wire-mesh-core 1.14.0 → 1.15.0

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { Transport } from "../ports/transport.cjs";
+import { r as Transport } from "../transport-Da7GP9ya.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { Transport } from "../ports/transport.mjs";
+import { r as Transport } from "../transport-ESMXRz3s.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { Transport } from "../ports/transport.cjs";
+import { r as Transport } from "../transport-Da7GP9ya.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { Transport } from "../ports/transport.mjs";
+import { r as Transport } from "../transport-ESMXRz3s.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/capability-request.cjs

@@ -0,0 +1,118 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_domain_tokens = require("./tokens.cjs");
+//#region src/domain/capability-request.ts
+/**
+* The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
+*
+* Two responsibilities live here, split the same way tokens.ts and room-token-verification.ts already split verification concerns: requestCapability is the asking side (a thin wrapper over MeshSession.sendManageRequest, parsing the grant response), and createCapabilityRequestHandler is the receiving side (validates the incoming ask, arms a receiver-side timeout so an unanswered request never hangs a requester forever, and hands the decision to the domain).
+*/
+const TOKEN_ID_BYTE_LENGTH = 16;
+function randomTokenId() {
+	const bytes = new Uint8Array(TOKEN_ID_BYTE_LENGTH);
+	crypto.getRandomValues(bytes);
+	return bytes;
+}
+/**
+* Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
+*/
+function buildCapabilityRequestCommand(capability, validUntil) {
+	return {
+		verb: capability,
+		params: {
+			verb: "capability.request",
+			capability,
+			...validUntil !== void 0 ? { "valid-until": validUntil } : {}
+		}
+	};
+}
+/**
+* Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
+*
+* targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
+*/
+async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil) {
+	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, void 0, timeoutMs);
+	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	const parsed = require_generated_protocol.capabilityGrantOkSchema.safeParse(outcome);
+	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
+	return parsed.data;
+}
+/**
+* Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
+*/
+function createCapabilityRequestHandler(options) {
+	return async function handleCapabilityRequest(incoming) {
+		const parsed = require_generated_protocol.capabilityRequestSchema.safeParse(incoming.command.params);
+		if (!parsed.success || parsed.data.capability !== options.capability) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const validUntil = parsed.data["valid-until"];
+		if (validUntil !== void 0 && validUntil <= options.clock.now()) {
+			await incoming.respond({
+				result: "error",
+				code: "expired"
+			});
+			return;
+		}
+		let settled = false;
+		const timeoutHandle = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			incoming.respond({
+				result: "error",
+				code: "timeout",
+				message: "no decision within the capability-request timeout"
+			}).catch(() => void 0);
+		}, options.timeoutMs);
+		timeoutHandle.unref();
+		options.onRequest({
+			scope: incoming.scope,
+			requesterDevice: options.bearerDevice,
+			async decide(decision) {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timeoutHandle);
+				if (decision.kind === "reject") {
+					await incoming.respond({
+						result: "error",
+						code: "denied",
+						...decision.reason !== void 0 ? { message: decision.reason } : {}
+					});
+					return;
+				}
+				const verdict = await require_domain_tokens.mintCapabilityToken({
+					identity: options.identity,
+					clock: options.clock,
+					tokenId: randomTokenId(),
+					bearer: options.bearerDevice,
+					capability: decision.capability,
+					scope: incoming.scope,
+					expires: decision.expires,
+					...decision.delegationsRemaining !== void 0 ? { delegationsRemaining: decision.delegationsRemaining } : {}
+				});
+				if (!verdict.ok) {
+					await incoming.respond({
+						result: "error",
+						code: "mint_failed"
+					});
+					return;
+				}
+				const grantedToken = verdict.token;
+				await incoming.respond({
+					result: "ok",
+					"granted-token": grantedToken,
+					...decision.extensions ?? {}
+				});
+			}
+		});
+	};
+}
+//#endregion
+exports.buildCapabilityRequestCommand = buildCapabilityRequestCommand;
+exports.createCapabilityRequestHandler = createCapabilityRequestHandler;
+exports.requestCapability = requestCapability;

