wire-mesh-core 1.19.0 → 1.20.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as Frame } from "../protocol-B3U828E7.cjs";
+import { D as Frame } from "../protocol-l9RMR3s5.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as Frame } from "../protocol-B3U828E7.mjs";
+import { D as Frame } from "../protocol-l9RMR3s5.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { P as IdentityKey, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { P as IdentityKey, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { P as IdentityKey, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { P as IdentityKey, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BrAqN6I5.cjs";
+import { r as Transport } from "../transport-Baipikk7.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B_diuPHT.mjs";
+import { r as Transport } from "../transport-DWbvUc3L.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BrAqN6I5.cjs";
+import { r as Transport } from "../transport-Baipikk7.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B_diuPHT.mjs";
+import { r as Transport } from "../transport-DWbvUc3L.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/capability-grant.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-Dp9BnUTZ.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-D2aFwPcZ.cjs";
+import { a as RevocationCheck } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-DSwixfDl.mjs";
+import { a as RevocationCheck } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
-import { i as verifyCapabilityToken, o as scopeNarrows } from "../tokens-D9I1Pn14.mjs";
+import { i as verifyCapabilityToken, o as scopeNarrows } from "../tokens-B5BUgkba.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-Dp9BnUTZ.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-D9I1Pn14.mjs";
+import { n as mintCapabilityToken } from "../tokens-B5BUgkba.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { x as DeviceId } from "../protocol-B3U828E7.cjs";
+import { x as DeviceId } from "../protocol-l9RMR3s5.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { x as DeviceId } from "../protocol-B3U828E7.mjs";
+import { x as DeviceId } from "../protocol-l9RMR3s5.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-B3U828E7.cjs";
+import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-l9RMR3s5.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-B3U828E7.mjs";
+import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-l9RMR3s5.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-BrAqN6I5.cjs";
+import { r as Transport, t as Connection } from "../transport-Baipikk7.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-B_diuPHT.mjs";
+import { r as Transport, t as Connection } from "../transport-DWbvUc3L.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/relay-hub.d.cts

@@ -1,4 +1,4 @@
-import { t as Connection } from "../transport-BrAqN6I5.cjs";
+import { t as Connection } from "../transport-Baipikk7.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/relay-hub.d.mts

@@ -1,4 +1,4 @@
-import { t as Connection } from "../transport-B_diuPHT.mjs";
+import { t as Connection } from "../transport-DWbvUc3L.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/revocation-view.cjs

@@ -1,19 +1,24 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-Dp9BnUTZ.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 //#region src/domain/revocation-view.ts
-function revocationKey(tokenId, issuer) {
-	return `${require_domain_device_id.bytesToHex(tokenId)}:${require_domain_device_id.deviceIdToHex(issuer)}`;
+function revocationKey(tokenId) {
+	return require_domain_device_id.bytesToHex(tokenId);
 }
 function createRevocationView() {
-	const revoked = /* @__PURE__ */ new Set();
+	const entriesByTokenId = /* @__PURE__ */ new Map();
 	return {
-		async isRevoked(tokenId, issuer) {
-			return Promise.resolve(revoked.has(revocationKey(tokenId, issuer)));
+		async entriesFor(tokenId) {
+			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
 			const verdict = await require_tokens.verifyRevocationEntry(entry, options);
-			if (verdict.ok) revoked.add(revocationKey(verdict.claims["token-id"], verdict.claims.issuer));
+			if (verdict.ok) {
+				const key = revocationKey(verdict.claims["token-id"]);
+				const existing = entriesByTokenId.get(key);
+				if (existing === void 0) entriesByTokenId.set(key, [verdict.claims]);
+				else existing.push(verdict.claims);
+			}
 			return verdict;
 		}
 	};

package/dist/domain/revocation-view.d.cts

@@ -1,8 +1,8 @@
-import { dt as RevocationEntry } from "../protocol-B3U828E7.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-D2aFwPcZ.cjs";
+import { dt as RevocationEntry } from "../protocol-l9RMR3s5.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
- * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by (token-id, issuer) per management.cddl's contract: an entry counts against a token only when both match, so a third party's entry for someone else's token-id is stored (it is a well-formed, self-certifying entry) but never matches a lookup for the token it does not actually govern.
+ * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.
  */
 export interface RevocationView extends RevocationCheck {
   /** Verifies one gossiped revocation-entry via verifyRevocationEntry and, if it verifies, records it. An entry that fails verification is dropped, not stored -- the returned verdict lets a caller log or otherwise report the refusal. */

