wire-mesh-core 3.8.0 → 3.10.0

package/dist/adapters/byte-stream-connection.d.cts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { N as Frame } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/byte-stream-connection.d.mts

@@ -1,5 +1,5 @@
-import { N as Frame } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { N as Frame } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/byte-stream-connection.d.ts
 /** The largest frame body a peer may announce in a length prefix, matching the 100 MiB the `ws` package applies to one message on the same hub, so a WebSocket peer and a byte-stream peer are bounded alike. Without a bound a peer-controlled 4 GiB prefix makes the reader buffer until memory runs out. */
 export declare const MAX_FRAME_BYTES: number;

package/dist/adapters/frame-codec.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.cjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/frame-codec.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, N as Frame, ht as RelayDataFrame } from "../protocol-DzmpxxUr.mjs";
 //#region src/adapters/frame-codec.d.ts
 export declare function messageFromFrame(frame: Frame): Uint8Array<ArrayBuffer>;
 /** Wraps frame as a relay-data-frame's own opaque payload, stamping to-device when the caller knows which established pairing to address it to (wire-mesh#30) -- the outbound counterpart to tryDecodeFrame's own doc comment below, which describes the inbound side of the same relay-data envelope. Omitting toDevice leaves the frame unaddressed, which the receiving hub then routes via its own most-recently-established-pairing fallback. */

package/dist/adapters/node-identity.d.cts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/node-identity.d.mts

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { B as IdentityKey, D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { webcrypto } from "node:crypto";
 //#region src/adapters/node-identity.d.ts
 export declare function deriveDeviceId(publicKey: Uint8Array): Promise<DeviceId>;

package/dist/adapters/tcp-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DP3hdehk.cjs";
+import { r as Transport } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/tcp-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Dv_LTCsF.mjs";
+import { r as Transport } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/tcp-transport.d.ts
 /** A Node net.Socket-based Transport: length-prefixed, CBOR-encoded frames over plain TCP -- matching Cascade's own transport shape, since interop with Cascade nodes is wire-mesh's stated goal. Framing (not TLS) is this adapter's own concern; a TLS-terminated variant is a separate adapter behind the same Transport contract. */
 export declare function createTcpTransport(): Transport;

package/dist/adapters/threshold-identity.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { DeviceKeyed } from "./threshold-wasm.cjs";
 import { ThresholdSubject } from "../domain/threshold-subject.cjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-identity.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { DeviceKeyed } from "./threshold-wasm.mjs";
 import { ThresholdSubject } from "../domain/threshold-subject.mjs";
 //#region src/adapters/threshold-identity.d.ts

package/dist/adapters/threshold-wasm.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/threshold-wasm.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
 //#region src/adapters/threshold-wasm.d.ts
 /** One `(deviceId, bytes)` pair -- the wasm boundary's own encoding of a map keyed by participant, since wasm-bindgen has no built-in `Map<Uint8Array, Uint8Array>` marshalling. */
 export interface DeviceKeyed<T extends Uint8Array = Uint8Array<ArrayBuffer>> {

package/dist/adapters/tls-transport.d.cts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-DP3hdehk.cjs";
+import { r as Transport } from "../transport-gDbSHO-r.cjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/adapters/tls-transport.d.mts

@@ -1,4 +1,4 @@
-import { r as Transport } from "../transport-Dv_LTCsF.mjs";
+import { r as Transport } from "../transport-bD3p_TO_.mjs";
 //#region src/adapters/tls-transport.d.ts
 export interface TlsIdentity {
   certificatePem: string;

package/dist/domain/advert-extension-policy.d.cts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/advert-extension-policy.d.mts

@@ -1,4 +1,4 @@
-import { et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/advert-extension-policy.d.ts
 /** Whether one extension entry's value is one the hub will carry. Must be strict: a value with a field the validator did not expect is refused, since the point is that nothing unexpected is published. */
 export type ExtensionValidator = (value: unknown) => boolean;

package/dist/domain/bulk.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { t as Connection } from "../transport-DP3hdehk.cjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { t as Connection } from "../transport-gDbSHO-r.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/bulk.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { D as DeviceId, N as Frame, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { t as Connection } from "../transport-bD3p_TO_.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/bulk.d.ts

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.
@@ -49,7 +49,7 @@ function createCapabilityGrantHandler(options) {
 			return;
 		}
 		const grantedToken = parsed.data["granted-token"];
-		const verdict = await require_tokens.verifyCapabilityToken(grantedToken, {
+		const verdict = await require_domain_tokens.verifyCapabilityToken(grantedToken, {
 			identity: options.identity,
 			clock: options.clock,
 			revocation: options.revocation,
@@ -69,7 +69,7 @@ function createCapabilityGrantHandler(options) {
 			});
 			return;
 		}
-		if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
+		if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
 			await incoming.respond({
 				result: "error",
 				code: "scope_mismatch"

package/dist/domain/capability-grant.d.cts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -1,8 +1,8 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -31,6 +31,17 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
@@ -38,7 +49,7 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 */
 async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
 	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = require_generated_protocol.capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
@@ -52,7 +63,7 @@ async function checkRequestPermission(incoming, options) {
 		code: "token_required"
 	};
 	if (options.revocation === void 0) throw new Error("requireRequestToken needs a revocation view on the handler options");
-	const verdict = await require_tokens.verifyCapabilityToken(incoming.token, {
+	const verdict = await require_domain_tokens.verifyCapabilityToken(incoming.token, {
 		identity: options.identity,
 		clock: options.clock,
 		revocation: options.revocation,
@@ -72,7 +83,7 @@ async function checkRequestPermission(incoming, options) {
 		ok: false,
 		code: "capability_mismatch"
 	};
-	if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) return {
+	if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) return {
 		ok: false,
 		code: "scope_mismatch"
 	};
@@ -136,7 +147,7 @@ function createCapabilityRequestHandler(options) {
 					});
 					return;
 				}
-				const verdict = await require_tokens.mintCapabilityToken({
+				const verdict = await require_domain_tokens.mintCapabilityToken({
 					identity: options.identity,
 					clock: options.clock,
 					tokenId: randomTokenId(),
@@ -164,6 +175,7 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
+exports.CapabilityRequestRefusedError = CapabilityRequestRefusedError;
 exports.MANAGE_REQUEST_CAPABILITY = MANAGE_REQUEST_CAPABILITY;
 exports.buildCapabilityRequestCommand = buildCapabilityRequestCommand;
 exports.createCapabilityRequestHandler = createCapabilityRequestHandler;

package/dist/domain/capability-request.d.cts

@@ -1,13 +1,20 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
-import { b as ConditionsContext, o as RevocationCheck, x as TokenDelegateHandler } from "../tokens-BMWCnQEF.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-D4NNPLnp.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *

package/dist/domain/capability-request.d.mts

@@ -1,13 +1,20 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken, u as CapabilityGrantOk } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
-import { b as ConditionsContext, o as RevocationCheck, x as TokenDelegateHandler } from "../tokens-DRkm_QOR.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqpG8VZZ.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *

package/dist/domain/capability-request.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { i as mintCapabilityToken, s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { mintCapabilityToken, verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -30,6 +30,17 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
@@ -37,7 +48,7 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 */
 async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
 	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
@@ -163,4 +174,4 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
-export { MANAGE_REQUEST_CAPABILITY, buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };
+export { CapabilityRequestRefusedError, MANAGE_REQUEST_CAPABILITY, buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };

package/dist/domain/coordinator-election.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/coordinator-election.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, g as CoordinatorFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, g as CoordinatorFrame } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/coordinator-election.d.ts
 /** The claim this side currently accepts: one coordinator, at the term that put it there. */
 export interface CoordinatorClaim {

package/dist/domain/data-sync.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/data-sync.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, E as DataRequestFrame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 //#region src/domain/data-sync.d.ts
 export interface DataSyncOptions {
   identity: IdentityPort;

package/dist/domain/device-id.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/device-id.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/device-id.d.ts
 /** Lowercase, byte-exact hex for an arbitrary-length byte string -- the same encoding convention deviceIdToHex uses for the fixed-length device-id case, extracted so any other byte string needing a stable, displayable, map-keyable text form (e.g. a token-id, which tokens.cddl defines as an arbitrary-length bstr rather than a 32-byte device-id) can use the identical convention without going through a device-id-shaped function. */
 export declare function bytesToHex(bytes: Uint8Array): string;

package/dist/domain/direct-manage-request.d.cts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.cjs";
-import { r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
+import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.cjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/direct-manage-request.d.mts

@@ -1,5 +1,5 @@
-import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-BgR1e_NI.mjs";
-import { r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
+import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
 import { IncomingManageRequest, ManageOutcome } from "./mesh-session.mjs";
 //#region src/domain/direct-manage-request.d.ts
 /** Reads exactly one frame off a freshly-accepted, bare connection and, if it's a manage-request, returns an IncomingManageRequest ready to hand to the same application-level dispatch logic session.incomingManageRequests already feeds elsewhere -- no handshake or gossip is ever read or sent on this connection (wire-mesh#38: the manage-request/manage-response exchange has no dependency on handshake state at the dispatch layer, confirmed against mesh-session.ts's own applyManageRequest/applyFrame). respond() sends the manage-response directly and closes the connection, since a one-off request/response is this connection's entire purpose -- unlike a real MeshSession, there is nothing further to do with it afterwards. Resolves null, without closing the connection (that's the caller's call), for any other first frame or if the connection ends before one arrives: interpreting either case is a Transport.listen() caller's own business, e.g. peeking the first frame to route between this path and acceptMeshSession's own handshake path. */

package/dist/domain/gossip-expansion.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
 import { MeshSession } from "./mesh-session.cjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/gossip-expansion.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, et as PeerAdvert } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
 import { MeshSession } from "./mesh-session.mjs";
 //#region src/domain/gossip-expansion.d.ts
 /** One not-yet-considered device this session's gossip directory has surfaced, carrying only what a dial/trust decision needs: the device-id to decide identity, and the "host:port" addresses its own peer-advert claims are directly reachable at, in the order it advertised them. */

package/dist/domain/grant-candidates.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 let zod = require("zod");
 //#region src/domain/grant-candidates.ts
 /**
@@ -38,7 +38,7 @@ function findGrantCandidate(directory, capability, scope) {
 			if (candidate.capability !== capability) continue;
 			const remaining = candidate["delegations-remaining"];
 			if (remaining !== void 0 && remaining <= 0) continue;
-			if (require_token_scope.scopeNarrows(candidate.scope, scope)) return entry.device;
+			if (require_domain_token_scope.scopeNarrows(candidate.scope, scope)) return entry.device;
 		}
 	}
 }

package/dist/domain/grant-candidates.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DzmpxxUr.cjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.cjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, f as CapabilityScope } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, f as CapabilityScope } from "../protocol-DzmpxxUr.mjs";
 import { DirectoryEntry, MeshSession } from "./mesh-session.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.d.ts

package/dist/domain/grant-candidates.mjs

@@ -1,5 +1,5 @@
 import { capabilityScopeSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.ts
 /**

package/dist/domain/handshake.d.cts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-BgR1e_NI.cjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DzmpxxUr.cjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/handshake.d.mts

@@ -1,4 +1,4 @@
-import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-BgR1e_NI.mjs";
+import { A as DomainId, R as HandshakeFrame, lt as ProtocolVersion } from "../protocol-DzmpxxUr.mjs";
 //#region src/domain/handshake.d.ts
 /** The highest protocol version this build of core understands. */
 export declare const SUPPORTED_PROTOCOL_VERSION: ProtocolVersion;

package/dist/domain/hub-mailbox.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/hub-mailbox.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 //#region src/domain/hub-mailbox.d.ts
 export interface MailboxLimits {

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
@@ -101,7 +101,7 @@ async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
 	try {
 		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
+		if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
 			ok: false,
 			reason: "wrong_recipient"
 		};

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.cjs";
-import { r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
+import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
-import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-BgR1e_NI.mjs";
-import { r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
+import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */