wire-mesh-core 3.7.2 → 3.8.0

package/dist/{tokens-DSG3SDr8.cjs → tokens-tPJQ7Vzt.cjs}

@@ -1,4 +1,5 @@
 const require_generated_protocol = require("./generated/protocol.cjs");
+const require_domain_device_id = require("./domain/device-id.cjs");
 const require_token_scope = require("./token-scope-CxHXTT3u.cjs");
 let cbor2 = require("cbor2");
 let zod = require("zod");
@@ -24,6 +25,24 @@ const NARROWING_SYSTEMS = [
 function isNarrowingSystem(system) {
 	return system === "bearer-is" || system === "expires-at" || system === "scope-narrows" || system === "capability-is" || system === "depth-remaining";
 }
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+const GRANTEE_IS = "grantee-is";
+const GRANTED_CAPABILITY_IS = "granted-capability-is";
+function isSubjectSystem(system) {
+	return system === "grantee-is" || system === "granted-capability-is";
+}
+const subjectHandlers = {
+	[GRANTEE_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(require_domain_device_id.deviceIdToHex(context.subject.bearer) === payload);
+	},
+	[GRANTED_CAPABILITY_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(context.subject.capability === payload);
+	}
+};
 function booleanFound(value) {
 	return {
 		found: true,
@@ -58,15 +77,15 @@ const narrowingHandlers = {
 		return booleanFound(context.candidate.delegationsRemaining !== void 0 && context.candidate.delegationsRemaining < parentRemaining);
 	}
 };
-/** `{kind:"compare", op:"eq", left:{kind:"delegate", system, payload:null}, right:{kind:"booleanLiteral", value:true}}` -- delegate is an ExpressionNode, not itself a PredicateNode (trilean's PredicateNodeSchema has no `delegate` member), so every predicate op is expressed this way: resolve the delegate to a boolean ComputedValue, then compare it against the literal `true`. */
-function delegateIsTrue(system) {
+/** `{kind:"compare", op:"eq", left:{kind:"delegate", system, payload}, right:{kind:"booleanLiteral", value:true}}` -- delegate is an ExpressionNode, not itself a PredicateNode (trilean's PredicateNodeSchema has no `delegate` member), so every predicate op is expressed this way: resolve the delegate to a boolean ComputedValue, then compare it against the literal `true`. The narrowing checks pass no payload (every fact they need arrives via context); the subject-mode systems take their comparison value as the payload. */
+function delegateIsTrue(system, payload = null) {
 	return {
 		kind: "compare",
 		op: "eq",
 		left: {
 			kind: "delegate",
 			system,
-			payload: null
+			payload
 		},
 		right: {
 			kind: "booleanLiteral",
@@ -104,16 +123,25 @@ async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
 /**
 * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
 */
-async function evaluateConditions(nodes, claims, clock, extraHandlers = {}) {
-	const context = {
+async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subject) {
+	const context = subject === void 0 ? {
 		clock,
 		claims
+	} : {
+		clock,
+		claims,
+		subject
 	};
 	const resolvers = {
 		resolveValue: unusedResolveValue,
 		resolveLookup: unusedResolveLookup,
 		resolveCollection: unusedResolveCollection,
 		resolveDelegate: async (system, payload) => {
+			if (subject !== void 0 && isSubjectSystem(system)) try {
+				return await subjectHandlers[system](payload, context);
+			} catch {
+				return { found: false };
+			}
 			const handler = Object.hasOwn(extraHandlers, system) ? extraHandlers[system] : void 0;
 			if (handler === void 0) return { found: false };
 			try {
@@ -134,6 +162,10 @@ async function evaluateConditions(nodes, claims, clock, extraHandlers = {}) {
 }
 //#endregion
 //#region src/domain/tokens.ts
+/** The capability verb of a grant-capability (wire-mesh#323): authority to mint other capability tokens, the same register manage:revoke already established for authority over tokens. */
+const MANAGE_GRANT_CAPABILITY = "manage:grant";
+/** Both link kinds walk at most this many hops before the verifier gives up, mirroring Rust's own MAX_CHAIN_DEPTH. Two colluding issuers can construct a mutually-bearing parent cycle that would otherwise recurse forever, and the authorised-by link makes the attack cheaper to mount, so TS gains the bound rather than relying on JS recursion limits. */
+const MAX_CHAIN_DEPTH = 64;