package/dist/domain/revocation-view.d.mts

@@ -1,8 +1,8 @@
-import { dt as RevocationEntry } from "../protocol-B3U828E7.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DSwixfDl.mjs";
+import { dt as RevocationEntry } from "../protocol-l9RMR3s5.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
- * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by (token-id, issuer) per management.cddl's contract: an entry counts against a token only when both match, so a third party's entry for someone else's token-id is stored (it is a well-formed, self-certifying entry) but never matches a lookup for the token it does not actually govern.
+ * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.
  */
 export interface RevocationView extends RevocationCheck {
   /** Verifies one gossiped revocation-entry via verifyRevocationEntry and, if it verifies, records it. An entry that fails verification is dropped, not stored -- the returned verdict lets a caller log or otherwise report the refusal. */

package/dist/domain/revocation-view.mjs

@@ -1,18 +1,23 @@
-import { a as verifyRevocationEntry } from "../tokens-D9I1Pn14.mjs";
-import { bytesToHex, deviceIdToHex } from "./device-id.mjs";
+import { a as verifyRevocationEntry } from "../tokens-B5BUgkba.mjs";
+import { bytesToHex } from "./device-id.mjs";
 //#region src/domain/revocation-view.ts
-function revocationKey(tokenId, issuer) {
-	return `${bytesToHex(tokenId)}:${deviceIdToHex(issuer)}`;
+function revocationKey(tokenId) {
+	return bytesToHex(tokenId);
 }
 function createRevocationView() {
-	const revoked = /* @__PURE__ */ new Set();
+	const entriesByTokenId = /* @__PURE__ */ new Map();
 	return {
-		async isRevoked(tokenId, issuer) {
-			return Promise.resolve(revoked.has(revocationKey(tokenId, issuer)));
+		async entriesFor(tokenId) {
+			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
 			const verdict = await verifyRevocationEntry(entry, options);
-			if (verdict.ok) revoked.add(revocationKey(verdict.claims["token-id"], verdict.claims.issuer));
+			if (verdict.ok) {
+				const key = revocationKey(verdict.claims["token-id"]);
+				const existing = entriesByTokenId.get(key);
+				if (existing === void 0) entriesByTokenId.set(key, [verdict.claims]);
+				else existing.push(verdict.claims);
+			}
 			return verdict;
 		}
 	};

package/dist/domain/room-token-verification.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-Dp9BnUTZ.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts

package/dist/domain/room-token-verification.d.cts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-D2aFwPcZ.cjs";
+import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.d.mts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-DSwixfDl.mjs";
+import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.mjs

@@ -1,4 +1,4 @@
-import { i as verifyCapabilityToken } from "../tokens-D9I1Pn14.mjs";
+import { i as verifyCapabilityToken } from "../tokens-B5BUgkba.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-Dp9BnUTZ.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-D2aFwPcZ.cjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DSwixfDl.mjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-D9I1Pn14.mjs";
+import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-B5BUgkba.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/generated/protocol.cjs

@@ -196,7 +196,8 @@ const revocationClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"token-id": zod.z.instanceof(Uint8Array),
 	"issuer": zod.z.lazy(() => deviceIdSchema),
 	"issuer-key": zod.z.lazy(() => identityKeySchema),
-	"revoked-at": zod.z.number().int().nonnegative()
+	"revoked-at": zod.z.number().int().nonnegative(),
+	"authorization": zod.z.instanceof(Uint8Array).optional()
 }));
 const revocationEntrySchema = zod.z.lazy(() => zod.z.lazy(() => coseSign1Schema));
 const revocationAnnounceFrameSchema = zod.z.lazy(() => zod.z.object({

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.cjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-l9RMR3s5.cjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.mjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-l9RMR3s5.mjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -195,7 +195,8 @@ const revocationClaimsSchema = z.lazy(() => z.object({
 	"token-id": z.instanceof(Uint8Array),
 	"issuer": z.lazy(() => deviceIdSchema),
 	"issuer-key": z.lazy(() => identityKeySchema),
-	"revoked-at": z.number().int().nonnegative()
+	"revoked-at": z.number().int().nonnegative(),
+	"authorization": z.instanceof(Uint8Array).optional()
 }));
 const revocationEntrySchema = z.lazy(() => z.lazy(() => coseSign1Schema));
 const revocationAnnounceFrameSchema = z.lazy(() => z.object({

package/dist/{identity-B7YMBhMf.d.mts → identity-5LJ_B8go.d.mts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.mjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-COdFfaW8.d.cts → identity-bg6IVGsH.d.cts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.cjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-BrAqN6I5.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-Baipikk7.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-B_diuPHT.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DWbvUc3L.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-B3U828E7.d.cts → protocol-l9RMR3s5.d.cts}

@@ -843,6 +843,7 @@ declare const revocationClaimsSchema: z.ZodLazy<z.ZodObject<{
     "public-key": z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
   }, z.core.$strip>>>;
   "revoked-at": z.ZodNumber;
+  authorization: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$strip>>;
 declare const revocationEntrySchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodTuple<[z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   "1": z.ZodOptional<z.ZodNumber>;

package/dist/{protocol-B3U828E7.d.mts → protocol-l9RMR3s5.d.mts}

@@ -843,6 +843,7 @@ declare const revocationClaimsSchema: z.ZodLazy<z.ZodObject<{
     "public-key": z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
   }, z.core.$strip>>>;
   "revoked-at": z.ZodNumber;
+  authorization: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$strip>>;
 declare const revocationEntrySchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodTuple<[z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   "1": z.ZodOptional<z.ZodNumber>;

package/dist/{tokens-D9I1Pn14.mjs → tokens-B5BUgkba.mjs}

@@ -217,6 +217,26 @@ async function verifyCapabilityToken(token, options) {
 	};
 	return verdict;
 }
+/**
+* Does one recorded revocation-claims entry actually revoke targetClaims, per management.cddl's own additive obligation? Valid when EITHER the entry's own issuer equals the target token's own issuer (the original, unconditional rule -- only a token's own issuer may revoke it), OR the entry carries an `authorization` that independently verifies as an ordinary capability-token -- with `expectedBearer` set to THIS entry's own `issuer`, proving the authorization was actually granted to the party submitting this revocation, not merely referenced from someone else's -- whose own `capability` is `manage:revoke` (spec/registry/core-capabilities.md) and whose own `scope` narrows targetClaims' scope. An authorization that fails any part of this (wrong capability, scope doesn't narrow, fails ordinary verification -- expired, revoked, bad signature, bearer mismatch) makes the entry no more valid than if `authorization` were absent; it never falls back to weakening the issuer-match rule.
+*/
+async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
+	if (bytesEqual(entry.issuer, targetClaims.issuer)) return true;
+	if (entry.authorization === void 0) return false;
+	let decodedAuthorization;
+	try {
+		decodedAuthorization = decode(entry.authorization, cdeDecodeOptions);
+	} catch {
+		return false;
+	}
+	const authorizationResult = capabilityTokenSchema.safeParse(decodedAuthorization);
+	if (!authorizationResult.success) return false;
+	const authorizationVerdict = await verifyCapabilityToken(authorizationResult.data, {
+		...options,
+		expectedBearer: entry.issuer
+	});
+	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
+}
 async function verifyTokenChain(token, options) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
@@ -260,7 +280,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "content_expired"
 	};
-	if (await options.revocation.isRevoked(claims["token-id"], claims.issuer)) return {
+	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
+	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
 		ok: false,
 		reason: "revoked"
 	};

package/dist/{tokens-DSwixfDl.d.mts → tokens-CBI54oF-.d.mts}

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "./identity-B7YMBhMf.mjs";
+import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "./identity-5LJ_B8go.mjs";
 import { t as Clock } from "./clock-DiSx-WKM.mjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -21,10 +21,10 @@ type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) =>
 //#endregion
 //#region src/domain/tokens.d.ts
 /**
- * The revocation view a verifier consults. Contract per management.cddl: an entry counts against a token only when BOTH its token-id and its issuer match the token's own -- only a token's own issuer may revoke it, so a third party's entry for someone else's token-id must be ignored. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id + issuer.
+ * The revocation view a verifier consults. Returns every recorded, already-signature-verified revocation-claims for tokenId, across every issuer that has ever submitted one -- unfiltered by the store itself. The actual verifier obligation (an entry counts against a token when its own issuer matches the token's own issuer, OR its optional `authorization` grants delegated revoke authority -- management.cddl) is checked by the caller (verifyTokenChain), not here, since that check needs the target token's own scope plus identity/clock to verify a nested authorization token, none of which a store constructed ahead of time has access to. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id alone -- a token-id can legitimately carry multiple recorded entries from different issuers.
  */
 interface RevocationCheck {
-  isRevoked: (tokenId: Uint8Array, issuer: DeviceId) => Promise<boolean>;
+  entriesFor: (tokenId: Uint8Array) => Promise<readonly RevocationClaims[]>;
 }
 type TokenVerdictReason = "malformed" | "bad_signature" | "wrong_issuer" | "bearer_mismatch" | "expired" | "not_yet_valid" | "content_expired" | "revoked" | "delegation_exceeds_parent" | "parent_invalid" |
 /** claims.conditions is present but its bstr fails CBOR decode, or decodes to something that is not a JSON array of valid trilean PredicateNodes -- fail-closed per CONVENTIONS.md's verifier-obligations glossary, the same treatment "malformed" already gives an undecodable payload. */

package/dist/{tokens-BxTxBmXt.cjs → tokens-Dp9BnUTZ.cjs}

@@ -217,6 +217,26 @@ async function verifyCapabilityToken(token, options) {
 	};
 	return verdict;
 }
+/**
+* Does one recorded revocation-claims entry actually revoke targetClaims, per management.cddl's own additive obligation? Valid when EITHER the entry's own issuer equals the target token's own issuer (the original, unconditional rule -- only a token's own issuer may revoke it), OR the entry carries an `authorization` that independently verifies as an ordinary capability-token -- with `expectedBearer` set to THIS entry's own `issuer`, proving the authorization was actually granted to the party submitting this revocation, not merely referenced from someone else's -- whose own `capability` is `manage:revoke` (spec/registry/core-capabilities.md) and whose own `scope` narrows targetClaims' scope. An authorization that fails any part of this (wrong capability, scope doesn't narrow, fails ordinary verification -- expired, revoked, bad signature, bearer mismatch) makes the entry no more valid than if `authorization` were absent; it never falls back to weakening the issuer-match rule.
+*/
+async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
+	if (bytesEqual(entry.issuer, targetClaims.issuer)) return true;
+	if (entry.authorization === void 0) return false;
+	let decodedAuthorization;
+	try {
+		decodedAuthorization = (0, cbor2.decode)(entry.authorization, cbor2.cdeDecodeOptions);
+	} catch {
+		return false;
+	}
+	const authorizationResult = require_generated_protocol.capabilityTokenSchema.safeParse(decodedAuthorization);
+	if (!authorizationResult.success) return false;
+	const authorizationVerdict = await verifyCapabilityToken(authorizationResult.data, {
+		...options,
+		expectedBearer: entry.issuer
+	});
+	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
+}
 async function verifyTokenChain(token, options) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
@@ -260,7 +280,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "content_expired"
 	};
-	if (await options.revocation.isRevoked(claims["token-id"], claims.issuer)) return {
+	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
+	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
 		ok: false,
 		reason: "revoked"
 	};

package/dist/{tokens-D2aFwPcZ.d.cts → tokens-H_mV_JCC.d.cts}

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "./identity-COdFfaW8.cjs";
+import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "./identity-bg6IVGsH.cjs";
 import { t as Clock } from "./clock-DiSx-WKM.cjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -21,10 +21,10 @@ type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) =>
 //#endregion
 //#region src/domain/tokens.d.ts
 /**
- * The revocation view a verifier consults. Contract per management.cddl: an entry counts against a token only when BOTH its token-id and its issuer match the token's own -- only a token's own issuer may revoke it, so a third party's entry for someone else's token-id must be ignored. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id + issuer.
+ * The revocation view a verifier consults. Returns every recorded, already-signature-verified revocation-claims for tokenId, across every issuer that has ever submitted one -- unfiltered by the store itself. The actual verifier obligation (an entry counts against a token when its own issuer matches the token's own issuer, OR its optional `authorization` grants delegated revoke authority -- management.cddl) is checked by the caller (verifyTokenChain), not here, since that check needs the target token's own scope plus identity/clock to verify a nested authorization token, none of which a store constructed ahead of time has access to. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id alone -- a token-id can legitimately carry multiple recorded entries from different issuers.
  */
 interface RevocationCheck {
-  isRevoked: (tokenId: Uint8Array, issuer: DeviceId) => Promise<boolean>;
+  entriesFor: (tokenId: Uint8Array) => Promise<readonly RevocationClaims[]>;
 }
 type TokenVerdictReason = "malformed" | "bad_signature" | "wrong_issuer" | "bearer_mismatch" | "expired" | "not_yet_valid" | "content_expired" | "revoked" | "delegation_exceeds_parent" | "parent_invalid" |
 /** claims.conditions is present but its bstr fails CBOR decode, or decodes to something that is not a JSON array of valid trilean PredicateNodes -- fail-closed per CONVENTIONS.md's verifier-obligations glossary, the same treatment "malformed" already gives an undecodable payload. */

package/dist/{transport-B_diuPHT.d.mts → transport-Baipikk7.d.cts}

@@ -1,4 +1,4 @@
-import { D as Frame, x as DeviceId } from "./protocol-B3U828E7.mjs";
+import { D as Frame, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-BrAqN6I5.d.cts → transport-DWbvUc3L.d.mts}

@@ -1,4 +1,4 @@
-import { D as Frame, x as DeviceId } from "./protocol-B3U828E7.cjs";
+import { D as Frame, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {