wire-mesh-core 3.8.0 → 3.9.0

package/dist/domain/capability-grant.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.
@@ -49,7 +49,7 @@ function createCapabilityGrantHandler(options) {
 			return;
 		}
 		const grantedToken = parsed.data["granted-token"];
-		const verdict = await require_tokens.verifyCapabilityToken(grantedToken, {
+		const verdict = await require_domain_tokens.verifyCapabilityToken(grantedToken, {
 			identity: options.identity,
 			clock: options.clock,
 			revocation: options.revocation,
@@ -69,7 +69,7 @@ function createCapabilityGrantHandler(options) {
 			});
 			return;
 		}
-		if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
+		if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) {
 			await incoming.respond({
 				result: "error",
 				code: "scope_mismatch"

package/dist/domain/capability-grant.d.cts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.d.mts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-grant.d.ts
 /**
  * Builds a capability-grant command per management.cddl. The outer `manage-command.verb` is the capability string itself, the identical convention capability-request.ts's own buildCapabilityRequestCommand already establishes -- a receiver's per-capability handler is how it knows which grant this push is even for. `params.verb` is the fixed "capability.grant" marker. No scope or invitee field: manage-request-frame's own top-level scope already carries the former, and the request's own destination already carries the latter -- naming either a second time inside params could only ever disagree with the fact it duplicates.

package/dist/domain/capability-grant.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-grant.ts
 /**
 * The generic, capability-agnostic capability-grant primitive (wire-mesh#117, spec/management.cddl) -- the unsolicited push counterpart to capability-request.ts's own ask/response primitive. Where capability-request lifts core/room's room.join shape (a pull: the requester asks, the owner mints and returns a grant on the same response) out of that one domain, capability-grant lifts room.invite's own shape (a push: the owner mints unprompted and delivers the grant in the request itself, since there is no approval round-trip to carry it back) the same way. core/room's own room-client.ts is the reference consumer: it builds sendRoomInvite as a thin wrapper over sendCapabilityGrant below, and wires createRoomRouter's dispatch onto createCapabilityGrantHandler for the receiving side.

package/dist/domain/capability-request.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -31,6 +31,17 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
@@ -38,7 +49,7 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 */
 async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
 	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = require_generated_protocol.capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
@@ -52,7 +63,7 @@ async function checkRequestPermission(incoming, options) {
 		code: "token_required"
 	};
 	if (options.revocation === void 0) throw new Error("requireRequestToken needs a revocation view on the handler options");
-	const verdict = await require_tokens.verifyCapabilityToken(incoming.token, {
+	const verdict = await require_domain_tokens.verifyCapabilityToken(incoming.token, {
 		identity: options.identity,
 		clock: options.clock,
 		revocation: options.revocation,
@@ -72,7 +83,7 @@ async function checkRequestPermission(incoming, options) {
 		ok: false,
 		code: "capability_mismatch"
 	};
-	if (!require_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) return {
+	if (!require_domain_token_scope.scopeNarrows(verdict.claims.scope, incoming.scope)) return {
 		ok: false,
 		code: "scope_mismatch"
 	};
@@ -136,7 +147,7 @@ function createCapabilityRequestHandler(options) {
 					});
 					return;
 				}
-				const verdict = await require_tokens.mintCapabilityToken({
+				const verdict = await require_domain_tokens.mintCapabilityToken({
 					identity: options.identity,
 					clock: options.clock,
 					tokenId: randomTokenId(),
@@ -164,6 +175,7 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
+exports.CapabilityRequestRefusedError = CapabilityRequestRefusedError;
 exports.MANAGE_REQUEST_CAPABILITY = MANAGE_REQUEST_CAPABILITY;
 exports.buildCapabilityRequestCommand = buildCapabilityRequestCommand;
 exports.createCapabilityRequestHandler = createCapabilityRequestHandler;

package/dist/domain/capability-request.d.cts

@@ -2,12 +2,19 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.cjs";
-import { b as ConditionsContext, o as RevocationCheck, x as TokenDelegateHandler } from "../tokens-BMWCnQEF.cjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-C-aIe1DT.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *

package/dist/domain/capability-request.d.mts

@@ -2,12 +2,19 @@ import { D as DeviceId, V as ManageCommand, f as CapabilityScope, p as Capabilit
 import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, MeshSession } from "./mesh-session.mjs";
-import { b as ConditionsContext, o as RevocationCheck, x as TokenDelegateHandler } from "../tokens-DRkm_QOR.mjs";
+import { m as TokenDelegateHandler, r as ConditionsContext } from "../token-predicates-DqvyS7Y8.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/capability-request.d.ts
 /**
  * Builds a capability-request command per management.cddl. The outer `manage-command.verb` is the capability string itself -- the same value as this map's own `params.capability` field -- never a generic literal: capability-verb's own CDDL grammar is a closed alternation of colon-delimited `domain:noun` regexes (spec/tokens.cddl), so a bare literal like "capability" could never satisfy it, and routing by capability (the same way room.send/room.join already share the ROOM_MEMBER_CAPABILITY outer verb) is how a receiver's own per-capability handler knows which grant this ask is even for. `params.verb` is the fixed "capability.request" marker that distinguishes this ask from any other verb sharing the same outer capability (mirroring room.send/room.join's own inner `params.verb` split under one shared outer verb). `valid-until`, when given, bounds how long this ask is worth granting (wire-mesh#82) -- a receiver refuses outright once its own clock has passed it, rather than presenting a stale ask to a human for approval.
  */
 export declare function buildCapabilityRequestCommand(capability: string, validUntil?: number): ManageCommand;
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+export declare class CapabilityRequestRefusedError extends Error {
+  readonly capability: string;
+  readonly code: string;
+  constructor(capability: string, code: string);
+}
 /**
  * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
  *

package/dist/domain/capability-request.mjs

@@ -1,6 +1,6 @@
 import { capabilityGrantOkSchema, capabilityRequestSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
-import { i as mintCapabilityToken, s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
+import { mintCapabilityToken, verifyCapabilityToken } from "./tokens.mjs";
 //#region src/domain/capability-request.ts
 /**
 * The generic, capability-agnostic capability-request / capability-grant-ok primitive (wire-mesh#78, spec/management.cddl). Lifts core/room's own room.join shape -- an ungated ask, held open, a human (or any other domain-supplied decision) accepts or refuses, acceptance mints and returns a token on the same response -- out of that one domain so any capability can reuse it, not just room:member. core/room's own room-client.ts is the reference consumer: it rewires requestToJoin/createRoomRouter's room.join handling onto requestCapability/createCapabilityRequestHandler below, supplying room-specific extension fields (its member list) through this module's own extensions mechanism rather than this module knowing anything about rooms.
@@ -30,6 +30,17 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 		}
 	};
 }
+/** A capability request the other side answered with a manage-error. The code is the receiver's own (`denied` for a human's no, `token_required`, `capability_mismatch` or `scope_mismatch` from the request-permission gate, or a verifier reason for a presented token it did not accept), kept as a field so a caller can tell a policy refusal from a person's decision without parsing the message. */
+var CapabilityRequestRefusedError = class extends Error {
+	capability;
+	code;
+	constructor(capability, code) {
+		super(`capability request for "${capability}" was refused (${code})`);
+		this.name = "CapabilityRequestRefusedError";
+		this.capability = capability;
+		this.code = code;
+	}
+};
 /**
 * Sends a deliberately ungated capability-request (no token field at all -- per management.cddl's own header comment, this primitive puts access control entirely in the receiving side's own decision, not a capability check on the request itself, the same design room.join already established). Resolves with the freshly granted capability-grant-ok on approval (its own open `* tstr => any` tail may carry domain-specific extension fields, e.g. core/room's member list -- a caller that needs those parses the raw result itself, the same way room-client.ts's own requestToJoin wrapper does); rejects on denial (an ordinary manage-error) or a malformed response.
 *
@@ -37,7 +48,7 @@ function buildCapabilityRequestCommand(capability, validUntil) {
 */
 async function requestCapability(session, capability, scope, targetDevice, timeoutMs, validUntil, requestToken) {
 	const outcome = await session.sendManageRequest(buildCapabilityRequestCommand(capability, validUntil), scope, targetDevice, requestToken, timeoutMs);
-	if (outcome.result !== "ok") throw new Error(`capability request for "${capability}" was refused (${outcome.code})`);
+	if (outcome.result !== "ok") throw new CapabilityRequestRefusedError(capability, outcome.code);
 	const parsed = capabilityGrantOkSchema.safeParse(outcome);
 	if (!parsed.success) throw new Error(`capability request for "${capability}" response was malformed`);
 	return parsed.data;
@@ -163,4 +174,4 @@ function createCapabilityRequestHandler(options) {
 	};
 }
 //#endregion
-export { MANAGE_REQUEST_CAPABILITY, buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };
+export { CapabilityRequestRefusedError, MANAGE_REQUEST_CAPABILITY, buildCapabilityRequestCommand, createCapabilityRequestHandler, requestCapability };

package/dist/domain/grant-candidates.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 let zod = require("zod");
 //#region src/domain/grant-candidates.ts
 /**
@@ -38,7 +38,7 @@ function findGrantCandidate(directory, capability, scope) {
 			if (candidate.capability !== capability) continue;
 			const remaining = candidate["delegations-remaining"];
 			if (remaining !== void 0 && remaining <= 0) continue;
-			if (require_token_scope.scopeNarrows(candidate.scope, scope)) return entry.device;
+			if (require_domain_token_scope.scopeNarrows(candidate.scope, scope)) return entry.device;
 		}
 	}
 }

package/dist/domain/grant-candidates.mjs

@@ -1,5 +1,5 @@
 import { capabilityScopeSchema } from "../generated/protocol.mjs";
-import { n as scopeNarrows } from "../token-scope-Z4bmci4M.mjs";
+import { scopeNarrows } from "./token-scope.mjs";
 import { z } from "zod";
 //#region src/domain/grant-candidates.ts
 /**

package/dist/domain/mesh-session.cjs

@@ -1,7 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_adapters_frame_codec = require("../adapters/frame-codec.cjs");
 const require_domain_device_id = require("./device-id.cjs");
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 const require_gossip_extensions = require("../gossip-extensions-BBYgMZ2N.cjs");
 const require_domain_peer_advert = require("./peer-advert.cjs");
 const require_domain_async_queue = require("./async-queue.cjs");
@@ -101,7 +101,7 @@ async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
 	try {
 		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
+		if (!require_domain_token_scope.bytesEqual(hello["to-device"], identity.deviceId)) return {
 			ok: false,
 			reason: "wrong_recipient"
 		};

package/dist/domain/mesh-session.mjs

@@ -1,6 +1,6 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
-import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";

package/dist/domain/notice-board.d.cts

@@ -2,7 +2,7 @@ import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeCl
 import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
 import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/notice-board.d.mts

@@ -2,7 +2,7 @@ import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeCl
 import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
 import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts
 /**

package/dist/domain/peer-advert.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_token_scope = require("../token-scope-CxHXTT3u.cjs");
+const require_domain_token_scope = require("./token-scope.cjs");
 let cbor2 = require("cbor2");
 //#region src/domain/peer-advert.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */
@@ -46,7 +46,7 @@ async function verifyPeerAdvert(identity, advert) {
 	const key = advert[PEER_ADVERT_IDENTITY_KEY_KEY];
 	try {
 		const derived = await identity.deriveDeviceId(key["public-key"]);
-		if (!require_token_scope.bytesEqual(derived, advert.device)) return false;
+		if (!require_domain_token_scope.bytesEqual(derived, advert.device)) return false;
 		return await identity.verify(key, peerAdvertSigningInput(advert), advert[PEER_ADVERT_SIGNATURE_KEY]);
 	} catch {
 		return false;

package/dist/domain/peer-advert.mjs

@@ -1,4 +1,4 @@
-import { t as bytesEqual } from "../token-scope-Z4bmci4M.mjs";
+import { bytesEqual } from "./token-scope.mjs";
 import { cdeEncodeOptions, encode } from "cbor2";
 //#region src/domain/peer-advert.ts
 /** peer-advert's own signature field, the one entry the signature does not cover, named once here so the signing input and the reserved-extension-key guard cannot drift apart. */

package/dist/domain/revocation-view.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return require_domain_device_id.bytesToHex(tokenId);
@@ -12,7 +12,7 @@ function createRevocationView() {
 			return Promise.resolve(entriesByTokenId.get(revocationKey(tokenId)) ?? []);
 		},
 		async record(entry, options) {
-			const verdict = await require_tokens.verifyRevocationEntry(entry, options);
+			const verdict = await require_domain_tokens.verifyRevocationEntry(entry, options);
 			if (verdict.ok) {
 				const key = revocationKey(verdict.claims["token-id"]);
 				const existing = entriesByTokenId.get(key);

package/dist/domain/revocation-view.d.cts

@@ -1,5 +1,5 @@
 import { bt as RevocationEntry } from "../protocol-BgR1e_NI.cjs";
-import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck, RevocationEntryVerdict, VerifyRevocationEntryOptions } from "./tokens.cjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.d.mts

@@ -1,5 +1,5 @@
 import { bt as RevocationEntry } from "../protocol-BgR1e_NI.mjs";
-import { f as VerifyRevocationEntryOptions, o as RevocationCheck, s as RevocationEntryVerdict } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck, RevocationEntryVerdict, VerifyRevocationEntryOptions } from "./tokens.mjs";
 //#region src/domain/revocation-view.d.ts
 /**
  * An in-memory RevocationCheck fed by ingested revocation-announce frames. Keyed by token-id alone, per management.cddl's contract: a token-id can legitimately carry multiple recorded entries from different issuers (the token's own issuer, and/or any number of parties holding a delegated manage:revoke authorization over it) -- entriesFor returns every one of them unfiltered, since checking which actually apply (issuer-match, or a verified authorization) is verifyTokenChain's own obligation, not this store's.

package/dist/domain/revocation-view.mjs

@@ -1,5 +1,5 @@
 import { bytesToHex } from "./device-id.mjs";
-import { c as verifyRevocationEntry } from "../tokens-D8JlTJNA.mjs";
+import { verifyRevocationEntry } from "./tokens.mjs";
 //#region src/domain/revocation-view.ts
 function revocationKey(tokenId) {
 	return bytesToHex(tokenId);

package/dist/domain/room-rekey.d.cts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../prot
 import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
+import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-rekey.d.mts

@@ -2,7 +2,7 @@ import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../prot
 import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
+import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/room-rekey.d.ts
 /**
  * Builds a room.rekey command per room.cddl. The outer verb is room:member, the same "one resource, several inner verbs" pattern room.send/room.leave/room.members already establish -- not a new capability of its own.

package/dist/domain/room-token-verification.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 const require_domain_room_path = require("./room-path.cjs");
 //#region src/domain/room-token-verification.ts
 /**
@@ -12,7 +12,7 @@ const ROOM_MEMBER_CAPABILITY = "room:member";
 * Verifies a `room:member` capability token against all six of core/room's verifier obligations. Delegates obligations 2/4/5 to verifyCapabilityToken directly; adds obligation 3 (scope.kind/scope.path must match the room being acted on) and obligation 1 (the chain's root must be the room's own owner for a named room, or the verifying identity itself for a DM -- never either named participant directly, since a DM token minted by anyone other than the verifier would let a sender self-issue authority to message a stranger unsolicited).
 */
 async function verifyRoomToken(token, options) {
-	const verdict = await require_tokens.verifyCapabilityToken(token, {
+	const verdict = await require_domain_tokens.verifyCapabilityToken(token, {
 		identity: options.identity,
 		clock: options.clock,
 		revocation: options.revocation,

package/dist/domain/room-token-verification.d.cts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-hFtBDZPO.cjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-BpQ6yJtj.cjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.d.mts

