wire-mesh-core 3.8.0 → 3.10.0

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
-import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.mjs";
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-7zD4ib-A.mjs";
+import { RevocationCheck } from "./tokens.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/shard-manifest.d.cts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.cjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.cjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.cjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/shard-manifest.d.mts

@@ -1,4 +1,4 @@
-import { D as DeviceId } from "../protocol-BgR1e_NI.mjs";
+import { D as DeviceId } from "../protocol-DzmpxxUr.mjs";
 import { PresentedShard, ShardConfig } from "./erasure-coding.mjs";
 //#region src/domain/shard-manifest.d.ts
 /** The content-type a core/data entry carrying a shard manifest declares. */

package/dist/domain/threshold-subject.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.
@@ -27,7 +27,7 @@ function refuseUnrecognisedKind(subject, known = KNOWN_KINDS) {
 * Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
 */
 function toBeSigned(subject) {
-	return Uint8Array.from(require_tokens.sig1ToBeSigned(subject.protected, subject.payload));
+	return Uint8Array.from(require_domain_tokens.sig1ToBeSigned(subject.protected, subject.payload));
 }
 //#endregion
 exports.KNOWN_KINDS = KNOWN_KINDS;

package/dist/domain/threshold-subject.mjs

@@ -1,4 +1,4 @@
-import { o as sig1ToBeSigned } from "../tokens-D8JlTJNA.mjs";
+import { sig1ToBeSigned } from "./tokens.mjs";
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.

package/dist/domain/token-predicates.cjs

@@ -0,0 +1,184 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_domain_device_id = require("./device-id.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+let zod = require("zod");
+let trilean = require("trilean");
+//#region src/domain/token-predicates.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+const conditionsListSchema = zod.z.array(trilean.PredicateNodeSchema);
+/**
+* tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+*/
+const BEARER_IS = "bearer-is";
+const EXPIRES_AT = "expires-at";
+const SCOPE_NARROWS = "scope-narrows";
+const CAPABILITY_IS = "capability-is";
+const DEPTH_REMAINING = "depth-remaining";
+const NARROWING_SYSTEMS = [
+	BEARER_IS,
+	EXPIRES_AT,
+	SCOPE_NARROWS,
+	CAPABILITY_IS,
+	DEPTH_REMAINING
+];
+function isNarrowingSystem(system) {
+	return system === "bearer-is" || system === "expires-at" || system === "scope-narrows" || system === "capability-is" || system === "depth-remaining";
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+const GRANTEE_IS = "grantee-is";
+const GRANTED_CAPABILITY_IS = "granted-capability-is";
+function isSubjectSystem(system) {
+	return system === "grantee-is" || system === "granted-capability-is";
+}
+const subjectHandlers = {
+	[GRANTEE_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(require_domain_device_id.deviceIdToHex(context.subject.bearer) === payload);
+	},
+	[GRANTED_CAPABILITY_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(context.subject.capability === payload);
+	}
+};
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+function noSelfGrantBar(capability, bearer) {
+	return {
+		kind: "not",
+		operand: {
+			kind: "and",
+			left: delegateIsTrue(GRANTED_CAPABILITY_IS, capability),
+			right: delegateIsTrue(GRANTEE_IS, require_domain_device_id.deviceIdToHex(bearer))
+		}
+	};
+}
+function booleanFound(value) {
+	return {
+		found: true,
+		value: {
+			kind: "boolean",
+			value
+		}
+	};
+}
+/** The five mandatory narrowing ops, each reading only from TokenPredicateContext -- never the delegate node's own payload, since every fact each op needs (which parent, which candidate) already travels via the context the caller constructs per evaluation, not via wire-encoded payload data. A context with no parentClaims (narrowing is being checked with nothing to narrow against) resolves every op to `false` rather than throwing -- fail-closed, matching how an indeterminate result already refuses a token. */
+const narrowingHandlers = {
+	[BEARER_IS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(require_domain_token_scope.bytesEqual(context.parentClaims.bearer, context.childIssuer));
+	},
+	[EXPIRES_AT]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(context.candidate.expires <= context.parentClaims.expires);
+	},
+	[SCOPE_NARROWS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(require_domain_token_scope.scopeNarrows(context.parentClaims.scope, context.candidate.scope));
+	},
+	[CAPABILITY_IS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(context.parentClaims.capability === context.candidate.capability);
+	},
+	[DEPTH_REMAINING]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		const parentRemaining = context.parentClaims["delegations-remaining"];
+		if (parentRemaining === void 0) return booleanFound(true);
+		return booleanFound(context.candidate.delegationsRemaining !== void 0 && context.candidate.delegationsRemaining < parentRemaining);
+	}
+};
+/** `{kind:"compare", op:"eq", left:{kind:"delegate", system, payload}, right:{kind:"booleanLiteral", value:true}}` -- delegate is an ExpressionNode, not itself a PredicateNode (trilean's PredicateNodeSchema has no `delegate` member), so every predicate op is expressed this way: resolve the delegate to a boolean ComputedValue, then compare it against the literal `true`. The narrowing checks pass no payload (every fact they need arrives via context); the subject-mode systems take their comparison value as the payload. */
+function delegateIsTrue(system, payload = null) {
+	return {
+		kind: "compare",
+		op: "eq",
+		left: {
+			kind: "delegate",
+			system,
+			payload
+		},
+		right: {
+			kind: "booleanLiteral",
+			value: true
+		}
+	};
+}
+/** trilean's three required resolvers are never exercised by any node this module constructs (narrowing/conditions nodes are built entirely from `compare`+`delegate`+`booleanLiteral`, never `reference`/`lookup`/`fold`/`some`/`every`) -- these stubs exist only because `Resolvers` requires them structurally. */
+const unusedResolveValue = async () => Promise.resolve({ found: false });
+const unusedResolveLookup = async () => Promise.resolve({ found: false });
+const unusedResolveCollection = async () => Promise.resolve([]);
+/**
+* Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+*/
+async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
+	const context = {
+		childIssuer,
+		candidate,
+		parentClaims
+	};
+	const resolvers = {
+		resolveValue: unusedResolveValue,
+		resolveLookup: unusedResolveLookup,
+		resolveCollection: unusedResolveCollection,
+		resolveDelegate: async (system, payload) => {
+			if (!isNarrowingSystem(system)) return { found: false };
+			return narrowingHandlers[system](payload, context);
+		}
+	};
+	for (const system of NARROWING_SYSTEMS) {
+		const result = await (0, trilean.evaluatePredicate)(delegateIsTrue(system), context, resolvers);
+		if (result.status !== "definite" || !result.value) return system;
+	}
+}
+/**
+* Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+*/
+async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subject) {
+	const context = subject === void 0 ? {
+		clock,
+		claims
+	} : {
+		clock,
+		claims,
+		subject
+	};
+	const resolvers = {
+		resolveValue: unusedResolveValue,
+		resolveLookup: unusedResolveLookup,
+		resolveCollection: unusedResolveCollection,
+		resolveDelegate: async (system, payload) => {
+			if (subject !== void 0 && isSubjectSystem(system)) try {
+				return await subjectHandlers[system](payload, context);
+			} catch {
+				return { found: false };
+			}
+			const handler = Object.hasOwn(extraHandlers, system) ? extraHandlers[system] : void 0;
+			if (handler === void 0) return { found: false };
+			try {
+				return await handler(payload, context);
+			} catch {
+				return { found: false };
+			}
+		}
+	};
+	for (const node of nodes) {
+		const result = await (0, trilean.evaluatePredicate)(node, context, resolvers);
+		if (result.status !== "definite" || !result.value) return {
+			ok: false,
+			reason: "not_satisfied"
+		};
+	}
+	return { ok: true };
+}
+//#endregion
+exports.BEARER_IS = BEARER_IS;
+exports.CAPABILITY_IS = CAPABILITY_IS;
+exports.DEPTH_REMAINING = DEPTH_REMAINING;
+exports.EXPIRES_AT = EXPIRES_AT;
+exports.GRANTED_CAPABILITY_IS = GRANTED_CAPABILITY_IS;
+exports.GRANTEE_IS = GRANTEE_IS;
+exports.SCOPE_NARROWS = SCOPE_NARROWS;
+exports.conditionsListSchema = conditionsListSchema;
+exports.evaluateConditions = evaluateConditions;
+exports.evaluateNarrowing = evaluateNarrowing;
+exports.noSelfGrantBar = noSelfGrantBar;

package/dist/domain/token-predicates.d.cts

@@ -0,0 +1,2 @@
+import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-D4NNPLnp.cjs";
+export { BEARER_IS, CAPABILITY_IS, ConditionsContext, ConditionsVerdict, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, GrantSubject, NarrowingCandidate, NarrowingSystem, SCOPE_NARROWS, SubjectSystem, TokenDelegateHandler, TokenPredicateContext, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/domain/token-predicates.d.mts

@@ -0,0 +1,2 @@
+import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-DqpG8VZZ.mjs";
+export { BEARER_IS, CAPABILITY_IS, ConditionsContext, ConditionsVerdict, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, GrantSubject, NarrowingCandidate, NarrowingSystem, SCOPE_NARROWS, SubjectSystem, TokenDelegateHandler, TokenPredicateContext, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/domain/token-predicates.mjs

@@ -0,0 +1,173 @@
+import { deviceIdToHex } from "./device-id.mjs";
+import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
+import { z } from "zod";
+import { PredicateNodeSchema, evaluatePredicate } from "trilean";
+//#region src/domain/token-predicates.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+const conditionsListSchema = z.array(PredicateNodeSchema);
+/**
+* tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+*/
+const BEARER_IS = "bearer-is";
+const EXPIRES_AT = "expires-at";
+const SCOPE_NARROWS = "scope-narrows";
+const CAPABILITY_IS = "capability-is";
+const DEPTH_REMAINING = "depth-remaining";
+const NARROWING_SYSTEMS = [
+	BEARER_IS,
+	EXPIRES_AT,
+	SCOPE_NARROWS,
+	CAPABILITY_IS,
+	DEPTH_REMAINING
+];
+function isNarrowingSystem(system) {
+	return system === "bearer-is" || system === "expires-at" || system === "scope-narrows" || system === "capability-is" || system === "depth-remaining";
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+const GRANTEE_IS = "grantee-is";
+const GRANTED_CAPABILITY_IS = "granted-capability-is";
+function isSubjectSystem(system) {
+	return system === "grantee-is" || system === "granted-capability-is";
+}
+const subjectHandlers = {
+	[GRANTEE_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(deviceIdToHex(context.subject.bearer) === payload);
+	},
+	[GRANTED_CAPABILITY_IS]: (payload, context) => {
+		if (context.subject === void 0) return { found: false };
+		if (typeof payload !== "string") return { found: false };
+		return booleanFound(context.subject.capability === payload);
+	}
+};
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+function noSelfGrantBar(capability, bearer) {
+	return {
+		kind: "not",
+		operand: {
+			kind: "and",
+			left: delegateIsTrue(GRANTED_CAPABILITY_IS, capability),
+			right: delegateIsTrue(GRANTEE_IS, deviceIdToHex(bearer))
+		}
+	};
+}
+function booleanFound(value) {
+	return {
+		found: true,
+		value: {
+			kind: "boolean",
+			value
+		}
+	};
+}
+/** The five mandatory narrowing ops, each reading only from TokenPredicateContext -- never the delegate node's own payload, since every fact each op needs (which parent, which candidate) already travels via the context the caller constructs per evaluation, not via wire-encoded payload data. A context with no parentClaims (narrowing is being checked with nothing to narrow against) resolves every op to `false` rather than throwing -- fail-closed, matching how an indeterminate result already refuses a token. */
+const narrowingHandlers = {
+	[BEARER_IS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(bytesEqual(context.parentClaims.bearer, context.childIssuer));
+	},
+	[EXPIRES_AT]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(context.candidate.expires <= context.parentClaims.expires);
+	},
+	[SCOPE_NARROWS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(scopeNarrows(context.parentClaims.scope, context.candidate.scope));
+	},
+	[CAPABILITY_IS]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		return booleanFound(context.parentClaims.capability === context.candidate.capability);
+	},
+	[DEPTH_REMAINING]: (_payload, context) => {
+		if (context.parentClaims === void 0) return booleanFound(false);
+		const parentRemaining = context.parentClaims["delegations-remaining"];
+		if (parentRemaining === void 0) return booleanFound(true);
+		return booleanFound(context.candidate.delegationsRemaining !== void 0 && context.candidate.delegationsRemaining < parentRemaining);
+	}
+};
+/** `{kind:"compare", op:"eq", left:{kind:"delegate", system, payload}, right:{kind:"booleanLiteral", value:true}}` -- delegate is an ExpressionNode, not itself a PredicateNode (trilean's PredicateNodeSchema has no `delegate` member), so every predicate op is expressed this way: resolve the delegate to a boolean ComputedValue, then compare it against the literal `true`. The narrowing checks pass no payload (every fact they need arrives via context); the subject-mode systems take their comparison value as the payload. */
+function delegateIsTrue(system, payload = null) {
+	return {
+		kind: "compare",
+		op: "eq",
+		left: {
+			kind: "delegate",
+			system,
+			payload
+		},
+		right: {
+			kind: "booleanLiteral",
+			value: true
+		}
+	};
+}
+/** trilean's three required resolvers are never exercised by any node this module constructs (narrowing/conditions nodes are built entirely from `compare`+`delegate`+`booleanLiteral`, never `reference`/`lookup`/`fold`/`some`/`every`) -- these stubs exist only because `Resolvers` requires them structurally. */
+const unusedResolveValue = async () => Promise.resolve({ found: false });
+const unusedResolveLookup = async () => Promise.resolve({ found: false });
+const unusedResolveCollection = async () => Promise.resolve([]);
+/**
+* Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+*/
+async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
+	const context = {
+		childIssuer,
+		candidate,
+		parentClaims
+	};
+	const resolvers = {
+		resolveValue: unusedResolveValue,
+		resolveLookup: unusedResolveLookup,
+		resolveCollection: unusedResolveCollection,
+		resolveDelegate: async (system, payload) => {
+			if (!isNarrowingSystem(system)) return { found: false };
+			return narrowingHandlers[system](payload, context);
+		}
+	};
+	for (const system of NARROWING_SYSTEMS) {
+		const result = await evaluatePredicate(delegateIsTrue(system), context, resolvers);
+		if (result.status !== "definite" || !result.value) return system;
+	}
+}
+/**
+* Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+*/
+async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subject) {
+	const context = subject === void 0 ? {
+		clock,
+		claims
+	} : {
+		clock,
+		claims,
+		subject
+	};
+	const resolvers = {
+		resolveValue: unusedResolveValue,
+		resolveLookup: unusedResolveLookup,
+		resolveCollection: unusedResolveCollection,
+		resolveDelegate: async (system, payload) => {
+			if (subject !== void 0 && isSubjectSystem(system)) try {
+				return await subjectHandlers[system](payload, context);
+			} catch {
+				return { found: false };
+			}
+			const handler = Object.hasOwn(extraHandlers, system) ? extraHandlers[system] : void 0;
+			if (handler === void 0) return { found: false };
+			try {
+				return await handler(payload, context);
+			} catch {
+				return { found: false };
+			}
+		}
+	};
+	for (const node of nodes) {
+		const result = await evaluatePredicate(node, context, resolvers);
+		if (result.status !== "definite" || !result.value) return {
+			ok: false,
+			reason: "not_satisfied"
+		};
+	}
+	return { ok: true };
+}
+//#endregion
+export { BEARER_IS, CAPABILITY_IS, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, SCOPE_NARROWS, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/{token-scope-CxHXTT3u.cjs → domain/token-scope.cjs}

@@ -1,3 +1,4 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 //#region src/domain/token-scope.ts
 /**
 * Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
@@ -29,15 +30,5 @@ function scopeNarrows(parent, child) {
 	return pathNarrows(child.path, parent.path);
 }
 //#endregion
-Object.defineProperty(exports, "bytesEqual", {
-	enumerable: true,
-	get: function() {
-		return bytesEqual;
-	}
-});
-Object.defineProperty(exports, "scopeNarrows", {
-	enumerable: true,
-	get: function() {
-		return scopeNarrows;
-	}
-});
+exports.bytesEqual = bytesEqual;
+exports.scopeNarrows = scopeNarrows;

package/dist/domain/token-scope.d.cts

@@ -0,0 +1,11 @@
+import { en as TokenClaims } from "../protocol-DzmpxxUr.cjs";
+//#region src/domain/token-scope.d.ts
+/**
+ * Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
+ */
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
+ */
+export declare function scopeNarrows(parent: TokenClaims["scope"], child: TokenClaims["scope"]): boolean;
+//#endregion

package/dist/domain/token-scope.d.mts

@@ -0,0 +1,11 @@
+import { en as TokenClaims } from "../protocol-DzmpxxUr.mjs";
+//#region src/domain/token-scope.d.ts
+/**
+ * Extracted out of tokens.ts specifically so token-predicates.ts (the generic evaluator's own delegate handlers) and tokens.ts (the chain walk, and its re-export for capability-grant.ts) can both depend on this pure, no-domain-imports module without creating an import cycle between the two -- tokens.ts imports evaluateNarrowing from token-predicates.ts, and token-predicates.ts's own scope-narrows/bearer-is handlers need these exact comparisons, so neither of those two files may import the other.
+ */
+export declare function bytesEqual(a: Uint8Array, b: Uint8Array): boolean;
+/**
+ * True when childScope narrows parentScope per tokens.cddl ("each hop can only narrow authority, never widen it"): the kind must be identical (a different kind is a different kind of authority, not a narrower one), and a parent with a path requires the child to carry an equal-or-descendant path -- an absent child path means the kind's whole-scope root, which is wider than any path-narrowed parent. A parent with no path (whole-scope root) lets any child path under the same kind through. Exported for capability-grant.ts's own obligation 4 (an unsolicited push's embedded token must equal-or-root the enclosing request's own scope), which is exactly this same narrowing relation applied outside a delegation chain, and for token-predicates.ts's own `scope-narrows` delegate handler.
+ */
+export declare function scopeNarrows(parent: TokenClaims["scope"], child: TokenClaims["scope"]): boolean;
+//#endregion

package/dist/{token-scope-Z4bmci4M.mjs → domain/token-scope.mjs}

@@ -29,4 +29,4 @@ function scopeNarrows(parent, child) {
 	return pathNarrows(child.path, parent.path);
 }
 //#endregion
-export { scopeNarrows as n, bytesEqual as t };
+export { bytesEqual, scopeNarrows };