wire-mesh-core 3.7.2 → 3.9.0

package/dist/domain/webrtc-signaling.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-DSG3SDr8.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";
@@ -86,7 +86,7 @@ function createNegotiationIdAllocator() {
 /** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
 async function authorizeIncomingOffer(incoming, options) {
 	if (incoming.token === void 0) return false;
-	const verdict = await require_tokens.verifyCapabilityToken(incoming.token, options);
+	const verdict = await require_domain_tokens.verifyCapabilityToken(incoming.token, options);
 	if (!verdict.ok) return false;
 	return verdict.claims.capability === "webrtc:signal" && verdict.claims.scope.kind === WEBRTC_SIGNAL_SCOPE.kind;
 }

package/dist/domain/webrtc-signaling.d.cts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DCDae3z4.cjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.cjs";
 import { IncomingManageRequest } from "./mesh-session.cjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-DqFu7iMX.cjs";
+import { VerifyCapabilityTokenOptions } from "./tokens.cjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.d.mts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DCDae3z4.mjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.mjs";
 import { IncomingManageRequest } from "./mesh-session.mjs";
-import { u as VerifyCapabilityTokenOptions } from "../tokens-CBiSYuzp.mjs";
+import { VerifyCapabilityTokenOptions } from "./tokens.mjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.mjs

@@ -1,4 +1,4 @@
-import { a as verifyCapabilityToken } from "../tokens-CMdWiRBb.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/generated/protocol.cjs

@@ -469,9 +469,12 @@ const tokenClaimsSchema = zod.z.lazy(() => zod.z.object({
 	"expires": zod.z.number().int().nonnegative(),
 	"not-before": zod.z.number().int().nonnegative().optional(),
 	"parent": zod.z.instanceof(Uint8Array).optional(),
+	"authorised-by": zod.z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": zod.z.number().int().nonnegative().optional(),
 	"valid-until": zod.z.number().int().nonnegative().optional(),
-	"conditions": zod.z.instanceof(Uint8Array).optional()
+	"conditions": zod.z.instanceof(Uint8Array).optional(),
+	"grants-capability": zod.z.lazy(() => capabilityVerbSchema).optional(),
+	"requests-capability": zod.z.lazy(() => capabilityVerbSchema).optional()
 }).catchall(zod.z.unknown()));
 const pingFrameSchema = zod.z.lazy(() => zod.z.object({ "type": zod.z.literal("ping") }));
 const pongFrameSchema = zod.z.lazy(() => zod.z.object({ "type": zod.z.literal("pong") }));

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DCDae3z4.cjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.cjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DCDae3z4.mjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.mjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -468,9 +468,12 @@ const tokenClaimsSchema = z.lazy(() => z.object({
 	"expires": z.number().int().nonnegative(),
 	"not-before": z.number().int().nonnegative().optional(),
 	"parent": z.instanceof(Uint8Array).optional(),
+	"authorised-by": z.instanceof(Uint8Array).optional(),
 	"delegations-remaining": z.number().int().nonnegative().optional(),
 	"valid-until": z.number().int().nonnegative().optional(),
-	"conditions": z.instanceof(Uint8Array).optional()
+	"conditions": z.instanceof(Uint8Array).optional(),
+	"grants-capability": z.lazy(() => capabilityVerbSchema).optional(),
+	"requests-capability": z.lazy(() => capabilityVerbSchema).optional()
 }).catchall(z.unknown()));
 const pingFrameSchema = z.lazy(() => z.object({ "type": z.literal("ping") }));
 const pongFrameSchema = z.lazy(() => z.object({ "type": z.literal("pong") }));

package/dist/{identity-DVCNuFLG.d.cts → identity-DJbr96J3.d.cts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-DCDae3z4.cjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-DcaYgjXT.d.mts → identity-ViYdZrIU.d.mts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-DCDae3z4.mjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DVCNuFLG.cjs";
+import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DcaYgjXT.mjs";
+import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-DIXjoQKn.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-B0GywEzG.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-DCDae3z4.d.cts → protocol-BgR1e_NI.d.cts}

@@ -1564,9 +1564,12 @@ declare const tokenClaimsSchema: z.ZodLazy<z.ZodObject<{
   expires: z.ZodNumber;
   "not-before": z.ZodOptional<z.ZodNumber>;
   parent: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+  "authorised-by": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   "delegations-remaining": z.ZodOptional<z.ZodNumber>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
   conditions: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+  "grants-capability": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>]>>>>;
+  "requests-capability": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>]>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const pingFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"ping">;

package/dist/{protocol-DCDae3z4.d.mts → protocol-BgR1e_NI.d.mts}

@@ -1564,9 +1564,12 @@ declare const tokenClaimsSchema: z.ZodLazy<z.ZodObject<{
   expires: z.ZodNumber;
   "not-before": z.ZodOptional<z.ZodNumber>;
   parent: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+  "authorised-by": z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
   "delegations-remaining": z.ZodOptional<z.ZodNumber>;
   "valid-until": z.ZodOptional<z.ZodNumber>;
   conditions: z.ZodOptional<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>;
+  "grants-capability": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>]>>>>;
+  "requests-capability": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>, z.ZodLazy<z.ZodLazy<z.ZodString>>]>>>>;
 }, z.core.$catchall<z.ZodUnknown>>>;
 declare const pingFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"ping">;

package/dist/{room-token-verification-CkGnFuQc.d.mts → room-token-verification-BpQ6yJtj.d.cts}

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-DCDae3z4.mjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "./tokens-CBiSYuzp.mjs";
+import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-BgR1e_NI.cjs";
+import { TokenVerdictReason, VerifyCapabilityTokenOptions } from "./domain/tokens.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/{room-token-verification-PSv4eQ1x.d.cts → room-token-verification-CTQSihUO.d.mts}

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-DCDae3z4.cjs";
-import { l as TokenVerdictReason, u as VerifyCapabilityTokenOptions } from "./tokens-DqFu7iMX.cjs";
+import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-BgR1e_NI.mjs";
+import { TokenVerdictReason, VerifyCapabilityTokenOptions } from "./domain/tokens.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/token-predicates-C-aIe1DT.d.cts

