agent-comms 8.6.2 → 8.7.0

package/dist/core/data-frame-routing.d.ts

@@ -1,14 +1,61 @@
 /**
- * data-frame-routing -- WireMeshTransport's own core/data frame dispatch (data-have/data-request/data-entries), split out under the repo's max-lines cap the same way gossip-directory.ts/hub-forwarding.ts were each split from the same owning file.
+ * WireMeshTransport's own core/data frame dispatch (data-have, data-request, data-entries), split out under the repo's max-lines cap the same way gossip-directory.ts and hub-forwarding.ts were each split from the same owning file.
  */
-import type { Frame } from "wire-mesh-core/generated/protocol";
+import type { DataHaveFrame, DataRequestFrame, Frame } from "wire-mesh-core/generated/protocol";
 import type { Connection } from "wire-mesh-core/ports/transport";
 import type { KeyValueStorage } from "wire-mesh-core/ports/storage";
-/** Routes one frame received on a raw data connection to wire-mesh-core's own core/data handlers, tracking the connection against its peer's device-id along the way (connectionsByPeer, mutated in place) so a later data-have/data-request/data-entries send addressed to that same peer reuses it. A no-op past the connectionsByPeer update when dataStorage is unset (this side doesn't participate in core/data at all) or the sender isn't yet a tracked peer session -- mirrors WireMeshTransport's own pre-extraction guard clauses exactly. Any handler error is reported via onError and swallowed, never thrown, since this runs inside the transport's own onFrame callback with no caller awaiting it directly. */
+import type { AccountLedgerReplica } from "./account-ledger.js";
+import type { WireMeshTransportOptions } from "./wire-mesh-transport-options.js";
+/** The most entries one data-entries reply carries, for every log this side answers for, the account ledger's included: a longer log catches up over several rounds, so the bound only caps one frame's size. */
+export declare const DATA_ENTRIES_RESPONSE_LIMIT = 100;
+/** What the router needs to replicate the account's grant ledger (agent-comms#344). */
+export interface AccountReplication {
+    /** The ledger, read on every frame and every announcement round because it opens after the transport is built and is replaced when the machine joins another account. Undefined until it has opened. */
+    ledger: () => AccountLedgerReplica | undefined;
+    /** Whether the peer whose session authenticated it as `deviceHex` holds the same account. Only such a peer is offered the ledger or answered for it, so a device of another account never stores the ciphertext or follows its head. */
+    isAccountPeer: (deviceHex: string) => Promise<boolean>;
+}
+/** Builds the router's account replication from the transport option: a peer is an account peer when the membership proof in its gossiped advert (looked up through `advertOf`) verifies against this machine's own principal. Undefined when the transport has no account ledger. */
+export declare function accountReplicationFrom(options: Readonly<WireMeshTransportOptions>["accountReplication"], advertOf: (deviceHex: string) => Readonly<Record<string, unknown>> | undefined): AccountReplication | undefined;
+/** Routes one frame received on a raw data connection, tracking the connection against its peer's device-id along the way (connectionsByPeer, mutated in place) so a later data-have, data-request or data-entries send addressed to that same peer reuses it. Nothing further happens until the sender is a tracked peer session. A frame naming one of the account's writer logs goes to the account ledger when the sender holds the same account and is dropped otherwise, without reaching dataStorage either way; any other data frame goes to wire-mesh-core's own core/data handlers over dataStorage, and is dropped when this side has no dataStorage. Any handler error is reported via onError and swallowed, never thrown, since this runs inside the transport's own onFrame callback with no caller awaiting it directly. */
 export declare function routeDataFrame(deps: Readonly<{
     connectionsByPeer: Map<string, Readonly<Connection>>;
     dataStorage: KeyValueStorage | undefined;
+    account: Readonly<AccountReplication> | undefined;
     peerSessions: ReadonlyMap<string, unknown>;
     onError: ((error: Error) => void) | undefined;
 }>, connection: Readonly<Connection>, frame: Frame): Promise<void>;
+/** Offers every account writer log this machine holds to every peer it has a live, trusted data connection with that holds the same account (agent-comms#344): such a peer that is behind asks for what it is missing, which is the data-domain fan-out that carries each machine's grants and revocations to every other. Called on the gossip cadence, so a machine that was away when an entry was written still catches up the next time it is connected. A send that fails is reported and the rest carry on; the next round retries it. */
+export declare function announceAccountLedger(deps: Readonly<{
+    connectionsByPeer: ReadonlyMap<string, Readonly<Connection>>;
+    account: Readonly<AccountReplication>;
+    peerSessions: ReadonlyMap<string, unknown>;
+    onError: ((error: Error) => void) | undefined;
+}>): Promise<void>;
+export interface DataFrameRouterDeps {
+    dataStorage: KeyValueStorage | undefined;
+    /** Absent for a transport with no account ledger. */
+    account: Readonly<AccountReplication> | undefined;
+    /** The transport's own trusted sessions, keyed by device-id hex: the gate every data frame and every announcement passes. */
+    peerSessions: ReadonlyMap<string, unknown>;
+    onError: ((error: Error) => void) | undefined;
+    /** How often the account ledger is offered to peers: the transport's own re-advertise cadence. */
+    announceIntervalMs: number;
+}
+/** WireMeshTransport's core/data state and dispatch, split out under the repo's max-lines cap: the connection each peer's frames arrive on, routing of every data frame received, the mechanical send primitive, and the periodic offer of the account ledger's writer logs. */
+export declare class DataFrameRouter {
+    private readonly deps;
+    /** Backs this side's own responder for an incoming data-have, data-request or data-entries frame about any log other than the account ledger's (agent-comms#50's P5 integration). When undefined, such frames are dropped; the account ledger's are routed either way. For those logs, deciding when to proactively call sendDataFrame at all (the catch-up policy: which peers' logs to track, when to send an initial data-have) stays the caller's business and this field only backs the mechanical parts (answering a have or request, storing entries); the account ledger's own offers are the router's, sent every announceIntervalMs. */
+    private readonly dataStorage;
+    /** Every peer this side has ever received a frame from, keyed by device-id hex, tracking the raw wire-mesh-core Connection each frame arrived on: what sendDataFrame needs, since neither AcceptedMeshSession nor MeshSession exposes a generic "send an arbitrary frame" method the way the raw Connection itself does. Registered eagerly on the very first frame from a connection (including one still in quarantine, e.g. before connect_request approval) so a later sendDataFrame call can reach it; routeDataFrame's own trust gate (peerSessions.has) is what actually decides whether to act on anything received this way, not this map. */
+    private readonly connectionsByPeer;
+    private announceInterval;
+    constructor(deps: Readonly<DataFrameRouterDeps>);
+    /** See routeDataFrame. */
+    route(connection: Readonly<Connection>, frame: Frame): Promise<void>;
+    /** Sends one frame on the connection peerDeviceHex's frames last arrived on. Throws if none has arrived from it yet. */
+    send(peerDeviceHex: string, frame: Readonly<DataHaveFrame> | Readonly<DataRequestFrame>): Promise<void>;
+    /** Stops offering the account ledger. A router that never started offering it has no timer to clear. */
+    stop(): void;
+}
 //# sourceMappingURL=data-frame-routing.d.ts.map

