wire-mesh-core 1.19.0 → 1.21.0

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as Frame } from "../protocol-B3U828E7.cjs";
+import { D as Frame } from "../protocol-l9RMR3s5.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as Frame } from "../protocol-B3U828E7.mjs";
+import { D as Frame } from "../protocol-l9RMR3s5.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** A frame that fails schema validation, caught separately from a decode failure so it can be dropped without disconnecting. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { P as IdentityKey, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { P as IdentityKey, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { P as IdentityKey, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { P as IdentityKey, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BrAqN6I5.cjs";
+import { r as Transport } from "../transport-Baipikk7.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B_diuPHT.mjs";
+import { r as Transport } from "../transport-DWbvUc3L.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BrAqN6I5.cjs";
+import { r as Transport } from "../transport-Baipikk7.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B_diuPHT.mjs";
+import { r as Transport } from "../transport-DWbvUc3L.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/capability-grant.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.
@@ -68,7 +69,7 @@ function createCapabilityGrantHandler(options) {
 			});
 			return;
 		}
-		if (!require_tokens.scopeNarrows(verdict.claims.scope, incoming.scope)) {
+		if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
 			await incoming.respond({
 				result: "error",
 				code: "scope_mismatch"

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-D2aFwPcZ.cjs";
+import { a as RevocationCheck } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { F as ManageCommand, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-DSwixfDl.mjs";
+import { a as RevocationCheck } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,5 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
-import { i as verifyCapabilityToken, o as scopeNarrows } from "../tokens-D9I1Pn14.mjs";
+import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
+import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { F as ManageCommand, i as CapabilityGrantOk, o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-D9I1Pn14.mjs";
+import { n as mintCapabilityToken } from "../tokens-VicRWTj1.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { x as DeviceId } from "../protocol-B3U828E7.cjs";
+import { x as DeviceId } from "../protocol-l9RMR3s5.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { x as DeviceId } from "../protocol-B3U828E7.mjs";
+import { x as DeviceId } from "../protocol-l9RMR3s5.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/grant-candidates.cjs

@@ -0,0 +1,47 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_generated_protocol = require("../generated/protocol.cjs");
+const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+let zod = require("zod");
+//#region src/domain/grant-candidates.ts
+/**
+* Gossip-advertised delegable-grant candidates (wire-mesh#87): lets a bearer of a still-delegable held token advertise its own willingness to field a capability-request for a narrower grant, and lets a requester discover the best candidate it can currently see before falling back to a capability's own structural root (that fallback -- e.g. a room's owner device-id -- is the caller's own concern, entirely outside this module; findGrantCandidate only ever returns a nearer-than-root candidate or undefined). Rides peer-advert's existing open extension tail (spec/transport.cddl, wire-mesh#91) under the domain-qualified key "capability-request/candidates" -- no new CDDL, no new wire mechanism, just a structured value on an already-shipped extension point.
+*
+* Honest limit, not closed here: this is only ever as complete as gossip propagation allows. A request can go unanswered by a nearer delegate not because none exists, but because it hasn't been gossiped yet -- the same "detection with propagation delay" honesty this spec already accepts for kick propagation and revocation timing.
+*/
+const GOSSIP_CANDIDATES_KEY = "capability-request/candidates";
+const grantCandidateSchema = zod.z.object({
+	capability: zod.z.string(),
+	scope: require_generated_protocol.capabilityScopeSchema,
+	"delegations-remaining": zod.z.number().int().nonnegative().optional()
+});
+const grantCandidateListSchema = zod.z.array(grantCandidateSchema);
+/**
+* Advertises this session's own willingness to field a capability-request for each of candidates, via sendGossipUpdate's own re-advertisement mechanism. Callers own their own re-advertisement cadence (there is no timer here, matching sendGossipUpdate's own design) -- calling this again with a fresh list replaces what was previously advertised under this key, exactly as sendGossipUpdate's own peer-advert re-send already does for any other extension field.
+*/
+async function advertiseGrantCandidates(session, candidates) {
+	await session.sendGossipUpdate({ [GOSSIP_CANDIDATES_KEY]: candidates });
+}
+/**
+* Scans directory for the best currently-gossiped delegate that could field a capability-request for capability over scope, returning its device-id -- or undefined when nothing closer than the capability's own structural root has been gossiped. A candidate qualifies when its own advertised capability matches exactly and its own advertised scope narrows into the requested scope (scopeNarrows' existing narrowing relation: the candidate's scope is the same as or a broader ancestor of scope), and its own delegations-remaining is either absent (unbounded) or still greater than zero.
+*
+* Selection policy, deliberately simple and explicitly stated rather than left implicit: the first qualifying candidate in directory's own order wins. Gossip carries no distance, latency, or load signal a requester could meaningfully rank candidates by, so no ordering directory provides is more defensible than any other -- "first seen" is exactly as reasonable a tie-break as "highest delegations-remaining" and simplest to implement and reason about.
+*
+* A malformed or non-conforming candidates value (from a misbehaving or out-of-date peer) is silently skipped, not treated as an error: this is a discovery hint over self-asserted, unsigned gossip, not a security check -- the token minted from any candidate this function returns still goes through mintCapabilityToken's own full narrowing checks regardless.
+*/
+function findGrantCandidate(directory, capability, scope) {
+	for (const entry of directory) {
+		const raw = entry.advert[GOSSIP_CANDIDATES_KEY];
+		if (raw === void 0) continue;
+		const parsed = grantCandidateListSchema.safeParse(raw);
+		if (!parsed.success) continue;
+		for (const candidate of parsed.data) {
+			if (candidate.capability !== capability) continue;
+			const remaining = candidate["delegations-remaining"];
+			if (remaining !== void 0 && remaining <= 0) continue;
+			if (require_token_scope.scopeNarrows(candidate.scope, scope)) return entry.device;
+		}
+	}
+}
+//#endregion
+exports.advertiseGrantCandidates = advertiseGrantCandidates;
+exports.findGrantCandidate = findGrantCandidate;

package/dist/domain/grant-candidates.d.cts

@@ -0,0 +1,26 @@
+import { o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
+import { z } from "zod";
+//#region src/domain/grant-candidates.d.ts
+declare const grantCandidateSchema: z.ZodObject<{
+  capability: z.ZodString;
+  scope: z.ZodLazy<z.ZodObject<{
+    kind: z.ZodString;
+    path: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  "delegations-remaining": z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type GrantCandidate = z.infer<typeof grantCandidateSchema>;
+/**
+ * Advertises this session's own willingness to field a capability-request for each of candidates, via sendGossipUpdate's own re-advertisement mechanism. Callers own their own re-advertisement cadence (there is no timer here, matching sendGossipUpdate's own design) -- calling this again with a fresh list replaces what was previously advertised under this key, exactly as sendGossipUpdate's own peer-advert re-send already does for any other extension field.
+ */
+export declare function advertiseGrantCandidates(session: Readonly<MeshSession>, candidates: readonly GrantCandidate[]): Promise<void>;
+/**
+ * Scans directory for the best currently-gossiped delegate that could field a capability-request for capability over scope, returning its device-id -- or undefined when nothing closer than the capability's own structural root has been gossiped. A candidate qualifies when its own advertised capability matches exactly and its own advertised scope narrows into the requested scope (scopeNarrows' existing narrowing relation: the candidate's scope is the same as or a broader ancestor of scope), and its own delegations-remaining is either absent (unbounded) or still greater than zero.
+ *
+ * Selection policy, deliberately simple and explicitly stated rather than left implicit: the first qualifying candidate in directory's own order wins. Gossip carries no distance, latency, or load signal a requester could meaningfully rank candidates by, so no ordering directory provides is more defensible than any other -- "first seen" is exactly as reasonable a tie-break as "highest delegations-remaining" and simplest to implement and reason about.
+ *
+ * A malformed or non-conforming candidates value (from a misbehaving or out-of-date peer) is silently skipped, not treated as an error: this is a discovery hint over self-asserted, unsigned gossip, not a security check -- the token minted from any candidate this function returns still goes through mintCapabilityToken's own full narrowing checks regardless.
+ */
+export declare function findGrantCandidate(directory: readonly DirectoryEntry[], capability: string, scope: Readonly<CapabilityScope>): DeviceId | undefined;
+//#endregion

package/dist/domain/grant-candidates.d.mts

@@ -0,0 +1,26 @@
+import { o as CapabilityScope, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
+import { z } from "zod";
+//#region src/domain/grant-candidates.d.ts
+declare const grantCandidateSchema: z.ZodObject<{
+  capability: z.ZodString;
+  scope: z.ZodLazy<z.ZodObject<{
+    kind: z.ZodString;
+    path: z.ZodOptional<z.ZodString>;
+  }, z.core.$strip>>;
+  "delegations-remaining": z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type GrantCandidate = z.infer<typeof grantCandidateSchema>;
+/**
+ * Advertises this session's own willingness to field a capability-request for each of candidates, via sendGossipUpdate's own re-advertisement mechanism. Callers own their own re-advertisement cadence (there is no timer here, matching sendGossipUpdate's own design) -- calling this again with a fresh list replaces what was previously advertised under this key, exactly as sendGossipUpdate's own peer-advert re-send already does for any other extension field.
+ */
+export declare function advertiseGrantCandidates(session: Readonly<MeshSession>, candidates: readonly GrantCandidate[]): Promise<void>;
+/**
+ * Scans directory for the best currently-gossiped delegate that could field a capability-request for capability over scope, returning its device-id -- or undefined when nothing closer than the capability's own structural root has been gossiped. A candidate qualifies when its own advertised capability matches exactly and its own advertised scope narrows into the requested scope (scopeNarrows' existing narrowing relation: the candidate's scope is the same as or a broader ancestor of scope), and its own delegations-remaining is either absent (unbounded) or still greater than zero.
+ *
+ * Selection policy, deliberately simple and explicitly stated rather than left implicit: the first qualifying candidate in directory's own order wins. Gossip carries no distance, latency, or load signal a requester could meaningfully rank candidates by, so no ordering directory provides is more defensible than any other -- "first seen" is exactly as reasonable a tie-break as "highest delegations-remaining" and simplest to implement and reason about.
+ *
+ * A malformed or non-conforming candidates value (from a misbehaving or out-of-date peer) is silently skipped, not treated as an error: this is a discovery hint over self-asserted, unsigned gossip, not a security check -- the token minted from any candidate this function returns still goes through mintCapabilityToken's own full narrowing checks regardless.
+ */
+export declare function findGrantCandidate(directory: readonly DirectoryEntry[], capability: string, scope: Readonly<CapabilityScope>): DeviceId | undefined;
+//#endregion

package/dist/domain/grant-candidates.mjs

@@ -0,0 +1,45 @@
+import { capabilityScopeSchema } from "../generated/protocol.mjs";
+import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
+import { z } from "zod";
+//#region src/domain/grant-candidates.ts
+/**
+* Gossip-advertised delegable-grant candidates (wire-mesh#87): lets a bearer of a still-delegable held token advertise its own willingness to field a capability-request for a narrower grant, and lets a requester discover the best candidate it can currently see before falling back to a capability's own structural root (that fallback -- e.g. a room's owner device-id -- is the caller's own concern, entirely outside this module; findGrantCandidate only ever returns a nearer-than-root candidate or undefined). Rides peer-advert's existing open extension tail (spec/transport.cddl, wire-mesh#91) under the domain-qualified key "capability-request/candidates" -- no new CDDL, no new wire mechanism, just a structured value on an already-shipped extension point.
+*
+* Honest limit, not closed here: this is only ever as complete as gossip propagation allows. A request can go unanswered by a nearer delegate not because none exists, but because it hasn't been gossiped yet -- the same "detection with propagation delay" honesty this spec already accepts for kick propagation and revocation timing.
+*/
+const GOSSIP_CANDIDATES_KEY = "capability-request/candidates";
+const grantCandidateSchema = z.object({
+	capability: z.string(),
+	scope: capabilityScopeSchema,
+	"delegations-remaining": z.number().int().nonnegative().optional()
+});
+const grantCandidateListSchema = z.array(grantCandidateSchema);
+/**
+* Advertises this session's own willingness to field a capability-request for each of candidates, via sendGossipUpdate's own re-advertisement mechanism. Callers own their own re-advertisement cadence (there is no timer here, matching sendGossipUpdate's own design) -- calling this again with a fresh list replaces what was previously advertised under this key, exactly as sendGossipUpdate's own peer-advert re-send already does for any other extension field.
+*/
+async function advertiseGrantCandidates(session, candidates) {
+	await session.sendGossipUpdate({ [GOSSIP_CANDIDATES_KEY]: candidates });
+}
+/**
+* Scans directory for the best currently-gossiped delegate that could field a capability-request for capability over scope, returning its device-id -- or undefined when nothing closer than the capability's own structural root has been gossiped. A candidate qualifies when its own advertised capability matches exactly and its own advertised scope narrows into the requested scope (scopeNarrows' existing narrowing relation: the candidate's scope is the same as or a broader ancestor of scope), and its own delegations-remaining is either absent (unbounded) or still greater than zero.
+*
+* Selection policy, deliberately simple and explicitly stated rather than left implicit: the first qualifying candidate in directory's own order wins. Gossip carries no distance, latency, or load signal a requester could meaningfully rank candidates by, so no ordering directory provides is more defensible than any other -- "first seen" is exactly as reasonable a tie-break as "highest delegations-remaining" and simplest to implement and reason about.
+*
+* A malformed or non-conforming candidates value (from a misbehaving or out-of-date peer) is silently skipped, not treated as an error: this is a discovery hint over self-asserted, unsigned gossip, not a security check -- the token minted from any candidate this function returns still goes through mintCapabilityToken's own full narrowing checks regardless.
+*/
+function findGrantCandidate(directory, capability, scope) {
+	for (const entry of directory) {
+		const raw = entry.advert[GOSSIP_CANDIDATES_KEY];
+		if (raw === void 0) continue;
+		const parsed = grantCandidateListSchema.safeParse(raw);
+		if (!parsed.success) continue;
+		for (const candidate of parsed.data) {
+			if (candidate.capability !== capability) continue;
+			const remaining = candidate["delegations-remaining"];
+			if (remaining !== void 0 && remaining <= 0) continue;
+			if (scopeNarrows(candidate.scope, scope)) return entry.device;
+		}
+	}
+}
+//#endregion
+export { advertiseGrantCandidates, findGrantCandidate };

