wire-mesh-core 3.8.0 → 3.9.0

package/dist/tokens-D8JlTJNA.mjs

@@ -1,617 +0,0 @@
-import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "./generated/protocol.mjs";
-import { bytesToHex, deviceIdToHex } from "./domain/device-id.mjs";
-import { n as scopeNarrows, t as bytesEqual } from "./token-scope-Z4bmci4M.mjs";
-import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
-import { z } from "zod";
-import { PredicateNodeSchema, evaluatePredicate } from "trilean";
-//#region src/domain/token-predicates.ts
-/** The wire shape of `token-claims.conditions` once CBOR-decoded: trilean's own PredicateNodeSchema is the single source of truth for what a condition entry may contain, re-validated here rather than trusted from a CDDL-generated shadow schema (see tokens.cddl's own comment on why `conditions` is an opaque bstr, not a native CDDL type) -- a token from an untrusted peer must pass trilean's real schema before any of its conditions are evaluated. Explicitly annotated: trilean's PredicateNodeSchema is a deeply recursive z.lazy() type whose inferred shape is too large for tsdown's declaration-file generator to serialise (TS7056) without this. */
-const conditionsListSchema = z.array(PredicateNodeSchema);
-/**
-* tokens.cddl's mandated core predicate-op vocabulary (issue #85): the five narrowing checks a verifier previously enforced as five hardcoded `if`s, now expressed as `delegate` systems every conforming verifier registers a handler for. Order matches the historical check order in verifyTokenChain/checkNarrowing, preserved so a caller mapping a failing system to its own reason vocabulary (MintRefusalReason's five distinct values; verifyTokenChain's single collapsed "delegation_exceeds_parent") sees the same check run first that always ran first.
-*/
-const BEARER_IS = "bearer-is";
-const EXPIRES_AT = "expires-at";
-const SCOPE_NARROWS = "scope-narrows";
-const CAPABILITY_IS = "capability-is";
-const DEPTH_REMAINING = "depth-remaining";
-const NARROWING_SYSTEMS = [
-	BEARER_IS,
-	EXPIRES_AT,
-	SCOPE_NARROWS,
-	CAPABILITY_IS,
-	DEPTH_REMAINING
-];
-function isNarrowingSystem(system) {
-	return system === "bearer-is" || system === "expires-at" || system === "scope-narrows" || system === "capability-is" || system === "depth-remaining";
-}
-/** The two subject-mode delegate systems (wire-mesh#323), registered only when a ConditionsContext carries a subject, and indeterminate (fail-closed) whenever one does not. */
-const GRANTEE_IS = "grantee-is";
-const GRANTED_CAPABILITY_IS = "granted-capability-is";
-function isSubjectSystem(system) {
-	return system === "grantee-is" || system === "granted-capability-is";
-}
-const subjectHandlers = {
-	[GRANTEE_IS]: (payload, context) => {
-		if (context.subject === void 0) return { found: false };
-		if (typeof payload !== "string") return { found: false };
-		return booleanFound(deviceIdToHex(context.subject.bearer) === payload);
-	},
-	[GRANTED_CAPABILITY_IS]: (payload, context) => {
-		if (context.subject === void 0) return { found: false };
-		if (typeof payload !== "string") return { found: false };
-		return booleanFound(context.subject.capability === payload);
-	}
-};
-function booleanFound(value) {
-	return {
-		found: true,
-		value: {
-			kind: "boolean",
-			value
-		}
-	};
-}
-/** The five mandatory narrowing ops, each reading only from TokenPredicateContext -- never the delegate node's own payload, since every fact each op needs (which parent, which candidate) already travels via the context the caller constructs per evaluation, not via wire-encoded payload data. A context with no parentClaims (narrowing is being checked with nothing to narrow against) resolves every op to `false` rather than throwing -- fail-closed, matching how an indeterminate result already refuses a token. */
-const narrowingHandlers = {
-	[BEARER_IS]: (_payload, context) => {
-		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(bytesEqual(context.parentClaims.bearer, context.childIssuer));
-	},
-	[EXPIRES_AT]: (_payload, context) => {
-		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(context.candidate.expires <= context.parentClaims.expires);
-	},
-	[SCOPE_NARROWS]: (_payload, context) => {
-		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(scopeNarrows(context.parentClaims.scope, context.candidate.scope));
-	},
-	[CAPABILITY_IS]: (_payload, context) => {
-		if (context.parentClaims === void 0) return booleanFound(false);
-		return booleanFound(context.parentClaims.capability === context.candidate.capability);
-	},
-	[DEPTH_REMAINING]: (_payload, context) => {
-		if (context.parentClaims === void 0) return booleanFound(false);
-		const parentRemaining = context.parentClaims["delegations-remaining"];
-		if (parentRemaining === void 0) return booleanFound(true);
-		return booleanFound(context.candidate.delegationsRemaining !== void 0 && context.candidate.delegationsRemaining < parentRemaining);
-	}
-};
-/** `{kind:"compare", op:"eq", left:{kind:"delegate", system, payload}, right:{kind:"booleanLiteral", value:true}}` -- delegate is an ExpressionNode, not itself a PredicateNode (trilean's PredicateNodeSchema has no `delegate` member), so every predicate op is expressed this way: resolve the delegate to a boolean ComputedValue, then compare it against the literal `true`. The narrowing checks pass no payload (every fact they need arrives via context); the subject-mode systems take their comparison value as the payload. */
-function delegateIsTrue(system, payload = null) {
-	return {
-		kind: "compare",
-		op: "eq",
-		left: {
-			kind: "delegate",
-			system,
-			payload
-		},
-		right: {
-			kind: "booleanLiteral",
-			value: true
-		}
-	};
-}
-/** trilean's three required resolvers are never exercised by any node this module constructs (narrowing/conditions nodes are built entirely from `compare`+`delegate`+`booleanLiteral`, never `reference`/`lookup`/`fold`/`some`/`every`) -- these stubs exist only because `Resolvers` requires them structurally. */
-const unusedResolveValue = async () => Promise.resolve({ found: false });
-const unusedResolveLookup = async () => Promise.resolve({ found: false });
-const unusedResolveCollection = async () => Promise.resolve([]);
-/**
-* Evaluates the five mandatory narrowing predicates against parentClaims/candidate, in their historical check order, short-circuiting on and returning the first that does not hold. Returns undefined when every check holds. This is the single mechanism both mintCapabilityToken's own pre-mint check and verifyTokenChain's own delegation-chain walk call -- the two can never silently drift into different ideas of what "narrows" means, because there is now exactly one implementation of each check, not two hardcoded copies.
-*/
-async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
-	const context = {
-		childIssuer,
-		candidate,
-		parentClaims
-	};
-	const resolvers = {
-		resolveValue: unusedResolveValue,
-		resolveLookup: unusedResolveLookup,
-		resolveCollection: unusedResolveCollection,
-		resolveDelegate: async (system, payload) => {
-			if (!isNarrowingSystem(system)) return { found: false };
-			return narrowingHandlers[system](payload, context);
-		}
-	};
-	for (const system of NARROWING_SYSTEMS) {
-		const result = await evaluatePredicate(delegateIsTrue(system), context, resolvers);
-		if (result.status !== "definite" || !result.value) return system;
-	}
-}
-/**
-* Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
-*/
-async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subject) {
-	const context = subject === void 0 ? {
-		clock,
-		claims
-	} : {
-		clock,
-		claims,
-		subject
-	};
-	const resolvers = {
-		resolveValue: unusedResolveValue,
-		resolveLookup: unusedResolveLookup,
-		resolveCollection: unusedResolveCollection,
-		resolveDelegate: async (system, payload) => {
-			if (subject !== void 0 && isSubjectSystem(system)) try {
-				return await subjectHandlers[system](payload, context);
-			} catch {
-				return { found: false };
-			}
-			const handler = Object.hasOwn(extraHandlers, system) ? extraHandlers[system] : void 0;
-			if (handler === void 0) return { found: false };
-			try {
-				return await handler(payload, context);
-			} catch {
-				return { found: false };
-			}
-		}
-	};
-	for (const node of nodes) {
-		const result = await evaluatePredicate(node, context, resolvers);
-		if (result.status !== "definite" || !result.value) return {
-			ok: false,
-			reason: "not_satisfied"
-		};
-	}
-	return { ok: true };
-}
-//#endregion
-//#region src/domain/tokens.ts
-/** The capability verb of a grant-capability (wire-mesh#323): authority to mint other capability tokens, the same register manage:revoke already established for authority over tokens. */
-const MANAGE_GRANT_CAPABILITY = "manage:grant";
-/** Both link kinds walk at most this many hops before the verifier gives up, mirroring Rust's own MAX_CHAIN_DEPTH. Two colluding issuers can construct a mutually-bearing parent cycle that would otherwise recurse forever, and the authorised-by link makes the attack cheaper to mount, so TS gains the bound rather than relying on JS recursion limits. */
-const MAX_CHAIN_DEPTH = 64;
-/** RFC 9052 §4.4 Sig_structure for a COSE_Sign1 with no external AAD: ["Signature1", protected, external_aad, payload]. Exported (not just used internally by verifyTokenChain) so any other self-certifying COSE_Sign1 construction in this codebase -- e.g. threshold-subject.ts's own to-be-signed bytes for a FROST-signed capability-token/revocation-entry/handle-record/room-notice -- reuses this single construction rather than a second hand-rolled one. */
-function sig1ToBeSigned(protectedHeader, payload) {
-	return encode([
-		"Signature1",
-		protectedHeader,
-		/* @__PURE__ */ new Uint8Array(0),
-		payload
-	], cdeEncodeOptions);
-}
-/** Normalises cbor2's encode() (and any other Uint8Array<ArrayBufferLike>-typed construction) to a fresh, non-shared, whole-buffer Uint8Array<ArrayBuffer> -- what the generated schemas' concrete-typed fields require. */
-function buf(bytes) {
-	return Uint8Array.from(bytes);
-}
-function encodeBuf(value) {
-	return buf(encode(value, cdeEncodeOptions));
-}
-/** The COSE protected header every capability-token/revocation-entry envelope in this codebase actually signs over: label 1 (alg) and label 4 (kid, the issuer's own device-id) -- matching the frozen conformance vectors, not the empty header a token merely needs to verify against itself. */
-function protectedHeaderFor(identity) {
-	return encodeBuf({
-		1: identity.identityKey.alg,
-		4: identity.deviceId
-	});
-}
-/** Decodes and validates a parent token's own claims from its raw CapabilityToken tuple -- the same decode `verifyTokenChain` performs on `claims.parent`, extracted here so mint can check narrowing against a parent's real claims without duplicating the CBOR/schema plumbing. Returns undefined for anything that doesn't parse; the caller turns that into its own refusal reason since "malformed" means something different at mint time than at verify time. */
-function decodeTokenClaims(token) {
-	const [, , payload] = token;
-	if (payload === null) return void 0;
-	let decoded;
-	try {
-		decoded = decode(payload, cdeDecodeOptions);
-	} catch {
-		return;
-	}
-	const result = tokenClaimsSchema.safeParse(decoded);
-	return result.success ? result.data : void 0;
-}
-/**
-* Verifies one capability token per tokens.cddl's own documented rules: the token is a well-formed COSE_Sign1 whose signature actually verifies against its own embedded issuer-key, that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id -- no shared secret needed to check this), the token is currently valid (not expired, not before not-before, not revoked by its own issuer), and -- recursively -- any parent delegation narrows rather than widens across all three axes of authority: the parent's bearer must be this token's issuer (the delegation chain is unbroken), this token's expiry must not exceed its parent's, and this token's scope must narrow its parent's (same kind; equal-or-descendant path when the parent carries one) with an identical capability verb (the capability-verb grammar has no sub-verb relation, so a different verb is a different authority, not a narrower one). Undecodable payload bytes return "malformed" and undecodable parent bytes return "parent_invalid" -- hostile input produces a verdict, never a throw.
-*/
-async function verifyCapabilityToken(token, options) {
-	const verdict = await verifyTokenChain(token, {
-		identity: options.identity,
-		clock: options.clock,
-		revocation: options.revocation,
-		...options.extraPredicateResolvers !== void 0 ? { extraPredicateResolvers: options.extraPredicateResolvers } : {}
-	});
-	if (!verdict.ok) return verdict;
-	if (options.expectedBearer !== void 0 && !bytesEqual(verdict.claims.bearer, options.expectedBearer)) return {
-		ok: false,
-		reason: "bearer_mismatch"
-	};
-	return verdict;
-}
-/**
-* Does one recorded revocation-claims entry actually revoke targetClaims, per management.cddl's own additive obligation? Valid when EITHER the entry's own issuer equals the target token's own issuer (the original, unconditional rule -- only a token's own issuer may revoke it), OR the entry carries an `authorization` that independently verifies as an ordinary capability-token -- with `expectedBearer` set to THIS entry's own `issuer`, proving the authorization was actually granted to the party submitting this revocation, not merely referenced from someone else's -- whose own `capability` is `manage:revoke` (spec/registry/core-capabilities.md) and whose own `scope` narrows targetClaims' scope. An authorization that fails any part of this (wrong capability, scope doesn't narrow, fails ordinary verification -- expired, revoked, bad signature, bearer mismatch) makes the entry no more valid than if `authorization` were absent; it never falls back to weakening the issuer-match rule.
-*/
-async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
-	if (bytesEqual(entry.issuer, targetClaims.issuer)) return true;
-	if (entry.authorization === void 0) return false;
-	let decodedAuthorization;
-	try {
-		decodedAuthorization = decode(entry.authorization, cdeDecodeOptions);
-	} catch {
-		return false;
-	}
-	const authorizationResult = capabilityTokenSchema.safeParse(decodedAuthorization);
-	if (!authorizationResult.success) return false;
-	const authorizationVerdict = await verifyCapabilityToken(authorizationResult.data, {
-		...options,
-		expectedBearer: entry.issuer
-	});
-	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
-}
-async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen = /* @__PURE__ */ new Set()) {
-	const [protectedHeader, , payload, signature] = token;
-	if (payload === null) return {
-		ok: false,
-		reason: "malformed"
-	};
-	if (depth >= MAX_CHAIN_DEPTH) return {
-		ok: false,
-		reason: "chain_too_deep"
-	};
-	const payloadHex = bytesToHex(payload);
-	if (seen.has(payloadHex)) return {
-		ok: false,
-		reason: "chain_cycle"
-	};
-	const deeperSeen = new Set(seen).add(payloadHex);
-	let decodedClaims;
-	try {
-		decodedClaims = decode(payload, cdeDecodeOptions);
-	} catch {
-		return {
-			ok: false,
-			reason: "malformed"
-		};
-	}
-	const claimsResult = tokenClaimsSchema.safeParse(decodedClaims);
-	if (!claimsResult.success) return {
-		ok: false,
-		reason: "malformed"
-	};
-	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
-		ok: false,
-		reason: "bad_signature"
-	};
-	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
-	if (!bytesEqual(derivedIssuerId, claims.issuer)) return {
-		ok: false,
-		reason: "wrong_issuer"
-	};
-	const now = options.clock.now();
-	if (claims.expires <= now) return {
-		ok: false,
-		reason: "expired"
-	};
-	if (claims["not-before"] !== void 0 && claims["not-before"] > now) return {
-		ok: false,
-		reason: "not_yet_valid"
-	};
-	const validUntil = claims["valid-until"];
-	if (validUntil !== void 0 && validUntil <= now) return {
-		ok: false,
-		reason: "content_expired"
-	};
-	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
-	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
-		ok: false,
-		reason: "revoked"
-	};
-	if (claims.conditions !== void 0) {
-		let decodedConditions;
-		try {
-			decodedConditions = decode(claims.conditions, cdeDecodeOptions);
-		} catch {
-			return {
-				ok: false,
-				reason: "conditions_invalid"
-			};
-		}
-		const conditionsResult = conditionsListSchema.safeParse(decodedConditions);
-		if (!conditionsResult.success) return {
-			ok: false,
-			reason: "conditions_invalid"
-		};
-		if (!(await evaluateConditions(conditionsResult.data, claims, options.clock, options.extraPredicateResolvers, subjectClaims)).ok) return {
-			ok: false,
-			reason: "conditions_not_satisfied"
-		};
-	}
-	const parentBytes = claims.parent;
-	const authorisationBytes = claims["authorised-by"];
-	if (claims.capability === "manage:grant" && parentBytes !== void 0) return {
-		ok: false,
-		reason: "authorisation_invalid"
-	};
-	if (parentBytes !== void 0 && authorisationBytes !== void 0) return {
-		ok: false,
-		reason: "malformed"
-	};
-	if (parentBytes !== void 0) {
-		let decodedParent;
-		try {
-			decodedParent = decode(parentBytes, cdeDecodeOptions);
-		} catch {
-			return {
-				ok: false,
-				reason: "parent_invalid"
-			};
-		}
-		const parentResult = capabilityTokenSchema.safeParse(decodedParent);
-		if (!parentResult.success) return {
-			ok: false,
-			reason: "parent_invalid"
-		};
-		const parentVerdict = await verifyTokenChain(parentResult.data, options, void 0, depth + 1, deeperSeen);
-		if (!parentVerdict.ok) {
-			if (parentVerdict.reason === "chain_too_deep" || parentVerdict.reason === "chain_cycle") return {
-				ok: false,
-				reason: parentVerdict.reason
-			};
-			return {
-				ok: false,
-				reason: "parent_invalid"
-			};
-		}
-		const candidate = {
-			capability: claims.capability,
-			scope: claims.scope,
-			expires: claims.expires,
-			...claims["delegations-remaining"] !== void 0 ? { delegationsRemaining: claims["delegations-remaining"] } : {}
-		};
-		if (await evaluateNarrowing(parentVerdict.claims, claims.issuer, candidate) !== void 0) return {
-			ok: false,
-			reason: "delegation_exceeds_parent"
-		};
-		return {
-			ok: true,
-			claims,
-			rootIssuer: parentVerdict.rootIssuer,
-			rootIssuerKey: parentVerdict.rootIssuerKey,
-			depth: parentVerdict.depth + 1
-		};
-	}
-	if (authorisationBytes !== void 0) {
-		let decodedAuthoriser;
-		try {
-			decodedAuthoriser = decode(authorisationBytes, cdeDecodeOptions);
-		} catch {
-			return {
-				ok: false,
-				reason: "authorisation_invalid"
-			};
-		}
-		const authoriserResult = capabilityTokenSchema.safeParse(decodedAuthoriser);
-		if (!authoriserResult.success) return {
-			ok: false,
-			reason: "authorisation_invalid"
-		};
-		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, claims, depth + 1, deeperSeen);
-		if (!authoriserVerdict.ok) {
-			if (authoriserVerdict.reason === "chain_too_deep" || authoriserVerdict.reason === "chain_cycle") return {
-				ok: false,
-				reason: authoriserVerdict.reason
-			};
-			return {
-				ok: false,
-				reason: "authorisation_invalid"
-			};
-		}
-		const authoriser = authoriserVerdict.claims;
-		const grantsCapability = authoriser["grants-capability"];
-		if (!(bytesEqual(authoriser.bearer, claims.issuer) && authoriser.capability === "manage:grant" && (grantsCapability === void 0 || grantsCapability === claims.capability) && scopeNarrows(authoriser.scope, claims.scope) && claims.expires <= authoriser.expires && (authoriser["delegations-remaining"] === void 0 || claims["delegations-remaining"] !== void 0 && claims["delegations-remaining"] < authoriser["delegations-remaining"]))) return {
-			ok: false,
-			reason: "authorisation_invalid"
-		};
-		return {
-			ok: true,
-			claims,
-			rootIssuer: authoriserVerdict.rootIssuer,
-			rootIssuerKey: authoriserVerdict.rootIssuerKey,
-			depth: authoriserVerdict.depth + 1
-		};
-	}
-	return {
-		ok: true,
-		claims,
-		rootIssuer: claims.issuer,
-		rootIssuerKey: claims["issuer-key"],
-		depth: 0
-	};
-}
-/**
-* Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
-*/
-async function verifyRevocationEntry(entry, options) {
-	const [protectedHeader, , payload, signature] = entry;
-	if (payload === null) return {
-		ok: false,
-		reason: "malformed"
-	};
-	let decodedClaims;
-	try {
-		decodedClaims = decode(payload, cdeDecodeOptions);
-	} catch {
-		return {
-			ok: false,
-			reason: "malformed"
-		};
-	}
-	const claimsResult = revocationClaimsSchema.safeParse(decodedClaims);
-	if (!claimsResult.success) return {
-		ok: false,
-		reason: "malformed"
-	};
-	const claims = claimsResult.data;
-	if (!await options.identity.verify(claims["issuer-key"], sig1ToBeSigned(protectedHeader, payload), signature)) return {
-		ok: false,
-		reason: "bad_signature"
-	};
-	const derivedIssuerId = await options.identity.deriveDeviceId(claims["issuer-key"]["public-key"]);
-	if (!bytesEqual(derivedIssuerId, claims.issuer)) return {
-		ok: false,
-		reason: "wrong_issuer"
-	};
-	return {
-		ok: true,
-		claims
-	};
-}
-/** Maps evaluateNarrowing's own NarrowingSystem (the first predicate op that did not hold) to mintCapabilityToken's five distinct refusal reasons -- verifyTokenChain collapses every narrowing failure to a single "delegation_exceeds_parent", but mint has always reported which specific rule was violated, since a caller building the candidate itself benefits from knowing exactly what to fix. */
-const NARROWING_SYSTEM_TO_MINT_REFUSAL = {
-	"bearer-is": "parent_bearer_mismatch",
-	"expires-at": "expires_exceeds_parent",
-	"scope-narrows": "scope_does_not_narrow",
-	"capability-is": "capability_mismatch",
-	"depth-remaining": "delegation_exceeds_parent"
-};
-/** The narrowing arithmetic tokens.cddl's own delegation obligations require (bearer match, expiry within the parent's, scope narrows, same capability, delegations-remaining strictly less than the parent's) -- shared between mintCapabilityToken (which additionally builds and signs the resulting token) and canGrant (a pure query with no minting side effect at all), so the two can never silently drift into two different ideas of what "narrows" means. Delegates the actual check to evaluateNarrowing (token-predicates.ts), the same generic evaluator verifyTokenChain's own delegation-chain walk uses, so mint and verify share one implementation of each of the five checks rather than two hardcoded copies. Returns the specific refusal reason, or undefined when every rule is satisfied. */
-async function checkNarrowing(parentClaims, granterDeviceId, candidate) {
-	const failedSystem = await evaluateNarrowing(parentClaims, granterDeviceId, candidate);
-	return failedSystem === void 0 ? void 0 : NARROWING_SYSTEM_TO_MINT_REFUSAL[failedSystem];
-}
-/** The authorised-by link's own arithmetic (wire-mesh#323), the analogue checkNarrowing already is for the parent link: everything tokens.cddl's authorised-by obligations require, checked against a not-yet-minted candidate, shared between mintCapabilityToken and canGrantVia so the two can never drift. The authoriser's conditions are evaluated in subject mode against the candidate, the same evaluation the verifier performs against the minted child. Returns the specific refusal reason, or undefined when the authorisation holds. */
-async function checkAuthorisation(authorisingClaims, minterDeviceId, candidate) {
-	if (authorisingClaims.parent !== void 0) return "authorisation_parent_forbidden";
-	if (!bytesEqual(authorisingClaims.bearer, minterDeviceId)) return "authorisation_bearer_mismatch";
-	const grantsCapability = authorisingClaims["grants-capability"];
-	if (authorisingClaims.capability !== "manage:grant" || grantsCapability !== void 0 && grantsCapability !== candidate.capability) return "authorisation_capability_mismatch";
-	if (!scopeNarrows(authorisingClaims.scope, candidate.scope)) return "authorisation_scope_does_not_narrow";
-	if (candidate.expires > authorisingClaims.expires) return "authorisation_exceeds_authoriser";
-	const remaining = authorisingClaims["delegations-remaining"];
-	if (remaining !== void 0 && (candidate.delegationsRemaining === void 0 || candidate.delegationsRemaining >= remaining)) return "authorisation_delegation_exceeds";
-	if (authorisingClaims.conditions !== void 0) {
-		let decodedConditions;
-		try {
-			decodedConditions = decode(authorisingClaims.conditions, cdeDecodeOptions);
-		} catch {
-			return "authorisation_malformed";
-		}
-		const conditionsResult = conditionsListSchema.safeParse(decodedConditions);
-		if (!conditionsResult.success) return "authorisation_malformed";
-		if (!(await evaluateConditions(conditionsResult.data, authorisingClaims, { now: () => 0 }, {}, candidate)).ok) return "authorisation_conditions_not_satisfied";
-	}
-}
-/**
-* A pure query: could deviceId, presenting heldToken as its own delegation authority," successfully mint a delegation matching candidate right now -- without attempting (and potentially failing) a real mint just to find out. Reuses mintCapabilityToken's own narrowing arithmetic via checkNarrowing, so the two can never silently drift into different ideas of what "narrows" means.
-*
-* Deliberately narrower than a full mint attempt in one respect: this checks only the narrowing rules tokens.cddl's own delegation obligations require (bearer match, expiry, scope, capability, delegations-remaining), the same scope mintCapabilityToken itself checks a *parent* against -- it does not verify heldToken's own signature or revocation status, exactly as mintCapabilityToken never re-verifies its own parent's signature either. A caller that also needs heldToken's cryptographic validity confirmed calls verifyCapabilityToken separately.
-*
-* Async as of the predicate-list evaluator (issue #85): checkNarrowing now routes through trilean's own evaluatePredicate, which is asynchronous throughout -- there is no synchronous path through a real evaluator call, so this is a genuine, deliberate breaking change to what was previously a synchronous pure function. No existing consumer of wire-mesh-core calls canGrant (confirmed against agent-comms, the only other repo depending on this package), so there is nothing to migrate.
-*/
-async function canGrant(heldToken, deviceId, candidate, now) {
-	if (candidate.expires <= now) return false;
-	const heldClaims = decodeTokenClaims(heldToken);
-	if (heldClaims === void 0) return false;
-	return await checkNarrowing(heldClaims, deviceId, candidate) === void 0;
-}
-/** A pure query: could deviceId, presenting heldGrantCapability as its minting authority, mint a token matching candidate right now (wire-mesh#323) -- canGrant's authorised-by analogue, with the same deliberately-narrower-than-verify caveat canGrant's own doc comment states: the held token's signature and revocation status are not checked here; a caller needing those confirmed calls verifyCapabilityToken separately. The candidate carries a bearer because the authoriser's subject-mode conditions read it (the no-self-grant bar). */
-async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
-	if (candidate.expires <= now) return false;
-	const heldClaims = decodeTokenClaims(heldGrantCapability);
-	if (heldClaims === void 0) return false;
-	return await checkAuthorisation(heldClaims, deviceId, candidate) === void 0;
-}
-/**
-* Mints one capability token: builds token-claims from the given fields, signs it as a COSE_Sign1 under `identity`'s own key, with a protected header matching what the frozen conformance vectors actually encode (`{1: alg, 4: issuer device-id}`, not the empty header a token merely needs to verify against itself).
-*
-* When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
-*/
-async function mintCapabilityToken(options) {
-	if (options.expires <= options.clock.now()) return {
-		ok: false,
-		reason: "already_expired"
-	};
-	if (options.parent !== void 0 && options.authorisedBy !== void 0) return {
-		ok: false,
-		reason: "links_exclusive"
-	};
-	if (options.capability === "manage:grant" && options.parent !== void 0) return {
-		ok: false,
-		reason: "authorisation_parent_forbidden"
-	};
-	let parentBytes;
-	if (options.parent !== void 0) {
-		const parentClaims = decodeTokenClaims(options.parent);
-		if (parentClaims === void 0) return {
-			ok: false,
-			reason: "parent_malformed"
-		};
-		const refusal = await checkNarrowing(parentClaims, options.identity.deviceId, {
-			capability: options.capability,
-			scope: options.scope,
-			expires: options.expires,
-			...options.delegationsRemaining !== void 0 ? { delegationsRemaining: options.delegationsRemaining } : {}
-		});
-		if (refusal !== void 0) return {
-			ok: false,
-			reason: refusal
-		};
-		parentBytes = encodeBuf(options.parent);
-	}
-	let authorisationBytes;
-	if (options.authorisedBy !== void 0) {
-		const authorisingClaims = decodeTokenClaims(options.authorisedBy);
-		if (authorisingClaims === void 0) return {
-			ok: false,
-			reason: "authorisation_malformed"
-		};
-		const refusal = await checkAuthorisation(authorisingClaims, options.identity.deviceId, {
-			capability: options.capability,
-			scope: options.scope,
-			bearer: options.bearer,
-			expires: options.expires,
-			...options.delegationsRemaining !== void 0 ? { delegationsRemaining: options.delegationsRemaining } : {}
-		});
-		if (refusal !== void 0) return {
-			ok: false,
-			reason: refusal
-		};
-		authorisationBytes = encodeBuf(options.authorisedBy);
-	}
-	const payload = encodeBuf({
-		"token-id": options.tokenId,
-		issuer: options.identity.deviceId,
-		"issuer-key": options.identity.identityKey,
-		bearer: options.bearer,
-		capability: options.capability,
-		scope: options.scope,
-		expires: options.expires,
-		...options.notBefore !== void 0 ? { "not-before": options.notBefore } : {},
-		...parentBytes !== void 0 ? { parent: parentBytes } : {},
-		...options.delegationsRemaining !== void 0 ? { "delegations-remaining": options.delegationsRemaining } : {},
-		...options.conditions !== void 0 ? { conditions: encodeBuf(options.conditions) } : {},
-		...authorisationBytes !== void 0 ? { "authorised-by": authorisationBytes } : {},
-		...options.grantsCapability !== void 0 ? { "grants-capability": options.grantsCapability } : {},
-		...options.requestsCapability !== void 0 ? { "requests-capability": options.requestsCapability } : {}
-	});
-	const protectedHeader = protectedHeaderFor(options.identity);
-	return {
-		ok: true,
-		token: [
-			protectedHeader,
-			{},
-			payload,
-			await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
-		]
-	};
-}
-/** Mints one revocation-entry (management.cddl): a COSE_Sign1 over revocation-claims, signed the same way mintCapabilityToken signs a token. No narrowing chain to check -- a revocation entry has no parent and cannot fail to be issuable the way a delegated token can, so this returns the entry directly rather than a verdict. */
-async function mintRevocationEntry(options) {
-	const payload = encodeBuf({
-		"token-id": options.tokenId,
-		issuer: options.identity.deviceId,
-		"issuer-key": options.identity.identityKey,
-		"revoked-at": options.revokedAt
-	});
-	const protectedHeader = protectedHeaderFor(options.identity);
-	return [
-		protectedHeader,
-		{},
-		payload,
-		await options.identity.sign(sig1ToBeSigned(protectedHeader, payload))
-	];
-}
-//#endregion
-export { mintRevocationEntry as a, verifyRevocationEntry as c, mintCapabilityToken as i, canGrant as n, sig1ToBeSigned as o, canGrantVia as r, verifyCapabilityToken as s, MANAGE_GRANT_CAPABILITY as t };