package/dist/core/data-frame-routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"data-frame-routing.d.ts","sourceRoot":"","sources":["../../src/core/data-frame-routing.ts"],"names":[],"mappings":"AAAA;;GAEG;AAQH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mCAAmC,CAAC;AAC/D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAIpE,isBAAisB;AACjsB,wBAAsB,cAAc,CAClC,IAAI,EAAE,QAAQ,CAAC;IACb,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,WAAW,EAAE,eAAe,GAAG,SAAS,CAAC;IACzC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC/C,CAAC,EACF,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAwBf"}
+{"version":3,"file":"data-frame-routing.d.ts","sourceRoot":"","sources":["../../src/core/data-frame-routing.ts"],"names":[],"mappings":"AAAA;;GAEG;AASH,OAAO,KAAK,EACV,aAAa,EACb,gBAAgB,EAChB,KAAK,EACN,MAAM,mCAAmC,CAAC;AAC3C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAEjF,iNAAiN;AACjN,eAAO,MAAM,2BAA2B,MAAM,CAAC;AAE/C,uFAAuF;AACvF,MAAM,WAAW,kBAAkB;IACjC,wMAAwM;IACxM,MAAM,EAAE,MAAM,oBAAoB,GAAG,SAAS,CAAC;IAC/C,wOAAwO;IACxO,aAAa,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACxD;AAED,sRAAsR;AACtR,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,QAAQ,CAAC,wBAAwB,CAAC,CAAC,oBAAoB,CAAC,EACjE,QAAQ,EAAE,CACR,SAAS,EAAE,MAAM,KACd,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,SAAS,GACjD,kBAAkB,GAAG,SAAS,CAehC;AAED,4yBAA4yB;AAC5yB,wBAAsB,cAAc,CAClC,IAAI,EAAE,QAAQ,CAAC;IACb,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IACrD,WAAW,EAAE,eAAe,GAAG,SAAS,CAAC;IACzC,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IAClD,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC/C,CAAC,EACF,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAChC,KAAK,EAAE,KAAK,GACX,OAAO,CAAC,IAAI,CAAC,CAoCf;AAED,ihBAAihB;AACjhB,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,QAAQ,CAAC;IACb,iBAAiB,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7D,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACtC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CAC/C,CAAC,GACD,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,eAAe,GAAG,SAAS,CAAC;IACzC,qDAAqD;IACrD,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAAG,SAAS,CAAC;IAClD,6HAA6H;IAC7H,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IAC9C,kGAAkG;IAClG,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAED,gRAAgR;AAChR,qBAAa,eAAe;IASd,OAAO,CAAC,QAAQ,CAAC,IAAI;IARjC,knBAAknB;IAClnB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA8B;IAE1D,unBAAunB;IACvnB,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAiC;IAEnE,OAAO,CAAC,gBAAgB,CAA6C;gBAExC,IAAI,EAAE,QAAQ,CAAC,mBAAmB,CAAC;IAmBhE,0BAA0B;IACpB,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAc1E,wHAAwH;IAClH,IAAI,CACR,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,QAAQ,CAAC,aAAa,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAC1D,OAAO,CAAC,IAAI,CAAC;IAUhB,wGAAwG;IACxG,IAAI,IAAI,IAAI;CAKb"}

