CAAC,aAAa,IAAI,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC;AAC5E,CAAC;AAED,8NAA8N;AAC9N,MAAM,UAAU,sBAAsB,CACpC,OAA0C;IAE1C,OAAO,gBAAgB,CAAC,mBAAmB,CAAC,OAAO,CAAC,EAAE,uBAAuB,CAAC;QAC5E,EAAE,WAAW,CAAC;AAClB,CAAC;AAED,4LAA4L;AAC5L,MAAM,UAAU,sBAAsB,CACpC,OAAqD,EACrD,WAA+B;IAE/B,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,uBAAuB,CAAC,CAAC;IAC/D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E,IAAI,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA0B,EAAE,GAAG,MAAM,EAAE,CAAC;IAClD,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;;QAClD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACpC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/core/machine-list-groups.d.ts

@@ -0,0 +1,13 @@
+/**
+ * list_agents' machine grouping (agent-comms#343): the listed agents split into one group per machine, this host first, then every other machine by id, then the agents no machine proof places. Split out of tool.ts to keep that file under the repo's max-lines cap.
+ */
+import type { AgentIdentity } from "./types.js";
+import type { Namer } from "./naming.js";
+/** One run of listed agents and the heading above it; no heading when nothing is grouped at all. */
+export interface AgentGroup {
+    heading: string | undefined;
+    agents: AgentIdentity[];
+}
+/** agents grouped by machine, each group keeping the agents' listed order and each heading naming its machine by the display convention (namer). machines maps device id to machine id (MeshStore.listAgentMachines); undefined on a store with no machine identity, in which case, as when no agent is placed on a machine, the list is one ungrouped run. */
+export declare function groupAgentsByMachine(agents: readonly AgentIdentity[], machines: ReadonlyMap<string, string> | undefined, ownMachine: string | undefined, namer: Namer): AgentGroup[];
+//# sourceMappingURL=machine-list-groups.d.ts.map

package/dist/core/machine-list-groups.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-list-groups.d.ts","sourceRoot":"","sources":["../../src/core/machine-list-groups.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC,oGAAoG;AACpG,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,aAAa,EAAE,CAAC;CACzB;AAED,+VAA+V;AAC/V,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,SAAS,aAAa,EAAE,EAChC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACjD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,KAAK,GACX,UAAU,EAAE,CAiCd"}

package/dist/core/machine-list-groups.js

@@ -0,0 +1,41 @@
+/**
+ * list_agents' machine grouping (agent-comms#343): the listed agents split into one group per machine, this host first, then every other machine by id, then the agents no machine proof places. Split out of tool.ts to keep that file under the repo's max-lines cap.
+ */
+/** agents grouped by machine, each group keeping the agents' listed order and each heading naming its machine by the display convention (namer). machines maps device id to machine id (MeshStore.listAgentMachines); undefined on a store with no machine identity, in which case, as when no agent is placed on a machine, the list is one ungrouped run. */
+export function groupAgentsByMachine(agents, machines, ownMachine, namer) {
+    if (machines === undefined ||
+        !agents.some((agent) => machines.has(agent.id))) {
+        return [{ heading: undefined, agents: [...agents] }];
+    }
+    const byMachine = new Map();
+    const unplaced = [];
+    for (const agent of agents) {
+        const machine = machines.get(agent.id);
+        if (machine === undefined) {
+            unplaced.push(agent);
+            continue;
+        }
+        const group = byMachine.get(machine);
+        if (group === undefined)
+            byMachine.set(machine, [agent]);
+        else
+            group.push(agent);
+    }
+    const groups = [...byMachine]
+        .sort(([a], [b]) => {
+        if (a === ownMachine)
+            return -1;
+        if (b === ownMachine)
+            return 1;
+        return a.localeCompare(b);
+    })
+        .map(([machine, members]) => ({
+        heading: `Machine ${namer(machine)}${machine === ownMachine ? " (this machine)" : ""}:`,
+        agents: members,
+    }));
+    if (unplaced.length > 0) {
+        groups.push({ heading: "Machine not proven:", agents: unplaced });
+    }
+    return groups;
+}
+//# sourceMappingURL=machine-list-groups.js.map