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-B3U828E7.cjs";
+import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-l9RMR3s5.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-B3U828E7.mjs";
+import { M as HandshakeFrame, et as ProtocolVersion, w as DomainId } from "../protocol-l9RMR3s5.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-BrAqN6I5.cjs";
+import { r as Transport, t as Connection } from "../transport-Baipikk7.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { D as Frame, F as ManageCommand, K as PeerAdvert, L as ManageError, R as ManageOk, dt as RevocationEntry, et as ProtocolVersion, o as CapabilityScope, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-B_diuPHT.mjs";
+import { r as Transport, t as Connection } from "../transport-DWbvUc3L.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/relay-hub.d.cts

@@ -1,4 +1,4 @@
-import { t as Connection } from "../transport-BrAqN6I5.cjs";
+import { t as Connection } from "../transport-Baipikk7.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/relay-hub.d.mts

@@ -1,4 +1,4 @@
-import { t as Connection } from "../transport-B_diuPHT.mjs";
+import { t as Connection } from "../transport-DWbvUc3L.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. */

package/dist/domain/revocation-view.cjs

@@ -1,19 +1,24 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 //#region src/domain/revocation-view.ts
-function revocationKey(tokenId, issuer) {
-	return `${require_domain_device_id.bytesToHex(tokenId)}:${require_domain_device_id.deviceIdToHex(issuer)}`;
+function revocationKey(tokenId) {
+	return require_domain_device_id.bytesToHex(tokenId);
 }
 function createRevocationView() {
-	const revoked = /* @__PURE__ */ new Set();
+	const entriesByTokenId = /* @__PURE__ */ new Map();
 	return {
-		async isRevoked(tokenId, issuer) {
-			return Promise.resolve(revoked.has(revocationKey(tokenId, issuer)));
+		async entriesFor(tokenId) {
+			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
 			const verdict = await require_tokens.verifyRevocationEntry(entry, options);
-			if (verdict.ok) revoked.add(revocationKey(verdict.claims["token-id"], verdict.claims.issuer));
+			if (verdict.ok) {
+				const key = revocationKey(verdict.claims["token-id"]);
+				const existing = entriesByTokenId.get(key);
+				if (existing === void 0) entriesByTokenId.set(key, [verdict.claims]);
+				else existing.push(verdict.claims);
+			}
 			return verdict;
 		}
 	};

package/dist/domain/revocation-view.d.cts

@@ -1,8 +1,8 @@
-import { dt as RevocationEntry } from "../protocol-B3U828E7.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-D2aFwPcZ.cjs";
+import { dt as RevocationEntry } from "../protocol-l9RMR3s5.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
- * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by (token-id, issuer) per management.cddl's contract: an entry counts against a token only when both match, so a third party's entry for someone else's token-id is stored (it is a well-formed, self-certifying entry) but never matches a lookup for the token it does not actually govern.
+ * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.
  */
 export interface RevocationView extends RevocationCheck {
   /** Verifies one gossiped revocation-entry via verifyRevocationEntry and, if it verifies, records it. An entry that fails verification is dropped, not stored -- the returned verdict lets a caller log or otherwise report the refusal. */

package/dist/domain/revocation-view.d.mts

@@ -1,8 +1,8 @@
-import { dt as RevocationEntry } from "../protocol-B3U828E7.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-DSwixfDl.mjs";
+import { dt as RevocationEntry } from "../protocol-l9RMR3s5.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
- * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by (token-id, issuer) per management.cddl's contract: an entry counts against a token only when both match, so a third party's entry for someone else's token-id is stored (it is a well-formed, self-certifying entry) but never matches a lookup for the token it does not actually govern.
+ * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.
  */
 export interface RevocationView extends RevocationCheck {
   /** Verifies one gossiped revocation-entry via verifyRevocationEntry and, if it verifies, records it. An entry that fails verification is dropped, not stored -- the returned verdict lets a caller log or otherwise report the refusal. */

package/dist/domain/revocation-view.mjs

@@ -1,18 +1,23 @@
-import { a as verifyRevocationEntry } from "../tokens-D9I1Pn14.mjs";
-import { bytesToHex, deviceIdToHex } from "./device-id.mjs";
+import { a as verifyRevocationEntry } from "../tokens-VicRWTj1.mjs";
+import { bytesToHex } from "./device-id.mjs";
 //#region src/domain/revocation-view.ts
-function revocationKey(tokenId, issuer) {
-	return `${bytesToHex(tokenId)}:${deviceIdToHex(issuer)}`;
+function revocationKey(tokenId) {
+	return bytesToHex(tokenId);
 }
 function createRevocationView() {
-	const revoked = /* @__PURE__ */ new Set();
+	const entriesByTokenId = /* @__PURE__ */ new Map();
 	return {
-		async isRevoked(tokenId, issuer) {
-			return Promise.resolve(revoked.has(revocationKey(tokenId, issuer)));
+		async entriesFor(tokenId) {
+			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
 			const verdict = await verifyRevocationEntry(entry, options);
-			if (verdict.ok) revoked.add(revocationKey(verdict.claims["token-id"], verdict.claims.issuer));
+			if (verdict.ok) {
+				const key = revocationKey(verdict.claims["token-id"]);
+				const existing = entriesByTokenId.get(key);
+				if (existing === void 0) entriesByTokenId.set(key, [verdict.claims]);
+				else existing.push(verdict.claims);
+			}
 			return verdict;
 		}
 	};

package/dist/domain/room-token-verification.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 const require_domain_device_id = require("./device-id.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts

package/dist/domain/room-token-verification.d.cts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-D2aFwPcZ.cjs";
+import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.cjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.d.mts

@@ -1,5 +1,5 @@
-import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-B3U828E7.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-DSwixfDl.mjs";
+import { kt as TokenClaims, s as CapabilityToken, x as DeviceId } from "../protocol-l9RMR3s5.mjs";
+import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 export declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/domain/room-token-verification.mjs

@@ -1,4 +1,4 @@
-import { i as verifyCapabilityToken } from "../tokens-D9I1Pn14.mjs";
+import { i as verifyCapabilityToken } from "../tokens-VicRWTj1.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts

package/dist/domain/tokens.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-BxTxBmXt.cjs");
+const require_tokens = require("../tokens-CiNXdKJ8.cjs");
 exports.canGrant = require_tokens.canGrant;
 exports.mintCapabilityToken = require_tokens.mintCapabilityToken;
 exports.mintRevocationEntry = require_tokens.mintRevocationEntry;

package/dist/domain/tokens.d.cts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-D2aFwPcZ.cjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-H_mV_JCC.cjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.d.mts

@@ -1,2 +1,2 @@
-import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-DSwixfDl.mjs";
+import { a as RevocationCheck, c as TokenVerdict, d as VerifyRevocationEntryOptions, f as canGrant, g as verifyRevocationEntry, h as verifyCapabilityToken, i as MintVerdict, l as TokenVerdictReason, m as mintRevocationEntry, n as MintRefusalReason, o as RevocationEntryVerdict, p as mintCapabilityToken, r as MintRevocationEntryOptions, s as RevocationEntryVerdictReason, t as MintCapabilityTokenOptions, u as VerifyCapabilityTokenOptions } from "../tokens-CBI54oF-.mjs";
 export { MintCapabilityTokenOptions, MintRefusalReason, MintRevocationEntryOptions, MintVerdict, RevocationCheck, RevocationEntryVerdict, RevocationEntryVerdictReason, TokenVerdict, TokenVerdictReason, VerifyCapabilityTokenOptions, VerifyRevocationEntryOptions, canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/domain/tokens.mjs

@@ -1,2 +1,2 @@
-import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-D9I1Pn14.mjs";
+import { a as verifyRevocationEntry, i as verifyCapabilityToken, n as mintCapabilityToken, r as mintRevocationEntry, t as canGrant } from "../tokens-VicRWTj1.mjs";
 export { canGrant, mintCapabilityToken, mintRevocationEntry, verifyCapabilityToken, verifyRevocationEntry };

package/dist/generated/protocol.cjs

@@ -196,7 +196,8 @@ const revocationClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"token-id": zod.z.instanceof(Uint8Array),
 	"issuer": zod.z.lazy(() => deviceIdSchema),
 	"issuer-key": zod.z.lazy(() => identityKeySchema),
-	"revoked-at": zod.z.number().int().nonnegative()
+	"revoked-at": zod.z.number().int().nonnegative(),
+	"authorization": zod.z.instanceof(Uint8Array).optional()
 }));
 const revocationEntrySchema = zod.z.lazy(() => zod.z.lazy(() => coseSign1Schema));
 const revocationAnnounceFrameSchema = zod.z.lazy(() => zod.z.object({

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.cjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-l9RMR3s5.cjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-B3U828E7.mjs";
+import { $ as ProcSpawn, $n as roomNoticeSchema, $t as dataRequestFrameSchema, A as HandleClaims, An as procKillSchema, At as WebrtcAnswer, B as ManageResponseFrame, Bn as relayInboundFrameSchema, Bt as capabilityTokenSchema, C as DmRoomPath, Cn as observedAddressFrameSchema, Ct as RoomSend, D as Frame, Dn as pingFrameSchema, Dt as StreamSession, E as ExecSessionInfo, En as peerIdentitySchema, Et as StreamEndFrame, F as ManageCommand, Fn as ptyResizeSchema, Ft as candidatesFrameSchema, G as OwnerNamedRoomPath, Gn as roomInviteSchema, Gt as coreDomainNameSchema, H as NamespacedCapability, Hn as revocationAnnounceFrameSchema, Ht as closeFrameSchema, I as ManageCommandParams, In as ptySpawnSchema, It as capabilityGrantOkSchema, J as PingFrame, Jn as roomLeaveSchema, Jt as coseHeaderLabelSchema, K as PeerAdvert, Kn as roomJoinOkSchema, Kt as coseHeaderAlgSchema, L as ManageError, Ln as ptyWriteSchema, Lt as capabilityGrantSchema, M as HandshakeFrame, Mn as procSpawnSchema, Mt as WebrtcOffer, N as IceCandidateInit, Nn as protocolVersionSchema, Nt as WireCandidate, O as FrameVariant, On as privateUseCapabilitySchema, Ot as SyncPunchFrame, P as IdentityKey, Pn as ptyKillSchema, Pt as candidateKindSchema, Q as ProcSignal, Qn as roomNoticeClaimsSchema, Qt as dataHaveFrameSchema, R as ManageOk, Rn as relayConnectFrameSchema, Rt as capabilityRequestSchema, S as DeviceIdHex, Sn as namespacedDomainIdSchema, St as RoomRead, T as ExecList, Tn as peerAdvertSchema, Tt as StreamDataFrame, U as NamespacedDomainId, Un as revocationClaimsSchema, Ut as coordinatorFrameSchema, V as MessageRef, Vn as relayOfferFrameSchema, Vt as capabilityVerbSchema, W as ObservedAddressFrame, Wn as revocationEntrySchema, Wt as coreCapabilitySchema, X as PrivateUseDomainId, Xn as roomMembersOkSchema, Xt as coseTokenHeadersSchema, Y as PrivateUseCapability, Yn as roomMemberSchema, Yt as coseSign1Schema, Z as ProcKill, Zn as roomMembersSchema, Zt as dataEntriesFrameSchema, _ as CoseTokenHeaders, _n as manageOkSchema, _t as RoomMembers, a as CapabilityRequest, an as execSessionInfoSchema, ar as streamEndFrameSchema, at as RelayConnectFrame, b as DataRequestFrame, bn as messageRefSchema, bt as RoomNoticeClaims, c as CapabilityVerb, cn as gossipFrameSchema, cr as tokenClaimsSchema, ct as RelayOfferFrame, d as CoreCapability, dn as handshakeFrameSchema, dr as webrtcOfferSchema, dt as RevocationEntry, en as deviceIdHexSchema, er as roomPathSchema, et as ProtocolVersion, f as CoreDomainName, fn as iceCandidateInitSchema, fr as wireCandidateSchema, ft as RoomInvite, g as CoseSign1, gn as manageErrorSchema, gt as RoomMember, h as CoseHeaderLabel, hn as manageCommandSchema, ht as RoomLeave, i as CapabilityGrantOk, in as execListSchema, ir as streamDataFrameSchema, it as PtyWrite, j as HandleRecord, jn as procSignalSchema, jt as WebrtcIceCandidate, k as GossipFrame, kn as privateUseDomainIdSchema, kt as TokenClaims, l as CloseFrame, ln as handleClaimsSchema, lr as webrtcAnswerSchema, lt as RevocationAnnounceFrame, m as CoseHeaderKid, mn as manageCommandParamsSchema, mt as RoomJoinOk, n as CandidatesFrame, nn as dmRoomPathSchema, nr as roomSendSchema, nt as PtyResize, o as CapabilityScope, on as frameSchema, or as streamSessionSchema, ot as RelayDataFrame, p as CoseHeaderAlg, pn as identityKeySchema, pt as RoomJoin, q as PeerIdentity, qn as roomJoinSchema, qt as coseHeaderKidSchema, r as CapabilityGrant, rn as domainIdSchema, rr as streamAckFrameSchema, rt as PtySpawn, s as CapabilityToken, sn as frameVariantSchema, sr as syncPunchFrameSchema, st as RelayInboundFrame, t as CandidateKind, tn as deviceIdSchema, tr as roomReadSchema, tt as PtyKill, u as CoordinatorFrame, un as handleRecordSchema, ur as webrtcIceCandidateSchema, ut as RevocationClaims, v as DataEntriesFrame, vn as manageRequestFrameSchema, vt as RoomMembersOk, w as DomainId, wn as ownerNamedRoomPathSchema, wt as StreamAckFrame, x as DeviceId, xn as namespacedCapabilitySchema, xt as RoomPath, y as DataHaveFrame, yn as manageResponseFrameSchema, yt as RoomNotice, z as ManageRequestFrame, zn as relayDataFrameSchema, zt as capabilityScopeSchema } from "../protocol-l9RMR3s5.mjs";
 export { CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PeerAdvert, PeerIdentity, PingFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomSend, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, TokenClaims, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomSendSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, tokenClaimsSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -195,7 +195,8 @@ const revocationClaimsSchema = z.lazy(() => z.object({
 	"token-id": z.instanceof(Uint8Array),
 	"issuer": z.lazy(() => deviceIdSchema),
 	"issuer-key": z.lazy(() => identityKeySchema),
-	"revoked-at": z.number().int().nonnegative()
+	"revoked-at": z.number().int().nonnegative(),
+	"authorization": z.instanceof(Uint8Array).optional()
 }));
 const revocationEntrySchema = z.lazy(() => z.lazy(() => coseSign1Schema));
 const revocationAnnounceFrameSchema = z.lazy(() => z.object({

package/dist/{identity-B7YMBhMf.d.mts → identity-5LJ_B8go.d.mts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.mjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-COdFfaW8.d.cts → identity-bg6IVGsH.d.cts}

@@ -1,4 +1,4 @@
-import { P as IdentityKey, x as DeviceId } from "./protocol-B3U828E7.cjs";
+import { P as IdentityKey, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-COdFfaW8.cjs";
+import { t as IdentityPort } from "../identity-bg6IVGsH.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-B7YMBhMf.mjs";
+import { t as IdentityPort } from "../identity-5LJ_B8go.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-BrAqN6I5.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-Baipikk7.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-B_diuPHT.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DWbvUc3L.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-B3U828E7.d.cts → protocol-l9RMR3s5.d.cts}

@@ -843,6 +843,7 @@ declare const revocationClaimsSchema: z.ZodLazy<z.ZodObject<{
     "public-key": z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
   }, z.core.$strip>>>;
   "revoked-at": z.ZodNumber;
+  authorization: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$strip>>;
 declare const revocationEntrySchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodTuple<[z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   "1": z.ZodOptional<z.ZodNumber>;

package/dist/{protocol-B3U828E7.d.mts → protocol-l9RMR3s5.d.mts}

@@ -843,6 +843,7 @@ declare const revocationClaimsSchema: z.ZodLazy<z.ZodObject<{
     "public-key": z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
   }, z.core.$strip>>>;
   "revoked-at": z.ZodNumber;
+  authorization: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
 }, z.core.$strip>>;
 declare const revocationEntrySchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodTuple<[z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   "1": z.ZodOptional<z.ZodNumber>;

package/dist/token-scope-CxHXTT3u.cjs

@@ -0,0 +1,43 @@
+//#region src/domain/token-scope.ts
+/**
+* Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
+*/
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+	return true;
+}
+/** True when the path contains a "." or ".." segment. Purely lexical prefix comparison would let "/work/../org" pass under "/work" -- a path that normalises outside the parent -- so any relative segment fails the narrowing comparison wholesale: fail-closed rather than reimplementing path normalisation, consistent with how empty, case-different, and non-boundary-prefixed paths already behave. */
+function hasRelativeSegment(path) {
+	return path.split("/").some((segment) => segment === "." || segment === "..");
+}
+/** True when childPath is parentPath or a descendant of it, compared on "/"-segment boundaries: "/work/sub" narrows "/work", but "/workbook" does NOT narrow "/work" despite the string prefix, because "book" continues the same segment. Paths containing "." or ".." segments never narrow anything (see hasRelativeSegment). */
+function pathNarrows(childPath, parentPath) {
+	if (hasRelativeSegment(childPath) || hasRelativeSegment(parentPath)) return false;
+	if (childPath === parentPath) return true;
+	if (!childPath.startsWith(parentPath)) return false;
+	if (parentPath.endsWith("/")) return true;
+	return childPath.charAt(parentPath.length) === "/";
+}
+/**
+* True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
+*/
+function scopeNarrows(parent, child) {
+	if (parent.kind !== child.kind) return false;
+	if (parent.path === void 0) return true;
+	if (child.path === void 0) return false;
+	return pathNarrows(child.path, parent.path);
+}
+//#endregion
+Object.defineProperty(exports, "bytesEqual", {
+	enumerable: true,
+	get: function() {
+		return bytesEqual;
+	}
+});
+Object.defineProperty(exports, "scopeNarrows", {
+	enumerable: true,
+	get: function() {
+		return scopeNarrows;
+	}
+});

