wire-mesh-core 1.46.0 → 1.48.0

package/dist/adapters/threshold-wasm.d.mts

@@ -0,0 +1,89 @@
+import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
+//#region src/adapters/threshold-wasm.d.ts
+/** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
+export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {
+  deviceId: DeviceId;
+  value: T;
+}
+export interface DkgRound1Result {
+  secretPackage: Uint8Array<ArrayBuffer>;
+  package: Uint8Array<ArrayBuffer>;
+}
+/** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
+export declare function dkgRound1(ownDeviceId: DeviceId, maxSigners: number, minSigners: number): DkgRound1Result;
+export interface SplitRound1PackageResult {
+  commitment: Uint8Array<ArrayBuffer>[];
+  proofOfKnowledge: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+export declare function splitRound1Package(serializedPackage: Uint8Array): SplitRound1PackageResult;
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+export declare function combineRound1Package(commitment: readonly Uint8Array[], proofOfKnowledge: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface DkgRound2Result {
+  secretPackage: Uint8Array<ArrayBuffer>;
+  outgoing: DeviceKeyed[];
+}
+/** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
+export declare function dkgRound2(ownSecretPackage: Uint8Array, round1: readonly DeviceKeyed[]): DkgRound2Result;
+export interface DkgRound3Result {
+  keyPackage: Uint8Array<ArrayBuffer>;
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** Round 3 (local, no wire traffic): verifies every received round-2 package and sums them into this participant's own long-term key package. `round1`/`round2` MUST NOT include this participant's own packages. */
+export declare function dkgRound3(ownSecretPackage: Uint8Array, round1: readonly DeviceKeyed[], round2: readonly DeviceKeyed[]): DkgRound3Result;
+/** The echo-broadcast transcript digest this participant sends on `threshold-keygen-confirm` -- SHA-256 over the FULL ordered set of every round-1 package (including this participant's own), so two honest participants' digests are directly comparable. */
+export declare function dkgTranscriptDigest(allRound1: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Verifies this participant's own transcript digest/group key against what a peer reported. A mismatch means the ceremony MUST abort, never be repaired in place. */
+export declare function dkgConfirmMatches(ownDigest: Uint8Array, ownGroupKey: Uint8Array, peerDigest: Uint8Array, peerGroupKey: Uint8Array): boolean;
+/** Extracts a key package's own signing-share bytes -- what `reshareRound1` needs as `ownOldSigningShare`. */
+export declare function keyPackageSigningShare(keyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface SigningRound1Result {
+  nonces: Uint8Array<ArrayBuffer>;
+  commitments: Uint8Array<ArrayBuffer>;
+}
+/**
+ * The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
+ */
+export declare function signingRound1Commit(ownKeyPackage: Uint8Array): SigningRound1Result;
+export interface SplitCommitmentsResult {
+  hiding: Uint8Array<ArrayBuffer>;
+  binding: Uint8Array<ArrayBuffer>;
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+export declare function splitCommitments(commitments: Uint8Array): SplitCommitmentsResult;
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+export declare function combineCommitments(hiding: Uint8Array, binding: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
+export declare function signingBuildPackage(commitments: readonly DeviceKeyed[], message: Uint8Array): Uint8Array<ArrayBuffer>;
+/** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
+export declare function signingRound2Sign(nonces: Uint8Array, signingPackage: Uint8Array, ownKeyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+/**
+ * Coordinator-side: sums and verifies the collected shares into the final aggregate signature -- an ordinary 64-byte Ed25519 signature. Throws if verification fails (a malformed or forged share); a caller MUST treat any thrown error here as "publish nothing".