@@ -0,0 +1,72 @@
+import { D as DeviceId, en as TokenClaims } from "./protocol-BgR1e_NI.cjs";
+import { t as Clock } from "./clock-DiSx-WKM.cjs";
+import { z } from "zod";
+import { JsonValue, PredicateNode, Resolution } from "trilean";
+//#region src/domain/token-predicates.d.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+declare const conditionsListSchema: z.ZodType<PredicateNode[]>;
+/**
+ * tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+ */
+declare const BEARER_IS = "bearer-is";
+declare const EXPIRES_AT = "expires-at";
+declare const SCOPE_NARROWS = "scope-narrows";
+declare const CAPABILITY_IS = "capability-is";
+declare const DEPTH_REMAINING = "depth-remaining";
+type NarrowingSystem = typeof BEARER_IS | typeof EXPIRES_AT | typeof SCOPE_NARROWS | typeof CAPABILITY_IS | typeof DEPTH_REMAINING;
+/** Everything needed to check candidate against parent, restated from tokens.ts's own NarrowingCandidate/checkNarrowing shape rather than requiring a full TokenClaims for the not-yet-minted child -- the same reasoning mintCapabilityToken's own checkNarrowing already applies (a delegation candidate has no token-id/issuer-key/bearer of its own yet). camelCase field names, matching NarrowingCandidate's own convention, deliberately distinct from TokenClaims' hyphenated wire field names. */
+interface NarrowingCandidate {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  expires: number;
+  delegationsRemaining?: number;
+}
+/**
+ * The local evaluation context every token predicate op reads from -- trilean's own `EvaluationContext` is deliberately typed `unknown` (an opaque, in-process value never serialised as part of the tree), so this is wire-mesh's own concrete shape for it. `childIssuer`/`candidate` describe the not-yet-minted or being-verified child; `parentClaims` is the already-decoded-and-verified parent, present only when narrowing is actually being checked against one. No clock: none of the five structural narrowing checks reason about the current time (unlike a conditions-list entry, which might -- see ConditionsContext).
+ */
+interface TokenPredicateContext {
+  readonly childIssuer: DeviceId;
+  readonly candidate: Readonly<NarrowingCandidate>;
+  readonly parentClaims?: Readonly<TokenClaims>;
+}
+/** A `conditions` entry's own generic evaluation context: no parent/candidate distinction, since a domain-specific condition (a message TTL, a future revoke-authorization check) reasons about the presented token's own claims directly, not a not-yet-minted delegation candidate. */
+interface ConditionsContext {
+  readonly clock: Clock;
+  readonly claims: Readonly<TokenClaims>;
+  /** The minted child a grant-capability's conditions are being evaluated against (wire-mesh#323 subject mode): present only inside an authorised-by verification walk or a mint-time authorisation check, never when a token's conditions are evaluated against its own claims. */
+  readonly subject?: Readonly<GrantSubject>;
+}
+/** The child half of a subject-mode conditions evaluation: the claims of the token a grant-capability authorises, structurally what NarrowingCandidate already is plus the bearer the mint named. Satisfied by a full TokenClaims, so the verifier passes the child's decoded claims directly. */
+interface GrantSubject {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  bearer: DeviceId;
+  expires: number;
+  delegationsRemaining?: number;
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+declare const GRANTEE_IS = "grantee-is";
+declare const GRANTED_CAPABILITY_IS = "granted-capability-is";
+type SubjectSystem = typeof GRANTEE_IS | typeof GRANTED_CAPABILITY_IS;
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+declare function noSelfGrantBar(capability: TokenClaims["capability"], bearer: DeviceId): PredicateNode;
+/** One delegate system's own handler: given the delegate node's payload and the concrete context it was invoked with, resolves to a boolean-valued Resolution. Handlers never throw for a data-quality problem -- an op that cannot make sense of its own payload/context returns `{found: false}`, which the evaluator turns into a fail-closed `indeterminate`. */
+type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) => Resolution | Promise<Resolution>;
+/**
+ * Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+ */
+declare function evaluateNarrowing(parentClaims: Readonly<TokenClaims>, childIssuer: DeviceId, candidate: Readonly<NarrowingCandidate>): Promise<NarrowingSystem | undefined>;
+type ConditionsVerdict = {
+  ok: true;
+} | {
+  ok: false;
+  reason: "not_satisfied";
+};
+/**
+ * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+ */
+declare function evaluateConditions(nodes: readonly PredicateNode[], claims: Readonly<TokenClaims>, clock: Readonly<Clock>, extraHandlers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>,
+/** Subject mode (wire-mesh#323): the minted child the carrying grant-capability's conditions bind to. Absent evaluates against the carrying token's own claims, exactly as before; present additionally registers the two subject systems, whose handlers read the subject rather than `claims`. */
+subject?: Readonly<GrantSubject>): Promise<ConditionsVerdict>;
+//#endregion
+export { evaluateConditions as _, DEPTH_REMAINING as a, GRANTEE_IS as c, NarrowingSystem as d, SCOPE_NARROWS as f, conditionsListSchema as g, TokenPredicateContext as h, ConditionsVerdict as i, GrantSubject as l, TokenDelegateHandler as m, CAPABILITY_IS as n, EXPIRES_AT as o, SubjectSystem as p, ConditionsContext as r, GRANTED_CAPABILITY_IS as s, BEARER_IS as t, NarrowingCandidate as u, evaluateNarrowing as v, noSelfGrantBar as y };

package/dist/token-predicates-DqvyS7Y8.d.mts

@@ -0,0 +1,72 @@
+import { D as DeviceId, en as TokenClaims } from "./protocol-BgR1e_NI.mjs";
+import { t as Clock } from "./clock-DiSx-WKM.mjs";
+import { z } from "zod";
+import { JsonValue, PredicateNode, Resolution } from "trilean";
+//#region src/domain/token-predicates.d.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+declare const conditionsListSchema: z.ZodType<PredicateNode[]>;
+/**
+ * tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+ */
+declare const BEARER_IS = "bearer-is";
+declare const EXPIRES_AT = "expires-at";
+declare const SCOPE_NARROWS = "scope-narrows";
+declare const CAPABILITY_IS = "capability-is";
+declare const DEPTH_REMAINING = "depth-remaining";
+type NarrowingSystem = typeof BEARER_IS | typeof EXPIRES_AT | typeof SCOPE_NARROWS | typeof CAPABILITY_IS | typeof DEPTH_REMAINING;
+/** Everything needed to check candidate against parent, restated from tokens.ts's own NarrowingCandidate/checkNarrowing shape rather than requiring a full TokenClaims for the not-yet-minted child -- the same reasoning mintCapabilityToken's own checkNarrowing already applies (a delegation candidate has no token-id/issuer-key/bearer of its own yet). camelCase field names, matching NarrowingCandidate's own convention, deliberately distinct from TokenClaims' hyphenated wire field names. */
+interface NarrowingCandidate {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  expires: number;
+  delegationsRemaining?: number;
+}
+/**
+ * The local evaluation context every token predicate op reads from -- trilean's own `EvaluationContext` is deliberately typed `unknown` (an opaque, in-process value never serialised as part of the tree), so this is wire-mesh's own concrete shape for it. `childIssuer`/`candidate` describe the not-yet-minted or being-verified child; `parentClaims` is the already-decoded-and-verified parent, present only when narrowing is actually being checked against one. No clock: none of the five structural narrowing checks reason about the current time (unlike a conditions-list entry, which might -- see ConditionsContext).
+ */
+interface TokenPredicateContext {
+  readonly childIssuer: DeviceId;
+  readonly candidate: Readonly<NarrowingCandidate>;
+  readonly parentClaims?: Readonly<TokenClaims>;
+}
+/** A `conditions` entry's own generic evaluation context: no parent/candidate distinction, since a domain-specific condition (a message TTL, a future revoke-authorization check) reasons about the presented token's own claims directly, not a not-yet-minted delegation candidate. */
+interface ConditionsContext {
+  readonly clock: Clock;
+  readonly claims: Readonly<TokenClaims>;
+  /** The minted child a grant-capability's conditions are being evaluated against (wire-mesh#323 subject mode): present only inside an authorised-by verification walk or a mint-time authorisation check, never when a token's conditions are evaluated against its own claims. */
+  readonly subject?: Readonly<GrantSubject>;
+}
+/** The child half of a subject-mode conditions evaluation: the claims of the token a grant-capability authorises, structurally what NarrowingCandidate already is plus the bearer the mint named. Satisfied by a full TokenClaims, so the verifier passes the child's decoded claims directly. */
+interface GrantSubject {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  bearer: DeviceId;
+  expires: number;
+  delegationsRemaining?: number;
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+declare const GRANTEE_IS = "grantee-is";
+declare const GRANTED_CAPABILITY_IS = "granted-capability-is";
+type SubjectSystem = typeof GRANTEE_IS | typeof GRANTED_CAPABILITY_IS;
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+declare function noSelfGrantBar(capability: TokenClaims["capability"], bearer: DeviceId): PredicateNode;
+/** One delegate system's own handler: given the delegate node's payload and the concrete context it was invoked with, resolves to a boolean-valued Resolution. Handlers never throw for a data-quality problem -- an op that cannot make sense of its own payload/context returns `{found: false}`, which the evaluator turns into a fail-closed `indeterminate`. */
+type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) => Resolution | Promise<Resolution>;
+/**
+ * Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+ */
+declare function evaluateNarrowing(parentClaims: Readonly<TokenClaims>, childIssuer: DeviceId, candidate: Readonly<NarrowingCandidate>): Promise<NarrowingSystem | undefined>;
+type ConditionsVerdict = {
+  ok: true;
+} | {
+  ok: false;
+  reason: "not_satisfied";
+};
+/**
+ * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+ */
+declare function evaluateConditions(nodes: readonly PredicateNode[], claims: Readonly<TokenClaims>, clock: Readonly<Clock>, extraHandlers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>,
+/** Subject mode (wire-mesh#323): the minted child the carrying grant-capability's conditions bind to. Absent evaluates against the carrying token's own claims, exactly as before; present additionally registers the two subject systems, whose handlers read the subject rather than `claims`. */
+subject?: Readonly<GrantSubject>): Promise<ConditionsVerdict>;
+//#endregion
+export { evaluateConditions as _, DEPTH_REMAINING as a, GRANTEE_IS as c, NarrowingSystem as d, SCOPE_NARROWS as f, conditionsListSchema as g, TokenPredicateContext as h, ConditionsVerdict as i, GrantSubject as l, TokenDelegateHandler as m, CAPABILITY_IS as n, EXPIRES_AT as o, SubjectSystem as p, ConditionsContext as r, GRANTED_CAPABILITY_IS as s, BEARER_IS as t, NarrowingCandidate as u, evaluateNarrowing as v, noSelfGrantBar as y };

