wire-mesh-core 3.8.0 → 3.10.0

package/dist/domain/webrtc-signaling.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";
@@ -86,7 +86,7 @@ function createNegotiationIdAllocator() {
 /** True when an incoming offer's own token authorizes webrtc:signal against this node's scope: verifyCapabilityToken checks the token's own internal validity and delegation chain; the capability/scope match against what is actually being invoked here is this caller's own responsibility, same as any other domain's request handler. expectedBearer is deliberately not checked: neither a browser client's MeshSession nor an SFU's own connection handling exposes a way to learn a peer's device-id independently of the token itself, unlike a scope with a path that constrains a specific resource. */
 async function authorizeIncomingOffer(incoming, options) {
 	if (incoming.token === void 0) return false;
-	const verdict = await require_tokens.verifyCapabilityToken(incoming.token, options);
+	const verdict = await require_domain_tokens.verifyCapabilityToken(incoming.token, options);
 	if (!verdict.ok) return false;
 	return verdict.claims.capability === "webrtc:signal" && verdict.claims.scope.kind === WEBRTC_SIGNAL_SCOPE.kind;
 }

package/dist/domain/webrtc-signaling.d.cts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.cjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DzmpxxUr.cjs";
 import { IncomingManageRequest } from "./mesh-session.cjs";
-import { d as VerifyCapabilityTokenOptions } from "../tokens-BMWCnQEF.cjs";
+import { VerifyCapabilityTokenOptions } from "./tokens.cjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.d.mts

@@ -1,6 +1,6 @@
-import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-BgR1e_NI.mjs";
+import { H as ManageCommandParams, Lt as SfuTrackEntry, Rt as SfuTrackMap, V as ManageCommand, an as WebrtcAnswer, f as CapabilityScope, on as WebrtcIceCandidate, sn as WebrtcOffer, z as IceCandidateInit } from "../protocol-DzmpxxUr.mjs";
 import { IncomingManageRequest } from "./mesh-session.mjs";
-import { d as VerifyCapabilityTokenOptions } from "../tokens-DRkm_QOR.mjs";
+import { VerifyCapabilityTokenOptions } from "./tokens.mjs";
 //#region src/domain/webrtc-signaling.d.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 export declare const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/domain/webrtc-signaling.mjs

@@ -1,4 +1,4 @@
-import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/webrtc-signaling.ts
 /** The one capability verb gating every core/webrtc message shape: an authority over this node's own signaling as a whole, not three separate resources, mirroring how core/exec's exec:pty gates all of its own inner verbs. webrtc.sfu-track-map is gated by this same verb (see spec/webrtc.cddl's own comment): an SFU able to shape a negotiation can already misreport whose media is on which mid, so a separate capability over the track-map itself would guard nothing a client doesn't already have to trust the SFU for. */
 const WEBRTC_SIGNAL_VERB = "webrtc:signal";

package/dist/generated/protocol.cjs

@@ -522,7 +522,8 @@ const relayOfferFrameSchema = zod.z.lazy(() => zod.z.object({
 }));
 const relayConnectFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("relay-connect"),
-	"target-device": zod.z.lazy(() => deviceIdSchema)
+	"target-device": zod.z.lazy(() => deviceIdSchema),
+	"source-device": zod.z.lazy(() => deviceIdSchema).optional()
 }));
 const relayDataFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("relay-data"),
@@ -532,7 +533,8 @@ const relayDataFrameSchema = zod.z.lazy(() => zod.z.object({
 }));
 const relayInboundFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("relay-inbound"),
-	"source-device": zod.z.lazy(() => deviceIdSchema)
+	"source-device": zod.z.lazy(() => deviceIdSchema),
+	"target-device": zod.z.lazy(() => deviceIdSchema).optional()
 }));
 const coordinatorFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("coordinator"),

package/dist/generated/protocol.d.cts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.cjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DzmpxxUr.cjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.d.mts

@@ -1,2 +1,2 @@
-import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-BgR1e_NI.mjs";
+import { $ as PathTraceOk, $n as manageRequestFrameSchema, $r as thresholdCommitSchema, $t as ThresholdSubject, A as DomainId, An as coseSign1Schema, Ar as roomJoinOkSchema, At as RoomPath, B as IdentityKey, Bn as execSessionInfoSchema, Br as roomRekeySchema, Bt as StreamDataFrame, C as CoseTokenHeaders, Cn as closeFrameSchema, Cr as relayDataFrameSchema, Ct as RoomJoinOk, D as DeviceId, Dn as coseHeaderAlgSchema, Dr as revocationClaimsSchema, Dt as RoomMembersOk, E as DataRequestFrame, En as coreDomainNameSchema, Er as revocationAnnounceFrameSchema, Et as RoomMembers, F as GossipFrame, Fn as deviceIdHexSchema, Fr as roomMembersSchema, Ft as SecureHelloFrame, G as ManageRequestFrame, Gn as handleRecordSchema, Gr as sfuTrackEntrySchema, Gt as ThresholdCommit, H as ManageCommandParams, Hn as frameVariantSchema, Hr as secureDataFrameSchema, Ht as StreamSession, I as HandleClaims, In as deviceIdSchema, Ir as roomNoticeClaimsSchema, It as SessionId, J as NamespacedCapability, Jn as identityKeySchema, Jr as streamDataFrameSchema, Jt as ThresholdKeygenRound1, K as ManageResponseFrame, Kn as handshakeFrameSchema, Kr as sfuTrackMapSchema, Kt as ThresholdCommitment, L as HandleRecord, Ln as dmRoomPathSchema, Lr as roomNoticeSchema, Lt as SfuTrackEntry, M as ExecSessionInfo, Mn as dataEntriesFrameSchema, Mr as roomLeaveSchema, Mt as RoomRekey, N as Frame, Nn as dataHaveFrameSchema, Nr as roomMemberSchema, Nt as RoomSend, O as DeviceIdHex, On as coseHeaderKidSchema, Or as revocationEntrySchema, Ot as RoomNotice, P as FrameVariant, Pn as dataRequestFrameSchema, Pr as roomMembersOkSchema, Pt as SecureDataFrame, Q as PathTrace, Qn as manageOkSchema, Qr as thresholdAbortSchema, Qt as ThresholdSign, R as HandshakeFrame, Rn as domainIdSchema, Rr as roomPathSchema, Rt as SfuTrackMap, S as CoseSign1, Sn as capabilityVerbSchema, Sr as relayConnectFrameSchema, St as RoomJoin, T as DataHaveFrame, Tn as coreCapabilitySchema, Tr as relayOfferFrameSchema, Tt as RoomMember, U as ManageError, Un as gossipFrameSchema, Ur as secureHelloFrameSchema, Ut as SyncPunchFrame, V as ManageCommand, Vn as frameSchema, Vr as roomSendSchema, Vt as StreamEndFrame, W as ManageOk, Wn as handleClaimsSchema, Wr as sessionIdSchema, Wt as ThresholdAbort, X as ObservedAddressFrame, Xn as manageCommandSchema, Xr as streamSessionSchema, Xt as ThresholdShareClaims, Y as NamespacedDomainId, Yn as manageCommandParamsSchema, Yr as streamEndFrameSchema, Yt as ThresholdKeygenRound2, Z as OwnerNamedRoomPath, Zn as manageErrorSchema, Zr as syncPunchFrameSchema, Zt as ThresholdShareEnvelope, _ as CoreCapability, _n as capabilityGrantOkSchema, _r as protocolVersionSchema, _t as RelayOfferFrame, a as BulkOpen, ai as thresholdShareEnvelopeSchema, an as WebrtcAnswer, ar as ownerNamedRoomPathSchema, at as PrivateUseDomainId, b as CoseHeaderKid, bn as capabilityScopeSchema, br as ptySpawnSchema, bt as RevocationEntry, c as CandidatesFrame, ci as tokenClaimsSchema, cn as WireCandidate, cr as peerAdvertSchema, ct as ProcSpawn, d as CapabilityRequest, di as transferIdSchema, dn as bulkDataFrameSchema, dr as pongFrameSchema, dt as PtyResize, ei as thresholdCommitmentSchema, en as TokenClaims, er as manageResponseFrameSchema, et