 /** RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD: ["Signature1", protected, external_aad, payload]. Exported (not just used internally by verifyTokenChain) so any other self-certifying COSE_Sign1 construction in this codebase -- e.g. threshold-subject.ts's own to-be-signed bytes for a FROST-signed capability-token/revocation-entry/handle-record/room-notice -- reuses this single construction rather than a second hand-rolled one. */
 function sig1ToBeSigned(protectedHeader, payload) {
 	return (0, cbor2.encode)([
@@ -207,12 +239,22 @@ async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
 	});
 	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && require_token_scope.scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
 }
-async function verifyTokenChain(token, options) {
+async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen = /* @__PURE__ */ new Set()) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
 		ok: false,
 		reason: "malformed"
 	};
+	if (depth >= MAX_CHAIN_DEPTH) return {
+		ok: false,
+		reason: "chain_too_deep"
+	};
+	const payloadHex = require_domain_device_id.bytesToHex(payload);
+	if (seen.has(payloadHex)) return {
+		ok: false,
+		reason: "chain_cycle"
+	};
+	const deeperSeen = new Set(seen).add(payloadHex);
 	let decodedClaims;
 	try {
 		decodedClaims = (0, cbor2.decode)(payload, cbor2.cdeDecodeOptions);
@@ -271,15 +313,25 @@ async function verifyTokenChain(token, options) {
 			ok: false,
 			reason: "conditions_invalid"
 		};
-		if (!(await evaluateConditions(conditionsResult.data, claims, options.clock, options.extraPredicateResolvers)).ok) return {
+		if (!(await evaluateConditions(conditionsResult.data, claims, options.clock, options.extraPredicateResolvers, subjectClaims)).ok) return {
 			ok: false,
 			reason: "conditions_not_satisfied"
 		};
 	}
-	if (claims.parent !== void 0) {
+	const parentBytes = claims.parent;
+	const authorisationBytes = claims["authorised-by"];
+	if (claims.capability === "manage:grant" && parentBytes !== void 0) return {
+		ok: false,
+		reason: "authorisation_invalid"
+	};
+	if (parentBytes !== void 0 && authorisationBytes !== void 0) return {
+		ok: false,
+		reason: "malformed"
+	};
+	if (parentBytes !== void 0) {
 		let decodedParent;
 		try {
-			decodedParent = (0, cbor2.decode)(claims.parent, cbor2.cdeDecodeOptions);
+			decodedParent = (0, cbor2.decode)(parentBytes, cbor2.cdeDecodeOptions);
 		} catch {
 			return {
 				ok: false,
@@ -291,11 +343,17 @@ async function verifyTokenChain(token, options) {
 			ok: false,
 			reason: "parent_invalid"
 		};
-		const parentVerdict = await verifyTokenChain(parentResult.data, options);
-		if (!parentVerdict.ok) return {
-			ok: false,
-			reason: "parent_invalid"
-		};
+		const parentVerdict = await verifyTokenChain(parentResult.data, options, void 0, depth + 1, deeperSeen);
+		if (!parentVerdict.ok) {
+			if (parentVerdict.reason === "chain_too_deep" || parentVerdict.reason === "chain_cycle") return {
+				ok: false,
+				reason: parentVerdict.reason
+			};
+			return {
+				ok: false,
+				reason: "parent_invalid"
+			};
+		}
 		const candidate = {
 			capability: claims.capability,
 			scope: claims.scope,
@@ -314,6 +372,46 @@ async function verifyTokenChain(token, options) {
 			depth: parentVerdict.depth + 1
 		};
 	}
+	if (authorisationBytes !== void 0) {
+		let decodedAuthoriser;
+		try {
+			decodedAuthoriser = (0, cbor2.decode)(authorisationBytes, cbor2.cdeDecodeOptions);
+		} catch {
+			return {
+				ok: false,
+				reason: "authorisation_invalid"
+			};
+		}
+		const authoriserResult = require_generated_protocol.capabilityTokenSchema.safeParse(decodedAuthoriser);
+		if (!authoriserResult.success) return {
+			ok: false,
+			reason: "authorisation_invalid"
+		};
+		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, claims, depth + 1, deeperSeen);
+		if (!authoriserVerdict.ok) {
+			if (authoriserVerdict.reason === "chain_too_deep" || authoriserVerdict.reason === "chain_cycle") return {
+				ok: false,
+				reason: authoriserVerdict.reason
+			};
+			return {
+				ok: false,
+				reason: "authorisation_invalid"
+			};
+		}
+		const authoriser = authoriserVerdict.claims;
+		const grantsCapability = authoriser["grants-capability"];
+		if (!(require_token_scope.bytesEqual(authoriser.bearer, claims.issuer) && authoriser.capability === "manage:grant" && (grantsCapability === void 0 || grantsCapability === claims.capability) && require_token_scope.scopeNarrows(authoriser.scope, claims.scope) && claims.expires <= authoriser.expires && (authoriser["delegations-remaining"] === void 0 || claims["delegations-remaining"] !== void 0 && claims["delegations-remaining"] < authoriser["delegations-remaining"]))) return {
+			ok: false,
+			reason: "authorisation_invalid"
+		};
+		return {
+			ok: true,
+			claims,
+			rootIssuer: authoriserVerdict.rootIssuer,
+			rootIssuerKey: authoriserVerdict.rootIssuerKey,
+			depth: authoriserVerdict.depth + 1
+		};
+	}
 	return {
 		ok: true,
 		claims,
@@ -373,8 +471,30 @@ async function checkNarrowing(parentClaims, granterDeviceId, candidate) {
 	const failedSystem = await evaluateNarrowing(parentClaims, granterDeviceId, candidate);
 	return failedSystem === void 0 ? void 0 : NARROWING_SYSTEM_TO_MINT_REFUSAL[failedSystem];
 }
+/** The authorised-by link's own arithmetic (wire-mesh#323), the analogue checkNarrowing already is for the parent link: everything tokens.cddl's authorised-by obligations require, checked against a not-yet-minted candidate, shared between mintCapabilityToken and canGrantVia so the two can never drift. The authoriser's conditions are evaluated in subject mode against the candidate, the same evaluation the verifier performs against the minted child. Returns the specific refusal reason, or undefined when the authorisation holds. */
+async function checkAuthorisation(authorisingClaims, minterDeviceId, candidate) {
+	if (authorisingClaims.parent !== void 0) return "authorisation_parent_forbidden";
+	if (!require_token_scope.bytesEqual(authorisingClaims.bearer, minterDeviceId)) return "authorisation_bearer_mismatch";
+	const grantsCapability = authorisingClaims["grants-capability"];
+	if (authorisingClaims.capability !== "manage:grant" || grantsCapability !== void 0 && grantsCapability !== candidate.capability) return "authorisation_capability_mismatch";
+	if (!require_token_scope.scopeNarrows(authorisingClaims.scope, candidate.scope)) return "authorisation_scope_does_not_narrow";
+	if (candidate.expires > authorisingClaims.expires) return "authorisation_exceeds_authoriser";
+	const remaining = authorisingClaims["delegations-remaining"];
+	if (remaining !== void 0 && (candidate.delegationsRemaining === void 0 || candidate.delegationsRemaining >= remaining)) return "authorisation_delegation_exceeds";
+	if (authorisingClaims.conditions !== void 0) {
+		let decodedConditions;
+		try {
+			decodedConditions = (0, cbor2.decode)(authorisingClaims.conditions, cbor2.cdeDecodeOptions);
+		} catch {
+			return "authorisation_malformed";
+		}
+		const conditionsResult = conditionsListSchema.safeParse(decodedConditions);
+		if (!conditionsResult.success) return "authorisation_malformed";
+		if (!(await evaluateConditions(conditionsResult.data, authorisingClaims, { now: () => 0 }, {}, candidate)).ok) return "authorisation_conditions_not_satisfied";
+	}
+}
 /**
-* A pure query: could deviceId, presenting heldToken as its own delegation authority, successfully mint a delegation matching candidate right now -- without attempting (and potentially failing) a real mint just to find out. Reuses mintCapabilityToken's own narrowing arithmetic via checkNarrowing, so the two can never silently drift into different ideas of what "narrows" means.
+* A pure query: could deviceId, presenting heldToken as its own delegation authority," successfully mint a delegation matching candidate right now -- without attempting (and potentially failing) a real mint just to find out. Reuses mintCapabilityToken's own narrowing arithmetic via checkNarrowing, so the two can never silently drift into different ideas of what "narrows" means.
 *
 * Deliberately narrower than a full mint attempt in one respect: this checks only the narrowing rules tokens.cddl's own delegation obligations require (bearer match, expiry, scope, capability, delegations-remaining), the same scope mintCapabilityToken itself checks a *parent* against -- it does not verify heldToken's own signature or revocation status, exactly as mintCapabilityToken never re-verifies its own parent's signature either. A caller that also needs heldToken's cryptographic validity confirmed calls verifyCapabilityToken separately.
 *
@@ -386,6 +506,13 @@ async function canGrant(heldToken, deviceId, candidate, now) {
 	if (heldClaims === void 0) return false;
 	return await checkNarrowing(heldClaims, deviceId, candidate) === void 0;
 }
+/** A pure query: could deviceId, presenting heldGrantCapability as its minting authority, mint a token matching candidate right now (wire-mesh#323) -- canGrant's authorised-by analogue, with the same deliberately-narrower-than-verify caveat canGrant's own doc comment states: the held token's signature and revocation status are not checked here; a caller needing those confirmed calls verifyCapabilityToken separately. The candidate carries a bearer because the authoriser's subject-mode conditions read it (the no-self-grant bar). */
+async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
+	if (candidate.expires <= now) return false;
+	const heldClaims = decodeTokenClaims(heldGrantCapability);
+	if (heldClaims === void 0) return false;
+	return await checkAuthorisation(heldClaims, deviceId, candidate) === void 0;
+}
 /**
 * Mints one capability token: builds token-claims from the given fields, signs it as a COSE_Sign1 under `identity`'s own key, with a protected header matching what the frozen conformance vectors actually encode (`{1: alg, 4: issuer device-id}`, not the empty header a token merely needs to verify against itself).
 *
@@ -396,6 +523,14 @@ async function mintCapabilityToken(options) {
 		ok: false,
 		reason: "already_expired"
 	};
+	if (options.parent !== void 0 && options.authorisedBy !== void 0) return {
+		ok: false,
+		reason: "links_exclusive"
+	};
+	if (options.capability === "manage:grant" && options.parent !== void 0) return {
+		ok: false,
+		reason: "authorisation_parent_forbidden"
+	};
 	let parentBytes;
 	if (options.parent !== void 0) {
 		const parentClaims = decodeTokenClaims(options.parent);
@@ -415,6 +550,26 @@ async function mintCapabilityToken(options) {
 		};
 		parentBytes = encodeBuf(options.parent);
 	}
+	let authorisationBytes;
+	if (options.authorisedBy !== void 0) {
+		const authorisingClaims = decodeTokenClaims(options.authorisedBy);
+		if (authorisingClaims === void 0) return {
+			ok: false,
+			reason: "authorisation_malformed"
+		};
+		const refusal = await checkAuthorisation(authorisingClaims, options.identity.deviceId, {
+			capability: options.capability,
+			scope: options.scope,
+			bearer: options.bearer,
+			expires: options.expires,
+			...options.delegationsRemaining !== void 0 ? { delegationsRemaining: options.delegationsRemaining } : {}
+		});
+		if (refusal !== void 0) return {
+			ok: false,
+			reason: refusal
+		};
+		authorisationBytes = encodeBuf(options.authorisedBy);
+	}
 	const payload = encodeBuf({
 		"token-id": options.tokenId,
 		issuer: options.identity.deviceId,
@@ -426,7 +581,10 @@ async function mintCapabilityToken(options) {
 		...options.notBefore !== void 0 ? { "not-before": options.notBefore } : {},
 		...parentBytes !== void 0 ? { parent: parentBytes } : {},
 		...options.delegationsRemaining !== void 0 ? { "delegations-remaining": options.delegationsRemaining } : {},
-		...options.conditions !== void 0 ? { conditions: encodeBuf(options.conditions) } : {}
+		...options.conditions !== void 0 ? { conditions: encodeBuf(options.conditions) } : {},
+		...authorisationBytes !== void 0 ? { "authorised-by": authorisationBytes } : {},
+		...options.grantsCapability !== void 0 ? { "grants-capability": options.grantsCapability } : {},
+		...options.requestsCapability !== void 0 ? { "requests-capability": options.requestsCapability } : {}
 	});
 	const protectedHeader = protectedHeaderFor(options.identity);
 	return {
@@ -456,12 +614,24 @@ async function mintRevocationEntry(options) {
 	];
 }
 //#endregion
+Object.defineProperty(exports, "MANAGE_GRANT_CAPABILITY", {
+	enumerable: true,
+	get: function() {
+		return MANAGE_GRANT_CAPABILITY;
+	}
+});
 Object.defineProperty(exports, "canGrant", {
 	enumerable: true,
 	get: function() {
 		return canGrant;
 	}
 });
+Object.defineProperty(exports, "canGrantVia", {
+	enumerable: true,
+	get: function() {
+		return canGrantVia;
+	}
+});
 Object.defineProperty(exports, "mintCapabilityToken", {
 	enumerable: true,
 	get: function() {

package/dist/{transport-B0GywEzG.d.mts → transport-DP3hdehk.d.cts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-DCDae3z4.mjs";
+import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-DIXjoQKn.d.cts → transport-Dv_LTCsF.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-DCDae3z4.cjs";
+import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.7.2",
+  "version": "3.8.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",