package/dist/core/data-frame-routing.js

@@ -1,21 +1,53 @@
 /**
- * data-frame-routing -- WireMeshTransport's own core/data frame dispatch (data-have/data-request/data-entries), split out under the repo's max-lines cap the same way gossip-directory.ts/hub-forwarding.ts were each split from the same owning file.
+ * WireMeshTransport's own core/data frame dispatch (data-have, data-request, data-entries), split out under the repo's max-lines cap the same way gossip-directory.ts and hub-forwarding.ts were each split from the same owning file.
  */
 import { handleDataEntries, handleDataHave, handleDataRequest, } from "wire-mesh-core/domain/data-sync";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
-const DATA_ENTRIES_RESPONSE_LIMIT = 100;
-/** Routes one frame received on a raw data connection to wire-mesh-core's own core/data handlers, tracking the connection against its peer's device-id along the way (connectionsByPeer, mutated in place) so a later data-have/data-request/data-entries send addressed to that same peer reuses it. A no-op past the connectionsByPeer update when dataStorage is unset (this side doesn't participate in core/data at all) or the sender isn't yet a tracked peer session -- mirrors WireMeshTransport's own pre-extraction guard clauses exactly. Any handler error is reported via onError and swallowed, never thrown, since this runs inside the transport's own onFrame callback with no caller awaiting it directly. */
+import { isDataFrame } from "wire-mesh-core/domain/hub-mailbox";
+import { readMembershipProof } from "./gossip-directory.js";
+/** The most entries one data-entries reply carries, for every log this side answers for, the account ledger's included: a longer log catches up over several rounds, so the bound only caps one frame's size. */
+export const DATA_ENTRIES_RESPONSE_LIMIT = 100;
+/** Builds the router's account replication from the transport option: a peer is an account peer when the membership proof in its gossiped advert (looked up through `advertOf`) verifies against this machine's own principal. Undefined when the transport has no account ledger. */
+export function accountReplicationFrom(options, advertOf) {
+    if (options === undefined)
+        return undefined;
+    return {
+        ledger: options.getLedger,
+        isAccountPeer: async (deviceHex) => {
+            const advert = advertOf(deviceHex);
+            const proof = advert === undefined
+                ? undefined
+                : readMembershipProof(advert, "membership");
+            return proof === undefined
+                ? false
+                : options.isAccountMember({ proof, deviceHex });
+        },
+    };
+}
+/** Routes one frame received on a raw data connection, tracking the connection against its peer's device-id along the way (connectionsByPeer, mutated in place) so a later data-have, data-request or data-entries send addressed to that same peer reuses it. Nothing further happens until the sender is a tracked peer session. A frame naming one of the account's writer logs goes to the account ledger when the sender holds the same account and is dropped otherwise, without reaching dataStorage either way; any other data frame goes to wire-mesh-core's own core/data handlers over dataStorage, and is dropped when this side has no dataStorage. Any handler error is reported via onError and swallowed, never thrown, since this runs inside the transport's own onFrame callback with no caller awaiting it directly. */
 export async function routeDataFrame(deps, connection, frame) {
     const peerDeviceId = connection.peerDeviceId;
     if (peerDeviceId === undefined)
         return;
     const deviceIdHex = deviceIdToHex(peerDeviceId);
     deps.connectionsByPeer.set(deviceIdHex, connection);
-    if (deps.dataStorage === undefined)
-        return;
     if (!deps.peerSessions.has(deviceIdHex))
         return;
     try {
+        const ledger = deps.account?.ledger();
+        if (isDataFrame(frame) &&
+            ledger !== undefined &&
+            deps.account !== undefined &&
+            ledger.ownsLog(frame.peer)) {
+            if (!(await deps.account.isAccountPeer(deviceIdHex)))
+                return;
+            const reply = await ledger.handleDataFrame(frame);
+            if (reply !== null)
+                await connection.send(reply);
+            return;
+        }
+        if (deps.dataStorage === undefined)
+            return;
         if (frame.type === "data-have") {
             const request = await handleDataHave(deps.dataStorage, frame);
             if (request !== null)
@@ -34,4 +66,79 @@ export async function routeDataFrame(deps, connection, frame) {
         deps.onError?.(error instanceof Error ? error : new Error(String(error)));
     }
 }
+/** Offers every account writer log this machine holds to every peer it has a live, trusted data connection with that holds the same account (agent-comms#344): such a peer that is behind asks for what it is missing, which is the data-domain fan-out that carries each machine's grants and revocations to every other. Called on the gossip cadence, so a machine that was away when an entry was written still catches up the next time it is connected. A send that fails is reported and the rest carry on; the next round retries it. */
+export async function announceAccountLedger(deps) {
+    const ledger = deps.account.ledger();
+    if (ledger === undefined)
+        return;
+    const frames = await ledger.announcements();
+    if (frames.length === 0)
+        return;
+    for (const [deviceHex, connection] of deps.connectionsByPeer) {
+        if (!deps.peerSessions.has(deviceHex))
+            continue;
+        if (!(await deps.account.isAccountPeer(deviceHex)))
+            continue;
+        for (const frame of frames) {
+            try {
+                await connection.send(frame);
+            }
+            catch (error) {
+                deps.onError?.(error instanceof Error ? error : new Error(String(error)));
+            }
+        }
+    }
+}
+/** WireMeshTransport's core/data state and dispatch, split out under the repo's max-lines cap: the connection each peer's frames arrive on, routing of every data frame received, the mechanical send primitive, and the periodic offer of the account ledger's writer logs. */
+export class DataFrameRouter {
+    deps;
+    /** Backs this side's own responder for an incoming data-have, data-request or data-entries frame about any log other than the account ledger's (agent-comms#50's P5 integration). When undefined, such frames are dropped; the account ledger's are routed either way. For those logs, deciding when to proactively call sendDataFrame at all (the catch-up policy: which peers' logs to track, when to send an initial data-have) stays the caller's business and this field only backs the mechanical parts (answering a have or request, storing entries); the account ledger's own offers are the router's, sent every announceIntervalMs. */
+    dataStorage;
+    /** Every peer this side has ever received a frame from, keyed by device-id hex, tracking the raw wire-mesh-core Connection each frame arrived on: what sendDataFrame needs, since neither AcceptedMeshSession nor MeshSession exposes a generic "send an arbitrary frame" method the way the raw Connection itself does. Registered eagerly on the very first frame from a connection (including one still in quarantine, e.g. before connect_request approval) so a later sendDataFrame call can reach it; routeDataFrame's own trust gate (peerSessions.has) is what actually decides whether to act on anything received this way, not this map. */
+    connectionsByPeer = new Map();
+    announceInterval;
+    constructor(deps) {
+        this.deps = deps;
+        this.dataStorage = deps.dataStorage;
+        const { account } = deps;
+        if (account === undefined)
+            return;
+        this.announceInterval = setInterval(() => {
+            announceAccountLedger({
+                connectionsByPeer: this.connectionsByPeer,
+                account,
+                peerSessions: deps.peerSessions,
+                onError: deps.onError,
+            }).catch((error) => {
+                deps.onError?.(error instanceof Error ? error : new Error(String(error)));
+            });
+        }, deps.announceIntervalMs);
+        this.announceInterval.unref();
+    }
+    /** See routeDataFrame. */
+    async route(connection, frame) {
+        await routeDataFrame({
+            connectionsByPeer: this.connectionsByPeer,
+            dataStorage: this.dataStorage,
+            account: this.deps.account,
+            peerSessions: this.deps.peerSessions,
+            onError: this.deps.onError,
+        }, connection, frame);
+    }
+    /** Sends one frame on the connection peerDeviceHex's frames last arrived on. Throws if none has arrived from it yet. */
+    async send(peerDeviceHex, frame) {
+        const connection = this.connectionsByPeer.get(peerDeviceHex);
+        if (connection === undefined) {
+            throw new Error(`WireMeshTransport: no live connection for peer ${peerDeviceHex}`);
+        }
+        await connection.send(frame);
+    }
+    /** Stops offering the account ledger. A router that never started offering it has no timer to clear. */
+    stop() {
+        if (this.announceInterval === undefined)
+            return;
+        clearInterval(this.announceInterval);
+        this.announceInterval = undefined;
+    }
+}
 //# sourceMappingURL=data-frame-routing.js.map

package/dist/core/data-frame-routing.js.map

@@ -1 +1 @@
-{"version":3,"file":"data-frame-routing.js","sourceRoot":"","sources":["../../src/core/data-frame-routing.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAKhE,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAExC,isBAAisB;AACjsB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAKE,EACF,UAAgC,EAChC,KAAY;IAEZ,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO;IAC3C,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO;IAChD,IAAI,CAAC;QACH,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,IAAI,CAAC,WAAW,EAChB,KAAK,EACL,2BAA2B,CAC5B,CAAC;YACF,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}
+{"version":3,"file":"data-frame-routing.js","sourceRoot":"","sources":["../../src/core/data-frame-routing.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,iBAAiB,GAClB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAC;AAShE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAG5D,iNAAiN;AACjN,MAAM,CAAC,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAU/C,sRAAsR;AACtR,MAAM,UAAU,sBAAsB,CACpC,OAAiE,EACjE,QAEkD;IAElD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,SAAS;QACzB,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;YACjC,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YACnC,MAAM,KAAK,GACT,MAAM,KAAK,SAAS;gBAClB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChD,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACpD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,4yBAA4yB;AAC5yB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAME,EACF,UAAgC,EAChC,KAAY;IAEZ,MAAM,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;IAC7C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO;IACvC,MAAM,WAAW,GAAG,aAAa,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO;IAChD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACtC,IACE,WAAW,CAAC,KAAK,CAAC;YAClB,MAAM,KAAK,SAAS;YACpB,IAAI,CAAC,OAAO,KAAK,SAAS;YAC1B,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAC1B,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;gBAAE,OAAO;YAC7D,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAClD,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QAC3C,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;YAC9D,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,OAAO,GAAG,MAAM,iBAAiB,CACrC,IAAI,CAAC,WAAW,EAChB,KAAK,EACL,2BAA2B,CAC5B,CAAC;YACF,IAAI,OAAO,KAAK,IAAI;gBAAE,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACzC,MAAM,iBAAiB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,ihBAAihB;AACjhB,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAKE;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO;IACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAChC,KAAK,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC7D,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAChD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;YAAE,SAAS;QAC7D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,IAAI,CAAC,OAAO,EAAE,CACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAaD,gRAAgR;AAChR,MAAM,OAAO,eAAe;IASG;IAR7B,knBAAknB;IACjmB,WAAW,CAA8B;IAE1D,unBAAunB;IACtmB,iBAAiB,GAAG,IAAI,GAAG,EAAsB,CAAC;IAE3D,gBAAgB,CAA6C;IAErE,YAA6B,IAAmC;QAAnC,SAAI,GAAJ,IAAI,CAA+B;QAC9D,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;QACzB,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO;QAClC,IAAI,CAAC,gBAAgB,GAAG,WAAW,CAAC,GAAG,EAAE;YACvC,qBAAqB,CAAC;gBACpB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;gBACzC,OAAO;gBACP,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAC1B,IAAI,CAAC,OAAO,EAAE,CACZ,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC1D,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAC5B,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,0BAA0B;IAC1B,KAAK,CAAC,KAAK,CAAC,UAAgC,EAAE,KAAY;QACxD,MAAM,cAAc,CAClB;YACE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;YAC1B,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,YAAY;YACpC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO;SAC3B,EACD,UAAU,EACV,KAAK,CACN,CAAC;IACJ,CAAC;IAED,wHAAwH;IACxH,KAAK,CAAC,IAAI,CACR,aAAqB,EACrB,KAA2D;QAE3D,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QAC7D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,kDAAkD,aAAa,EAAE,CAClE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAED,wGAAwG;IACxG,IAAI;QACF,IAAI,IAAI,CAAC,gBAAgB,KAAK,SAAS;YAAE,OAAO;QAChD,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACrC,IAAI,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACpC,CAAC;CACF"}