+ */
+export declare function signingAggregate(signingPackage: Uint8Array, shares: readonly DeviceKeyed[], publicKeyPackage: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareRound1Result {
+  commitment: Uint8Array<ArrayBuffer>;
+  outgoing: DeviceKeyed[];
+}
+/**
+ * Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
+ */
+export declare function reshareRound1(ownDeviceId: DeviceId, ownOldSigningShare: Uint8Array, survivorDeviceIds: readonly DeviceId[], newParticipantDeviceIds: readonly DeviceId[], newMinSigners: number): ReshareRound1Result;
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+export declare function reshareSplitCommitment(commitment: Uint8Array): Uint8Array<ArrayBuffer>[];
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+export declare function reshareCombineCommitmentParts(parts: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
+/** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
+export declare function reshareCombineCommitments(commitments: readonly Uint8Array[]): Uint8Array<ArrayBuffer>;
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+export declare function reshareTranscriptDigest(survivorCommitments: readonly DeviceKeyed[], groupVerifyingKey: Uint8Array): Uint8Array<ArrayBuffer>;
+export interface ReshareDerivePublicKeyPackageResult {
+  publicKeyPackage: Uint8Array<ArrayBuffer>;
+  groupVerifyingKey: Uint8Array<ArrayBuffer>;
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+export declare function reshareDerivePublicKeyPackage(combinedCommitment: Uint8Array, newParticipantDeviceIds: readonly DeviceId[]): ReshareDerivePublicKeyPackageResult;
+/** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
+export declare function reshareCombineReceivedShares(ownDeviceId: DeviceId, received: readonly Uint8Array[], publicKeyPackage: Uint8Array, newMinSigners: number): Uint8Array<ArrayBuffer>;
+//#endregion

package/dist/adapters/threshold-wasm.mjs

@@ -0,0 +1,174 @@
+import { deviceIdSchema } from "../generated/protocol.mjs";
+import * as wasm from "../../wasm-dist/wire_mesh_threshold_wasm.js";
+//#region src/adapters/threshold-wasm.ts
+/**
+* A typed TS wrapper over the WASM build of `wire-mesh-threshold` (the audited `frost-core`/`frost-ed25519` crates, ZcashFoundation, NCC-audited) -- wire-mesh#29's own chosen route for a TS FROST(Ed25519, SHA-512) participant, over a from-scratch reimplementation of the cryptography.
+*
+* Built by `scripts/build-threshold-wasm.sh` into `wasm-dist/` (gitignored, a genuine compiled build artifact like `dist/`, never committed) -- run it before importing this module, in dev and in CI alike. This module performs NO domain logic of its own, only re-typing the raw wasm bindings' `Uint8Array`/`Array<any>` surface against this package's own `DeviceId` type and Node-capable-device-only availability: FROST participation cannot use Web Crypto at all (raw scalar/point arithmetic is deliberately outside what Web Crypto exposes), so unlike `node-identity.ts`'s counterpart in `web-crypto-identity.ts`, this adapter has no browser-side equivalent in v1 -- per wire-mesh#29's own resolved design, a browser is a threshold-group BEARER only, never a SHAREHOLDER, in v1.
+*/
+function isUint8Array(value) {
+	return value instanceof Uint8Array;
+}
+/** Copies into a fresh, whole-buffer `Uint8Array<ArrayBuffer>` -- the wasm-bindgen-generated `.d.ts` declares its `Uint8Array` returns unparameterized (`Uint8Array<ArrayBufferLike>`), which callers such as `verifyWithPublicKey` (`node-identity.ts`) reject; this is the same normalisation that adapter's own `toBufferSource` already applies at its boundary. */
+function toBufferSource(bytes) {
+	return Uint8Array.from(bytes);
+}
+function toParallelArrays(entries) {
+	return [entries.map((e) => e.deviceId), entries.map((e) => e.value)];
+}
+function fromParallelArrays(ids, values) {
+	if (ids.length !== values.length) throw new Error(`wasm returned mismatched parallel arrays: ${String(ids.length)} ids, ${String(values.length)} values`);
+	const result = [];
+	for (let i = 0; i < ids.length; i += 1) {
+		const id = ids[i];
+		const value = values[i];
+		if (!isUint8Array(value)) throw new Error("wasm returned a non-Uint8Array value in a parallel array");
+		result.push({
+			deviceId: deviceIdSchema.parse(id),
+			value: toBufferSource(value)
+		});
+	}
+	return result;
+}
+/** Round 1: samples this participant's own polynomial and commits to it. See `wire_mesh_threshold::dkg::round1`'s own doc comment for the full design. */
+function dkgRound1(ownDeviceId, maxSigners, minSigners) {
+	const out = wasm.dkg_round1(ownDeviceId, maxSigners, minSigners);
+	return {
+		secretPackage: toBufferSource(out.secretPackage),
+		package: toBufferSource(out.package)
+	};
+}
+/** Splits a serialized DKG round-1 package (dkgRound1's own `package` output) into `threshold-keygen-round1`'s own wire shape: the Feldman commitment as an array of independently-serialized coefficients (`commitment: [* bstr]`) and the Schnorr proof of knowledge as a separate byte string -- unlike frost-core's own combined-blob serialization. The inverse of combineRound1Package. */
+function splitRound1Package(serializedPackage) {
+	const out = wasm.split_round1_package(serializedPackage);
+	const commitment = [];
+	for (const coefficient of out.commitment) {
+		if (!isUint8Array(coefficient)) throw new Error("wasm returned a non-Uint8Array entry in split_round1_package's own commitment array");
+		commitment.push(toBufferSource(coefficient));
+	}
+	return {
+		commitment,
+		proofOfKnowledge: toBufferSource(out.proofOfKnowledge)
+	};
+}
+/** Reconstructs a serialized DKG round-1 package (the same combined-blob shape dkgRound2/dkgRound3/dkgTranscriptDigest expect) from the two independently-serialized wire fields `threshold-keygen-round1` carries. The inverse of splitRound1Package. */
+function combineRound1Package(commitment, proofOfKnowledge) {
+	return toBufferSource(wasm.combine_round1_package([...commitment], proofOfKnowledge));
+}
+/** Round 2: verifies every other participant's round-1 proof of knowledge and computes this participant's own pairwise sub-shares. `round1` MUST NOT include this participant's own package. */
+function dkgRound2(ownSecretPackage, round1) {
+	const [ids, packages] = toParallelArrays(round1);
+	const out = wasm.dkg_round2(ownSecretPackage, ids, packages);
+	return {
+		secretPackage: toBufferSource(out.secretPackage),
+		outgoing: fromParallelArrays(out.recipientIds, out.packages)
+	};
+}
+/** Round 3 (local, no wire traffic): verifies every received round-2 package and sums them into this participant's own long-term key package. `round1`/`round2` MUST NOT include this participant's own packages. */
+function dkgRound3(ownSecretPackage, round1, round2) {
+	const [ids1, packages1] = toParallelArrays(round1);
+	const [ids2, packages2] = toParallelArrays(round2);
+	const out = wasm.dkg_round3(ownSecretPackage, ids1, packages1, ids2, packages2);
+	return {
+		keyPackage: toBufferSource(out.keyPackage),
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
+}
+/** The echo-broadcast transcript digest this participant sends on `threshold-keygen-confirm` -- SHA-256 over the FULL ordered set of every round-1 package (including this participant's own), so two honest participants' digests are directly comparable. */
+function dkgTranscriptDigest(allRound1, groupVerifyingKey) {
+	const [ids, packages] = toParallelArrays(allRound1);
+	return toBufferSource(wasm.dkg_transcript_digest(ids, packages, groupVerifyingKey));
+}
+/** Verifies this participant's own transcript digest/group key against what a peer reported. A mismatch means the ceremony MUST abort, never be repaired in place. */
+function dkgConfirmMatches(ownDigest, ownGroupKey, peerDigest, peerGroupKey) {
+	return wasm.dkg_confirm_matches(ownDigest, ownGroupKey, peerDigest, peerGroupKey);
+}
+/** Extracts a key package's own signing-share bytes -- what `reshareRound1` needs as `ownOldSigningShare`. */
+function keyPackageSigningShare(keyPackage) {
+	return toBufferSource(wasm.key_package_signing_share(keyPackage));
+}
+/**
+* The pure-crypto half of round 1: generates a fresh nonce pair and its commitments. Persisting `nonces` durably before this participant's own round-1 response leaves the device is the CALLER's own obligation -- nonce reuse across two released signature shares discloses this participant's long-term key share outright. This function has no storage dependency and cannot enforce that obligation itself.
+*/
+function signingRound1Commit(ownKeyPackage) {
+	const out = wasm.signing_round1_commit(ownKeyPackage);
+	return {
+		nonces: toBufferSource(out.nonces),
+		commitments: toBufferSource(out.commitments)
+	};
+}
+/** Splits a serialized SigningCommitments blob (signingRound1Commit's own `commitments` output) into the two independently-serialized halves `threshold-commitment`'s wire shape carries (`hiding: bstr, binding: bstr`) -- unlike frost-core's own combined-blob serialization, which is opaque and not spec-shaped. The inverse of combineCommitments. */
+function splitCommitments(commitments) {
+	const out = wasm.split_commitments(commitments);
+	return {
+		hiding: toBufferSource(out.hiding),
+		binding: toBufferSource(out.binding)
+	};
+}
+/** Reconstructs a serialized SigningCommitments blob (the same combined-blob shape signingBuildPackage/signingRound2Sign expect) from the two independently-serialized halves `threshold-commitment` carries on the wire. The inverse of splitCommitments. */
+function combineCommitments(hiding, binding) {
+	return toBufferSource(wasm.combine_commitments(hiding, binding));
+}
+/** Coordinator-side: builds the signing-package bytes every participant's round 2 is computed against. */
+function signingBuildPackage(commitments, message) {
+	const [ids, values] = toParallelArrays(commitments);
+	return toBufferSource(wasm.signing_build_package(ids, values, message));
+}
+/** Round 2: releases this participant's signature share. The CALLER MUST have already taken (one-shot) `nonces` from its own durable nonce store before calling this. */
+function signingRound2Sign(nonces, signingPackage, ownKeyPackage) {
+	return toBufferSource(wasm.signing_round2_sign(nonces, signingPackage, ownKeyPackage));
+}
+/**
+* Coordinator-side: sums and verifies the collected shares into the final aggregate signature -- an ordinary 64-byte Ed25519 signature. Throws if verification fails (a malformed or forged share); a caller MUST treat any thrown error here as "publish nothing".
+*/
+function signingAggregate(signingPackage, shares, publicKeyPackage) {
+	const [ids, values] = toParallelArrays(shares);
+	return toBufferSource(wasm.signing_aggregate(signingPackage, ids, values, publicKeyPackage));
+}
+/**
+* Survivor side: re-shares this device's own Lagrange-weighted sub-share of the group secret across a new (possibly different) participant set. See `wire_mesh_threshold::reshare`'s own module doc comment (Rust side) for the full design rationale -- deliberately not built on a zero-secret "refresh" delta, which cannot onboard a device with no prior share or safely change the threshold.
+*/
+function reshareRound1(ownDeviceId, ownOldSigningShare, survivorDeviceIds, newParticipantDeviceIds, newMinSigners) {
+	const out = wasm.reshare_round1(ownDeviceId, ownOldSigningShare, [...survivorDeviceIds], [...newParticipantDeviceIds], newMinSigners);
+	return {
+		commitment: toBufferSource(out.commitment),
+		outgoing: fromParallelArrays(out.recipientIds, out.shares)
+	};
+}
+/** Splits a survivor's serialized broadcast commitment (reshareRound1's own `commitment` output) into `threshold-keygen-round1`'s own wire shape: an array of independently-serialized coefficients (`commitment: [* bstr]`) -- unlike reshareRound1's own whole-blob serialization. The inverse of reshareCombineCommitmentParts. */
+function reshareSplitCommitment(commitment) {
+	const out = [];
+	for (const part of wasm.reshare_split_commitment(commitment)) {
+		if (!isUint8Array(part)) throw new Error("wasm returned a non-Uint8Array entry in reshare_split_commitment's own output array");
+		out.push(toBufferSource(part));
+	}
+	return out;
+}
+/** Reconstructs a survivor's serialized broadcast commitment (the same whole-blob shape reshareCombineCommitments expects each entry of its own commitments array to be) from the wire's own per-coefficient array. The inverse of reshareSplitCommitment. */
+function reshareCombineCommitmentParts(parts) {
+	return toBufferSource(wasm.reshare_combine_commitment_parts([...parts]));
+}
+/** Sums T survivors' broadcast commitment vectors into the one combined VSS commitment `reshareDerivePublicKeyPackage` needs. */
+function reshareCombineCommitments(commitments) {
+	return toBufferSource(wasm.reshare_combine_commitments([...commitments]));
+}
+/** The echo-broadcast transcript digest a member of the new participant set sends on threshold-keygen-confirm for a reshare -- the reshare analogue of dkgTranscriptDigest, structurally distinct because a reshare's own survivor commitment carries no proof-of-knowledge component: deserializing one as a DKG round-1 package fails outright, since the two are different wire shapes entirely. `survivorCommitments` entries are each the same whole-blob shape reshareRound1's own `commitment` output is (NOT the wire's own split [* bstr] parts -- combine those first via reshareCombineCommitmentParts if collected off the wire). */
+function reshareTranscriptDigest(survivorCommitments, groupVerifyingKey) {
+	const [ids, commitments] = toParallelArrays(survivorCommitments);
+	return toBufferSource(wasm.reshare_transcript_digest(ids, commitments, groupVerifyingKey));
+}
+/** The group's derived public key package given the combined commitment and the new participant set. `groupVerifyingKey` is what `threshold-keygen-confirm`'s own `group-key` field carries and what a reshare's own verifier obligation checks against `existing-group-key` (MUST equal it -- a reshare that changes the group key is a takeover, not a reshare). */
+function reshareDerivePublicKeyPackage(combinedCommitment, newParticipantDeviceIds) {
+	const out = wasm.reshare_derive_public_key_package(combinedCommitment, [...newParticipantDeviceIds]);
+	return {
+		publicKeyPackage: toBufferSource(out.publicKeyPackage),
+		groupVerifyingKey: toBufferSource(out.groupVerifyingKey)
+	};
+}
+/** New-participant side (local): verifies each received share against its own embedded commitment, sums the validated shares, and builds this participant's final key package. */
+function reshareCombineReceivedShares(ownDeviceId, received, publicKeyPackage, newMinSigners) {
+	return toBufferSource(wasm.reshare_combine_received_shares(ownDeviceId, [...received], publicKeyPackage, newMinSigners));
+}
+//#endregion
+export { combineCommitments, combineRound1Package, dkgConfirmMatches, dkgRound1, dkgRound2, dkgRound3, dkgTranscriptDigest, keyPackageSigningShare, reshareCombineCommitmentParts, reshareCombineCommitments, reshareCombineReceivedShares, reshareDerivePublicKeyPackage, reshareRound1, reshareSplitCommitment, reshareTranscriptDigest, signingAggregate, signingBuildPackage, signingRound1Commit, signingRound2Sign, splitCommitments, splitRound1Package };

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BbSGNRFZ.cjs";
+import { r as Transport } from "../transport-De0zHlaA.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-BNeF6kDe.mjs";
+import { r as Transport } from "../transport-C7KVkhgb.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/bulk.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D8CU6s2_.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as Connection } from "../transport-BbSGNRFZ.cjs";
+import { t as Connection } from "../transport-De0zHlaA.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/bulk.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D8CU6s2_.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as Connection } from "../transport-BNeF6kDe.mjs";
+import { t as Connection } from "../transport-C7KVkhgb.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts
 /** The two capabilities matching the direction each manage-command actually flows (spec/bulk.cddl): the sender proves write authority to open a transfer, the receiver proves read authority to ask for one to continue. */

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-DxGVURpB.cjs");
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D8CU6s2_.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-B1-MAIST.cjs";
+import { a as RevocationCheck } from "../tokens-Cl8sQo7o.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-D8CU6s2_.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-Bh82oidM.mjs";
+import { a as RevocationCheck } from "../tokens-CVyPoJ6l.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
 import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { i as verifyCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
+import { a as verifyCapabilityToken } from "../tokens-B0dpTLhS.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-DxGVURpB.cjs");
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/capability-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D8CU6s2_.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-D8CU6s2_.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/capability-request.d.ts

package/dist/domain/capability-request.mjs

@@ -1,5 +1,5 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-CdQwzCyJ.mjs";
+import { n as mintCapabilityToken } from "../tokens-B0dpTLhS.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D8CU6s2_.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-CNFRVx9w.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-D8CU6s2_.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-CNFRVx9w.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-D8CU6s2_.cjs";
+import { D as DeviceId } from "../protocol-CNFRVx9w.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-D8CU6s2_.mjs";
+import { D as DeviceId } from "../protocol-CNFRVx9w.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-D8CU6s2_.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-CNFRVx9w.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-D8CU6s2_.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-CNFRVx9w.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-D8CU6s2_.cjs";
+import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-CNFRVx9w.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-D8CU6s2_.mjs";
+import { A as DomainId, R as HandshakeFrame, ot as ProtocolVersion } from "../protocol-CNFRVx9w.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D8CU6s2_.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-CNFRVx9w.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { r as Transport, t as Connection } from "../transport-BbSGNRFZ.cjs";
+import { r as Transport, t as Connection } from "../transport-De0zHlaA.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-D8CU6s2_.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, Q as PeerAdvert, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, _t as RevocationEntry, f as CapabilityScope, ot as ProtocolVersion, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-CNFRVx9w.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { r as Transport, t as Connection } from "../transport-BNeF6kDe.mjs";
+import { r as Transport, t as Connection } from "../transport-C7KVkhgb.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/notice-board.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Et as RoomNoticeClaims, T as DataHaveFrame, Tt as RoomNotice, p as CapabilityToken } from "../protocol-D8CU6s2_.cjs";
+import { D as DeviceId, Et as RoomNoticeClaims, T as DataHaveFrame, Tt as RoomNotice, p as CapabilityToken } from "../protocol-CNFRVx9w.cjs";
 import { KeyValueStorage } from "../ports/storage.cjs";
-import { t as IdentityPort } from "../identity-DHf0J6IA.cjs";
+import { t as IdentityPort } from "../identity-CUkDHCRK.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { a as RevocationCheck } from "../tokens-B1-MAIST.cjs";
+import { a as RevocationCheck } from "../tokens-Cl8sQo7o.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, Et as RoomNoticeClaims, T as DataHaveFrame, Tt as RoomNotice, p as CapabilityToken } from "../protocol-D8CU6s2_.mjs";
+import { D as DeviceId, Et as RoomNoticeClaims, T as DataHaveFrame, Tt as RoomNotice, p as CapabilityToken } from "../protocol-CNFRVx9w.mjs";
 import { KeyValueStorage } from "../ports/storage.mjs";
-import { t as IdentityPort } from "../identity-Oelt3uEn.mjs";
+import { t as IdentityPort } from "../identity-9TmmK7vP.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { a as RevocationCheck } from "../tokens-Bh82oidM.mjs";
+import { a as RevocationCheck } from "../tokens-CVyPoJ6l.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/relay-hub.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D8CU6s2_.cjs";
-import { t as Connection } from "../transport-BbSGNRFZ.cjs";
+import { N as Frame } from "../protocol-CNFRVx9w.cjs";
+import { t as Connection } from "../transport-De0zHlaA.cjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-hub.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D8CU6s2_.mjs";
-import { t as Connection } from "../transport-BNeF6kDe.mjs";
+import { N as Frame } from "../protocol-CNFRVx9w.mjs";
+import { t as Connection } from "../transport-C7KVkhgb.mjs";
 //#region src/domain/relay-hub.d.ts
 export interface RelayHub {
   /** Drives one accepted connection until it closes: registers gossip-advertised devices, re-broadcasts each gossip frame to every other connected client and replies to the gossiping connection with a catch-up frame of every other already-known device, answers relay-connect by pairing and notifying the target, and forwards relay-data within established pairings. Resolves when the connection's frame stream ends. Internally just registerConnection followed by a loop of onFrame calls and a final onDisconnect -- kept as its own method since a dedicated hub deployment (wire-mesh-node/cloudflare-hub) has nothing else driving the connection and wants the whole lifecycle in one call. */

package/dist/domain/relay-use-gate.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D8CU6s2_.cjs";
-import { t as Connection } from "../transport-BbSGNRFZ.cjs";
+import { N as Frame } from "../protocol-CNFRVx9w.cjs";
+import { t as Connection } from "../transport-De0zHlaA.cjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/relay-use-gate.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-D8CU6s2_.mjs";
-import { t as Connection } from "../transport-BNeF6kDe.mjs";
+import { N as Frame } from "../protocol-CNFRVx9w.mjs";
+import { t as Connection } from "../transport-C7KVkhgb.mjs";
 //#region src/domain/relay-use-gate.d.ts
 export interface RelayUseAuthorizationTracker {
   /** True once authorize() has been called for this exact connection and revoke() has not been called since. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-DxGVURpB.cjs");
+const require_tokens = require("../tokens-Dh6mG6p_.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
-import { _t as RevocationEntry } from "../protocol-D8CU6s2_.cjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-B1-MAIST.cjs";
+import { _t as RevocationEntry } from "../protocol-CNFRVx9w.cjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-Cl8sQo7o.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
-import { _t as RevocationEntry } from "../protocol-D8CU6s2_.mjs";
-import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-Bh82oidM.mjs";
+import { _t as RevocationEntry } from "../protocol-CNFRVx9w.mjs";
+import { a as RevocationCheck, d as VerifyRevocationEntryOptions, o as RevocationEntryVerdict } from "../tokens-CVyPoJ6l.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
 import { bytesToHex } from "./device-id.mjs";
-import { a as verifyRevocationEntry } from "../tokens-CdQwzCyJ.mjs";
+import { o as verifyRevocationEntry } from "../tokens-B0dpTLhS.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);