package/dist/domain/capability-request.d.cts

@@ -0,0 +1,56 @@
+import { P as ManageCommand, a as CapabilityScope, b as DeviceId, r as CapabilityGrantOk } from "../protocol-MnxTzpRP.cjs";
+import { t as IdentityPort } from "../identity-DkEe1465.cjs";
+import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
+//#region src/domain/capability-request.d.ts
+/**
+ * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
+ */
+export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/**
+ * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
+ *
+ * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
+ */
+export declare function requestCapability(session: Readonly<MeshSession>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number): Promise<CapabilityGrantOk>;
+/**
+ * A receiver's decision on one incoming capability-request, mirroring room-client.ts's own (now capability-specific) RoomJoinDecision, generalized to any capability: "accept" mints and returns a fresh token; "reject" sends an ordinary manage-error carrying an optional human-readable reason.
+ */
+export type CapabilityGrantDecision = {
+  kind: "accept";
+  /** The capability the minted token actually carries -- usually, but not necessarily, the same string the request itself asked for (a receiver is free to grant something narrower). */
+  capability: string;
+  expires: number;
+  delegationsRemaining?: number;
+  /** Fields the domain wants merged onto the `{result:"ok", "granted-token": token, ...}` response, riding capability-grant-ok's own open `* tstr => any` tail -- the mechanism core/room's own room-join-ok uses for its `members` field, generalized so this module never needs to know what any particular capability's own grant response should additionally carry. Omit for a capability (e.g. a bare exec grant) whose response needs nothing beyond the token itself. */
+  extensions?: Record<string, unknown>;
+} | {
+  kind: "reject";
+  reason?: string;
+};
+/** One incoming, not-yet-expired capability-request, surfaced for the domain to accept or reject via decide(). */
+export interface CapabilityGrantRequestEvent {
+  /** The scope this request's own manage-request-frame carries -- e.g. core/room's `{kind:"room", path: roomPath}` -- passed through unchanged so the domain can inspect it (a room handler reads `.path` back out) without this module needing to know its shape. */
+  scope: Readonly<CapabilityScope>;
+  /** The peer device-id authenticated on the connection this request arrived over -- the requester, and so the future bearer of any token minted on acceptance. Same role as RoomRouterOptions.peerDevice / RoomJoinRequestEvent.requesterDevice. */
+  requesterDevice: DeviceId;
+  /** Resolves this request with the domain's decision. Settles the request's response exactly once: whichever of a real decide() call or the handler's own receiver-side timeout comes first wins, and the other is a no-op -- the same single-settle guarantee agent-comms' own PendingConnection timer/accept/reject/disconnect race already established (ported here, not reinvented). */
+  decide: (decision: Readonly<CapabilityGrantDecision>) => Promise<void>;
+}
+export interface CreateCapabilityRequestHandlerOptions {
+  /** The capability this handler grants. Checked against both the incoming request's own `params.capability` field (a mismatch is refused as malformed rather than trusted -- nothing about manage-command.verb structurally guarantees params.capability agrees with it) and used as the scope this handler is willing to act on at all; a caller wanting to grant several distinct capabilities over one session constructs one handler per capability, the same way core/room constructs one handler for `room:member` and nothing else. */
+  capability: string;
+  identity: IdentityPort;
+  clock: Clock;
+  /** The peer device-id authenticated on this session's own connection -- the requester, and so the future bearer of any token this handler mints. One handler is constructed per session for the same reason one RoomRouter is (RoomRouterOptions.peerDevice): MeshSession exposes no way for domain code to learn the authenticated peer independently. */
+  bearerDevice: DeviceId;
+  /** Receiver-side auto-reject window (wire-mesh#81): how long an incoming request may sit awaiting the domain's decision before this side responds with a real manage-error timeout rather than leaving the requester's own sendManageRequest hanging indefinitely. Ported from agent-comms' PendingConnection pattern (`wire-mesh-transport.ts`'s `pendingConnectionTimeoutMs` / `expirePendingConnection`): an unref'd timer so a stray one can never by itself keep the process alive, cleared the instant decide() is actually called so it can never fire after the request has already been answered. IncomingManageRequest exposes no requester-disconnect signal at this layer (unlike agent-comms' own transport, which owns the raw connection), so only the timeout half of that pattern is implemented here -- there is nothing to detect the requester giving up early honestly, so this module does not pretend to. */
+  timeoutMs: number;
+  /** Called once per incoming, not-yet-expired capability-request, for the domain to accept or reject via the event's own decide(). */
+  onRequest: (event: Readonly<CapabilityGrantRequestEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
+ */
+export declare function createCapabilityRequestHandler(options: Readonly<CreateCapabilityRequestHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/capability-request.d.mts