package/dist/{transport-DIXjoQKn.d.cts → transport-DP3hdehk.d.cts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-DCDae3z4.cjs";
+import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-B0GywEzG.d.mts → transport-Dv_LTCsF.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-DCDae3z4.mjs";
+import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.7.2",
+  "version": "3.9.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -194,6 +194,14 @@
       "import": "./dist/domain/threshold-subject.mjs",
       "require": "./dist/domain/threshold-subject.cjs"
     },
+    "./domain/token-predicates": {
+      "import": "./dist/domain/token-predicates.mjs",
+      "require": "./dist/domain/token-predicates.cjs"
+    },
+    "./domain/token-scope": {
+      "import": "./dist/domain/token-scope.mjs",
+      "require": "./dist/domain/token-scope.cjs"
+    },
     "./domain/tokens": {
       "import": "./dist/domain/tokens.mjs",
       "require": "./dist/domain/tokens.cjs"

package/dist/tokens-CBiSYuzp.d.mts

@@ -1,126 +0,0 @@
-import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "./protocol-DCDae3z4.mjs";
-import { t as IdentityPort } from "./identity-DcaYgjXT.mjs";
-import { t as Clock } from "./clock-DiSx-WKM.mjs";
-import { z } from "zod";
-import { JsonValue, PredicateNode, Resolution } from "trilean";
-//#region src/domain/token-predicates.d.ts
-/** Everything needed to check candidate against parent, restated from tokens.ts's own NarrowingCandidate/checkNarrowing shape rather than requiring a full TokenClaims for the not-yet-minted child -- the same reasoning mintCapabilityToken's own checkNarrowing already applies (a delegation candidate has no token-id/issuer-key/bearer of its own yet). camelCase field names, matching NarrowingCandidate's own convention, deliberately distinct from TokenClaims' hyphenated wire field names. */
-interface NarrowingCandidate {
-  capability: TokenClaims["capability"];
-  scope: TokenClaims["scope"];
-  expires: number;
-  delegationsRemaining?: number;
-}
-/** A `conditions` entry's own generic evaluation context: no parent/candidate distinction, since a domain-specific condition (a message TTL, a future revoke-authorization check) reasons about the presented token's own claims directly, not a not-yet-minted delegation candidate. */
-interface ConditionsContext {
-  readonly clock: Clock;
-  readonly claims: Readonly<TokenClaims>;
-}
-/** One delegate system's own handler: given the delegate node's payload and the concrete context it was invoked with, resolves to a boolean-valued Resolution. Handlers never throw for a data-quality problem -- an op that cannot make sense of its own payload/context returns `{found: false}`, which the evaluator turns into a fail-closed `indeterminate`. */
-type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) => Resolution | Promise<Resolution>;
-//#endregion
-//#region src/domain/tokens.d.ts
-/**
- * The revocation view a verifier consults. Returns every recorded, already-signature-verified revocation-claims for tokenId, across every issuer that has ever submitted one -- unfiltered by the store itself. The actual verifier obligation (an entry counts against a token when its own issuer matches the token's own issuer, OR its optional `authorization` grants delegated revoke authority -- management.cddl) is checked by the caller (verifyTokenChain), not here, since that check needs the target token's own scope plus identity/clock to verify a nested authorization token, none of which a store constructed ahead of time has access to. Implementations ingest gossiped revocation-announce frames via verifyRevocationEntry (which enforces each entry's own signature and self-certification) and key the resulting claims by token-id alone -- a token-id can legitimately carry multiple recorded entries from different issuers.
- */
-interface RevocationCheck {
-  entriesFor: (tokenId: Uint8Array) => Promise<readonly RevocationClaims[]>;
-}
-type TokenVerdictReason = "malformed" | "bad_signature" | "wrong_issuer" | "bearer_mismatch" | "expired" | "not_yet_valid" | "content_expired" | "revoked" | "delegation_exceeds_parent" | "parent_invalid" |
-/** claims.conditions is present but its bstr fails CBOR decode, or decodes to something that is not a JSON array of valid trilean PredicateNodes -- fail-closed per CONVENTIONS.md's verifier-obligations glossary, the same treatment "malformed" already gives an undecodable payload. */
-"conditions_invalid" |
-/** claims.conditions decoded and validated, but at least one entry did not evaluate to a definite `true` (indeterminate or false) -- the issuer's own additional restriction was not met. */
-"conditions_not_satisfied";
-type TokenVerdict = {
-  ok: true;
-  claims: TokenClaims;
-  /** The device-id at the root of this token's delegation chain: its own issuer when it carries no parent, otherwise the root of its parent's chain. Lets a caller (e.g. core/room's obligation that a chain must terminate at the path's own owner, or the verifier itself for a DM) check the chain's root with one equality comparison instead of re-walking the parent chain a second time. */
-  rootIssuer: DeviceId;
-  /** The root ancestor's own self-certifying issuer-key -- already decoded during the walk (every TokenClaims carries its own issuer-key), just threaded up rather than re-derived. Lets a caller compute an ECDH shared secret against the chain's root (e.g. room.rekey's own sender, for a named room whose token chain terminates at the owner) without a separate, out-of-band way to learn that issuer's public key. */
-  rootIssuerKey: IdentityKey;
-  /** How many delegation hops this token is from its own root -- 0 for a root grant. Costs nothing extra once rootIssuer is being tracked, and makes the delegation bound observable for diagnostics. */
-  depth: number;
-} | {
-  ok: false;
-  reason: TokenVerdictReason;
-};
-interface VerifyCapabilityTokenOptions {
-  identity: IdentityPort;
-  clock: Clock;
-  revocation: RevocationCheck;
-  /** When given, the token must bear this device -- the caller presenting a token to authorise itself, not someone else. */
-  expectedBearer?: DeviceId;
-  /** Registers domain-specific delegate systems a presented token's own `conditions` entries may name, beyond the five mandatory narrowing ops (which are never reachable from `conditions` -- see evaluateConditions's own doc comment). None are registered by wire-mesh-core itself; a domain (a message TTL, #84's future revoke-authorization check) supplies its own here. A `conditions` entry naming a system absent from this map is indeterminate, and therefore fails the whole token -- fail-closed, not a silent no-op. */
-  extraPredicateResolvers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>;
-}
-/** RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD: ["Signature1", protected, external_aad, payload]. Exported (not just used internally by verifyTokenChain) so any other self-certifying COSE_Sign1 construction in this codebase -- e.g. threshold-subject.ts's own to-be-signed bytes for a FROST-signed capability-token/revocation-entry/handle-record/room-notice -- reuses this single construction rather than a second hand-rolled one. */
-declare function sig1ToBeSigned(protectedHeader: Uint8Array, payload: Uint8Array): Uint8Array;
-/**