package/dist/core/machine-list-groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-list-groups.js","sourceRoot":"","sources":["../../src/core/machine-list-groups.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,+VAA+V;AAC/V,MAAM,UAAU,oBAAoB,CAClC,MAAgC,EAChC,QAAiD,EACjD,UAA8B,EAC9B,KAAY;IAEZ,IACE,QAAQ,KAAK,SAAS;QACtB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAC/C,CAAC;QACD,OAAO,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IACrD,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,MAAM,GAAiB,CAAC,GAAG,SAAS,CAAC;SACxC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QACjB,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,UAAU;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5B,OAAO,EAAE,WAAW,KAAK,CAAC,OAAO,CAAC,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG;QACvF,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC,CAAC;IACN,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/machine-name-claim.d.ts

@@ -0,0 +1,22 @@
+/**
+ * This host's self display name claim (agent-comms#345), kept fresh beside the machine proof: re-minted on the proofs' own cadence from whatever name machine-identity.json currently holds, so a name set or cleared by any bridge on the host reaches every bridge's advert within one refresh, and the setting bridge's at once.
+ */
+import type { MeshStoreIdentity } from "./mesh-store-shared.js";
+export interface MachineNameClaimDeps {
+    /** Throws if the store has no identity yet. */
+    getIdentity: () => MeshStoreIdentity;
+    onError: (error: Error) => void;
+}
+export declare class MachineNameClaim {
+    private readonly deps;
+    private claim;
+    private timer;
+    constructor(deps: Readonly<MachineNameClaimDeps>);
+    /** The current claim, undefined while the machine has no name or before the first claim is minted. */
+    current(): string | undefined;
+    start(): void;
+    stop(): void;
+    /** Re-reads the machine's name and re-mints its claim now; drops the claim when the machine has no name. A failed mint is reported and the previous claim is kept until the next refresh. */
+    refresh(): Promise<void>;
+}
+//# sourceMappingURL=machine-name-claim.d.ts.map

package/dist/core/machine-name-claim.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-name-claim.d.ts","sourceRoot":"","sources":["../../src/core/machine-name-claim.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAKhE,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,iBAAiB,CAAC;IACrC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,gBAAgB;IAIf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHjC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,KAAK,CAA6C;gBAE7B,IAAI,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IAEjE,sGAAsG;IACtG,OAAO,IAAI,MAAM,GAAG,SAAS;IAI7B,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAKZ,6LAA6L;IACvL,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAoB/B"}

package/dist/core/machine-name-claim.js

@@ -0,0 +1,52 @@
+/**
+ * This host's self display name claim (agent-comms#345), kept fresh beside the machine proof: re-minted on the proofs' own cadence from whatever name machine-identity.json currently holds, so a name set or cleared by any bridge on the host reaches every bridge's advert within one refresh, and the setting bridge's at once.
+ */
+import { loadMachineDisplayName } from "./machine-identity.js";
+import { MEMBERSHIP_PROOF_LIFETIME_MS } from "./membership-proof.js";
+import { PROOF_REFRESH_INTERVAL_MS } from "./membership-proofs.js";
+import { mintNameClaim } from "./name-claim.js";
+export class MachineNameClaim {
+    deps;
+    claim;
+    timer;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The current claim, undefined while the machine has no name or before the first claim is minted. */
+    current() {
+        return this.claim;
+    }
+    start() {
+        this.stop();
+        void this.refresh();
+        this.timer = setInterval(() => {
+            void this.refresh();
+        }, PROOF_REFRESH_INTERVAL_MS);
+        this.timer.unref();
+    }
+    stop() {
+        clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Re-reads the machine's name and re-mints its claim now; drops the claim when the machine has no name. A failed mint is reported and the previous claim is kept until the next refresh. */
+    async refresh() {
+        const identity = this.deps.getIdentity();
+        const name = loadMachineDisplayName(identity.machineIdentityOptions);
+        if (name === undefined) {
+            this.claim = undefined;
+            return;
+        }
+        try {
+            this.claim = await mintNameClaim({
+                issuer: identity.machineIdentity,
+                clock: identity.clock,
+                name,
+                lifetimeMs: MEMBERSHIP_PROOF_LIFETIME_MS,
+            });
+        }
+        catch (error) {
+            this.deps.onError(error instanceof Error ? error : new Error(String(error)));
+        }
+    }
+}
+//# sourceMappingURL=machine-name-claim.js.map