@@ -0,0 +1,56 @@
+import { P as ManageCommand, a as CapabilityScope, b as DeviceId, r as CapabilityGrantOk } from "../protocol-MnxTzpRP.mjs";
+import { t as IdentityPort } from "../identity-D8iJZRZZ.mjs";
+import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
+//#region src/domain/capability-request.d.ts
+/**
+ * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
+ */
+export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/**
+ * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
+ *
+ * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
+ */
+export declare function requestCapability(session: Readonly<MeshSession>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number): Promise<CapabilityGrantOk>;
+/**
+ * A receiver's decision on one incoming capability-request, mirroring room-client.ts's own (now capability-specific) RoomJoinDecision, generalized to any capability: "accept" mints and returns a fresh token; "reject" sends an ordinary manage-error carrying an optional human-readable reason.
+ */
+export type CapabilityGrantDecision = {
+  kind: "accept";
+  /** The capability the minted token actually carries -- usually, but not necessarily, the same string the request itself asked for (a receiver is free to grant something narrower). */
+  capability: string;
+  expires: number;
+  delegationsRemaining?: number;
+  /** Fields the domain wants merged onto the `{result:"ok", "granted-token": token, ...}` response, riding capability-grant-ok's own open `* tstr => any` tail -- the mechanism core/room's own room-join-ok uses for its `members` field, generalized so this module never needs to know what any particular capability's own grant response should additionally carry. Omit for a capability (e.g. a bare exec grant) whose response needs nothing beyond the token itself. */
+  extensions?: Record<string, unknown>;
+} | {
+  kind: "reject";
+  reason?: string;
+};
+/** One incoming, not-yet-expired capability-request, surfaced for the domain to accept or reject via decide(). */
+export interface CapabilityGrantRequestEvent {
+  /** The scope this request's own manage-request-frame carries -- e.g. core/room's `{kind:"room", path: roomPath}` -- passed through unchanged so the domain can inspect it (a room handler reads `.path` back out) without this module needing to know its shape. */
+  scope: Readonly<CapabilityScope>;
+  /** The peer device-id authenticated on the connection this request arrived over -- the requester, and so the future bearer of any token minted on acceptance. Same role as RoomRouterOptions.peerDevice / RoomJoinRequestEvent.requesterDevice. */
+  requesterDevice: DeviceId;
+  /** Resolves this request with the domain's decision. Settles the request's response exactly once: whichever of a real decide() call or the handler's own receiver-side timeout comes first wins, and the other is a no-op -- the same single-settle guarantee agent-comms' own PendingConnection timer/accept/reject/disconnect race already established (ported here, not reinvented). */
+  decide: (decision: Readonly<CapabilityGrantDecision>) => Promise<void>;
+}
+export interface CreateCapabilityRequestHandlerOptions {
+  /** The capability this handler grants. Checked against both the incoming request's own `params.capability` field (a mismatch is refused as malformed rather than trusted -- nothing about manage-command.verb structurally guarantees params.capability agrees with it) and used as the scope this handler is willing to act on at all; a caller wanting to grant several distinct capabilities over one session constructs one handler per capability, the same way core/room constructs one handler for `room:member` and nothing else. */
+  capability: string;
+  identity: IdentityPort;
+  clock: Clock;
+  /** The peer device-id authenticated on this session's own connection -- the requester, and so the future bearer of any token this handler mints. One handler is constructed per session for the same reason one RoomRouter is (RoomRouterOptions.peerDevice): MeshSession exposes no way for domain code to learn the authenticated peer independently. */
+  bearerDevice: DeviceId;
+  /** Receiver-side auto-reject window (wire-mesh#81): how long an incoming request may sit awaiting the domain's decision before this side responds with a real manage-error timeout rather than leaving the requester's own sendManageRequest hanging indefinitely. Ported from agent-comms' PendingConnection pattern (`wire-mesh-transport.ts`'s `pendingConnectionTimeoutMs` / `expirePendingConnection`): an unref'd timer so a stray one can never by itself keep the process alive, cleared the instant decide() is actually called so it can never fire after the request has already been answered. IncomingManageRequest exposes no requester-disconnect signal at this layer (unlike agent-comms' own transport, which owns the raw connection), so only the timeout half of that pattern is implemented here -- there is nothing to detect the requester giving up early honestly, so this module does not pretend to. */
+  timeoutMs: number;
+  /** Called once per incoming, not-yet-expired capability-request, for the domain to accept or reject via the event's own decide(). */
+  onRequest: (event: Readonly<CapabilityGrantRequestEvent>) => void;
+}
+/**
+ * Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
+ */
+export declare function createCapabilityRequestHandler(options: Readonly<CreateCapabilityRequestHandlerOptions>): (incoming: Readonly<IncomingManageRequest>) => Promise<void>;
+//#endregion