package/dist/core/device-membership.d.ts

@@ -8,12 +8,12 @@ import type { RevocationView } from "wire-mesh-core/domain/revocation-view";
 import type { IdentityPort } from "wire-mesh-core/ports/identity";
 import type { Clock } from "wire-mesh-core/ports/clock";
 import type { DeviceId, RevocationEntry } from "wire-mesh-core/generated/protocol";
-import { type UserIdentityOptions } from "./user-identity.js";
+import type { AccountLedger } from "./account-ledger.js";
 export interface AdmitDeviceOptions {
     /** The user principal's own identity -- signs the membership grant. */
     userIdentity: IdentityPort;
-    /** Directory override for tests, forwarded to user-identity.ts's own issued-grant storage -- must resolve to the same user-identity.json userIdentity's own key material lives in. */
-    userIdentityOptions?: UserIdentityOptions;
+    /** The account's replicated grant ledger, which records the admission so any machine holding the account key can revoke it. */
+    accountLedger: AccountLedger;
     clock: Clock;
     tokenId: Uint8Array<ArrayBuffer>;
     /** The device being admitted. */
@@ -32,22 +32,22 @@ export interface MintGroupMembershipOptions {
 /** The group:member token itself, with no record kept of having issued it: a root-level, non-delegable grant bearing options.deviceId and scoped to the issuer's own group (groupPath). admitDevice adds the issued-grant bookkeeping a later removeDevice needs; a caller that only needs a short-lived proof (membership-proof.ts) uses this directly, so the shared identity file is not rewritten every time one of its many bridges refreshes its proof. */
 export declare function mintGroupMembership(options: Readonly<MintGroupMembershipOptions>): Promise<MintVerdict>;
 /**
- * Mints deviceId's own group:member grant from the user principal: a root-level, non-delegable token scoped to the principal's own group (groupPath). On success, records the grant's token-id under the principal's own issued-grant store so a later removeDevice call can find it to revoke: an admission without this bookkeeping would leave removal permanently unable to find what to revoke, so this is not optional side-book-keeping, it is what makes revocation possible at all.
+ * Mints deviceId's own group:member grant from the user principal: a root-level, non-delegable token scoped to the principal's own group (groupPath). On success, records the grant's token-id in the account's replicated ledger so a later removeDevice, on this machine or any other holding the account key, can find it to revoke. An admission without that record would leave removal permanently unable to find what to revoke, so it is what makes revocation possible at all.
  */
 export declare function admitDevice(options: Readonly<AdmitDeviceOptions>): Promise<MintVerdict>;
 export interface RemoveDeviceOptions {
     /** The user principal's own identity -- only the principal that issued a device's membership may revoke it. */
     userIdentity: IdentityPort;
-    userIdentityOptions?: UserIdentityOptions;
+    accountLedger: AccountLedger;
     clock: Clock;
     /** Recorded locally immediately, so this principal's own future verifications see the removal without waiting on gossip -- mirrors room-lifecycle.ts's own revokeMemberGrant ordering (record before broadcast). */
     revocation: RevocationView;
     deviceId: DeviceId;
 }
 /**
- * Revokes deviceId's own group:member grant for real, if this principal ever recorded admitting it: mints a revocation-entry for its token-id, records it in the given RevocationView immediately, and forgets the issued-grant record (a later re-admission mints and records a genuinely fresh one rather than leaving a stale entry alongside it). Silently returns undefined when no issued-grant record exists (a device that was never actually admitted, or a grant predating this bookkeeping) -- mirrors room-lifecycle.ts's own revokeMemberGrant, which does the same for a room member.
+ * Revokes every group:member grant for deviceId that the account's ledger holds as outstanding, whichever machine of the account minted it: mints a revocation-entry for each token-id, records it in the given RevocationView immediately, and appends it to the ledger, so every other machine of the account sees the grant as revoked and a later re-admission starts from nothing outstanding. Returns no entries for a device the account never admitted.
  *
- * Returns the minted entry so the caller can broadcast it to the mesh (this module has no MeshTransport dependency to do so itself, mirroring the module-level "no assumption about locality" boundary documented above) -- every other device that might hold this device's grant, including other devices of this same user, needs the entry to independently start refusing it.
+ * Returns the minted entries so the caller can broadcast them to the mesh (this module has no MeshTransport dependency to do so itself, mirroring the module-level "no assumption about locality" boundary documented above): every other device that might hold one of this device's grants needs the entry to independently start refusing it.
  */
-export declare function removeDevice(options: Readonly<RemoveDeviceOptions>): Promise<RevocationEntry | undefined>;
+export declare function removeDevice(options: Readonly<RemoveDeviceOptions>): Promise<RevocationEntry[]>;
 //# sourceMappingURL=device-membership.d.ts.map

package/dist/core/device-membership.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"device-membership.d.ts","sourceRoot":"","sources":["../../src/core/device-membership.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAK5B,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;IAC3B,sLAAsL;IACtL,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,iCAAiC;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,iLAAiL;IACjL,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,qDAAqD;IACrD,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,icAAic;AACjc,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GAC5C,OAAO,CAAC,WAAW,CAAC,CActB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,MAAM,WAAW,mBAAmB;IAClC,+GAA+G;IAC/G,YAAY,EAAE,YAAY,CAAC;IAC3B,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,KAAK,EAAE,KAAK,CAAC;IACb,oNAAoN;IACpN,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACrC,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAatC"}
+{"version":3,"file":"device-membership.d.ts","sourceRoot":"","sources":["../../src/core/device-membership.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EAChB,MAAM,mCAAmC,CAAC;AAK3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD,MAAM,WAAW,kBAAkB;IACjC,uEAAuE;IACvE,YAAY,EAAE,YAAY,CAAC;IAC3B,+HAA+H;IAC/H,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,iCAAiC;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,0BAA0B;IACzC,iLAAiL;IACjL,MAAM,EAAE,YAAY,CAAC;IACrB,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,qDAAqD;IACrD,QAAQ,EAAE,QAAQ,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,icAAic;AACjc,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,QAAQ,CAAC,0BAA0B,CAAC,GAC5C,OAAO,CAAC,WAAW,CAAC,CActB;AAED;;GAEG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GACpC,OAAO,CAAC,WAAW,CAAC,CAatB;AAED,MAAM,WAAW,mBAAmB;IAClC,+GAA+G;IAC/G,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,oNAAoN;IACpN,UAAU,EAAE,cAAc,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,GACrC,OAAO,CAAC,eAAe,EAAE,CAAC,CAuB5B"}

package/dist/core/device-membership.js

@@ -6,7 +6,6 @@
 import { mintCapabilityToken, mintRevocationEntry, } from "wire-mesh-core/domain/tokens";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
 import { DEVICE_MEMBER_CAPABILITY, groupPath, } from "./device-membership-verification.js";
-import { deleteIssuedDeviceGrant, loadIssuedDeviceGrant, saveIssuedDeviceGrant, } from "./user-identity.js";
 /** delegationsRemaining for every device-membership grant -- deliberately non-delegable: a device that could re-mint membership for another device would let any admitted device silently admit others, defeating the point of the principal being the one place admission is decided (the same reasoning room-lifecycle.ts's own mintOwnerRootGrant already documents for a room owner's self-grant). */
 const NOT_DELEGABLE = 0;
 /** The group:member token itself, with no record kept of having issued it: a root-level, non-delegable grant bearing options.deviceId and scoped to the issuer's own group (groupPath). admitDevice adds the issued-grant bookkeeping a later removeDevice needs; a caller that only needs a short-lived proof (membership-proof.ts) uses this directly, so the shared identity file is not rewritten every time one of its many bridges refreshes its proof. */
@@ -26,7 +25,7 @@ export async function mintGroupMembership(options) {
     });
 }
 /**
- * Mints deviceId's own group:member grant from the user principal: a root-level, non-delegable token scoped to the principal's own group (groupPath). On success, records the grant's token-id under the principal's own issued-grant store so a later removeDevice call can find it to revoke: an admission without this bookkeeping would leave removal permanently unable to find what to revoke, so this is not optional side-book-keeping, it is what makes revocation possible at all.
+ * Mints deviceId's own group:member grant from the user principal: a root-level, non-delegable token scoped to the principal's own group (groupPath). On success, records the grant's token-id in the account's replicated ledger so a later removeDevice, on this machine or any other holding the account key, can find it to revoke. An admission without that record would leave removal permanently unable to find what to revoke, so it is what makes revocation possible at all.
  */
 export async function admitDevice(options) {
     const verdict = await mintGroupMembership({
@@ -35,26 +34,28 @@ export async function admitDevice(options) {
     });
     if (!verdict.ok)
         return verdict;
-    saveIssuedDeviceGrant(options.userIdentityOptions, deviceIdToHex(options.deviceId), options.tokenId);
+    await options.accountLedger.recordGrant("device", deviceIdToHex(options.deviceId), options.tokenId);
     return verdict;
 }
 /**
- * Revokes deviceId's own group:member grant for real, if this principal ever recorded admitting it: mints a revocation-entry for its token-id, records it in the given RevocationView immediately, and forgets the issued-grant record (a later re-admission mints and records a genuinely fresh one rather than leaving a stale entry alongside it). Silently returns undefined when no issued-grant record exists (a device that was never actually admitted, or a grant predating this bookkeeping) -- mirrors room-lifecycle.ts's own revokeMemberGrant, which does the same for a room member.
+ * Revokes every group:member grant for deviceId that the account's ledger holds as outstanding, whichever machine of the account minted it: mints a revocation-entry for each token-id, records it in the given RevocationView immediately, and appends it to the ledger, so every other machine of the account sees the grant as revoked and a later re-admission starts from nothing outstanding. Returns no entries for a device the account never admitted.
  *
- * Returns the minted entry so the caller can broadcast it to the mesh (this module has no MeshTransport dependency to do so itself, mirroring the module-level "no assumption about locality" boundary documented above) -- every other device that might hold this device's grant, including other devices of this same user, needs the entry to independently start refusing it.
+ * Returns the minted entries so the caller can broadcast them to the mesh (this module has no MeshTransport dependency to do so itself, mirroring the module-level "no assumption about locality" boundary documented above): every other device that might hold one of this device's grants needs the entry to independently start refusing it.
  */
 export async function removeDevice(options) {
     const deviceHex = deviceIdToHex(options.deviceId);
-    const tokenId = loadIssuedDeviceGrant(options.userIdentityOptions, deviceHex);
-    if (tokenId === undefined)
-        return undefined;
-    const entry = await mintRevocationEntry({
-        identity: options.userIdentity,
-        tokenId,
-        revokedAt: options.clock.now(),
-    });
-    await options.revocation.record(entry, { identity: options.userIdentity });
-    deleteIssuedDeviceGrant(options.userIdentityOptions, deviceHex);
-    return entry;
+    const outstanding = await options.accountLedger.outstandingGrants("device", deviceHex);
+    const entries = [];
+    for (const { tokenId } of outstanding) {
+        const entry = await mintRevocationEntry({
+            identity: options.userIdentity,
+            tokenId,
+            revokedAt: options.clock.now(),
+        });
+        await options.revocation.record(entry, { identity: options.userIdentity });
+        await options.accountLedger.recordRevocation("device", deviceHex, tokenId, entry);
+        entries.push(entry);
+    }
+    return entries;
 }
 //# sourceMappingURL=device-membership.js.map

package/dist/core/device-membership.js.map

@@ -1 +1 @@
-{"version":3,"file":"device-membership.js","sourceRoot":"","sources":["../../src/core/device-membership.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAQhE,OAAO,EACL,wBAAwB,EACxB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GAEtB,MAAM,oBAAoB,CAAC;AAE5B,0YAA0Y;AAC1Y,MAAM,aAAa,GAAG,CAAC,CAAC;AAwBxB,icAAic;AACjc,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6C;IAE7C,OAAO,mBAAmB,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,UAAU,EAAE,wBAAwB;QACpC,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;SACzC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,aAAa;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAqC;IAErC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,GAAG,OAAO;QACV,MAAM,EAAE,OAAO,CAAC,YAAY;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,qBAAqB,CACnB,OAAO,CAAC,mBAAmB,EAC3B,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC/B,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsC;IAEtC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE5C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;QACtC,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,OAAO;QACP,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;KAC/B,CAAC,CAAC;IACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3E,uBAAuB,CAAC,OAAO,CAAC,mBAAmB,EAAE,SAAS,CAAC,CAAC;IAChE,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"device-membership.js","sourceRoot":"","sources":["../../src/core/device-membership.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAQhE,OAAO,EACL,wBAAwB,EACxB,SAAS,GACV,MAAM,qCAAqC,CAAC;AAG7C,0YAA0Y;AAC1Y,MAAM,aAAa,GAAG,CAAC,CAAC;AAwBxB,icAAic;AACjc,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAA6C;IAE7C,OAAO,mBAAmB,CAAC;QACzB,QAAQ,EAAE,OAAO,CAAC,MAAM;QACxB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,UAAU,EAAE,wBAAwB;QACpC,KAAK,EAAE;YACL,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;SACzC;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,aAAa;KACpC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAqC;IAErC,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,GAAG,OAAO;QACV,MAAM,EAAE,OAAO,CAAC,YAAY;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CACrC,QAAQ,EACR,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC/B,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAsC;IAEtC,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,iBAAiB,CAC/D,QAAQ,EACR,SAAS,CACV,CAAC;IACF,MAAM,OAAO,GAAsB,EAAE,CAAC;IACtC,KAAK,MAAM,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,QAAQ,EAAE,OAAO,CAAC,YAAY;YAC9B,OAAO;YACP,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE;SAC/B,CAAC,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;QAC3E,MAAM,OAAO,CAAC,aAAa,CAAC,gBAAgB,CAC1C,QAAQ,EACR,SAAS,EACT,OAAO,EACP,KAAK,CACN,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/dm-send-delegation.d.ts

@@ -7,12 +7,12 @@ import { type MintVerdict } from "wire-mesh-core/domain/tokens";
 import type { IdentityPort } from "wire-mesh-core/ports/identity";
 import type { Clock } from "wire-mesh-core/ports/clock";
 import type { CapabilityToken, DeviceId } from "wire-mesh-core/generated/protocol";
-import { type UserIdentityOptions } from "./user-identity.js";
+import type { AccountLedger } from "./account-ledger.js";
 export interface DelegateDmSendToDeviceOptions {
     /** The principal doing the sub-delegating -- must be the same identity the parent grant's own bearer names, or mintCapabilityToken's own parent-bearer-matches-issuer narrowing check refuses the mint outright (`parent_bearer_mismatch`). */
     userIdentity: IdentityPort;
-    /** Directory override for tests, forwarded to user-identity.ts's own issued-grant storage -- must resolve to the same user-identity.json userIdentity's own key material lives in. */
-    userIdentityOptions?: UserIdentityOptions;
+    /** The account's replicated grant ledger, which records the delegation so any machine holding the account key can revoke it. */
+    accountLedger: AccountLedger;
     clock: Clock;
     tokenId: Uint8Array<ArrayBuffer>;
     /** The grant this principal itself was admitted with (room-lifecycle.ts's admitAgentForDm, minted with delegationsRemaining \> 0) -- every one of tokens.cddl's own narrowing obligations is checked against it at mint time. */
@@ -26,7 +26,7 @@ export interface DelegateDmSendToDeviceOptions {
     delegationsRemaining?: number;
 }
 /**
- * Mints deviceId's own dm:send delegation from a received grant: bearer = deviceId, parent = the grant this principal itself was admitted with, scope unchanged (still the REMOTE admitting principal's own "user" scope, never this principal's own device-id) -- mintCapabilityToken's own narrowing refuses this outright if parent's own delegationsRemaining was 0 (nothing left to sub-delegate) or if userIdentity does not match parent's own bearer. On success, records the token-id under THIS principal's own issued-grant store, keyed by deviceId's hex, so a later revocation can find it -- reuses user-identity.ts's saveIssuedDmGrant/loadIssuedDmGrant/deleteIssuedDmGrant exactly as admitAgentForDm's own root-level self-grants do, since both are simply "grants this identity has issued," keyed by bearer, regardless of whether the grant is root-level or itself a delegation.
+ * Mints deviceId's own dm:send delegation from a received grant: bearer = deviceId, parent = the grant this principal itself was admitted with, scope unchanged (still the REMOTE admitting principal's own "user" scope, never this principal's own device-id); mintCapabilityToken's own narrowing refuses this outright if parent's own delegationsRemaining was 0 (nothing left to sub-delegate) or if userIdentity does not match parent's own bearer. On success, records the token-id in THIS principal's own replicated grant ledger as a dm grant keyed by deviceId's hex, so a later revocation on any of the account's machines can find it; admitAgentForDm's own root-level self-grants are recorded the same way, since both are simply grants this identity has issued, keyed by bearer, whether root-level or a delegation.
  */
 export declare function delegateDmSendToDevice(options: Readonly<DelegateDmSendToDeviceOptions>): Promise<MintVerdict>;
 //# sourceMappingURL=dm-send-delegation.d.ts.map

package/dist/core/dm-send-delegation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dm-send-delegation.d.ts","sourceRoot":"","sources":["../../src/core/dm-send-delegation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EACV,eAAe,EACf,QAAQ,EACT,MAAM,mCAAmC,CAAC;AAK3C,OAAO,EAEL,KAAK,mBAAmB,EACzB,MAAM,oBAAoB,CAAC;AAK5B,MAAM,WAAW,6BAA6B;IAC5C,+OAA+O;IAC/O,YAAY,EAAE,YAAY,CAAC;IAC3B,sLAAsL;IACtL,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,iOAAiO;IACjO,MAAM,EAAE,eAAe,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,EAAE,QAAQ,CAAC;IACnB,yPAAyP;IACzP,2BAA2B,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,sNAAsN;IACtN,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAC/C,OAAO,CAAC,WAAW,CAAC,CAuBtB"}
+{"version":3,"file":"dm-send-delegation.d.ts","sourceRoot":"","sources":["../../src/core/dm-send-delegation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,EACV,eAAe,EACf,QAAQ,EACT,MAAM,mCAAmC,CAAC;AAK3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKzD,MAAM,WAAW,6BAA6B;IAC5C,+OAA+O;IAC/O,YAAY,EAAE,YAAY,CAAC;IAC3B,gIAAgI;IAChI,aAAa,EAAE,aAAa,CAAC;IAC7B,KAAK,EAAE,KAAK,CAAC;IACb,OAAO,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;IACjC,iOAAiO;IACjO,MAAM,EAAE,eAAe,CAAC;IACxB,4EAA4E;IAC5E,QAAQ,EAAE,QAAQ,CAAC;IACnB,yPAAyP;IACzP,2BAA2B,EAAE,QAAQ,CAAC;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,sNAAsN;IACtN,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,QAAQ,CAAC,6BAA6B,CAAC,GAC/C,OAAO,CAAC,WAAW,CAAC,CAuBtB"}