package/dist/core/machine-name-claim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine-name-claim.js","sourceRoot":"","sources":["../../src/core/machine-name-claim.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAE/D,OAAO,EAAE,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAQhD,MAAM,OAAO,gBAAgB;IAIE;IAHrB,KAAK,CAAqB;IAC1B,KAAK,CAA6C;IAE1D,YAA6B,IAAoC;QAApC,SAAI,GAAJ,IAAI,CAAgC;IAAG,CAAC;IAErE,sGAAsG;IACtG,OAAO;QACL,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;YAC5B,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtB,CAAC,EAAE,yBAAyB,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,IAAI;QACF,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,6LAA6L;IAC7L,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,IAAI,GAAG,sBAAsB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;QACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACvB,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,IAAI,CAAC,KAAK,GAAG,MAAM,aAAa,CAAC;gBAC/B,MAAM,EAAE,QAAQ,CAAC,eAAe;gBAChC,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,IAAI;gBACJ,UAAU,EAAE,4BAA4B;aACzC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,IAAI,CAAC,OAAO,CACf,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/core/membership-proof.d.ts

@@ -1,9 +1,9 @@
 /**
- * The proof a device gossips to show that its user principal vouches for it (agent-comms#266): a short-lived group:member token, minted by that principal for that one device, carried as one line of text. A receiver that trusts the principal verifies it against the gossiping device and then trusts the device without it being listed individually, which is what trusting a principal is for.
+ * The proof a device gossips to show that a grouping issuer vouches for it (agent-comms#266 for the user principal, agent-comms#343 for the machine): a short-lived group:member token, minted by that issuer for that one device, carried as one line of text. A receiver that trusts the issuer verifies it against the gossiping device and then trusts the device without it being listed individually, which is what trusting a principal or a machine is for. A receiver that only wants to know which machine a device runs on reads the issuer out of the proof (identifyMembershipProofIssuer).
  *
- * A proof shows that the principal vouches for a device id. It does not show that whoever gossips it is that device: both arrive in the same unauthenticated advert and anyone who has read one can repeat it, so it earns only what GatewayTrust.isReachable grants (see directory-admission.ts). It is also public: it names the principal, so anyone connected to the hub can see which devices belong to which principal.
+ * A proof shows that the issuer vouches for a device id. It does not show that whoever gossips it is that device: both arrive in the same unauthenticated advert and anyone who has read one can repeat it, so it earns only what GatewayTrust.isReachable grants (see directory-admission.ts). It is also public: it names the issuer, so anyone connected to the hub can see which devices belong to which principal and which run on the same machine. That is why a proof is only ever carried in the agent/self advert, which a hidden or ghost agent never sends.
  *
- * Every bridge of one account shares that account's user identity, so any of them can mint a proof for any device id, which is the same trust the principal is given anyway. Proofs are short-lived rather than revocable, so removeDevice (which revokes an admitDevice grant) does not affect them and a removed device holding the account's key can keep minting its own: they are minted without recording an issued-grant, so a bridge refreshing its own does not rewrite the shared user-identity.json.
+ * Every bridge of one account shares that account's user identity, and every bridge one account runs on a host shares that account's machine identity for the host (machine-identity.ts), so any of them can mint a proof for any device id, which is the same trust the issuer is given anyway. Proofs are short-lived rather than revocable, so removeDevice (which revokes an admitDevice grant) does not affect them and a removed device holding the issuer's key can keep minting its own: they are minted without recording an issued-grant, so a bridge refreshing its own does not rewrite the shared identity file.
  */
 import type { Clock } from "wire-mesh-core/ports/clock";
 import type { IdentityPort } from "wire-mesh-core/ports/identity";
@@ -14,20 +14,20 @@ export declare const MAX_MEMBERSHIP_PROOF_LENGTH = 4096;
 /** How long a minted proof stays valid. Long enough to ride out a missed refresh or a gossip gap, short enough that a device an account stops running stops being trusted soon after. */
 export declare const MEMBERSHIP_PROOF_LIFETIME_MS: number;
 export interface MintMembershipProofOptions {
-    /** The user principal vouching for the device. */
-    userIdentity: IdentityPort;
+    /** The grouping issuer vouching for the device: the user principal or the machine. */
+    issuer: IdentityPort;
     clock: Clock;
     /** The device the proof is for, and the only device it will verify for. */
     deviceId: DeviceId;
 }
-/** A fresh proof that options.userIdentity vouches for options.deviceId, as one line of text. Throws MINT_FAILED if the token cannot be minted. */
+/** A fresh proof that options.issuer vouches for options.deviceId, as one line of text. Throws MINT_FAILED if the token cannot be minted. */
 export declare function mintMembershipProof(options: Readonly<MintMembershipProofOptions>): Promise<string>;
 export interface VerifyMembershipProofOptions {
     proof: string;
     /** The device the proof is claimed for: the gossiping device the directory entry names. */
     deviceId: DeviceId;
-    /** The principal the proof must have been minted by. */
-    principalId: DeviceId;
+    /** The issuer (principal or machine) the proof must have been minted by. */
+    issuerId: DeviceId;
     /** The verifying node's own identity, clock and revocation view. */
     identity: IdentityPort;
     clock: Clock;
@@ -40,6 +40,17 @@ export type MembershipProofVerdict = {
     ok: false;
     reason: string;
 };
-/** Whether options.proof shows that options.principalId vouches for options.deviceId right now. Never throws for a bad proof: text that is not a token, a token for another device or principal, an expired or revoked one, all come back as a refusal. */
+/** Whether options.proof shows that options.issuerId vouches for options.deviceId right now. Never throws for a bad proof: text that is not a token, a token for another device or issuer, an expired or revoked one, all come back as a refusal. */
 export declare function verifyMembershipProof(options: Readonly<VerifyMembershipProofOptions>): Promise<MembershipProofVerdict>;
+export type IdentifyMembershipProofOptions = Omit<VerifyMembershipProofOptions, "issuerId">;
+export type IdentifiedMembershipProof = {
+    ok: true;
+    issuerHex: string;
+    expires: number;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Which issuer options.proof shows vouching for options.deviceId right now, learned from the proof itself rather than checked against one already known: the same refusals as verifyMembershipProof, plus a proof whose named group is not the key that signed it. */
+export declare function identifyMembershipProofIssuer(options: Readonly<IdentifyMembershipProofOptions>): Promise<IdentifiedMembershipProof>;
 //# sourceMappingURL=membership-proof.d.ts.map

