wire-mesh-core 3.7.2 → 3.9.0

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-DIXjoQKn.cjs";
+import { N as Frame } from "../protocol-BgR1e_NI.cjs";
+import { t as Connection } from "../transport-DP3hdehk.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-B0GywEzG.mjs";
+import { N as Frame } from "../protocol-BgR1e_NI.mjs";
+import { t as Connection } from "../transport-Dv_LTCsF.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DIXjoQKn.cjs";
+import { r as Transport } from "../transport-DP3hdehk.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B0GywEzG.mjs";
+import { r as Transport } from "../transport-Dv_LTCsF.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DIXjoQKn.cjs";
+import { r as Transport } from "../transport-DP3hdehk.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-B0GywEzG.mjs";
+import { r as Transport } from "../transport-Dv_LTCsF.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/advert-extension-policy.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DCDae3z4.cjs";
+import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/advert-extension-policy.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-DCDae3z4.mjs";
+import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { t as Connection } from "../transport-DIXjoQKn.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { t as Connection } from "../transport-DP3hdehk.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { t as Connection } from "../transport-B0GywEzG.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { t as Connection } from "../transport-Dv_LTCsF.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.
@@ -49,7 +49,7 @@ function createCapabilityGrantHandler(options) {
 			return;
 		}
 		const grantedToken = parsed.data["granted-token"];
-		const verdict = await require_tokens.verifyCapabilityToken(grantedToken, {
+		const verdict = await require_domain_tokens.verifyCapabilityToken(grantedToken, {
 			identity: options.identity,
 			clock: options.clock,
 			revocation: options.revocation,
@@ -69,7 +69,7 @@ function createCapabilityGrantHandler(options) {
 			});
 			return;
 		}
-		if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
+		if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
 			await incoming.respond({
 				result: "error",
 				code: "scope_mismatch"

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { a as RevocationCheck } from "../tokens-DqFu7iMX.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { a as RevocationCheck } from "../tokens-CBiSYuzp.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -30,18 +31,64 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
 * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
 */
-async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil) {
-	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, void 0, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
+	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = require_generated_protocol.capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
 }
+/** The capability verb of a request-permission (wire-mesh#324): the right to ask for a capability, grantable and delegable like any other. */
+const MANAGE_REQUEST_CAPABILITY = "manage:request";
+/** The request-permission gate (wire-mesh#324): the incoming request must present a manage:request token naming this requester as bearer, matching this capability when the token names one, and covering the request's own scope. A wrong token is an ordinary manage-error, never an exception -- the same convention every other refusal here already follows. */
+async function checkRequestPermission(incoming, options) {
+	if (incoming.token === void 0) return {
+		ok: false,
+		code: "token_required"
+	};
+	if (options.revocation === void 0) throw new Error("requireRequestToken needs a revocation view on the handler options");
+	const verdict = await require_domain_tokens.verifyCapabilityToken(incoming.token, {
+		identity: options.identity,
+		clock: options.clock,
+		revocation: options.revocation,
+		expectedBearer: options.bearerDevice,
+		...options.extraPredicateResolvers !== void 0 ? { extraPredicateResolvers: options.extraPredicateResolvers } : {}
+	});
+	if (!verdict.ok) return {
+		ok: false,
+		code: verdict.reason
+	};
+	if (verdict.claims.capability !== "manage:request") return {
+		ok: false,
+		code: "capability_mismatch"
+	};
+	const requestsCapability = verdict.claims["requests-capability"];
+	if (requestsCapability !== void 0 && requestsCapability !== options.capability) return {
+		ok: false,
+		code: "capability_mismatch"
+	};
+	if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) return {
+		ok: false,
+		code: "scope_mismatch"
+	};
+	return { ok: true };
+}
 /**
 * Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
 */
@@ -55,7 +102,18 @@ function createCapabilityRequestHandler(options) {
 			});
 			return;
 		}
-		const validUntil = parsed.data["valid-until"];
+		const params = parsed.data;
+		if (options.requireRequestToken === true) {
+			const verdict = await checkRequestPermission(incoming, options);
+			if (!verdict.ok) {
+				await incoming.respond({
+					result: "error",
+					code: verdict.code
+				});
+				return;
+			}
+		}
+		const validUntil = params["valid-until"];
 		if (validUntil !== void 0 && validUntil <= options.clock.now()) {
 			await incoming.respond({
 				result: "error",
@@ -89,7 +147,7 @@ function createCapabilityRequestHandler(options) {
 					});
 					return;
 				}
-				const verdict = await require_tokens.mintCapabilityToken({
+				const verdict = await require_domain_tokens.mintCapabilityToken({
 					identity: options.identity,
 					clock: options.clock,
 					tokenId: randomTokenId(),
@@ -117,6 +175,8 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
+exports.CapabilityRequestRefusedError = CapabilityRequestRefusedError;
+exports.MANAGE_REQUEST_CAPABILITY = MANAGE_REQUEST_CAPABILITY;
 exports.buildCapabilityRequestCommand = buildCapabilityRequestCommand;
 exports.createCapabilityRequestHandler = createCapabilityRequestHandler;
 exports.requestCapability = requestCapability;

package/dist/domain/capability-request.d.cts

@@ -1,18 +1,28 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-DCDae3z4.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-C-aIe1DT.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *
  * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
  */
-export declare function requestCapability(session: Readonly<Pick<MeshSession, "sendManageRequest">>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number): Promise<CapabilityGrantOk>;
+export declare function requestCapability(session: Readonly<Pick<MeshSession, "sendManageRequest">>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number,
+/** A manage:request token to present with the ask, for a receiver that gates requesting (wire-mesh#324). Absent keeps the request ungated, which is what a stranger's first contact must remain able to send. */
+requestToken?: CapabilityToken): Promise<CapabilityGrantOk>;
 /**
  * A receiver's decision on one incoming capability-request, mirroring room-client.ts's own (now capability-specific) RoomJoinDecision, generalized to any capability: "accept" mints and returns a fresh token; "reject" sends an ordinary manage-error carrying an optional human-readable reason.
  */
@@ -37,11 +47,19 @@ export interface CapabilityGrantRequestEvent {
   /** Resolves this request with the domain's decision. Settles the request's response exactly once: whichever of a real decide() call or the handler's own receiver-side timeout comes first wins, and the other is a no-op -- the same single-settle guarantee agent-comms' own PendingConnection timer/accept/reject/disconnect race already established (ported here, not reinvented). */
   decide: (decision: Readonly<CapabilityGrantDecision>) => Promise<void>;
 }
+/** The capability verb of a request-permission (wire-mesh#324): the right to ask for a capability, grantable and delegable like any other. */
+export declare const MANAGE_REQUEST_CAPABILITY = "manage:request";
 export interface CreateCapabilityRequestHandlerOptions {
   /** The capability this handler grants. Checked against both the incoming request's own `params.capability` field (a mismatch is refused as malformed rather than trusted -- nothing about manage-command.verb structurally guarantees params.capability agrees with it) and used as the scope this handler is willing to act on at all; a caller wanting to grant several distinct capabilities over one session constructs one handler per capability, the same way core/room constructs one handler for `room:member` and nothing else. */
   capability: string;
   identity: IdentityPort;
   clock: Clock;
+  /** The revocation view the request-permission gate (requireRequestToken) verifies a presented manage:request token against -- the same plumbing every other token verification here already takes. Required only when the gate is on. */
+  revocation?: RevocationCheck;
+  /** Opt the receiver into the request-permission gate (wire-mesh#324): when on, a request must present a valid manage:request token whose bearer is the authenticated requester, whose requests-capability (when present) matches this handler's capability, and whose scope covers the request's own scope. Off by default so a stranger's first contact still reaches the domain's own decision. */
+  requireRequestToken?: boolean;
+  /** Domain-specific delegate systems a presented request-permission's own conditions entries may name, forwarded verbatim to verifyCapabilityToken. */
+  extraPredicateResolvers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>;
   /** The peer device-id authenticated on this session's own connection -- the requester, and so the future bearer of any token this handler mints. One handler is constructed per session for the same reason one RoomRouter is (RoomRouterOptions.peerDevice): MeshSession exposes no way for domain code to learn the authenticated peer independently. */
   bearerDevice: DeviceId;
   /** Receiver-side auto-reject window (wire-mesh#81): how long an incoming request may sit awaiting the domain's decision before this side responds with a real manage-error timeout rather than leaving the requester's own sendManageRequest hanging indefinitely. Ported from agent-comms' PendingConnection pattern (`wire-mesh-transport.ts`'s `pendingConnectionTimeoutMs` / `expirePendingConnection`): an unref'd timer so a stray one can never by itself keep the process alive, cleared the instant decide() is actually called so it can never fire after the request has already been answered. IncomingManageRequest exposes no requester-disconnect signal at this layer (unlike agent-comms' own transport, which owns the raw connection), so only the timeout half of that pattern is implemented here -- there is nothing to detect the requester giving up early honestly, so this module does not pretend to. */

package/dist/domain/capability-request.d.mts

@@ -1,18 +1,28 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, u as CapabilityGrantOk } from "../protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqvyS7Y8.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *
  * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
  */
-export declare function requestCapability(session: Readonly<Pick<MeshSession, "sendManageRequest">>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number): Promise<CapabilityGrantOk>;
+export declare function requestCapability(session: Readonly<Pick<MeshSession, "sendManageRequest">>, capability: string, scope: Readonly<CapabilityScope>, targetDevice?: DeviceId, timeoutMs?: number, validUntil?: number,
+/** A manage:request token to present with the ask, for a receiver that gates requesting (wire-mesh#324). Absent keeps the request ungated, which is what a stranger's first contact must remain able to send. */
+requestToken?: CapabilityToken): Promise<CapabilityGrantOk>;
 /**
  * A receiver's decision on one incoming capability-request, mirroring room-client.ts's own (now capability-specific) RoomJoinDecision, generalized to any capability: "accept" mints and returns a fresh token; "reject" sends an ordinary manage-error carrying an optional human-readable reason.
  */
@@ -37,11 +47,19 @@ export interface CapabilityGrantRequestEvent {
   /** Resolves this request with the domain's decision. Settles the request's response exactly once: whichever of a real decide() call or the handler's own receiver-side timeout comes first wins, and the other is a no-op -- the same single-settle guarantee agent-comms' own PendingConnection timer/accept/reject/disconnect race already established (ported here, not reinvented). */
   decide: (decision: Readonly<CapabilityGrantDecision>) => Promise<void>;
 }
+/** The capability verb of a request-permission (wire-mesh#324): the right to ask for a capability, grantable and delegable like any other. */
+export declare const MANAGE_REQUEST_CAPABILITY = "manage:request";
 export interface CreateCapabilityRequestHandlerOptions {
   /** The capability this handler grants. Checked against both the incoming request's own `params.capability` field (a mismatch is refused as malformed rather than trusted -- nothing about manage-command.verb structurally guarantees params.capability agrees with it) and used as the scope this handler is willing to act on at all; a caller wanting to grant several distinct capabilities over one session constructs one handler per capability, the same way core/room constructs one handler for `room:member` and nothing else. */
   capability: string;
   identity: IdentityPort;
   clock: Clock;
+  /** The revocation view the request-permission gate (requireRequestToken) verifies a presented manage:request token against -- the same plumbing every other token verification here already takes. Required only when the gate is on. */
+  revocation?: RevocationCheck;
+  /** Opt the receiver into the request-permission gate (wire-mesh#324): when on, a request must present a valid manage:request token whose bearer is the authenticated requester, whose requests-capability (when present) matches this handler's capability, and whose scope covers the request's own scope. Off by default so a stranger's first contact still reaches the domain's own decision. */
+  requireRequestToken?: boolean;
+  /** Domain-specific delegate systems a presented request-permission's own conditions entries may name, forwarded verbatim to verifyCapabilityToken. */
+  extraPredicateResolvers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>;
   /** The peer device-id authenticated on this session's own connection -- the requester, and so the future bearer of any token this handler mints. One handler is constructed per session for the same reason one RoomRouter is (RoomRouterOptions.peerDevice): MeshSession exposes no way for domain code to learn the authenticated peer independently. */
   bearerDevice: DeviceId;
   /** Receiver-side auto-reject window (wire-mesh#81): how long an incoming request may sit awaiting the domain's decision before this side responds with a real manage-error timeout rather than leaving the requester's own sendManageRequest hanging indefinitely. Ported from agent-comms' PendingConnection pattern (`wire-mesh-transport.ts`'s `pendingConnectionTimeoutMs` / `expirePendingConnection`): an unref'd timer so a stray one can never by itself keep the process alive, cleared the instant decide() is actually called so it can never fire after the request has already been answered. IncomingManageRequest exposes no requester-disconnect signal at this layer (unlike agent-comms' own transport, which owns the raw connection), so only the timeout half of that pattern is implemented here -- there is nothing to detect the requester giving up early honestly, so this module does not pretend to. */

