wire-mesh-core 4.0.3 → 4.0.4

package/dist/domain/mesh-session.cjs

@@ -131,7 +131,7 @@ function ivFor(counter) {
 function associatedData(sender, recipient, counter) {
 	return concat(DATA_CONTEXT, sender, recipient, counterBytes(counter));
 }
-async function deriveDirectionKey(secret, salt, low, high, label) {
+async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	const material = await crypto.subtle.importKey("raw", Uint8Array.from(secret), "HKDF", false, ["deriveKey"]);
 	return crypto.subtle.deriveKey({
 		name: "HKDF",
@@ -163,8 +163,20 @@ async function establishChannel(identity, pending, remote, peer) {
 	const low = localIsLow ? identity.deviceId : peer.deviceId;
 	const high = localIsLow ? peer.deviceId : identity.deviceId;
 	const salt = concat(localIsLow ? pending.hello.nonce : remote.nonce, localIsLow ? remote.nonce : pending.hello.nonce);
-	const lowToHigh = await deriveDirectionKey(secret, salt, low, high, LABEL_LOW_TO_HIGH);
-	const highToLow = await deriveDirectionKey(secret, salt, low, high, LABEL_HIGH_TO_LOW);
+	const lowToHigh = await deriveDirectionKey({
+		secret,
+		salt,
+		low,
+		high,
+		label: LABEL_LOW_TO_HIGH
+	});
+	const highToLow = await deriveDirectionKey({
+		secret,
+		salt,
+		low,
+		high,
+		label: LABEL_HIGH_TO_LOW
+	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
 	let nextSendCounter = 0;
@@ -194,7 +206,7 @@ async function establishChannel(identity, pending, remote, peer) {
 		} catch {
 			return;
 		}
-		highestReceived = data.counter;
+		highestReceived = Math.max(highestReceived, data.counter);
 		return require_adapters_frame_codec.tryDecodeFrame(plaintext) ?? void 0;
 	}
 	return {
@@ -479,16 +491,17 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			frame
 		});
 		if (frame.type === "handshake") applyRemoteHandshake(frame);
-		else if (frame.type === "gossip") for (const advert of frame.peers) {
-			if (!await require_domain_peer_advert.verifyPeerAdvert(identity, advert)) continue;
-			directory.set(require_domain_device_id.deviceIdToHex(advert.device), {
-				device: advert.device,
-				advert
-			});
-			topology.recordAdvert(advert.device);
-			onPeerAdvert?.(advert);
-		}
-		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
+		else if (frame.type === "gossip") {
+			const verdicts = await Promise.all(frame.peers.map(async (advert) => require_domain_peer_advert.verifyPeerAdvert(identity, advert)));
+			for (const advert of frame.peers.filter((_, i) => verdicts[i] === true)) {
+				directory.set(require_domain_device_id.deviceIdToHex(advert.device), {
+					device: advert.device,
+					advert
+				});
+				topology.recordAdvert(advert.device);
+				onPeerAdvert?.(advert);
+			}
+		} else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());

package/dist/domain/mesh-session.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
 export declare const HANDSHAKE_TIMEOUT_MS = 3000;

package/dist/domain/mesh-session.mjs

@@ -130,7 +130,7 @@ function ivFor(counter) {
 function associatedData(sender, recipient, counter) {
 	return concat(DATA_CONTEXT, sender, recipient, counterBytes(counter));
 }
-async function deriveDirectionKey(secret, salt, low, high, label) {
+async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	const material = await crypto.subtle.importKey("raw", Uint8Array.from(secret), "HKDF", false, ["deriveKey"]);
 	return crypto.subtle.deriveKey({
 		name: "HKDF",
@@ -162,8 +162,20 @@ async function establishChannel(identity, pending, remote, peer) {
 	const low = localIsLow ? identity.deviceId : peer.deviceId;
 	const high = localIsLow ? peer.deviceId : identity.deviceId;
 	const salt = concat(localIsLow ? pending.hello.nonce : remote.nonce, localIsLow ? remote.nonce : pending.hello.nonce);
-	const lowToHigh = await deriveDirectionKey(secret, salt, low, high, LABEL_LOW_TO_HIGH);
-	const highToLow = await deriveDirectionKey(secret, salt, low, high, LABEL_HIGH_TO_LOW);
+	const lowToHigh = await deriveDirectionKey({
+		secret,
+		salt,
+		low,
+		high,
+		label: LABEL_LOW_TO_HIGH
+	});
+	const highToLow = await deriveDirectionKey({
+		secret,
+		salt,
+		low,
+		high,
+		label: LABEL_HIGH_TO_LOW
+	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
 	let nextSendCounter = 0;
@@ -193,7 +205,7 @@ async function establishChannel(identity, pending, remote, peer) {
 		} catch {
 			return;
 		}
-		highestReceived = data.counter;
+		highestReceived = Math.max(highestReceived, data.counter);
 		return tryDecodeFrame(plaintext) ?? void 0;
 	}
 	return {
@@ -478,16 +490,17 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			frame
 		});
 		if (frame.type === "handshake") applyRemoteHandshake(frame);
-		else if (frame.type === "gossip") for (const advert of frame.peers) {
-			if (!await verifyPeerAdvert(identity, advert)) continue;
-			directory.set(deviceIdToHex(advert.device), {
-				device: advert.device,
-				advert
-			});
-			topology.recordAdvert(advert.device);
-			onPeerAdvert?.(advert);
-		}
-		else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
+		else if (frame.type === "gossip") {
+			const verdicts = await Promise.all(frame.peers.map(async (advert) => verifyPeerAdvert(identity, advert)));
+			for (const advert of frame.peers.filter((_, i) => verdicts[i] === true)) {
+				directory.set(deviceIdToHex(advert.device), {
+					device: advert.device,
+					advert
+				});
+				topology.recordAdvert(advert.device);
+				onPeerAdvert?.(advert);
+			}
+		} else if (frame.type === "relay-inbound") relayPairings.add(frame["source-device"]);
 		else if (frame.type === "manage-response") applyManageResponse(frame);
 		else if (frame.type === "manage-request") applyManageRequest(frame);
 		else if (frame.type === "pong") pingRoundTrips.resolveOldest(clock.now());

package/dist/domain/notice-board.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
+const require_sequential = require("../sequential-CtQVlW8M.cjs");
 const require_domain_data_sync = require("./data-sync.cjs");
 const require_domain_group_key = require("./group-key.cjs");
 const require_domain_room = require("./room.cjs");
@@ -59,7 +60,9 @@ function createNoticeBoard(options) {
 	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await require_domain_data_sync.readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
+		await require_sequential.eachInOrder(entries, async (entry) => {
+			out.push(await readOne(entry, room, dmRootPolicy));
+		});
 		return out;
 	}
 	async function readOne(entry, room, dmRootPolicy) {

package/dist/domain/notice-board.d.cts

@@ -1,7 +1,7 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";
 //#region src/domain/notice-board.d.ts

package/dist/domain/notice-board.d.mts

@@ -1,7 +1,7 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as KeyValueStorage } from "../storage-B403CRyu.mjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";
 //#region src/domain/notice-board.d.ts

package/dist/domain/notice-board.mjs

@@ -1,4 +1,5 @@
 import { roomNoticeSchema } from "../generated/protocol.mjs";
+import { t as eachInOrder } from "../sequential-D_W3THly.mjs";
 import { appendOwnEntry, handleDataEntries, headSeqFor, readEntries } from "./data-sync.mjs";
 import { decryptNoticeContent, encryptNoticeContent, encryptedContentType, isEncryptedContentType, plaintextContentType } from "./group-key.mjs";
 import { createRoomNotice, verifyRoomNotice } from "./room.mjs";
@@ -58,7 +59,9 @@ function createNoticeBoard(options) {
 	async function readLog(peer, room, dmRootPolicy) {
 		const entries = await readEntries(storage, peer, 0);
 		const out = [];
-		for (const entry of entries) out.push(await readOne(entry, room, dmRootPolicy));
+		await eachInOrder(entries, async (entry) => {
+			out.push(await readOne(entry, room, dmRootPolicy));
+		});
 		return out;
 	}
 	async function readOne(entry, room, dmRootPolicy) {

package/dist/domain/path-trace.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 //#region src/domain/path-trace.d.ts
 /** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */

package/dist/domain/path-trace.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, H as ManageCommandParams, Q as PathTrace, V as ManageCommand, f as CapabilityScope, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 //#region src/domain/path-trace.d.ts
 /** path:trace names no real capability -- see spec/management.cddl's own comment -- and is registered purely as a namespaced wire identifier so manage-command.verb's own capability-verb grammar has something syntactically valid to carry (registry/core-capabilities.md). */

package/dist/domain/relay-hub.cjs

@@ -49,6 +49,9 @@ function createRelayHub(options) {
 		mostRecentPairing.set(a, b);
 		mostRecentPairing.set(b, a);
 	}
+	function forgetPairingsWith(own, connection) {
+		for (const [key, paired] of own) if (paired === connection) own.delete(key);
+	}
 	function forgetConnection(connection) {
 		connections.delete(connection);
 		for (const [key, registration] of devices) if (registration.connection === connection) devices.delete(key);
@@ -59,9 +62,7 @@ function createRelayHub(options) {
 		if (own) {
 			for (const peer of own.values()) {
 				const peerOwn = pairings.get(peer);
-				if (peerOwn) {
-					for (const [key, paired] of peerOwn) if (paired === connection) peerOwn.delete(key);
-				}
+				if (peerOwn) forgetPairingsWith(peerOwn, connection);
 				if (mostRecentPairing.get(peer) === connection) mostRecentPairing.delete(peer);
 				stateChanged(peer);
 			}
@@ -142,8 +143,9 @@ function createRelayHub(options) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
 			const accepted = [];
-			for (const advert of frame.peers) {
-				if (!await require_domain_peer_advert.verifyPeerAdvert(options.identity, advert)) continue;
+			const verified = await Promise.all(frame.peers.map(async (advert) => await require_domain_peer_advert.verifyPeerAdvert(options.identity, advert) ? advert : void 0));
+			for (const advert of verified) {
+				if (advert === void 0) continue;
 				if (options.extensionPolicy !== void 0) {
 					const verdict = require_domain_advert_extension_policy.checkAdvertExtensions(advert, options.extensionPolicy);
 					if (!verdict.ok) {
@@ -175,12 +177,15 @@ function createRelayHub(options) {
 				type: "gossip",
 				peers: accepted
 			};
-			for (const other of connections) {
-				if (other === connection) continue;
-				try {
-					await other.send(forwarded);
+			const forwardTo = async (remaining) => {
+				const next = remaining.next();
+				if (next.done === true) return;
+				if (next.value !== connection) try {
+					await next.value.send(forwarded);
 				} catch {}
-			}
+				await forwardTo(remaining);
+			};
+			await forwardTo(connections.values());
 			const catchUp = [];
 			for (const registration of devices.values()) if (registration.connection !== connection) catchUp.push(registration.advert);
 			if (catchUp.length > 0 && connection !== uplink) try {

package/dist/domain/relay-hub.mjs

@@ -48,6 +48,9 @@ function createRelayHub(options) {
 		mostRecentPairing.set(a, b);
 		mostRecentPairing.set(b, a);
 	}
+	function forgetPairingsWith(own, connection) {
+		for (const [key, paired] of own) if (paired === connection) own.delete(key);
+	}
 	function forgetConnection(connection) {
 		connections.delete(connection);
 		for (const [key, registration] of devices) if (registration.connection === connection) devices.delete(key);
@@ -58,9 +61,7 @@ function createRelayHub(options) {
 		if (own) {
 			for (const peer of own.values()) {
 				const peerOwn = pairings.get(peer);
-				if (peerOwn) {
-					for (const [key, paired] of peerOwn) if (paired === connection) peerOwn.delete(key);
-				}
+				if (peerOwn) forgetPairingsWith(peerOwn, connection);
 				if (mostRecentPairing.get(peer) === connection) mostRecentPairing.delete(peer);
 				stateChanged(peer);
 			}
@@ -141,8 +142,9 @@ function createRelayHub(options) {
 		if (frame.type === "gossip") {
 			const supplanted = /* @__PURE__ */ new Set();
 			const accepted = [];
-			for (const advert of frame.peers) {
-				if (!await verifyPeerAdvert(options.identity, advert)) continue;
+			const verified = await Promise.all(frame.peers.map(async (advert) => await verifyPeerAdvert(options.identity, advert) ? advert : void 0));
+			for (const advert of verified) {
+				if (advert === void 0) continue;
 				if (options.extensionPolicy !== void 0) {
 					const verdict = checkAdvertExtensions(advert, options.extensionPolicy);
 					if (!verdict.ok) {
@@ -174,12 +176,15 @@ function createRelayHub(options) {
 				type: "gossip",
 				peers: accepted
 			};
-			for (const other of connections) {
-				if (other === connection) continue;
-				try {
-					await other.send(forwarded);
+			const forwardTo = async (remaining) => {
+				const next = remaining.next();
+				if (next.done === true) return;
+				if (next.value !== connection) try {
+					await next.value.send(forwarded);
 				} catch {}
-			}
+				await forwardTo(remaining);
+			};
+			await forwardTo(connections.values());
 			const catchUp = [];
 			for (const registration of devices.values()) if (registration.connection !== connection) catchUp.push(registration.advert);
 			if (catchUp.length > 0 && connection !== uplink) try {

package/dist/domain/room-rekey.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 //#region src/domain/room-rekey.d.ts

package/dist/domain/room-rekey.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 //#region src/domain/room-rekey.d.ts

package/dist/domain/room.d.cts

@@ -1,6 +1,6 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";
 //#region src/domain/room.d.ts

package/dist/domain/room.d.mts

@@ -1,6 +1,6 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";
 //#region src/domain/room.d.ts

package/dist/domain/token-predicates.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_domain_device_id = require("./device-id.cjs");
+const require_sequential = require("../sequential-CtQVlW8M.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 let zod = require("zod");
 let trilean = require("trilean");
@@ -125,10 +126,10 @@ async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
 			return narrowingHandlers[system](payload, context);
 		}
 	};
-	for (const system of NARROWING_SYSTEMS) {
+	return require_sequential.firstAsync(NARROWING_SYSTEMS, async (system) => {
 		const result = await (0, trilean.evaluatePredicate)(delegateIsTrue(system), context, resolvers);
-		if (result.status !== "definite" || !result.value) return system;
-	}
+		return result.status !== "definite" || !result.value;
+	});
 }
 /**
 * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
@@ -161,14 +162,13 @@ async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subj
 			}
 		}
 	};
-	for (const node of nodes) {
+	return await require_sequential.firstAsync(nodes, async (node) => {
 		const result = await (0, trilean.evaluatePredicate)(node, context, resolvers);
-		if (result.status !== "definite" || !result.value) return {
-			ok: false,
-			reason: "not_satisfied"
-		};
-	}
-	return { ok: true };
+		return result.status !== "definite" || !result.value;
+	}) === void 0 ? { ok: true } : {
+		ok: false,
+		reason: "not_satisfied"
+	};
 }
 //#endregion
 exports.BEARER_IS = BEARER_IS;

package/dist/domain/token-predicates.d.cts

@@ -1,2 +1,2 @@
-import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-D4NNPLnp.cjs";
+import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-lg4TtUxm.cjs";
 export { BEARER_IS, CAPABILITY_IS, ConditionsContext, ConditionsVerdict, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, GrantSubject, NarrowingCandidate, NarrowingSystem, SCOPE_NARROWS, SubjectSystem, TokenDelegateHandler, TokenPredicateContext, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/domain/token-predicates.d.mts

@@ -1,2 +1,2 @@
-import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-DqpG8VZZ.mjs";
+import { _ as evaluateConditions, a as DEPTH_REMAINING, c as GRANTEE_IS, d as NarrowingSystem, f as SCOPE_NARROWS, g as conditionsListSchema, h as TokenPredicateContext, i as ConditionsVerdict, l as GrantSubject, m as TokenDelegateHandler, n as CAPABILITY_IS, o as EXPIRES_AT, p as SubjectSystem, r as ConditionsContext, s as GRANTED_CAPABILITY_IS, t as BEARER_IS, u as NarrowingCandidate, v as evaluateNarrowing, y as noSelfGrantBar } from "../token-predicates-CrieP1WI.mjs";
 export { BEARER_IS, CAPABILITY_IS, ConditionsContext, ConditionsVerdict, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, GrantSubject, NarrowingCandidate, NarrowingSystem, SCOPE_NARROWS, SubjectSystem, TokenDelegateHandler, TokenPredicateContext, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/domain/token-predicates.mjs

@@ -1,4 +1,5 @@
 import { deviceIdToHex } from "./device-id.mjs";
+import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
 import { z } from "zod";
 import { PredicateNodeSchema, evaluatePredicate } from "trilean";
@@ -124,10 +125,10 @@ async function evaluateNarrowing(parentClaims, childIssuer, candidate) {
 			return narrowingHandlers[system](payload, context);
 		}
 	};
-	for (const system of NARROWING_SYSTEMS) {
+	return firstAsync(NARROWING_SYSTEMS, async (system) => {
 		const result = await evaluatePredicate(delegateIsTrue(system), context, resolvers);
-		if (result.status !== "definite" || !result.value) return system;
-	}
+		return result.status !== "definite" || !result.value;
+	});
 }
 /**
 * Evaluates token-claims' own `conditions` field (issue #85): additional, issuer-chosen predicates strictly additive to the five mandatory narrowing checks above, which are computed structurally (from a delegated token's own claims and its parent's) and never read from this field -- the five built-ins are inherently about a parent/child relationship, so they are not meaningfully reusable inside a bare, parent-less conditions evaluation, unlike a genuine domain-specific condition (a message TTL, #84's future revoke-authorization check) which reasons about the presented token's own claims directly. `extraHandlers` is the registration point for those: none exist yet, so a `conditions` entry naming any system with no registered handler resolves `{found: false}` -- indeterminate, fail-closed. Absent `nodes` (an empty array, the caller's own signal for "no conditions field present") is trivially `{ok: true}` -- no extra restrictions, exactly today's behaviour. Every entry MUST evaluate to a definite `true`; the loop short-circuits on the first indeterminate or false result.
@@ -160,14 +161,13 @@ async function evaluateConditions(nodes, claims, clock, extraHandlers = {}, subj
 			}
 		}
 	};
-	for (const node of nodes) {
+	return await firstAsync(nodes, async (node) => {
 		const result = await evaluatePredicate(node, context, resolvers);
-		if (result.status !== "definite" || !result.value) return {
-			ok: false,
-			reason: "not_satisfied"
-		};
-	}
-	return { ok: true };
+		return result.status !== "definite" || !result.value;
+	}) === void 0 ? { ok: true } : {
+		ok: false,
+		reason: "not_satisfied"
+	};
 }
 //#endregion
 export { BEARER_IS, CAPABILITY_IS, DEPTH_REMAINING, EXPIRES_AT, GRANTED_CAPABILITY_IS, GRANTEE_IS, SCOPE_NARROWS, conditionsListSchema, evaluateConditions, evaluateNarrowing, noSelfGrantBar };

package/dist/domain/tokens.cjs

@@ -1,6 +1,7 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_generated_protocol = require("../generated/protocol.cjs");
 const require_domain_device_id = require("./device-id.cjs");
+const require_sequential = require("../sequential-CtQVlW8M.cjs");
 const require_domain_token_scope = require("./token-scope.cjs");
 const require_domain_token_predicates = require("./token-predicates.cjs");
 let cbor2 = require("cbor2");
@@ -82,7 +83,11 @@ async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
 	});
 	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && require_domain_token_scope.scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
 }
-async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen = /* @__PURE__ */ new Set()) {
+const LEAF_LINK = {
+	depth: 0,
+	seen: /* @__PURE__ */ new Set()
+};
+async function verifyTokenChain(token, options, { subjectClaims, depth, seen } = LEAF_LINK) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
 		ok: false,
@@ -137,7 +142,7 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 		reason: "content_expired"
 	};
 	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
-	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
+	if (await require_sequential.firstAsync(revocationEntries, async (entry) => revocationEntryGrantsRevoke(entry, claims, options)) !== void 0) return {
 		ok: false,
 		reason: "revoked"
 	};
@@ -186,7 +191,10 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 			ok: false,
 			reason: "parent_invalid"
 		};
-		const parentVerdict = await verifyTokenChain(parentResult.data, options, void 0, depth + 1, deeperSeen);
+		const parentVerdict = await verifyTokenChain(parentResult.data, options, {
+			depth: depth + 1,
+			seen: deeperSeen
+		});
 		if (!parentVerdict.ok) {
 			if (parentVerdict.reason === "chain_too_deep" || parentVerdict.reason === "chain_cycle") return {
 				ok: false,
@@ -230,7 +238,11 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 			ok: false,
 			reason: "authorisation_invalid"
 		};
-		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, claims, depth + 1, deeperSeen);
+		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, {
+			subjectClaims: claims,
+			depth: depth + 1,
+			seen: deeperSeen
+		});
 		if (!authoriserVerdict.ok) {
 			if (authoriserVerdict.reason === "chain_too_deep" || authoriserVerdict.reason === "chain_cycle") return {
 				ok: false,

package/dist/domain/tokens.d.cts

@@ -1,7 +1,7 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.cjs";
 import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
-import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-D4NNPLnp.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
+import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-lg4TtUxm.cjs";
 import { PredicateNode } from "trilean";
 //#region src/domain/tokens.d.ts
 /** The capability verb of a grant-capability (wire-mesh#323): authority to mint other capability tokens, the same register manage:revoke already established for authority over tokens. */

package/dist/domain/tokens.d.mts

@@ -1,7 +1,7 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.mjs";
 import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
-import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-DqpG8VZZ.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
+import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-CrieP1WI.mjs";
 import { PredicateNode } from "trilean";
 //#region src/domain/tokens.d.ts
 /** The capability verb of a grant-capability (wire-mesh#323): authority to mint other capability tokens, the same register manage:revoke already established for authority over tokens. */

package/dist/domain/tokens.mjs

@@ -1,5 +1,6 @@
 import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
+import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
 import { conditionsListSchema, evaluateConditions, evaluateNarrowing } from "./token-predicates.mjs";
 import { cdeDecodeOptions, cdeEncodeOptions, decode, encode } from "cbor2";
@@ -81,7 +82,11 @@ async function revocationEntryGrantsRevoke(entry, targetClaims, options) {
 	});
 	return authorizationVerdict.ok && authorizationVerdict.claims.capability === "manage:revoke" && scopeNarrows(authorizationVerdict.claims.scope, targetClaims.scope);
 }
-async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen = /* @__PURE__ */ new Set()) {
+const LEAF_LINK = {
+	depth: 0,
+	seen: /* @__PURE__ */ new Set()
+};
+async function verifyTokenChain(token, options, { subjectClaims, depth, seen } = LEAF_LINK) {
 	const [protectedHeader, , payload, signature] = token;
 	if (payload === null) return {
 		ok: false,
@@ -136,7 +141,7 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 		reason: "content_expired"
 	};
 	const revocationEntries = await options.revocation.entriesFor(claims["token-id"]);
-	for (const entry of revocationEntries) if (await revocationEntryGrantsRevoke(entry, claims, options)) return {
+	if (await firstAsync(revocationEntries, async (entry) => revocationEntryGrantsRevoke(entry, claims, options)) !== void 0) return {
 		ok: false,
 		reason: "revoked"
 	};
@@ -185,7 +190,10 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 			ok: false,
 			reason: "parent_invalid"
 		};
-		const parentVerdict = await verifyTokenChain(parentResult.data, options, void 0, depth + 1, deeperSeen);
+		const parentVerdict = await verifyTokenChain(parentResult.data, options, {
+			depth: depth + 1,
+			seen: deeperSeen
+		});
 		if (!parentVerdict.ok) {
 			if (parentVerdict.reason === "chain_too_deep" || parentVerdict.reason === "chain_cycle") return {
 				ok: false,
@@ -229,7 +237,11 @@ async function verifyTokenChain(token, options, subjectClaims, depth = 0, seen =
 			ok: false,
 			reason: "authorisation_invalid"
 		};
-		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, claims, depth + 1, deeperSeen);
+		const authoriserVerdict = await verifyTokenChain(authoriserResult.data, options, {
+			subjectClaims: claims,
+			depth: depth + 1,
+			seen: deeperSeen
+		});
 		if (!authoriserVerdict.ok) {
 			if (authoriserVerdict.reason === "chain_too_deep" || authoriserVerdict.reason === "chain_cycle") return {
 				ok: false,

package/dist/ports/clock.d.cts

@@ -1,2 +1,2 @@
-import { t as Clock } from "../clock-DiSx-WKM.cjs";
+import { t as Clock } from "../clock-DhUPRfLh.cjs";
 export { Clock };

package/dist/ports/clock.d.mts

@@ -1,2 +1,2 @@
-import { t as Clock } from "../clock-DiSx-WKM.mjs";
+import { t as Clock } from "../clock-DhUPRfLh.mjs";
 export { Clock };

package/dist/ports/storage.d.cts

@@ -1,2 +1,2 @@
-import { t as KeyValueStorage } from "../storage-B403CRyu.cjs";
+import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
 export { KeyValueStorage };