package/dist/core/membership-proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-proof.d.ts","sourceRoot":"","sources":["../../src/core/membership-proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAUlE,gPAAgP;AAChP,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,yLAAyL;AACzL,eAAO,MAAM,4BAA4B,QACU,CAAC;AAEpD,MAAM,WAAW,0BAA0B;IACzC,kDAAkD;IAClD,YAAY,EAAE,YAAY,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC;IACb,2EAA2E;IAC3E,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,mJAAmJ;AACnJ,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,QAAQ,EAAE,QAAQ,CAAC;IACnB,wDAAwD;IACxD,WAAW,EAAE,QAAQ,CAAC;IACtB,oEAAoE;IACpE,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEhE,2PAA2P;AAC3P,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,QAAQ,CAAC,4BAA4B,CAAC,GAC9C,OAAO,CAAC,sBAAsB,CAAC,CAqBjC"}
+{"version":3,"file":"membership-proof.d.ts","sourceRoot":"","sources":["../../src/core/membership-proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAEV,QAAQ,EACT,MAAM,mCAAmC,CAAC;AAa3C,gPAAgP;AAChP,eAAO,MAAM,2BAA2B,OAAO,CAAC;AAEhD,yLAAyL;AACzL,eAAO,MAAM,4BAA4B,QACU,CAAC;AAEpD,MAAM,WAAW,0BAA0B;IACzC,sFAAsF;IACtF,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,2EAA2E;IAC3E,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED,6IAA6I;AAC7I,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GAC5C,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,2FAA2F;IAC3F,QAAQ,EAAE,QAAQ,CAAC;IACnB,4EAA4E;IAC5E,QAAQ,EAAE,QAAQ,CAAC;IACnB,oEAAoE;IACpE,QAAQ,EAAE,YAAY,CAAC;IACvB,KAAK,EAAE,KAAK,CAAC;IACb,UAAU,EAAE,cAAc,CAAC;CAC5B;AAED,MAAM,MAAM,sBAAsB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgBhE,qPAAqP;AACrP,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,QAAQ,CAAC,4BAA4B,CAAC,GAC9C,OAAO,CAAC,sBAAsB,CAAC,CAcjC;AAED,MAAM,MAAM,8BAA8B,GAAG,IAAI,CAC/C,4BAA4B,EAC5B,UAAU,CACX,CAAC;AAEF,MAAM,MAAM,yBAAyB,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAChD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,uQAAuQ;AACvQ,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,QAAQ,CAAC,8BAA8B,CAAC,GAChD,OAAO,CAAC,yBAAyB,CAAC,CAgBpC"}