package/dist/core/dm-send-delegation.js

@@ -6,11 +6,10 @@
 import { mintCapabilityToken, } from "wire-mesh-core/domain/tokens";
 import { deviceIdToHex } from "wire-mesh-core/domain/device-id";
 import { DM_SEND_CAPABILITY, DM_SEND_SCOPE_KIND, } from "./dm-token-verification.js";
-import { saveIssuedDmGrant, } from "./user-identity.js";
 /** delegationsRemaining a delegated device's own token permits below it, when the caller doesn't ask for more -- 0, matching every other non-delegable grant this codebase already mints by default (device-membership.ts's own NOT_DELEGABLE): an ordinary device is a leaf of the chain, not a further delegator. */
 const LEAF_NOT_DELEGABLE = 0;
 /**
- * Mints deviceId's own dm:send delegation from a received grant: bearer = deviceId, parent = the grant this principal itself was admitted with, scope unchanged (still the REMOTE admitting principal's own "user" scope, never this principal's own device-id) -- mintCapabilityToken's own narrowing refuses this outright if parent's own delegationsRemaining was 0 (nothing left to sub-delegate) or if userIdentity does not match parent's own bearer. On success, records the token-id under THIS principal's own issued-grant store, keyed by deviceId's hex, so a later revocation can find it -- reuses user-identity.ts's saveIssuedDmGrant/loadIssuedDmGrant/deleteIssuedDmGrant exactly as admitAgentForDm's own root-level self-grants do, since both are simply "grants this identity has issued," keyed by bearer, regardless of whether the grant is root-level or itself a delegation.
+ * Mints deviceId's own dm:send delegation from a received grant: bearer = deviceId, parent = the grant this principal itself was admitted with, scope unchanged (still the REMOTE admitting principal's own "user" scope, never this principal's own device-id); mintCapabilityToken's own narrowing refuses this outright if parent's own delegationsRemaining was 0 (nothing left to sub-delegate) or if userIdentity does not match parent's own bearer. On success, records the token-id in THIS principal's own replicated grant ledger as a dm grant keyed by deviceId's hex, so a later revocation on any of the account's machines can find it; admitAgentForDm's own root-level self-grants are recorded the same way, since both are simply grants this identity has issued, keyed by bearer, whether root-level or a delegation.
  */
 export async function delegateDmSendToDevice(options) {
     const verdict = await mintCapabilityToken({
@@ -29,7 +28,7 @@ export async function delegateDmSendToDevice(options) {
     });
     if (!verdict.ok)
         return verdict;
-    saveIssuedDmGrant(options.userIdentityOptions, deviceIdToHex(options.deviceId), options.tokenId);
+    await options.accountLedger.recordGrant("dm", deviceIdToHex(options.deviceId), options.tokenId);
     return verdict;
 }
 //# sourceMappingURL=dm-send-delegation.js.map

package/dist/core/dm-send-delegation.js.map

@@ -1 +1 @@
-{"version":3,"file":"dm-send-delegation.js","sourceRoot":"","sources":["../../src/core/dm-send-delegation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAOhE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAE5B,uTAAuT;AACvT,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAoB7B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgD;IAEhD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,UAAU,EAAE,kBAAkB;QAC9B,KAAK,EAAE;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,kBAAkB;QACxE,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,iBAAiB,CACf,OAAO,CAAC,mBAAmB,EAC3B,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC/B,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"dm-send-delegation.js","sourceRoot":"","sources":["../../src/core/dm-send-delegation.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EACL,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAOhE,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,4BAA4B,CAAC;AAGpC,uTAAuT;AACvT,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAoB7B;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAgD;IAEhD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC;QACxC,QAAQ,EAAE,OAAO,CAAC,YAAY;QAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,QAAQ;QACxB,UAAU,EAAE,kBAAkB;QAC9B,KAAK,EAAE;YACL,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,2BAA2B,CAAC;SACzD;QACD,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,oBAAoB,EAAE,OAAO,CAAC,oBAAoB,IAAI,kBAAkB;QACxE,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC;IAEhC,MAAM,OAAO,CAAC,aAAa,CAAC,WAAW,CACrC,IAAI,EACJ,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC/B,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/group-proofs.d.ts

@@ -23,6 +23,11 @@ export declare class GroupProofs {
     private readonly machineName;
     private readonly getIdentity;
     constructor(deps: Readonly<GroupProofsDeps>);
+    /** Whether a gossiped proof shows that deviceHex belongs to the account this store holds, judged against the user principal's own proofs (MembershipProofs.isAccountMember). */
+    isAccountMember(claim: Readonly<{
+        proof: string;
+        deviceHex: string;
+    }>): Promise<boolean>;
     /** The agent/self advert fields carrying this device's current proofs, each absent until it has first been minted. */
     advertFields(): Pick<AgentSelfSummary, "membership" | "machine" | "machineName">;
     /** Starts keeping both proofs fresh; called once the store's identity is attached. */

package/dist/core/group-proofs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"group-proofs.d.ts","sourceRoot":"","sources":["../../src/core/group-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AASpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EACV,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,WAAW,EAAE,MAAM,iBAAiB,CAAC;IACrC,iEAAiE;IACjE,YAAY,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClD,kCAAkC;IAClC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;gBAE1C,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;IA4C3C,sHAAsH;IACtH,YAAY,IAAI,IAAI,CAClB,gBAAgB,EAChB,YAAY,GAAG,SAAS,GAAG,aAAa,CACzC;IAWD,sFAAsF;IACtF,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAMZ,+KAA+K;IACzK,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,sGAAsG;IAChG,MAAM,CACV,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACvE,OAAO,CAAC,sBAAsB,CAAC;IAIlC,qLAAqL;IAC/K,QAAQ,CACZ,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACpD,OAAO,CAAC,yBAAyB,CAAC;IAIrC,uFAAuF;IACjF,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAItD,kGAAkG;IAC5F,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAGnD"}
+{"version":3,"file":"group-proofs.d.ts","sourceRoot":"","sources":["../../src/core/group-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AASpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,KAAK,EACV,yBAAyB,EACzB,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,WAAW,EAAE,MAAM,iBAAiB,CAAC;IACrC,iEAAiE;IACjE,YAAY,EAAE,MAAM,iBAAiB,GAAG,SAAS,CAAC;IAClD,kCAAkC;IAClC,SAAS,EAAE,MAAM,MAAM,CAAC;IACxB,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,aAAa,CAAC;IACtC,OAAO,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAmB;IAC/C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA0B;gBAE1C,IAAI,EAAE,QAAQ,CAAC,eAAe,CAAC;IA4C3C,gLAAgL;IAC1K,eAAe,CACnB,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACpD,OAAO,CAAC,OAAO,CAAC;IAInB,sHAAsH;IACtH,YAAY,IAAI,IAAI,CAClB,gBAAgB,EAChB,YAAY,GAAG,SAAS,GAAG,aAAa,CACzC;IAWD,sFAAsF;IACtF,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAMZ,+KAA+K;IACzK,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAK9D,sGAAsG;IAChG,MAAM,CACV,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACvE,OAAO,CAAC,sBAAsB,CAAC;IAIlC,qLAAqL;IAC/K,QAAQ,CACZ,KAAK,EAAE,QAAQ,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,GACpD,OAAO,CAAC,yBAAyB,CAAC;IAIrC,uFAAuF;IACjF,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAItD,kGAAkG;IAC5F,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAGnD"}

package/dist/core/group-proofs.js

@@ -55,6 +55,10 @@ export class GroupProofs {
             onError: deps.onError,
         });
     }
+    /** Whether a gossiped proof shows that deviceHex belongs to the account this store holds, judged against the user principal's own proofs (MembershipProofs.isAccountMember). */
+    async isAccountMember(claim) {
+        return this.principal.isAccountMember(claim);
+    }
     /** The agent/self advert fields carrying this device's current proofs, each absent until it has first been minted. */
     advertFields() {
         const membership = this.principal.current();

package/dist/core/group-proofs.js.map

@@ -1 +1 @@
-{"version":3,"file":"group-proofs.js","sourceRoot":"","sources":["../../src/core/group-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAmBlD,MAAM,OAAO,WAAW;IACL,SAAS,CAAmB;IAC5B,OAAO,CAAmB;IAC1B,QAAQ,CAAkB;IAC1B,WAAW,CAAmB;IAC9B,WAAW,CAA0B;IAEtD,YAAY,IAA+B;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACpC,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC;YAClC,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC;YAClC,gBAAgB,EAAE,GAAG,EAAE,CACrB,IAAI,CAAC,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE;YACpD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,GAAG,EAAE;gBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/C,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,iBAAiB,EAAE,GAAG,EAAE;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,gBAAgB,CAAC;YACtC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAED,sHAAsH;IACtH,YAAY;QAIV,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,+KAA+K;IAC/K,KAAK,CAAC,eAAe,CAAC,IAAwB;QAC5C,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACV,KAAwE;QAExE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,qLAAqL;IACrL,KAAK,CAAC,QAAQ,CACZ,KAAqD;QAErD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;CACF"}
+{"version":3,"file":"group-proofs.js","sourceRoot":"","sources":["../../src/core/group-proofs.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAGhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAmBlD,MAAM,OAAO,WAAW;IACL,SAAS,CAAmB;IAC5B,OAAO,CAAmB;IAC1B,QAAQ,CAAkB;IAC1B,WAAW,CAAmB;IAC9B,WAAW,CAA0B;IAEtD,YAAY,IAA+B;QACzC,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;QACpC,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QACF,IAAI,CAAC,SAAS,GAAG,IAAI,gBAAgB,CAAC;YACpC,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY;SAC9C,CAAC,CAAC;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC;YAClC,GAAG,MAAM;YACT,QAAQ,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe;SACjD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC;YAClC,gBAAgB,EAAE,GAAG,EAAE,CACrB,IAAI,CAAC,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,EAAE,IAAI,EAAE;YACpD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC/C,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,YAAY,EAAE,GAAG,EAAE;gBACjB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;YACvD,CAAC;YACD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACvC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC/C,OAAO,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,iBAAiB,EAAE,GAAG,EAAE;gBACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;gBACrC,OAAO,QAAQ,KAAK,SAAS;oBAC3B,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,sBAAsB,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;YAC9D,CAAC;SACF,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,GAAG,IAAI,gBAAgB,CAAC;YACtC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;IACL,CAAC;IAED,gLAAgL;IAChL,KAAK,CAAC,eAAe,CACnB,KAAqD;QAErD,OAAO,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAED,sHAAsH;IACtH,YAAY;QAIV,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;QAC/C,OAAO;YACL,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,sFAAsF;IACtF,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,IAAI;QACF,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAED,+KAA+K;IAC/K,KAAK,CAAC,eAAe,CAAC,IAAwB;QAC5C,sBAAsB,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;IACpC,CAAC;IAED,sGAAsG;IACtG,KAAK,CAAC,MAAM,CACV,KAAwE;QAExE,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IAED,qLAAqL;IACrL,KAAK,CAAC,QAAQ,CACZ,KAAqD;QAErD,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;IAC1C,CAAC;IAED,kGAAkG;IAClG,KAAK,CAAC,YAAY;QAChB,OAAO,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;IACtC,CAAC;CACF"}

package/dist/core/identity-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store.d.ts","sourceRoot":"","sources":["../../src/core/identity-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAQzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAGlD,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAYD,wgBAAwgB;AACxgB,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM;IACN;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE;IACtD,MAAM,GAAG,IAAI;IACb,MAAM;CACP,CAAC;AAgBF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAYpC;AAqCD,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,GACrB,yBAAyB,CAgB3B;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,yBAAyB,GACpC,eAAe,CAkBjB;AA0BD,4UAA4U;AAC5U,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,CAIhE;AA0ED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,YAAY,CAad;AAkDD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,GAAG,SAAS,CAKpB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,YAAY,CAId;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAKtE;AA0DD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CASjC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,GACrB,IAAI,CAgBN;AAED,sGAAsG;AACtG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,GACf,IAAI,CAUN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CASjC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,GACrB,IAAI,CAgBN;AAED,6JAA6J;AAC7J,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,IAAI,CAUN;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAQrC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,UAAU,GAClB,IAAI,CAiBN;AAED,4PAA4P;AAC5P,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,IAAI,CASN;AASD,wPAAwP;AACxP,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAWD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,GAC5C,kBAAkB,CAuBpB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAC7C,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAClC,IAAI,CAaN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,GAC5C,MAAM,CAOR;AAED,4LAA4L;AAC5L,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,0mBAA0mB;AAC1mB,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAkBD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,wBAAwB,CAgC1B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,MAAM,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GACzC,IAAI,CAQN"}
+{"version":3,"file":"identity-store.d.ts","sourceRoot":"","sources":["../../src/core/identity-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAQzE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AASlD,4EAA4E;AAC5E,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,oCAAoC;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAYD,wgBAAwgB;AACxgB,MAAM,MAAM,yBAAyB,GAAG;IACtC,MAAM;IACN;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE;IACtD,MAAM,GAAG,IAAI;IACb,MAAM;CACP,CAAC;AAgBF,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,yBAAyB,CAYpC;AAqCD,0EAA0E;AAC1E,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,GACrB,yBAAyB,CAgB3B;AAED,qCAAqC;AACrC,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,yBAAyB,GACpC,eAAe,CAkBjB;AA0BD,4UAA4U;AAC5U,wBAAgB,WAAW,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,MAAM,CAIhE;AAeD;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,YAAY,CAad;AAkDD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,GAAG,SAAS,CAKpB;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,YAAY,CAId;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAAG,IAAI,CAEtE;AA0DD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CASjC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,eAAe,GACrB,IAAI,CAgBN;AAED,sGAAsG;AACtG,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,GACf,IAAI,CAUN;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CASjC;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,GACrB,IAAI,CAgBN;AAED,6JAA6J;AAC7J,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,SAAS,EAAE,MAAM,GAChB,IAAI,CAUN;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,UAAU,CAAC,WAAW,CAAC,GAAG,SAAS,CAQrC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,EACvB,OAAO,EAAE,UAAU,GAClB,IAAI,CAiBN;AAED,4PAA4P;AAC5P,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,IAAI,CASN;AASD,wPAAwP;AACxP,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAWD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,GAC5C,kBAAkB,CAuBpB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,EAC7C,KAAK,EAAE,QAAQ,CAAC,kBAAkB,CAAC,GAClC,IAAI,CAaN;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,GAC5C,MAAM,CAOR;AAED,4LAA4L;AAC5L,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,0mBAA0mB;AAC1mB,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAClC;AAkBD;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,GAC3B,wBAAwB,CAgC1B;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC,EAC5B,MAAM,EAAE,QAAQ,CAAC,wBAAwB,CAAC,GACzC,IAAI,CAQN"}