- * Verifies one capability token per tokens.cddl's own documented rules: the token is a well-formed COSE_Sign1 whose signature actually verifies against its own embedded issuer-key, that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id -- no shared secret needed to check this), the token is currently valid (not expired, not before not-before, not revoked by its own issuer), and -- recursively -- any parent delegation narrows rather than widens across all three axes of authority: the parent's bearer must be this token's issuer (the delegation chain is unbroken), this token's expiry must not exceed its parent's, and this token's scope must narrow its parent's (same kind; equal-or-descendant path when the parent carries one) with an identical capability verb (the capability-verb grammar has no sub-verb relation, so a different verb is a different authority, not a narrower one). Undecodable payload bytes return "malformed" and undecodable parent bytes return "parent_invalid" -- hostile input produces a verdict, never a throw.
- */
-declare function verifyCapabilityToken(token: CapabilityToken, options: VerifyCapabilityTokenOptions): Promise<TokenVerdict>;
-type RevocationEntryVerdictReason = "malformed" | "bad_signature" | "wrong_issuer";
-type RevocationEntryVerdict = {
-  ok: true;
-  claims: RevocationClaims;
-} | {
-  ok: false;
-  reason: RevocationEntryVerdictReason;
-};
-interface VerifyRevocationEntryOptions {
-  /** Crypto primitives only -- any IdentityPort instance can verify any entry, since everything needed to check one travels inside the entry itself. */
-  identity: IdentityPort;
-}
-/**
- * Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
- */
-declare function verifyRevocationEntry(entry: RevocationEntry, options: VerifyRevocationEntryOptions): Promise<RevocationEntryVerdict>;
-type MintRefusalReason = "already_expired" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent";
-type MintVerdict = {
-  ok: true;
-  token: CapabilityToken;
-} | {
-  ok: false;
-  reason: MintRefusalReason;
-};
-/**
- * A pure query: could deviceId, presenting heldToken as its own delegation authority, successfully mint a delegation matching candidate right now -- without attempting (and potentially failing) a real mint just to find out. Reuses mintCapabilityToken's own narrowing arithmetic via checkNarrowing, so the two can never silently drift into different ideas of what "narrows" means.
- *
- * Deliberately narrower than a full mint attempt in one respect: this checks only the narrowing rules tokens.cddl's own delegation obligations require (bearer match, expiry, scope, capability, delegations-remaining), the same scope mintCapabilityToken itself checks a *parent* against -- it does not verify heldToken's own signature or revocation status, exactly as mintCapabilityToken never re-verifies its own parent's signature either. A caller that also needs heldToken's cryptographic validity confirmed calls verifyCapabilityToken separately.
- *
- * Async as of the predicate-list evaluator (issue #85): checkNarrowing now routes through trilean's own evaluatePredicate, which is asynchronous throughout -- there is no synchronous path through a real evaluator call, so this is a genuine, deliberate breaking change to what was previously a synchronous pure function. No existing consumer of wire-mesh-core calls canGrant (confirmed against agent-comms, the only other repo depending on this package), so there is nothing to migrate.
- */
-declare function canGrant(heldToken: CapabilityToken, deviceId: DeviceId, candidate: Readonly<NarrowingCandidate>, now: number): Promise<boolean>;
-interface MintCapabilityTokenOptions {
-  /** The issuer -- signs the token, and supplies the self-certifying issuer/issuer-key claims. */
-  identity: IdentityPort;
-  clock: Clock;
-  tokenId: Uint8Array<ArrayBuffer>;
-  bearer: DeviceId;
-  capability: TokenClaims["capability"];
-  scope: TokenClaims["scope"];
-  expires: number;
-  notBefore?: number;
-  /** How many further delegation hops the *resulting* token itself permits below it -- unrelated to, and never a bound on, whether `identity` may mint further tokens of its own at the root level for other bearers. Those are two different facts: a token minted with `delegationsRemaining: 0` genuinely cannot itself be re-delegated (correct -- e.g. a room owner's own self-signed root grant, which should never be handed onward), but that same `0` says nothing about the issuer's own separate, ordinary authority to mint additional independent root-level grants (naming no `parent` at all) for other bearers. Root-level minting for a second bearer is never blocked by any existing token's own `delegationsRemaining`, because it uses no `parent` in the first place -- there is no narrowing check to run. Confirmed live in agent-comms' own room-membership implementation (`ExaDev/agent-comms` PR #72): each member's own join/invite grant is minted as its own independent, parent-less, root-level token precisely because the room owner's `delegationsRemaining: 0` self-grant cannot parent anything -- correct by this same reasoning, not a workaround. */
-  delegationsRemaining?: number;
-  /** The issuer's own token, when this is a delegation rather than a root grant. Its claims are checked against every narrowing rule below -- mint refuses rather than producing a token verifyCapabilityToken would reject anyway. Omit entirely for a root-level grant (including a second, independent root-level grant for a different bearer under the same capability/scope this issuer already grants elsewhere) -- there is no bound on how many such root grants an issuer may mint, since none of them narrows any other. */
-  parent?: CapabilityToken;
-  /** Additional, issuer-chosen restrictions beyond the five mandatory narrowing checks (issue #85) -- CBOR-encoded into claims.conditions verbatim, evaluated by every verifier via evaluateConditions. Strictly additive: has no bearing on narrowing, which mint enforces separately above regardless of what's given here. Not re-validated against trilean's own schema before encoding -- the TS type already guarantees a well-formed PredicateNode[] at this call site, unlike the bytes a verifier decodes from an untrusted wire token, which always are. */
-  conditions?: PredicateNode[];
-}
-/**
- * Mints one capability token: builds token-claims from the given fields, signs it as a COSE_Sign1 under `identity`'s own key, with a protected header matching what the frozen conformance vectors actually encode (`{1: alg, 4: issuer device-id}`, not the empty header a token merely needs to verify against itself).
- *
- * When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
- */
-declare function mintCapabilityToken(options: MintCapabilityTokenOptions): Promise<MintVerdict>;
-interface MintRevocationEntryOptions {
-  /** The token's own issuer -- only a token's own issuer may revoke it (management.cddl), so this must be the same identity that minted the token being revoked. */
-  identity: IdentityPort;
-  tokenId: Uint8Array<ArrayBuffer>;
-  revokedAt: number;
-}
-/** Mints one revocation-entry (management.cddl): a COSE_Sign1 over revocation-claims, signed the same way mintCapabilityToken signs a token. No narrowing chain to check -- a revocation entry has no parent and cannot fail to be issuable the way a delegated token can, so this returns the entry directly rather than a verdict. */
-declare function mintRevocationEntry(options: MintRevocationEntryOptions): Promise<RevocationEntry>;
-//#endregion
-export { verifyRevocationEntry as _, RevocationCheck as a, TokenVerdict as c, VerifyRevocationEntryOptions as d, canGrant as f, verifyCapabilityToken as g, sig1ToBeSigned as h, MintVerdict as i, TokenVerdictReason as l, mintRevocationEntry as m, MintRefusalReason as n, RevocationEntryVerdict as o, mintCapabilityToken as p, MintRevocationEntryOptions as r, RevocationEntryVerdictReason as s, MintCapabilityTokenOptions as t, VerifyCapabilityTokenOptions as u };