@@ -1,2 +1,2 @@
-import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-7zD4ib-A.mjs";
+import { a as verifyRoomToken, i as VerifyRoomTokenOptions, n as RoomTokenVerdict, r as RoomTokenVerdictReason, t as ROOM_MEMBER_CAPABILITY } from "../room-token-verification-CTQSihUO.mjs";
 export { ROOM_MEMBER_CAPABILITY, RoomTokenVerdict, RoomTokenVerdictReason, VerifyRoomTokenOptions, verifyRoomToken };

package/dist/domain/room-token-verification.mjs

@@ -1,5 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
-import { s as verifyCapabilityToken } from "../tokens-D8JlTJNA.mjs";
+import { verifyCapabilityToken } from "./tokens.mjs";
 import { parseRoomPath } from "./room-path.mjs";
 //#region src/domain/room-token-verification.ts
 /**

package/dist/domain/room.d.cts

@@ -1,8 +1,8 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.cjs";
 import { t as IdentityPort } from "../identity-DJbr96J3.cjs";
 import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { o as RevocationCheck } from "../tokens-BMWCnQEF.cjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-hFtBDZPO.cjs";
+import { RevocationCheck } from "./tokens.cjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-BpQ6yJtj.cjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/room.d.mts

@@ -1,8 +1,8 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-BgR1e_NI.mjs";
 import { t as IdentityPort } from "../identity-ViYdZrIU.mjs";
 import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { o as RevocationCheck } from "../tokens-DRkm_QOR.mjs";
-import { r as RoomTokenVerdictReason } from "../room-token-verification-7zD4ib-A.mjs";
+import { RevocationCheck } from "./tokens.mjs";
+import { r as RoomTokenVerdictReason } from "../room-token-verification-CTQSihUO.mjs";
 //#region src/domain/room.d.ts
 export type RoomNoticeVerdictReason = "malformed" | "wrong_room" | "bad_signature" | "wrong_poster" | "content_expired" | "key_epoch_mismatch" | RoomTokenVerdictReason;
 export type RoomNoticeVerdict = {

package/dist/domain/threshold-subject.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_tokens = require("../tokens-tPJQ7Vzt.cjs");
+const require_domain_tokens = require("./tokens.cjs");
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.
@@ -27,7 +27,7 @@ function refuseUnrecognisedKind(subject, known = KNOWN_KINDS) {
 * Reconstructs the exact bytes this participant signs its round-1 commitment (and, transitively, its round-2 share) over -- the Sig_structure built from THIS participant's own decoding of `protected`/`payload`, never a coordinator-supplied to-be-signed blob.
 */
 function toBeSigned(subject) {
-	return Uint8Array.from(require_tokens.sig1ToBeSigned(subject.protected, subject.payload));
+	return Uint8Array.from(require_domain_tokens.sig1ToBeSigned(subject.protected, subject.payload));
 }
 //#endregion
 exports.KNOWN_KINDS = KNOWN_KINDS;

package/dist/domain/threshold-subject.mjs

@@ -1,4 +1,4 @@
-import { o as sig1ToBeSigned } from "../tokens-D8JlTJNA.mjs";
+import { sig1ToBeSigned } from "./tokens.mjs";
 //#region src/domain/threshold-subject.ts
 /**
 * `threshold-subject` -- what a signing session actually asks a group to sign, and the single most important design decision in the whole protocol: it carries the FULL decoded content, never a bare hash. A participant that commits to an opaque digest is a blind signer, and the entire security value of T-of-N is that each participant independently reviews and authorises the content -- returning a round-1 commitment IS that act of authorisation. This module builds exactly the bytes a participant signs its round-1 commitment over: the RFC 9052 §4.4 `Sig_structure`, reusing `tokens.ts`'s own `sig1ToBeSigned` rather than a second hand-rolled construction, and NEVER accepting a pre-assembled to-be-signed blob from a coordinator. Mirrors `wire_mesh_threshold::subject` on the Rust side exactly.