package/dist/core/membership-proof.js

@@ -1,12 +1,12 @@
 /**
- * The proof a device gossips to show that its user principal vouches for it (agent-comms#266): a short-lived group:member token, minted by that principal for that one device, carried as one line of text. A receiver that trusts the principal verifies it against the gossiping device and then trusts the device without it being listed individually, which is what trusting a principal is for.
+ * The proof a device gossips to show that a grouping issuer vouches for it (agent-comms#266 for the user principal, agent-comms#343 for the machine): a short-lived group:member token, minted by that issuer for that one device, carried as one line of text. A receiver that trusts the issuer verifies it against the gossiping device and then trusts the device without it being listed individually, which is what trusting a principal or a machine is for. A receiver that only wants to know which machine a device runs on reads the issuer out of the proof (identifyMembershipProofIssuer).
  *
- * A proof shows that the principal vouches for a device id. It does not show that whoever gossips it is that device: both arrive in the same unauthenticated advert and anyone who has read one can repeat it, so it earns only what GatewayTrust.isReachable grants (see directory-admission.ts). It is also public: it names the principal, so anyone connected to the hub can see which devices belong to which principal.
+ * A proof shows that the issuer vouches for a device id. It does not show that whoever gossips it is that device: both arrive in the same unauthenticated advert and anyone who has read one can repeat it, so it earns only what GatewayTrust.isReachable grants (see directory-admission.ts). It is also public: it names the issuer, so anyone connected to the hub can see which devices belong to which principal and which run on the same machine. That is why a proof is only ever carried in the agent/self advert, which a hidden or ghost agent never sends.
  *
- * Every bridge of one account shares that account's user identity, so any of them can mint a proof for any device id, which is the same trust the principal is given anyway. Proofs are short-lived rather than revocable, so removeDevice (which revokes an admitDevice grant) does not affect them and a removed device holding the account's key can keep minting its own: they are minted without recording an issued-grant, so a bridge refreshing its own does not rewrite the shared user-identity.json.
+ * Every bridge of one account shares that account's user identity, and every bridge one account runs on a host shares that account's machine identity for the host (machine-identity.ts), so any of them can mint a proof for any device id, which is the same trust the issuer is given anyway. Proofs are short-lived rather than revocable, so removeDevice (which revokes an admitDevice grant) does not affect them and a removed device holding the issuer's key can keep minting its own: they are minted without recording an issued-grant, so a bridge refreshing its own does not rewrite the shared identity file.
  */
-import { mintDeviceMembership } from "./device-membership.js";
-import { verifyDeviceMembership } from "./device-membership-verification.js";
+import { mintGroupMembership } from "./device-membership.js";
+import { identifyGroupIssuer, verifyDeviceMembership, } from "./device-membership-verification.js";
 import { randomId } from "./random-id.js";
 import { CommsError } from "./store.js";
 import { decodeTokenText, encodeTokenText } from "./token-text.js";
@@ -16,10 +16,10 @@ const MEMBERSHIP_PROOF_LIFETIME_MINUTES = 15;
 export const MAX_MEMBERSHIP_PROOF_LENGTH = 4096;
 /** How long a minted proof stays valid. Long enough to ride out a missed refresh or a gossip gap, short enough that a device an account stops running stops being trusted soon after. */
 export const MEMBERSHIP_PROOF_LIFETIME_MS = MEMBERSHIP_PROOF_LIFETIME_MINUTES * MS_PER_MINUTE;
-/** A fresh proof that options.userIdentity vouches for options.deviceId, as one line of text. Throws MINT_FAILED if the token cannot be minted. */
+/** A fresh proof that options.issuer vouches for options.deviceId, as one line of text. Throws MINT_FAILED if the token cannot be minted. */
 export async function mintMembershipProof(options) {
-    const verdict = await mintDeviceMembership({
-        userIdentity: options.userIdentity,
+    const verdict = await mintGroupMembership({
+        issuer: options.issuer,
         clock: options.clock,
         tokenId: randomId(),
         deviceId: options.deviceId,
@@ -30,24 +30,29 @@ export async function mintMembershipProof(options) {
     }
     return encodeTokenText(verdict.token);
 }
-/** Whether options.proof shows that options.principalId vouches for options.deviceId right now. Never throws for a bad proof: text that is not a token, a token for another device or principal, an expired or revoked one, all come back as a refusal. */
-export async function verifyMembershipProof(options) {
-    if (options.proof.length > MAX_MEMBERSHIP_PROOF_LENGTH) {
+/** The proof text decoded to a token, or the refusal for text that cannot be one. */
+function decodeProof(proof) {
+    if (proof.length > MAX_MEMBERSHIP_PROOF_LENGTH) {
         return { ok: false, reason: "too_long" };
     }
-    let token;
     try {
-        token = decodeTokenText(options.proof);
+        return { ok: true, token: decodeTokenText(proof) };
     }
     catch {
         return { ok: false, reason: "not_a_token" };
     }
-    const verdict = await verifyDeviceMembership(token, {
+}
+/** Whether options.proof shows that options.issuerId vouches for options.deviceId right now. Never throws for a bad proof: text that is not a token, a token for another device or issuer, an expired or revoked one, all come back as a refusal. */
+export async function verifyMembershipProof(options) {
+    const decoded = decodeProof(options.proof);
+    if (!decoded.ok)
+        return decoded;
+    const verdict = await verifyDeviceMembership(decoded.token, {
         identity: options.identity,
         clock: options.clock,
         revocation: options.revocation,
         expectedBearer: options.deviceId,
-        userDeviceId: options.principalId,
+        groupIssuerId: options.issuerId,
     });
     if (!verdict.ok)
         return { ok: false, reason: verdict.reason };
@@ -56,4 +61,25 @@ export async function verifyMembershipProof(options) {
         return { ok: false, reason: "not_root_level" };
     return { ok: true, expires: verdict.claims.expires };
 }
+/** Which issuer options.proof shows vouching for options.deviceId right now, learned from the proof itself rather than checked against one already known: the same refusals as verifyMembershipProof, plus a proof whose named group is not the key that signed it. */
+export async function identifyMembershipProofIssuer(options) {
+    const decoded = decodeProof(options.proof);
+    if (!decoded.ok)
+        return decoded;
+    const verdict = await identifyGroupIssuer(decoded.token, {
+        identity: options.identity,
+        clock: options.clock,
+        revocation: options.revocation,
+        expectedBearer: options.deviceId,
+    });
+    if (!verdict.ok)
+        return { ok: false, reason: verdict.reason };
+    if (verdict.depth !== 0)
+        return { ok: false, reason: "not_root_level" };
+    return {
+        ok: true,
+        issuerHex: verdict.issuerHex,
+        expires: verdict.claims.expires,
+    };
+}
 //# sourceMappingURL=membership-proof.js.map

package/dist/core/membership-proof.js.map

@@ -1 +1 @@
-{"version":3,"file":"membership-proof.js","sourceRoot":"","sources":["../../src/core/membership-proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAE7C,gPAAgP;AAChP,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,yLAAyL;AACzL,MAAM,CAAC,MAAM,4BAA4B,GACvC,iCAAiC,GAAG,aAAa,CAAC;AAUpD,mJAAmJ;AACnJ,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6C;IAE7C,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,QAAQ,EAAE;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,4BAA4B;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAClB,sCAAsC,OAAO,CAAC,MAAM,EAAE,EACtD,aAAa,CACd,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAiBD,2PAA2P;AAC3P,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA+C;IAE/C,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QACvD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE;QAClD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,QAAQ;QAChC,YAAY,EAAE,OAAO,CAAC,WAAW;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,gHAAgH;IAChH,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AACvD,CAAC"}
+{"version":3,"file":"membership-proof.js","sourceRoot":"","sources":["../../src/core/membership-proof.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEnE,MAAM,aAAa,GAAG,MAAM,CAAC;AAC7B,MAAM,iCAAiC,GAAG,EAAE,CAAC;AAE7C,gPAAgP;AAChP,MAAM,CAAC,MAAM,2BAA2B,GAAG,IAAI,CAAC;AAEhD,yLAAyL;AACzL,MAAM,CAAC,MAAM,4BAA4B,GACvC,iCAAiC,GAAG,aAAa,CAAC;AAUpD,6IAA6I;AAC7I,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6C;IAE7C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,QAAQ,EAAE;QACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,4BAA4B;KAC5D,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,UAAU,CAClB,sCAAsC,OAAO,CAAC,MAAM,EAAE,EACtD,aAAa,CACd,CAAC;IACJ,CAAC;IACD,OAAO,eAAe,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAiBD,qFAAqF;AACrF,SAAS,WAAW,CAClB,KAAa;IAEb,IAAI,KAAK,CAAC,MAAM,GAAG,2BAA2B,EAAE,CAAC;QAC/C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,qPAAqP;AACrP,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAA+C;IAE/C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,EAAE;QAC1D,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,QAAQ;QAChC,aAAa,EAAE,OAAO,CAAC,QAAQ;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,gHAAgH;IAChH,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACxE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;AACvD,CAAC;AAWD,uQAAuQ;AACvQ,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAAiD;IAEjD,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,KAAK,EAAE;QACvD,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,QAAQ;KACjC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACxE,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO;KAChC,CAAC;AACJ,CAAC"}

package/dist/core/membership-proofs.d.ts

@@ -1,11 +1,16 @@
 /**
- * A device's own membership proof, kept fresh, and the check for other devices' proofs (agent-comms#266). Split out of MeshStore, which hands it its identity, peer id and error sink.
+ * A device's own membership proof under one grouping issuer, kept fresh, and the checks for other devices' proofs (agent-comms#266, agent-comms#343). MeshStore holds one instance per issuer, its user principal and its machine, and hands each its identity, peer id and error sink. The checks do not depend on which issuer an instance mints under, so either instance can verify or identify any proof.
  */
+import type { IdentityPort } from "wire-mesh-core/ports/identity";
 import type { MeshStoreIdentity } from "./mesh-store-shared.js";
-import { type MembershipProofVerdict } from "./membership-proof.js";
+import { type IdentifiedMembershipProof, type MembershipProofVerdict } from "./membership-proof.js";
+/** How often an advertised proof, or a name claim riding beside it, is re-minted. */
+export declare const PROOF_REFRESH_INTERVAL_MS: number;
 export interface MembershipProofsDeps {
     /** Throws if the store has no identity yet. */
     getIdentity: () => MeshStoreIdentity;
+    /** The issuer this instance mints under, picked out of the store's identity: its user principal or its machine. */
+    issuerOf: (identity: Readonly<MeshStoreIdentity>) => IdentityPort;
     /** This device's own id (hex). */
     getPeerId: () => string;
     onError: (error: Error) => void;
@@ -16,19 +21,22 @@ export declare class MembershipProofs {
     private minting;
     private timer;
     constructor(deps: Readonly<MembershipProofsDeps>);
-    /** The agent/self advert field carrying this device's current proof, empty until the first has been minted. */
-    advertField(): {
-        membership?: string;
-    };
+    /** This device's current proof, undefined until the first has been minted. */
+    current(): string | undefined;
     /** Mints a proof now and again on an interval. A failed mint is reported and retried on the next tick; the previous proof stays until it lapses. */
     start(): void;
     stop(): void;
-    /** Whether a gossiped proof shows that principalHex vouches for deviceHex, as this node sees it: its own identity, clock and revocation view. */
+    /** Whether a gossiped proof shows that issuerHex vouches for deviceHex, as this node sees it: its own identity, clock and revocation view. */
     verify(claim: Readonly<{
         proof: string;
         deviceHex: string;
-        principalHex: string;
+        issuerHex: string;
     }>): Promise<MembershipProofVerdict>;
+    /** Which issuer a gossiped proof shows vouching for deviceHex, as this node sees it. */
+    identify(claim: Readonly<{
+        proof: string;
+        deviceHex: string;
+    }>): Promise<IdentifiedMembershipProof>;
     private refresh;
 }
 //# sourceMappingURL=membership-proofs.d.ts.map

package/dist/core/membership-proofs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"membership-proofs.d.ts","sourceRoot":"","sources":["../../src/core/membership-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAIL,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,iBAAiB,CAAC;IACrC,kCAAkC;IAClC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,gBAAgB;IAKf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJjC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA6C;gBAE7B,IAAI,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IAEjE,+GAA+G;IAC/G,WAAW,IAAI;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE;IAItC,oJAAoJ;IACpJ,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAKZ,iJAAiJ;IAC3I,MAAM,CACV,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,GAC1E,OAAO,CAAC,sBAAsB,CAAC;IAYlC,OAAO,CAAC,OAAO;CAuBhB"}
+{"version":3,"file":"membership-proofs.d.ts","sourceRoot":"","sources":["../../src/core/membership-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAKL,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC5B,MAAM,uBAAuB,CAAC;AAI/B,qFAAqF;AACrF,eAAO,MAAM,yBAAyB,QACiB,CAAC;AAExD,MAAM,WAAW,oBAAoB;IACnC,+CAA+C;IAC/C,WAAW,EAAE,MAAM,iBAAiB,CAAC;IACrC,mHAAmH;IACnH,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,KAAK,YAAY,CAAC;IAClE,kCAAkC;IAClC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,gBAAgB;IAKf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAJjC,OAAO,CAAC,KAAK,CAAqB;IAClC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAA6C;gBAE7B,IAAI,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IAEjE,8EAA8E;IAC9E,OAAO,IAAI,MAAM,GAAG,SAAS;IAI7B,oJAAoJ;IACpJ,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAKZ,8IAA8I;IACxI,MAAM,CACV,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACvE,OAAO,CAAC,sBAAsB,CAAC;IAYlC,wFAAwF;IAClF,QAAQ,CACZ,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACpD,OAAO,CAAC,yBAAyB,CAAC;IAWrC,OAAO,CAAC,OAAO;CAuBhB"}