as PeerAdvert, f as CapabilityScope, fi as versionGetSchema, fn as bulkEndFrameSchema, fr as privateUseCapabilitySchema, ft as PtySpawn, g as CoordinatorFrame, gi as wireCandidateSchema, gn as candidatesFrameSchema, gr as procSpawnSchema, gt as RelayInboundFrame, h as CloseFrame, hi as webrtcOfferSchema, hn as candidateKindSchema, hr as procSignalSchema, ht as RelayDataFrame, i as BulkEndFrame, ii as thresholdShareClaimsSchema, in as VersionGet, ir as observedAddressFrameSchema, it as PrivateUseCapability, j as ExecList, jn as coseTokenHeadersSchema, jr as roomJoinSchema, jt as RoomRead, k as DmRoomPath, kn as coseHeaderLabelSchema, kr as roomInviteSchema, kt as RoomNoticeClaims, l as CapabilityGrant, li as topologyGetSchema, ln as bulkAckFrameSchema, lr as peerIdentitySchema, lt as ProtocolVersion, m as CapabilityVerb, mi as webrtcIceCandidateSchema, mn as bulkResumeSchema, mr as procKillSchema, mt as RelayConnectFrame, n as BulkCancel, ni as thresholdKeygenRound1Schema, nn as TopologyPeers, nr as namespacedCapabilitySchema, nt as PingFrame, o as BulkResume, oi as thresholdSignSchema, on as WebrtcIceCandidate, or as pathTraceOkSchema, ot as ProcKill, p as CapabilityToken, pi as webrtcAnswerSchema, pn as bulkOpenSchema, pr as privateUseDomainIdSchema, pt as PtyWrite, q as MessageRef, qn as iceCandidateInitSchema, qr as streamAckFrameSchema, qt as ThresholdKeygenConfirm, r as BulkDataFrame, ri as thresholdKeygenRound2Schema, rn as TransferId, rr as namespacedDomainIdSchema, rt as PongFrame, s as CandidateKind, si as thresholdSubjectSchema, sn as WebrtcOffer, sr as pathTraceSchema, st as ProcSignal, t as BulkAckFrame, ti as thresholdKeygenConfirmSchema, tn as TopologyGet, tr as messageRefSchema, tt as PeerIdentity, u as CapabilityGrantOk, ui as topologyPeersSchema, un as bulkCancelSchema, ur as pingFrameSchema, ut as PtyKill, v as CoreDomainName, vn as capabilityGrantSchema, vr as ptyKillSchema, vt as RevocationAnnounceFrame, w as DataEntriesFrame, wn as coordinatorFrameSchema, wr as relayInboundFrameSchema, wt as RoomLeave, x as CoseHeaderLabel, xn as capabilityTokenSchema, xr as ptyWriteSchema, xt as RoomInvite, y as CoseHeaderAlg, yn as capabilityRequestSchema, yr as ptyResizeSchema, yt as RevocationClaims, z as IceCandidateInit, zn as execListSchema, zr as roomReadSchema, zt as StreamAckFrame } from "../protocol-DzmpxxUr.mjs";
 export { BulkAckFrame, BulkCancel, BulkDataFrame, BulkEndFrame, BulkOpen, BulkResume, CandidateKind, CandidatesFrame, CapabilityGrant, CapabilityGrantOk, CapabilityRequest, CapabilityScope, CapabilityToken, CapabilityVerb, CloseFrame, CoordinatorFrame, CoreCapability, CoreDomainName, CoseHeaderAlg, CoseHeaderKid, CoseHeaderLabel, CoseSign1, CoseTokenHeaders, DataEntriesFrame, DataHaveFrame, DataRequestFrame, DeviceId, DeviceIdHex, DmRoomPath, DomainId, ExecList, ExecSessionInfo, Frame, FrameVariant, GossipFrame, HandleClaims, HandleRecord, HandshakeFrame, IceCandidateInit, IdentityKey, ManageCommand, ManageCommandParams, ManageError, ManageOk, ManageRequestFrame, ManageResponseFrame, MessageRef, NamespacedCapability, NamespacedDomainId, ObservedAddressFrame, OwnerNamedRoomPath, PathTrace, PathTraceOk, PeerAdvert, PeerIdentity, PingFrame, PongFrame, PrivateUseCapability, PrivateUseDomainId, ProcKill, ProcSignal, ProcSpawn, ProtocolVersion, PtyKill, PtyResize, PtySpawn, PtyWrite, RelayConnectFrame, RelayDataFrame, RelayInboundFrame, RelayOfferFrame, RevocationAnnounceFrame, RevocationClaims, RevocationEntry, RoomInvite, RoomJoin, RoomJoinOk, RoomLeave, RoomMember, RoomMembers, RoomMembersOk, RoomNotice, RoomNoticeClaims, RoomPath, RoomRead, RoomRekey, RoomSend, SecureDataFrame, SecureHelloFrame, SessionId, SfuTrackEntry, SfuTrackMap, StreamAckFrame, StreamDataFrame, StreamEndFrame, StreamSession, SyncPunchFrame, ThresholdAbort, ThresholdCommit, ThresholdCommitment, ThresholdKeygenConfirm, ThresholdKeygenRound1, ThresholdKeygenRound2, ThresholdShareClaims, ThresholdShareEnvelope, ThresholdSign, ThresholdSubject, TokenClaims, TopologyGet, TopologyPeers, TransferId, VersionGet, WebrtcAnswer, WebrtcIceCandidate, WebrtcOffer, WireCandidate, bulkAckFrameSchema, bulkCancelSchema, bulkDataFrameSchema, bulkEndFrameSchema, bulkOpenSchema, bulkResumeSchema, candidateKindSchema, candidatesFrameSchema, capabilityGrantOkSchema, capabilityGrantSchema, capabilityRequestSchema, capabilityScopeSchema, capabilityTokenSchema, capabilityVerbSchema, closeFrameSchema, coordinatorFrameSchema, coreCapabilitySchema, coreDomainNameSchema, coseHeaderAlgSchema, coseHeaderKidSchema, coseHeaderLabelSchema, coseSign1Schema, coseTokenHeadersSchema, dataEntriesFrameSchema, dataHaveFrameSchema, dataRequestFrameSchema, deviceIdHexSchema, deviceIdSchema, dmRoomPathSchema, domainIdSchema, execListSchema, execSessionInfoSchema, frameSchema, frameVariantSchema, gossipFrameSchema, handleClaimsSchema, handleRecordSchema, handshakeFrameSchema, iceCandidateInitSchema, identityKeySchema, manageCommandParamsSchema, manageCommandSchema, manageErrorSchema, manageOkSchema, manageRequestFrameSchema, manageResponseFrameSchema, messageRefSchema, namespacedCapabilitySchema, namespacedDomainIdSchema, observedAddressFrameSchema, ownerNamedRoomPathSchema, pathTraceOkSchema, pathTraceSchema, peerAdvertSchema, peerIdentitySchema, pingFrameSchema, pongFrameSchema, privateUseCapabilitySchema, privateUseDomainIdSchema, procKillSchema, procSignalSchema, procSpawnSchema, protocolVersionSchema, ptyKillSchema, ptyResizeSchema, ptySpawnSchema, ptyWriteSchema, relayConnectFrameSchema, relayDataFrameSchema, relayInboundFrameSchema, relayOfferFrameSchema, revocationAnnounceFrameSchema, revocationClaimsSchema, revocationEntrySchema, roomInviteSchema, roomJoinOkSchema, roomJoinSchema, roomLeaveSchema, roomMemberSchema, roomMembersOkSchema, roomMembersSchema, roomNoticeClaimsSchema, roomNoticeSchema, roomPathSchema, roomReadSchema, roomRekeySchema, roomSendSchema, secureDataFrameSchema, secureHelloFrameSchema, sessionIdSchema, sfuTrackEntrySchema, sfuTrackMapSchema, streamAckFrameSchema, streamDataFrameSchema, streamEndFrameSchema, streamSessionSchema, syncPunchFrameSchema, thresholdAbortSchema, thresholdCommitSchema, thresholdCommitmentSchema, thresholdKeygenConfirmSchema, thresholdKeygenRound1Schema, thresholdKeygenRound2Schema, thresholdShareClaimsSchema, thresholdShareEnvelopeSchema, thresholdSignSchema, thresholdSubjectSchema, tokenClaimsSchema, topologyGetSchema, topologyPeersSchema, transferIdSchema, versionGetSchema, webrtcAnswerSchema, webrtcIceCandidateSchema, webrtcOfferSchema, wireCandidateSchema };

package/dist/generated/protocol.mjs

@@ -521,7 +521,8 @@ const relayOfferFrameSchema = z.lazy(() => z.object({
 }));
 const relayConnectFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("relay-connect"),
-	"target-device": z.lazy(() => deviceIdSchema)
+	"target-device": z.lazy(() => deviceIdSchema),
+	"source-device": z.lazy(() => deviceIdSchema).optional()
 }));
 const relayDataFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("relay-data"),
@@ -531,7 +532,8 @@ const relayDataFrameSchema = z.lazy(() => z.object({
 }));
 const relayInboundFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("relay-inbound"),
-	"source-device": z.lazy(() => deviceIdSchema)
+	"source-device": z.lazy(() => deviceIdSchema),
+	"target-device": z.lazy(() => deviceIdSchema).optional()
 }));
 const coordinatorFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("coordinator"),

package/dist/{identity-DJbr96J3.d.cts → identity-B6nhlSOT.d.cts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.cjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.cjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/{identity-ViYdZrIU.d.mts → identity-EV-HHv_D.d.mts}

@@ -1,4 +1,4 @@
-import { B as IdentityKey, D as DeviceId } from "./protocol-BgR1e_NI.mjs";
+import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.mjs";
 //#region src/ports/identity.d.ts
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).

package/dist/ports/identity.d.cts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
+import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
 export { IdentityPort };

package/dist/ports/identity.d.mts

@@ -1,2 +1,2 @@
-import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
+import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
 export { IdentityPort };

package/dist/ports/transport.d.cts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-DP3hdehk.cjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
 export { Connection, Listener, Transport };

package/dist/ports/transport.d.mts

@@ -1,2 +1,2 @@
-import { n as Listener, r as Transport, t as Connection } from "../transport-Dv_LTCsF.mjs";
+import { n as Listener, r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
 export { Connection, Listener, Transport };

package/dist/{protocol-BgR1e_NI.d.cts → protocol-DzmpxxUr.d.cts}

@@ -323,6 +323,7 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
   payload: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
@@ -331,6 +332,7 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;
   term: z.ZodNumber;
@@ -628,6 +630,7 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
   payload: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
@@ -636,6 +639,7 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;
   term: z.ZodNumber;
@@ -1634,6 +1638,7 @@ declare const relayOfferFrameSchema: z.ZodLazy<z.ZodObject<{
 declare const relayConnectFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>;
 declare const relayDataFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
@@ -1644,6 +1649,7 @@ declare const relayDataFrameSchema: z.ZodLazy<z.ZodObject<{
 declare const relayInboundFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>;
 declare const coordinatorFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;

package/dist/{protocol-BgR1e_NI.d.mts → protocol-DzmpxxUr.d.mts}

@@ -323,6 +323,7 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
   payload: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
@@ -331,6 +332,7 @@ declare const frameVariantSchema: z.ZodLazy<z.ZodUnion<readonly [z.ZodLazy<z.Zod
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;
   term: z.ZodNumber;
@@ -628,6 +630,7 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
   payload: z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>;
@@ -636,6 +639,7 @@ declare const frameSchema: z.ZodLazy<z.ZodLazy<z.ZodLazy<z.ZodUnion<readonly [z.
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>>, z.ZodLazy<z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;
   term: z.ZodNumber;
@@ -1634,6 +1638,7 @@ declare const relayOfferFrameSchema: z.ZodLazy<z.ZodObject<{
 declare const relayConnectFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-connect">;
   "target-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "source-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>;
 declare const relayDataFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-data">;
@@ -1644,6 +1649,7 @@ declare const relayDataFrameSchema: z.ZodLazy<z.ZodObject<{
 declare const relayInboundFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"relay-inbound">;
   "source-device": z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>;
+  "target-device": z.ZodOptional<z.ZodLazy<z.ZodLazy<z.ZodCustom<Uint8Array<ArrayBuffer>, Uint8Array<ArrayBuffer>>>>>;
 }, z.core.$strip>>;
 declare const coordinatorFrameSchema: z.ZodLazy<z.ZodObject<{
   type: z.ZodLiteral<"coordinator">;

package/dist/{room-token-verification-7zD4ib-A.d.mts → room-token-verification-Dh7SGJfK.d.cts}

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-BgR1e_NI.mjs";
-import { d as VerifyCapabilityTokenOptions, u as TokenVerdictReason } from "./tokens-DRkm_QOR.mjs";
+import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-DzmpxxUr.cjs";
+import { TokenVerdictReason, VerifyCapabilityTokenOptions } from "./domain/tokens.cjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/{room-token-verification-hFtBDZPO.d.cts → room-token-verification-Hb1LkpFh.d.mts}

@@ -1,5 +1,5 @@
-import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-BgR1e_NI.cjs";
-import { d as VerifyCapabilityTokenOptions, u as TokenVerdictReason } from "./tokens-BMWCnQEF.cjs";
+import { B as IdentityKey, D as DeviceId, en as TokenClaims, p as CapabilityToken } from "./protocol-DzmpxxUr.mjs";
+import { TokenVerdictReason, VerifyCapabilityTokenOptions } from "./domain/tokens.mjs";
 //#region src/domain/room-token-verification.d.ts
 /** The one capability every core/room verb (room.send/read/leave/members) is gated by, per spec/room.cddl -- room.join/room.invite are deliberately ungated instead and need no token check at all. */
 declare const ROOM_MEMBER_CAPABILITY = "room:member";

package/dist/token-predicates-D4NNPLnp.d.cts

@@ -0,0 +1,72 @@
+import { D as DeviceId, en as TokenClaims } from "./protocol-DzmpxxUr.cjs";
+import { t as Clock } from "./clock-DiSx-WKM.cjs";
+import { z } from "zod";
+import { JsonValue, PredicateNode, Resolution } from "trilean";
+//#region src/domain/token-predicates.d.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+declare const conditionsListSchema: z.ZodType<PredicateNode[]>;
+/**
+ * tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+ */
+declare const BEARER_IS = "bearer-is";
+declare const EXPIRES_AT = "expires-at";
+declare const SCOPE_NARROWS = "scope-narrows";
+declare const CAPABILITY_IS = "capability-is";
+declare const DEPTH_REMAINING = "depth-remaining";
+type NarrowingSystem = typeof BEARER_IS | typeof EXPIRES_AT | typeof SCOPE_NARROWS | typeof CAPABILITY_IS | typeof DEPTH_REMAINING;
+/** Everything needed to check candidate against parent, restated from tokens.ts's own NarrowingCandidate/checkNarrowing shape rather than requiring a full TokenClaims for the not-yet-minted child -- the same reasoning mintCapabilityToken's own checkNarrowing already applies (a delegation candidate has no token-id/issuer-key/bearer of its own yet). camelCase field names, matching NarrowingCandidate's own convention, deliberately distinct from TokenClaims' hyphenated wire field names. */
+interface NarrowingCandidate {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  expires: number;
+  delegationsRemaining?: number;
+}
+/**
+ * The local evaluation context every token predicate op reads from -- trilean's own `EvaluationContext` is deliberately typed `unknown` (an opaque, in-process value never serialised as part of the tree), so this is wire-mesh's own concrete shape for it. `childIssuer`/`candidate` describe the not-yet-minted or being-verified child; `parentClaims` is the already-decoded-and-verified parent, present only when narrowing is actually being checked against one. No clock: none of the five structural narrowing checks reason about the current time (unlike a conditions-list entry, which might -- see ConditionsContext).
+ */
+interface TokenPredicateContext {
+  readonly childIssuer: DeviceId;
+  readonly candidate: Readonly<NarrowingCandidate>;
+  readonly parentClaims?: Readonly<TokenClaims>;
+}
+/** A `conditions` entry's own generic evaluation context: no parent/candidate distinction, since a domain-specific condition (a message TTL, a future revoke-authorization check) reasons about the presented token's own claims directly, not a not-yet-minted delegation candidate. */
+interface ConditionsContext {
+  readonly clock: Clock;
+  readonly claims: Readonly<TokenClaims>;
+  /** The minted child a grant-capability's conditions are being evaluated against (wire-mesh#323 subject mode): present only inside an authorised-by verification walk or a mint-time authorisation check, never when a token's conditions are evaluated against its own claims. */
+  readonly subject?: Readonly<GrantSubject>;
+}
+/** The child half of a subject-mode conditions evaluation: the claims of the token a grant-capability authorises, structurally what NarrowingCandidate already is plus the bearer the mint named. Satisfied by a full TokenClaims, so the verifier passes the child's decoded claims directly. */
+interface GrantSubject {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  bearer: DeviceId;
+  expires: number;
+  delegationsRemaining?: number;
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+declare const GRANTEE_IS = "grantee-is";
+declare const GRANTED_CAPABILITY_IS = "granted-capability-is";
+type SubjectSystem = typeof GRANTEE_IS | typeof GRANTED_CAPABILITY_IS;
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+declare function noSelfGrantBar(capability: TokenClaims["capability"], bearer: DeviceId): PredicateNode;
+/** One delegate system's own handler: given the delegate node's payload and the concrete context it was invoked with, resolves to a boolean-valued Resolution. Handlers never throw for a data-quality problem -- an op that cannot make sense of its own payload/context returns `{found: false}`, which the evaluator turns into a fail-closed `indeterminate`. */
+type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) => Resolution | Promise<Resolution>;
+/**
+ * Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+ */
+declare function evaluateNarrowing(parentClaims: Readonly<TokenClaims>, childIssuer: DeviceId, candidate: Readonly<NarrowingCandidate>): Promise<NarrowingSystem | undefined>;
+type ConditionsVerdict = {
+  ok: true;
+} | {
+  ok: false;
+  reason: "not_satisfied";
+};
+/**
+ * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+ */
+declare function evaluateConditions(nodes: readonly PredicateNode[], claims: Readonly<TokenClaims>, clock: Readonly<Clock>, extraHandlers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>,
+/** Subject mode (wire-mesh#323): the minted child the carrying grant-capability's conditions bind to. Absent evaluates against the carrying token's own claims, exactly as before; present additionally registers the two subject systems, whose handlers read the subject rather than `claims`. */
+subject?: Readonly<GrantSubject>): Promise<ConditionsVerdict>;
+//#endregion
+export { evaluateConditions as _, DEPTH_REMAINING as a, GRANTEE_IS as c, NarrowingSystem as d, SCOPE_NARROWS as f, conditionsListSchema as g, TokenPredicateContext as h, ConditionsVerdict as i, GrantSubject as l, TokenDelegateHandler as m, CAPABILITY_IS as n, EXPIRES_AT as o, SubjectSystem as p, ConditionsContext as r, GRANTED_CAPABILITY_IS as s, BEARER_IS as t, NarrowingCandidate as u, evaluateNarrowing as v, noSelfGrantBar as y };

package/dist/token-predicates-DqpG8VZZ.d.mts

@@ -0,0 +1,72 @@
+import { D as DeviceId, en as TokenClaims } from "./protocol-DzmpxxUr.mjs";
+import { t as Clock } from "./clock-DiSx-WKM.mjs";
+import { z } from "zod";
+import { JsonValue, PredicateNode, Resolution } from "trilean";
+//#region src/domain/token-predicates.d.ts
+/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
+declare const conditionsListSchema: z.ZodType<PredicateNode[]>;
+/**
+ * tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
+ */
+declare const BEARER_IS = "bearer-is";
+declare const EXPIRES_AT = "expires-at";
+declare const SCOPE_NARROWS = "scope-narrows";
+declare const CAPABILITY_IS = "capability-is";
+declare const DEPTH_REMAINING = "depth-remaining";
+type NarrowingSystem = typeof BEARER_IS | typeof EXPIRES_AT | typeof SCOPE_NARROWS | typeof CAPABILITY_IS | typeof DEPTH_REMAINING;
+/** Everything needed to check candidate against parent, restated from tokens.ts's own NarrowingCandidate/checkNarrowing shape rather than requiring a full TokenClaims for the not-yet-minted child -- the same reasoning mintCapabilityToken's own checkNarrowing already applies (a delegation candidate has no token-id/issuer-key/bearer of its own yet). camelCase field names, matching NarrowingCandidate's own convention, deliberately distinct from TokenClaims' hyphenated wire field names. */
+interface NarrowingCandidate {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  expires: number;
+  delegationsRemaining?: number;
+}
+/**
+ * The local evaluation context every token predicate op reads from -- trilean's own `EvaluationContext` is deliberately typed `unknown` (an opaque, in-process value never serialised as part of the tree), so this is wire-mesh's own concrete shape for it. `childIssuer`/`candidate` describe the not-yet-minted or being-verified child; `parentClaims` is the already-decoded-and-verified parent, present only when narrowing is actually being checked against one. No clock: none of the five structural narrowing checks reason about the current time (unlike a conditions-list entry, which might -- see ConditionsContext).
+ */
+interface TokenPredicateContext {
+  readonly childIssuer: DeviceId;
+  readonly candidate: Readonly<NarrowingCandidate>;
+  readonly parentClaims?: Readonly<TokenClaims>;
+}
+/** A `conditions` entry's own generic evaluation context: no parent/candidate distinction, since a domain-specific condition (a message TTL, a future revoke-authorization check) reasons about the presented token's own claims directly, not a not-yet-minted delegation candidate. */
+interface ConditionsContext {
+  readonly clock: Clock;
+  readonly claims: Readonly<TokenClaims>;
+  /** The minted child a grant-capability's conditions are being evaluated against (wire-mesh#323 subject mode): present only inside an authorised-by verification walk or a mint-time authorisation check, never when a token's conditions are evaluated against its own claims. */
+  readonly subject?: Readonly<GrantSubject>;
+}
+/** The child half of a subject-mode conditions evaluation: the claims of the token a grant-capability authorises, structurally what NarrowingCandidate already is plus the bearer the mint named. Satisfied by a full TokenClaims, so the verifier passes the child's decoded claims directly. */
+interface GrantSubject {
+  capability: TokenClaims["capability"];
+  scope: TokenClaims["scope"];
+  bearer: DeviceId;
+  expires: number;
+  delegationsRemaining?: number;
+}
+/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
+declare const GRANTEE_IS = "grantee-is";
+declare const GRANTED_CAPABILITY_IS = "granted-capability-is";
+type SubjectSystem = typeof GRANTEE_IS | typeof GRANTED_CAPABILITY_IS;
+/** The named no-self-grant bar (wire-mesh#323): one conditions entry an issuer puts on a grant-capability so its bearer may not mint a `capability` token naming itself as bearer. `not(and(...))` under strict Kleene: a child granted to anyone else passes, a child granted to the bearer fails, and any unresolvable leg stays indeterminate and refuses. */
+declare function noSelfGrantBar(capability: TokenClaims["capability"], bearer: DeviceId): PredicateNode;
+/** One delegate system's own handler: given the delegate node's payload and the concrete context it was invoked with, resolves to a boolean-valued Resolution. Handlers never throw for a data-quality problem -- an op that cannot make sense of its own payload/context returns `{found: false}`, which the evaluator turns into a fail-closed `indeterminate`. */
+type TokenDelegateHandler<TContext> = (payload: JsonValue, context: TContext) => Resolution | Promise<Resolution>;
+/**
+ * Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
+ */
+declare function evaluateNarrowing(parentClaims: Readonly<TokenClaims>, childIssuer: DeviceId, candidate: Readonly<NarrowingCandidate>): Promise<NarrowingSystem | undefined>;
+type ConditionsVerdict = {
+  ok: true;
+} | {
+  ok: false;
+  reason: "not_satisfied";
+};
+/**
+ * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
+ */
+declare function evaluateConditions(nodes: readonly PredicateNode[], claims: Readonly<TokenClaims>, clock: Readonly<Clock>, extraHandlers?: Readonly<Record<string, TokenDelegateHandler<ConditionsContext>>>,
+/** Subject mode (wire-mesh#323): the minted child the carrying grant-capability's conditions bind to. Absent evaluates against the carrying token's own claims, exactly as before; present additionally registers the two subject systems, whose handlers read the subject rather than `claims`. */
+subject?: Readonly<GrantSubject>): Promise<ConditionsVerdict>;
+//#endregion
+export { evaluateConditions as _, DEPTH_REMAINING as a, GRANTEE_IS as c, NarrowingSystem as d, SCOPE_NARROWS as f, conditionsListSchema as g, TokenPredicateContext as h, ConditionsVerdict as i, GrantSubject as l, TokenDelegateHandler as m, CAPABILITY_IS as n, EXPIRES_AT as o, SubjectSystem as p, ConditionsContext as r, GRANTED_CAPABILITY_IS as s, BEARER_IS as t, NarrowingCandidate as u, evaluateNarrowing as v, noSelfGrantBar as y };

package/dist/{transport-Dv_LTCsF.d.mts → transport-bD3p_TO_.d.mts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.mjs";
+import { D as DeviceId, N as Frame } from "./protocol-DzmpxxUr.mjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/dist/{transport-DP3hdehk.d.cts → transport-gDbSHO-r.d.cts}

@@ -1,4 +1,4 @@
-import { D as DeviceId, N as Frame } from "./protocol-BgR1e_NI.cjs";
+import { D as DeviceId, N as Frame } from "./protocol-DzmpxxUr.cjs";
 //#region src/ports/transport.d.ts
 /**
  * An async, serialisable-data contract for exchanging frame values over some connection -- deliberately without baking in any specific transport's own primitives (no raw socket types, no WebSocket-specific options), so a TCP adapter, a WebSocket adapter, or an in-memory adapter for tests can all satisfy it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "3.8.0",
+  "version": "3.10.0",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",
@@ -194,6 +194,14 @@
       "import": "./dist/domain/threshold-subject.mjs",
       "require": "./dist/domain/threshold-subject.cjs"
     },
+    "./domain/token-predicates": {
+      "import": "./dist/domain/token-predicates.mjs",
+      "require": "./dist/domain/token-predicates.cjs"
+    },
+    "./domain/token-scope": {
+      "import": "./dist/domain/token-scope.mjs",
+      "require": "./dist/domain/token-scope.cjs"
+    },
     "./domain/tokens": {
       "import": "./dist/domain/tokens.mjs",
       "require": "./dist/domain/tokens.cjs"