package/dist/token-scope-Z4bmci4M.mjs

@@ -0,0 +1,32 @@
+//#region src/domain/token-scope.ts
+/**
+* Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
+*/
+function bytesEqual(a, b) {
+	if (a.length !== b.length) return false;
+	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
+	return true;
+}
+/** True when the path contains a "." or ".." segment. Purely lexical prefix comparison would let "/work/../org" pass under "/work" -- a path that normalises outside the parent -- so any relative segment fails the narrowing comparison wholesale: fail-closed rather than reimplementing path normalisation, consistent with how empty, case-different, and non-boundary-prefixed paths already behave. */
+function hasRelativeSegment(path) {
+	return path.split("/").some((segment) => segment === "." || segment === "..");
+}
+/** True when childPath is parentPath or a descendant of it, compared on "/"-segment boundaries: "/work/sub" narrows "/work", but "/workbook" does NOT narrow "/work" despite the string prefix, because "book" continues the same segment. Paths containing "." or ".." segments never narrow anything (see hasRelativeSegment). */
+function pathNarrows(childPath, parentPath) {
+	if (hasRelativeSegment(childPath) || hasRelativeSegment(parentPath)) return false;
+	if (childPath === parentPath) return true;
+	if (!childPath.startsWith(parentPath)) return false;
+	if (parentPath.endsWith("/")) return true;
+	return childPath.charAt(parentPath.length) === "/";
+}
+/**
+* True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
+*/
+function scopeNarrows(parent, child) {
+	if (parent.kind !== child.kind) return false;
+	if (parent.path === void 0) return true;
+	if (child.path === void 0) return false;
+	return pathNarrows(child.path, parent.path);
+}
+//#endregion
+export { scopeNarrows as n, bytesEqual as t };

package/dist/{tokens-DSwixfDl.d.mts → tokens-CBI54oF-.d.mts}

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-B3U828E7.mjs";
-import { t as IdentityPort } from "./identity-B7YMBhMf.mjs";
+import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
+import { t as IdentityPort } from "./identity-5LJ_B8go.mjs";
 import { t as Clock } from "./clock-DiSx-WKM.mjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -21,10 +21,10 @@ type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) =>
 //#endregion
 //#region src/domain/tokens.d.ts
 /**
- * The revocation view a verifier consults. Contract per management.cddl: an entry counts against a token only when BOTH its token-id and its issuer match the token's own -- only a token's own issuer may revoke it, so a third party's entry for someone else's token-id must be ignored. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id + issuer.
+ * The revocation view a verifier consults. Returns every recorded, already-signature-verified revocation-claims for tokenId, across every issuer that has ever submitted one -- unfiltered by the store itself. The actual verifier obligation (an entry counts against a token when its own issuer matches the token's own issuer, OR its optional `authorization` grants delegated revoke authority -- management.cddl) is checked by the caller (verifyTokenChain), not here, since that check needs the target token's own scope plus identity/clock to verify a nested authorization token, none of which a store constructed ahead of time has access to. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id alone -- a token-id can legitimately carry multiple recorded entries from different issuers.
  */
 interface RevocationCheck {
-  isRevoked: (tokenId: Uint8Array, issuer: DeviceId) => Promise<boolean>;
+  entriesFor: (tokenId: Uint8Array) => Promise<readonly RevocationClaims[]>;
 }
 type TokenVerdictReason = "malformed" | "bad_signature" | "wrong_issuer" | "bearer_mismatch" | "expired" | "not_yet_valid" | "content_expired" | "revoked" | "delegation_exceeds_parent" | "parent_invalid" |
 /** claims.conditions is present but its bstr fails CBOR decode, or decodes to something that is not a JSON array of valid trilean PredicateNodes -- fail-closed per CONVENTIONS.md's verifier-obligations glossary, the same treatment "malformed" already gives an undecodable payload. */