package/dist/domain/capability-request.mjs

@@ -1,5 +1,6 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as mintCapabilityToken } from "../tokens-CMdWiRBb.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { mintCapabilityToken, verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -29,18 +30,64 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
 * targetDevice and timeoutMs forward directly to MeshSession.sendManageRequest's own identically-named parameters (relay routing and a requester-side give-up bound respectively -- wire-mesh#80 is already implemented there, not duplicated here). validUntil, when given, is attached to the request itself (wire-mesh#82) so a slow-to-answer receiver -- or a relay/facilitator forwarding this request on the caller's behalf -- can refuse or drop a now-stale ask outright rather than holding or forwarding it.
 */
-async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil) {
-	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, void 0, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
+	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
 }
+/** The capability verb of a request-permission (wire-mesh#324): the right to ask for a capability, grantable and delegable like any other. */
+const MANAGE_REQUEST_CAPABILITY = "manage:request";
+/** The request-permission gate (wire-mesh#324): the incoming request must present a manage:request token naming this requester as bearer, matching this capability when the token names one, and covering the request's own scope. A wrong token is an ordinary manage-error, never an exception -- the same convention every other refusal here already follows. */
+async function checkRequestPermission(incoming, options) {
+	if (incoming.token === void 0) return {
+		ok: false,
+		code: "token_required"
+	};
+	if (options.revocation === void 0) throw new Error("requireRequestToken needs a revocation view on the handler options");
+	const verdict = await verifyCapabilityToken(incoming.token, {
+		identity: options.identity,
+		clock: options.clock,
+		revocation: options.revocation,
+		expectedBearer: options.bearerDevice,
+		...options.extraPredicateResolvers !== void 0 ? { extraPredicateResolvers: options.extraPredicateResolvers } : {}
+	});
+	if (!verdict.ok) return {
+		ok: false,
+		code: verdict.reason
+	};
+	if (verdict.claims.capability !== "manage:request") return {
+		ok: false,
+		code: "capability_mismatch"
+	};
+	const requestsCapability = verdict.claims["requests-capability"];
+	if (requestsCapability !== void 0 && requestsCapability !== options.capability) return {
+		ok: false,
+		code: "capability_mismatch"
+	};
+	if (!scopeNarrows(verdict.claims.scope, incoming.scope)) return {
+		ok: false,
+		code: "scope_mismatch"
+	};
+	return { ok: true };
+}
 /**
 * Builds a reusable handler for one capability's incoming capability-requests. The returned function is the generic counterpart to room-client.ts's own (now capability-specific) handleRoomJoin: given one IncomingManageRequest, it refuses a request for the wrong capability or a malformed payload as `{result:"error", code:"malformed"}`, refuses an already-expired request (per its own `valid-until`, wire-mesh#82) as `{result:"error", code:"expired"}` without ever invoking onRequest, otherwise arms the receiver-side timeout described on CreateCapabilityRequestHandlerOptions.timeoutMs and calls onRequest so the domain can accept (minting a fresh token via mintCapabilityToken and responding `{result:"ok", "granted-token": token, ...extensions}`) or reject (an ordinary manage-error) via the event's own decide().
 */
@@ -54,7 +101,18 @@ function createCapabilityRequestHandler(options) {
 			});
 			return;
 		}
-		const validUntil = parsed.data["valid-until"];
+		const params = parsed.data;
+		if (options.requireRequestToken === true) {
+			const verdict = await checkRequestPermission(incoming, options);
+			if (!verdict.ok) {
+				await incoming.respond({
+					result: "error",
+					code: verdict.code
+				});
+				return;
+			}
+		}
+		const validUntil = params["valid-until"];
 		if (validUntil !== void 0 && validUntil <= options.clock.now()) {
 			await incoming.respond({
 				result: "error",
@@ -116,4 +174,4 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
-export { buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };
+export { CapabilityRequestRefusedError, MANAGE_REQUEST_CAPABILITY, buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };

package/dist/domain/coordinator-election.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.cjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/coordinator-election.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.mjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DCDae3z4.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-DCDae3z4.cjs";
+import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;