package/dist/domain/capability-request.mjs

@@ -0,0 +1,115 @@
+import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
+import { mintCapabilityToken } from "./tokens.mjs";
+//#region src/domain/capability-request.ts
+/**
+* The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
+*
+* Two responsibilities live here, split the same way tokens.ts and room-token-verification.ts already split verification concerns: requestCapability is the asking side (a thin wrapper over MeshSession.sendManageRequest, parsing the grant response), and createCapabilityRequestHandler is the receiving side (validates the incoming ask, arms a receiver-side timeout so an unanswered request never hangs a requester forever, and hands the decision to the domain).
+*/
+const TOKEN_ID_BYTE_LENGTH = 16;
+function randomTokenId() {
+	const bytes = new Uint8Array(TOKEN_ID_BYTE_LENGTH);
+	crypto.getRandomValues(bytes);
+	return bytes;
+}
+/**
+* Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
+*/
+function buildCapabilityRequestCommand(capability, validUntil) {
+	return {
+		verb: capability,
+		params: {
+			verb: "capability.request",
+			capability,
+			...validUntil !== void 0 ? { "valid-until": validUntil } : {}
+		}
+	};
+}
+/**
+* Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
+*
+* targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
+*/
+async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil) {
+	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, void 0, timeoutMs);
+	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	const parsed = capabilityGrantOkSchema.safeParse(outcome);
+	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
+	return parsed.data;
+}
+/**
+* Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
+*/
+function createCapabilityRequestHandler(options) {
+	return async function handleCapabilityRequest(incoming) {
+		const parsed = capabilityRequestSchema.safeParse(incoming.command.params);
+		if (!parsed.success || parsed.data.capability !== options.capability) {
+			await incoming.respond({
+				result: "error",
+				code: "malformed"
+			});
+			return;
+		}
+		const validUntil = parsed.data["valid-until"];
+		if (validUntil !== void 0 && validUntil <= options.clock.now()) {
+			await incoming.respond({
+				result: "error",
+				code: "expired"
+			});
+			return;
+		}
+		let settled = false;
+		const timeoutHandle = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			incoming.respond({
+				result: "error",
+				code: "timeout",
+				message: "no decision within the capability-request timeout"
+			}).catch(() => void 0);
+		}, options.timeoutMs);
+		timeoutHandle.unref();
+		options.onRequest({
+			scope: incoming.scope,
+			requesterDevice: options.bearerDevice,
+			async decide(decision) {
+				if (settled) return;
+				settled = true;
+				clearTimeout(timeoutHandle);
+				if (decision.kind === "reject") {
+					await incoming.respond({
+						result: "error",
+						code: "denied",
+						...decision.reason !== void 0 ? { message: decision.reason } : {}
+					});
+					return;
+				}
+				const verdict = await mintCapabilityToken({
+					identity: options.identity,
+					clock: options.clock,
+					tokenId: randomTokenId(),
+					bearer: options.bearerDevice,
+					capability: decision.capability,
+					scope: incoming.scope,
+					expires: decision.expires,
+					...decision.delegationsRemaining !== void 0 ? { delegationsRemaining: decision.delegationsRemaining } : {}
+				});
+				if (!verdict.ok) {
+					await incoming.respond({
+						result: "error",
+						code: "mint_failed"
+					});
+					return;
+				}
+				const grantedToken = verdict.token;
+				await incoming.respond({
+					result: "ok",
+					"granted-token": grantedToken,
+					...decision.extensions ?? {}
+				});
+			}
+		});
+	};
+}
+//#endregion
+export { buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
 import { $ as ProtocolVersion, E as Frame, G as PeerAdvert, I as ManageError, L as ManageOk, P as ManageCommand, a as CapabilityScope, b as DeviceId, o as CapabilityToken, ut as RevocationEntry } from "../protocol-MnxTzpRP.cjs";
 import { t as IdentityPort } from "../identity-DkEe1465.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { Connection, Transport } from "../ports/transport.cjs";
+import { r as Transport, t as Connection } from "../transport-Da7GP9ya.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
 import { $ as ProtocolVersion, E as Frame, G as PeerAdvert, I as ManageError, L as ManageOk, P as ManageCommand, a as CapabilityScope, b as DeviceId, o as CapabilityToken, ut as RevocationEntry } from "../protocol-MnxTzpRP.mjs";
 import { t as IdentityPort } from "../identity-D8iJZRZZ.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { Connection, Transport } from "../ports/transport.mjs";
+import { r as Transport, t as Connection } from "../transport-ESMXRz3s.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/relay-hub.d.cts

@@ -1,4 +1,4 @@
-import { Connection } from "../ports/transport.cjs";
+import { t as Connection } from "../transport-Da7GP9ya.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/relay-hub.d.mts

@@ -1,4 +1,4 @@
-import { Connection } from "../ports/transport.mjs";
+import { t as Connection } from "../transport-ESMXRz3s.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_domain_device_id = require("./device-id.cjs");
 const require_domain_tokens = require("./tokens.cjs");
+const require_domain_device_id = require("./device-id.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId, issuer) {
 	return `${require_domain_device_id.bytesToHex(tokenId)}:${require_domain_device_id.deviceIdToHex(issuer)}`;

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
-import { bytesToHex, deviceIdToHex } from "./device-id.mjs";
 import { verifyRevocationEntry } from "./tokens.mjs";
+import { bytesToHex, deviceIdToHex } from "./device-id.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId, issuer) {
 	return `${bytesToHex(tokenId)}:${deviceIdToHex(issuer)}`;

package/dist/domain/room-token-verification.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_tokens = require("./tokens.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_room_path = require("./room-path.cjs");
-const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/room-token-verification.ts
 /**
 * core/room's six verifier obligations (spec/room.cddl), layered on top of verifyCapabilityToken (obligations 2, 4, and 5 -- bearer match, ordinary token-claims checks, and delegations-remaining narrowing -- already live there). This module adds the two obligations specific to room-shaped scopes: the chain must terminate at the correct root for the path's own shape (1), and the token's own scope must actually name the room the request claims to act on (3). Obligation 6 (refuse an unrecognised content-type/kind) is a message-handling concern, not a token-verification one, and belongs to each consumer's own room verb router instead.

package/dist/domain/room-token-verification.mjs

@@ -1,6 +1,6 @@
+import { verifyCapabilityToken } from "./tokens.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { parseRoomPath } from "./room-path.mjs";
-import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/room-token-verification.ts
 /**
 * core/room's six verifier obligations (spec/room.cddl), layered on top of verifyCapabilityToken (obligations 2, 4, and 5 -- bearer match, ordinary token-claims checks, and delegations-remaining narrowing -- already live there). This module adds the two obligations specific to room-shaped scopes: the chain must terminate at the correct root for the path's own shape (1), and the token's own scope must actually name the room the request claims to act on (3). Obligation 6 (refuse an unrecognised content-type/kind) is a message-handling concern, not a token-verification one, and belongs to each consumer's own room verb router instead.

package/dist/ports/transport.d.cts

@@ -1,29 +1,2 @@
-import { E as Frame, b as DeviceId } from "../protocol-MnxTzpRP.cjs";
-//#region src/ports/transport.d.ts
-/**
- * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
- */
-export interface Connection {
-  send: (frame: Frame) => Promise<void>;
-  /** Frames received on this connection, in arrival order, until the connection closes. */
-  receive: () => AsyncIterable<Frame>;
-  close: () => Promise<void>;
-  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
-  readonly peerDeviceId?: DeviceId;
-  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
-  unref?: () => void;
-}
-export interface Listener {
-  /** Stops listening and closes the listener. */
-  close: () => Promise<void>;
-  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
-  address: string;
-  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
-  unref?: () => void;
-}
-export interface Transport {
-  connect: (address: string) => Promise<Connection>;
-  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
-  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
-}
-//#endregion
+import { n as Listener, r as Transport, t as Connection } from "../transport-Da7GP9ya.cjs";
+export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,29 +1,2 @@
-import { E as Frame, b as DeviceId } from "../protocol-MnxTzpRP.mjs";
-//#region src/ports/transport.d.ts
-/**
- * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
- */
-export interface Connection {
-  send: (frame: Frame) => Promise<void>;
-  /** Frames received on this connection, in arrival order, until the connection closes. */
-  receive: () => AsyncIterable<Frame>;
-  close: () => Promise<void>;
-  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
-  readonly peerDeviceId?: DeviceId;
-  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
-  unref?: () => void;
-}
-export interface Listener {
-  /** Stops listening and closes the listener. */
-  close: () => Promise<void>;
-  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
-  address: string;
-  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
-  unref?: () => void;
-}
-export interface Transport {
-  connect: (address: string) => Promise<Connection>;
-  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
-  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
-}
-//#endregion
+import { n as Listener, r as Transport, t as Connection } from "../transport-ESMXRz3s.mjs";
+export { Connection, Listener, Transport };

package/dist/transport-Da7GP9ya.d.cts

@@ -0,0 +1,30 @@
+import { E as Frame, b as DeviceId } from "./protocol-MnxTzpRP.cjs";
+//#region src/ports/transport.d.ts
+/**
+ * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
+ */
+interface Connection {
+  send: (frame: Frame) => Promise<void>;
+  /** Frames received on this connection, in arrival order, until the connection closes. */
+  receive: () => AsyncIterable<Frame>;
+  close: () => Promise<void>;
+  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
+  readonly peerDeviceId?: DeviceId;
+  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
+  unref?: () => void;
+}
+interface Listener {
+  /** Stops listening and closes the listener. */
+  close: () => Promise<void>;
+  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
+  address: string;
+  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
+  unref?: () => void;
+}
+interface Transport {
+  connect: (address: string) => Promise<Connection>;
+  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
+  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
+}
+//#endregion
+export { Listener as n, Transport as r, Connection as t };

package/dist/transport-ESMXRz3s.d.mts

@@ -0,0 +1,30 @@
+import { E as Frame, b as DeviceId } from "./protocol-MnxTzpRP.mjs";
+//#region src/ports/transport.d.ts
+/**
+ * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.
+ */
+interface Connection {
+  send: (frame: Frame) => Promise<void>;
+  /** Frames received on this connection, in arrival order, until the connection closes. */
+  receive: () => AsyncIterable<Frame>;
+  close: () => Promise<void>;
+  /** The peer's device-id, cryptographically authenticated by the adapter itself (never a value read off the wire) -- absent when the adapter has nothing to authenticate against (createTcpTransport) or the peer presented no credential to check (an accepting createTlsTransport connection whose peer sent no certificate). A caller that later receives an application-level claim of who the peer is (e.g. an `introduce`-style message) MUST treat a mismatch against this field as a spoofing attempt and refuse the claim, exactly the same "reject and destroy" obligation self-certifying claims elsewhere in this spec already carry. */
+  readonly peerDeviceId?: DeviceId;
+  /** Lets the event loop exit while this connection is still open and functioning -- a caller that wants I/O to keep working without keeping the process alive (matching Node's own `net.Socket.unref()`) calls this once. Adapters with no underlying handle to unref (an in-memory test double, a browser WebSocket) simply omit it. */
+  unref?: () => void;
+}
+interface Listener {
+  /** Stops listening and closes the listener. */
+  close: () => Promise<void>;
+  /** The address actually bound, as "host:port". A caller may pass port 0 to take an OS-assigned port and needs it handed back to connect to (or advertise) -- tests rely on this to avoid fixed-port collisions. */
+  address: string;
+  /** Lets the event loop exit while this listener is still bound and accepting connections. See Connection.unref for the same rationale; adapters with nothing to unref omit it. */
+  unref?: () => void;
+}
+interface Transport {
+  connect: (address: string) => Promise<Connection>;
+  /** Starts listening; each accepted connection is handed to onConnection. Resolves once bound, with the address actually listening on. */
+  listen: (address: string, onConnection: (connection: Readonly<Connection>) => void) => Promise<Listener>;
+}
+//#endregion
+export { Listener as n, Transport as r, Connection as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {
@@ -85,6 +85,10 @@
       "import": "./dist/adapters/tls-transport.mjs",
       "require": "./dist/adapters/tls-transport.cjs"
     },
+    "./domain/capability-request": {
+      "import": "./dist/domain/capability-request.mjs",
+      "require": "./dist/domain/capability-request.cjs"
+    },
     "./domain/device-id": {
       "import": "./dist/domain/device-id.mjs",
       "require": "./dist/domain/device-id.cjs"