package/dist/{tokens-BxTxBmXt.cjs → tokens-CiNXdKJ8.cjs}

@@ -1,38 +1,8 @@
 const require_generated_protocol = require("./generated/protocol.cjs");
+const require_token_scope = require("./token-scope-CxHXTT3u.cjs");
 let zod = require("zod");
 let cbor2 = require("cbor2");
 let trilean = require("trilean");
-//#region src/domain/token-scope.ts
-/**
-* Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
-*/
-function bytesEqual(a, b) {
-	if (a.length !== b.length) return false;
-	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
-	return true;
-}
-/** True when the path contains a "." or ".." segment. Purely lexical prefix comparison would let "/work/../org" pass under "/work" -- a path that normalises outside the parent -- so any relative segment fails the narrowing comparison wholesale: fail-closed rather than reimplementing path normalisation, consistent with how empty, case-different, and non-boundary-prefixed paths already behave. */
-function hasRelativeSegment(path) {
-	return path.split("/").some((segment) => segment === "." || segment === "..");
-}
-/** True when childPath is parentPath or a descendant of it, compared on "/"-segment boundaries: "/work/sub" narrows "/work", but "/workbook" does NOT narrow "/work" despite the string prefix, because "book" continues the same segment. Paths containing "." or ".." segments never narrow anything (see hasRelativeSegment). */
-function pathNarrows(childPath, parentPath) {
-	if (hasRelativeSegment(childPath) || hasRelativeSegment(parentPath)) return false;
-	if (childPath === parentPath) return true;
-	if (!childPath.startsWith(parentPath)) return false;
-	if (parentPath.endsWith("/")) return true;
-	return childPath.charAt(parentPath.length) === "/";
-}
-/**
-* True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
-*/
-function scopeNarrows(parent, child) {
-	if (parent.kind !== child.kind) return false;
-	if (parent.path === void 0) return true;
-	if (child.path === void 0) return false;
-	return pathNarrows(child.path, parent.path);
-}
-//#endregion
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
 const conditionsListSchema = zod.z.array(trilean.PredicateNodeSchema);
@@ -67,7 +37,7 @@ function booleanFound(value) {
 const narrowingHandlers = {
 	[BEARER_IS]: (_payload, context) => {
 		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(bytesEqual(context.parentClaims.bearer, context.childIssuer));
+		return booleanFound(require_token_scope.bytesEqual(context.parentClaims.bearer, context.childIssuer));
 	},
 	[EXPIRES_AT]: (_payload, context) => {
 		if (context.parentClaims === void 0) return booleanFound(false);
@@ -75,7 +45,7 @@ const narrowingHandlers = {
 	},
 	[SCOPE_NARROWS]: (_payload, context) => {
 		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(scopeNarrows(context.parentClaims.scope, context.candidate.scope));
+		return booleanFound(require_token_scope.scopeNarrows(context.parentClaims.scope, context.candidate.scope));
 	},
 	[CAPABILITY_IS]: (_payload, context) => {
 		if (context.parentClaims === void 0) return booleanFound(false);
@@ -211,12 +181,32 @@ async function verifyCapabilityToken(token, options) {
 		...options.extraPredicateResolvers !== void 0 ? { extraPredicateResolvers: options.extraPredicateResolvers } : {}
 	});
 	if (!verdict.ok) return verdict;
-	if (options.expectedBearer !== void 0 && !bytesEqual(verdict.claims.bearer, options.expectedBearer)) return {
+	if (options.expectedBearer !== void 0 && !require_token_scope.bytesEqual(verdict.claims.bearer, options.expectedBearer)) return {
 		ok: false,
 		reason: "bearer_mismatch"
 	};
 	return verdict;
 }
+/**
+* Does one recorded revocation-claims entry actually revoke targetClaims, per management.cddl's own additive obligation? Valid when EITHER the entry's own issuer equals the target token's own issuer (the original, unconditional rule -- only a token's own issuer may revoke it), OR the entry carries an `authorization` that independently verifies as an ordinary capability-token -- with `expectedBearer` set to THIS entry's own `issuer`, proving the authorization was actually granted to the party submitting this revocation, not merely referenced from someone else's -- whose own `capability` is `manage:revoke` (spec/registry/core-capabilities.md) and whose own `scope` narrows targetClaims' scope. An authorization that fails any part of this (wrong capability, scope doesn't narrow, fails ordinary verification -- expired, revoked, bad signature, bearer mismatch) makes the entry no more valid than if `authorization` were absent; it never falls back to weakening the issuer-match rule.
+*/
+async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
+	if (require_token_scope.bytesEqual(entry.issuer, targetClaims.issuer)) return true;
+	if (entry.authorization === void 0) return false;
+	let decodedAuthorization;
+	try {
+		decodedAuthorization = (0, cbor2.decode)(entry.authorization, cbor2.cdeDecodeOptions);
+	} catch {
+		return false;
+	}
+	const authorizationResult = require_generated_protocol.capabilityTokenSchema.safeParse(decodedAuthorization);
+	if (!authorizationResult.success) return false;
+	const authorizationVerdict = await verifyCapabilityToken(authorizationResult.data, {
+		...options,
+		expectedBearer: entry.issuer
+	});
+	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && require_token_scope.scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
+}
 async function verifyTokenChain(token, options) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
@@ -242,7 +232,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "bad_signature"
 	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
+	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
+	if (!require_token_scope.bytesEqual(derivedIssuerId, claims.issuer)) return {
 		ok: false,
 		reason: "wrong_issuer"
 	};
@@ -260,7 +251,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "content_expired"
 	};
-	if (await options.revocation.isRevoked(claims["token-id"], claims.issuer)) return {
+	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
+	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
 		ok: false,
 		reason: "revoked"
 	};
@@ -356,7 +348,8 @@ async function verifyRevocationEntry(entry, options) {
 		ok: false,
 		reason: "bad_signature"
 	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
+	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
+	if (!require_token_scope.bytesEqual(derivedIssuerId, claims.issuer)) return {
 		ok: false,
 		reason: "wrong_issuer"
 	};
@@ -479,12 +472,6 @@ Object.defineProperty(exports, "mintRevocationEntry", {
 		return mintRevocationEntry;
 	}
 });
-Object.defineProperty(exports, "scopeNarrows", {
-	enumerable: true,
-	get: function() {
-		return scopeNarrows;
-	}
-});
 Object.defineProperty(exports, "verifyCapabilityToken", {
 	enumerable: true,
 	get: function() {

package/dist/{tokens-D2aFwPcZ.d.cts → tokens-H_mV_JCC.d.cts}

@@ -1,5 +1,5 @@
-import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-B3U828E7.cjs";
-import { t as IdentityPort } from "./identity-COdFfaW8.cjs";
+import { dt as RevocationEntry, kt as TokenClaims, s as CapabilityToken, ut as RevocationClaims, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
+import { t as IdentityPort } from "./identity-bg6IVGsH.cjs";
 import { t as Clock } from "./clock-DiSx-WKM.cjs";
 import { z } from "zod";
 import { JsonValue, PredicateNode, Resolution } from "trilean";
@@ -21,10 +21,10 @@ type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) =>
 //#endregion
 //#region src/domain/tokens.d.ts
 /**
- * The revocation view a verifier consults. Contract per management.cddl: an entry counts against a token only when BOTH its token-id and its issuer match the token's own -- only a token's own issuer may revoke it, so a third party's entry for someone else's token-id must be ignored. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id + issuer.
+ * The revocation view a verifier consults. Returns every recorded, already-signature-verified revocation-claims for tokenId, across every issuer that has ever submitted one -- unfiltered by the store itself. The actual verifier obligation (an entry counts against a token when its own issuer matches the token's own issuer, OR its optional `authorization` grants delegated revoke authority -- management.cddl) is checked by the caller (verifyTokenChain), not here, since that check needs the target token's own scope plus identity/clock to verify a nested authorization token, none of which a store constructed ahead of time has access to. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id alone -- a token-id can legitimately carry multiple recorded entries from different issuers.
  */
 interface RevocationCheck {
-  isRevoked: (tokenId: Uint8Array, issuer: DeviceId) => Promise<boolean>;
+  entriesFor: (tokenId: Uint8Array) => Promise<readonly RevocationClaims[]>;
 }
 type TokenVerdictReason = "malformed" | "bad_signature" | "wrong_issuer" | "bearer_mismatch" | "expired" | "not_yet_valid" | "content_expired" | "revoked" | "delegation_exceeds_parent" | "parent_invalid" |
 /** claims.conditions is present but its bstr fails CBOR decode, or decodes to something that is not a JSON array of valid trilean PredicateNodes -- fail-closed per CONVENTIONS.md's verifier-obligations glossary, the same treatment "malformed" already gives an undecodable payload. */

package/dist/{tokens-D9I1Pn14.mjs → tokens-VicRWTj1.mjs}

@@ -1,38 +1,8 @@
 import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "./generated/protocol.mjs";
+import { n as scopeNarrows, t as bytesEqual } from "./token-scope-Z4bmci4M.mjs";
 import { z } from "zod";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
 import { PredicateNodeSchema, evaluatePredicate } from "trilean";
-//#region src/domain/token-scope.ts
-/**
-* Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
-*/
-function bytesEqual(a, b) {
-	if (a.length !== b.length) return false;
-	for (let i = 0; i < a.length; i += 1) if (a[i] !== b[i]) return false;
-	return true;
-}
-/** True when the path contains a "." or ".." segment. Purely lexical prefix comparison would let "/work/../org" pass under "/work" -- a path that normalises outside the parent -- so any relative segment fails the narrowing comparison wholesale: fail-closed rather than reimplementing path normalisation, consistent with how empty, case-different, and non-boundary-prefixed paths already behave. */
-function hasRelativeSegment(path) {
-	return path.split("/").some((segment) => segment === "." || segment === "..");
-}
-/** True when childPath is parentPath or a descendant of it, compared on "/"-segment boundaries: "/work/sub" narrows "/work", but "/workbook" does NOT narrow "/work" despite the string prefix, because "book" continues the same segment. Paths containing "." or ".." segments never narrow anything (see hasRelativeSegment). */
-function pathNarrows(childPath, parentPath) {
-	if (hasRelativeSegment(childPath) || hasRelativeSegment(parentPath)) return false;
-	if (childPath === parentPath) return true;
-	if (!childPath.startsWith(parentPath)) return false;
-	if (parentPath.endsWith("/")) return true;
-	return childPath.charAt(parentPath.length) === "/";
-}
-/**
-* True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
-*/
-function scopeNarrows(parent, child) {
-	if (parent.kind !== child.kind) return false;
-	if (parent.path === void 0) return true;
-	if (child.path === void 0) return false;
-	return pathNarrows(child.path, parent.path);
-}
-//#endregion
 //#region src/domain/token-predicates.ts
 /** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
 const conditionsListSchema = z.array(PredicateNodeSchema);
@@ -217,6 +187,26 @@ async function verifyCapabilityToken(token, options) {
 	};
 	return verdict;
 }
+/**
+* Does one recorded revocation-claims entry actually revoke targetClaims, per management.cddl's own additive obligation? Valid when EITHER the entry's own issuer equals the target token's own issuer (the original, unconditional rule -- only a token's own issuer may revoke it), OR the entry carries an `authorization` that independently verifies as an ordinary capability-token -- with `expectedBearer` set to THIS entry's own `issuer`, proving the authorization was actually granted to the party submitting this revocation, not merely referenced from someone else's -- whose own `capability` is `manage:revoke` (spec/registry/core-capabilities.md) and whose own `scope` narrows targetClaims' scope. An authorization that fails any part of this (wrong capability, scope doesn't narrow, fails ordinary verification -- expired, revoked, bad signature, bearer mismatch) makes the entry no more valid than if `authorization` were absent; it never falls back to weakening the issuer-match rule.
+*/
+async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
+	if (bytesEqual(entry.issuer, targetClaims.issuer)) return true;
+	if (entry.authorization === void 0) return false;
+	let decodedAuthorization;
+	try {
+		decodedAuthorization = decode(entry.authorization, cdeDecodeOptions);
+	} catch {
+		return false;
+	}
+	const authorizationResult = capabilityTokenSchema.safeParse(decodedAuthorization);
+	if (!authorizationResult.success) return false;
+	const authorizationVerdict = await verifyCapabilityToken(authorizationResult.data, {
+		...options,
+		expectedBearer: entry.issuer
+	});
+	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
+}
 async function verifyTokenChain(token, options) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
@@ -242,7 +232,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "bad_signature"
 	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
+	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
+	if (!bytesEqual(derivedIssuerId, claims.issuer)) return {
 		ok: false,
 		reason: "wrong_issuer"
 	};
@@ -260,7 +251,8 @@ async function verifyTokenChain(token, options) {
 		ok: false,
 		reason: "content_expired"
 	};
-	if (await options.revocation.isRevoked(claims["token-id"], claims.issuer)) return {
+	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
+	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
 		ok: false,
 		reason: "revoked"
 	};
@@ -356,7 +348,8 @@ async function verifyRevocationEntry(entry, options) {
 		ok: false,
 		reason: "bad_signature"
 	};
-	if (!bytesEqual(await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]), claims.issuer)) return {
+	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
+	if (!bytesEqual(derivedIssuerId, claims.issuer)) return {
 		ok: false,
 		reason: "wrong_issuer"
 	};
@@ -461,4 +454,4 @@ async function mintRevocationEntry(options) {
 	];
 }
 //#endregion
-export { verifyRevocationEntry as a, verifyCapabilityToken as i, mintCapabilityToken as n, scopeNarrows as o, mintRevocationEntry as r, canGrant as t };
+export { verifyRevocationEntry as a, verifyCapabilityToken as i, mintCapabilityToken as n, mintRevocationEntry as r, canGrant as t };

package/dist/{transport-B_diuPHT.d.mts → transport-Baipikk7.d.cts}

@@ -1,4 +1,4 @@
-import { D as Frame, x as DeviceId } from "./protocol-B3U828E7.mjs";
+import { D as Frame, x as DeviceId } from "./protocol-l9RMR3s5.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-BrAqN6I5.d.cts → transport-DWbvUc3L.d.mts}

@@ -1,4 +1,4 @@
-import { D as Frame, x as DeviceId } from "./protocol-B3U828E7.cjs";
+import { D as Frame, x as DeviceId } from "./protocol-l9RMR3s5.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "1.19.0",
+  "version": "1.21.0",
   "type": "module",
   "packageManager": "pnpm@12.4.1+sha512.2e81e399d73fe8390dab25e06aa788ab7a5908248d2f5a370f82b481147a6a7a367bf8048f9a6fdb6460f21a66f0542dedb8b94ca2c8723596741920b1656d4c",
   "repository": {
@@ -98,6 +98,10 @@
       "import": "./dist/domain/device-id.mjs",
       "require": "./dist/domain/device-id.cjs"
     },
+    "./domain/grant-candidates": {
+      "import": "./dist/domain/grant-candidates.mjs",
+      "require": "./dist/domain/grant-candidates.cjs"
+    },
     "./domain/handshake": {
       "import": "./dist/domain/handshake.mjs",
       "require": "./dist/domain/handshake.cjs"