wire-mesh-core 4.0.8 → 4.1.1

package/dist/domain/mesh-session.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.cjs";
 import { r as Transport, t as Connection } from "../transport-gDbSHO-r.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -136,7 +136,9 @@ addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
-onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
+/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
+onLocalFault?: (error: unknown) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, E as DataRequestFrame, N as Frame, T as DataHaveFrame, U as ManageError, V as ManageCommand, W as ManageOk, bt as RevocationEntry, et as PeerAdvert, f as CapabilityScope, g as CoordinatorFrame, lt as ProtocolVersion, nn as TopologyPeers, p as CapabilityToken, w as DataEntriesFrame } from "../protocol-DzmpxxUr.mjs";
 import { r as Transport, t as Connection } from "../transport-bD3p_TO_.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 //#region src/domain/mesh-session.d.ts
 /** How long to wait for the node's handshake before calling it unanswered. A relay-only node never sends one; that is a state to display, not an error. */
@@ -136,7 +136,9 @@ addresses?: readonly string[],
 /** Fired for every peer-advert entry as it's applied to the directory, regardless of source -- the hook a gossip-expansion consumer (wire-mesh#187, gossip-expansion.ts's own createGossipExpansion) uses to observe newly-gossiped peers without becoming a second, competing consumer of this session's own single-reader events stream (each emitted SessionEvent wakes at most one waiter, so a second for-await loop over events would silently steal events from whichever consumer already reads it). Omit for a caller with no use for it, exactly today's behaviour. */
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
-onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>): MeshSession;
+onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
+/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
+onLocalFault?: (error: unknown) => void): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -1,10 +1,12 @@
 import { messageFromFrame, tryDecodeFrame, wrapRelayData } from "../adapters/frame-codec.mjs";
+import { IdentityKeyError } from "../ports/identity.mjs";
 import { deviceIdToHex } from "./device-id.mjs";
 import { bytesEqual } from "./token-scope.mjs";
 import { a as OWN_VERSION, i as CORE_VERSION_GOSSIP_KEY, n as TOPOLOGY_PEERS_GOSSIP_KEY, o as isVersionGetCommand, r as validateGossipExtensions, s as versionGetOutcome } from "../gossip-extensions-B6WJjkAr.mjs";
 import { signPeerAdvert, verifyPeerAdvert } from "./peer-advert.mjs";
 import { createAsyncQueue } from "./async-queue.mjs";
-import { negotiate } from "./handshake.mjs";
+import { ChannelExhaustedError } from "./channel-exhausted-error.mjs";
+import { localHandshake, negotiate } from "./handshake.mjs";
 import { isDataFrame } from "./hub-mailbox.mjs";
 import { createPingRoundTrips } from "./ping-round-trips.mjs";
 import { createTopologySnapshotTracker } from "./topology-snapshot.mjs";
@@ -26,6 +28,19 @@ function createRelayPairings() {
 	};
 }
 //#endregion
+//#region src/domain/bounded-log.ts
+/** A log that keeps only its most recent `window` entries: newest at the end, the oldest dropped once the window is full. Pure and closure-free, split out of mesh-session.ts to keep that file under this repo's max-lines lint budget; nothing here is session-shaped. */
+function createBoundedLog(window) {
+	const log = [];
+	return {
+		record: (entry) => {
+			log.push(entry);
+			if (log.length > window) log.splice(0, log.length - window);
+		},
+		entries: () => [...log]
+	};
+}
+//#endregion
 //#region src/domain/secure-channel.ts
 /**
 * The end-to-end channel two devices open between themselves inside a relay pairing (spec/secure-channel.cddl). A relay only forwards the bytes of a `relay-data` frame, and without this it could read them, alter them, and say who sent them. Here the two devices authenticate each other's identity keys over a fresh ECDH exchange, derive one AES-256-GCM key per direction, and seal every frame they exchange so the relay sees ciphertext and every receiver learns the sender's identity from the handshake and nothing a relay asserts.
@@ -95,16 +110,16 @@ async function beginHandshake(identity, peer) {
 	};
 }
 /**
-* Checks a received hello: its identity key must hash to a device-id (which is then the peer), it must be addressed to this device, and its signature must verify under that key over the input spec/secure-channel.cddl defines. Never throws: a hostile hello gets a verdict.
+* Checks a received hello: it must be addressed to this device, its identity key must be a usable key, and its signature must verify under that key over the input spec/secure-channel.cddl defines. A hostile hello gets a verdict. An error from the identity port that is not an IdentityKeyError is a failure of the port, not a verdict about the peer, and propagates.
 */
 async function verifyHello(identity, hello) {
 	const key = hello["identity-key"];
+	const sender = await identity.deriveDeviceId(key["public-key"]);
+	if (!bytesEqual(hello["to-device"], identity.deviceId)) return {
+		ok: false,
+		reason: "wrong_recipient"
+	};
 	try {
-		const sender = await identity.deriveDeviceId(key["public-key"]);
-		if (!bytesEqual(hello["to-device"], identity.deviceId)) return {
-			ok: false,
-			reason: "wrong_recipient"
-		};
 		return await identity.verify(key, helloSigningInput(hello["ephemeral-key"], hello.nonce, sender, identity.deviceId), hello.signature) ? {
 			ok: true,
 			peer: {
@@ -115,13 +130,30 @@ async function verifyHello(identity, hello) {
 			ok: false,
 			reason: "bad_signature"
 		};
-	} catch {
+	} catch (error) {
+		if (!(error instanceof IdentityKeyError)) throw error;
 		return {
 			ok: false,
-			reason: "identity_mismatch"
+			reason: error.fault === "unsupported_alg" ? "unsupported_identity_alg" : "invalid_identity_key"
 		};
 	}
 }
+/** The largest counter a channel uses: the counter is an unsigned 64-bit integer on the wire, and this implementation holds it as a JavaScript number, exact up to this value. A frame above it is refused at decoding, never truncated, and sealing refuses to go past it, never wraps. */
+const MAX_COUNTER = Number.MAX_SAFE_INTEGER;
+/** Throws a RangeError unless `counter` is a counter a channel can start from: a non-negative safe integer. */
+function assertFirstSendCounter(counter) {
+	if (!Number.isSafeInteger(counter) || counter < 0) throw new RangeError("firstSendCounter must be a non-negative safe integer");
+}
+/**
+* Takes the next send counter from `next`, the counter the next seal would use: returns it with the counter that follows. Throws once `next` is past MAX_COUNTER, since a counter that cannot be held exactly would repeat an IV under the same key.
+*/
+function claimSendCounter(next) {
+	if (next > MAX_COUNTER) throw new ChannelExhaustedError();
+	return {
+		counter: next,
+		next: next + 1
+	};
+}
 function ivFor(counter) {
 	const iv = new Uint8Array(GCM_IV_BYTE_LENGTH);
 	iv.set(counterBytes(counter), IV_COUNTER_OFFSET);
@@ -143,11 +175,10 @@ async function deriveDirectionKey({ secret, salt, low, high, label }) {
 	}, false, ["encrypt", "decrypt"]);
 }
 /**
-* Completes a handshake once the peer's hello has verified: derives the two directional keys from the ECDH result of the ephemeral keys and returns the channel. Returns undefined when the peer's ephemeral key is not a valid P-256 point, which only a hostile or broken peer sends.
-*
-* `peer` is the device verifyHello authenticated for `remote`, and `pending` is this side's own half, whether the handshake was begun here or in answer to that hello.
+* establishChannel with its inputs in one object, and the one extra that tests need: where this end's send counter starts. This module is not a published entry (it is in tsdown.config.ts's INTERNAL_MODULES) and the session never passes `firstSendCounter`, so every real channel starts at 0; a test passes a counter near MAX_COUNTER to reach the bound without sealing 2^53 frames.
 */
-async function establishChannel(identity, pending, remote, peer) {
+async function establishChannelFrom(identity, { pending, remote, peer, firstSendCounter = 0 }) {
+	assertFirstSendCounter(firstSendCounter);
 	let secret;
 	try {
 		const remoteKey = await crypto.subtle.importKey("raw", Uint8Array.from(remote["ephemeral-key"]), ECDH_PARAMS, false, []);
@@ -178,7 +209,7 @@ async function establishChannel(identity, pending, remote, peer) {
 	});
 	const sendKey = localIsLow ? lowToHigh : highToLow;
 	const receiveKey = localIsLow ? highToLow : lowToHigh;
-	let nextSendCounter = 0;
+	let nextSendCounter = firstSendCounter;
 	let highestReceived = -1;
 	let sealing = Promise.resolve();
 	let opening = Promise.resolve();
@@ -194,7 +225,10 @@ async function establishChannel(identity, pending, remote, peer) {
 		};
 	}
 	async function openOne(data) {
-		if (data.counter <= highestReceived) return void 0;
+		if (data.counter <= highestReceived) return {
+			ok: false,
+			reason: "replayed"
+		};
 		let plaintext;
 		try {
 			plaintext = new Uint8Array(await crypto.subtle.decrypt({
@@ -203,30 +237,47 @@ async function establishChannel(identity, pending, remote, peer) {
 				additionalData: associatedData(peer.deviceId, identity.deviceId, data.counter)
 			}, receiveKey, Uint8Array.from(data.ciphertext)));
 		} catch {
-			return;
+			return {
+				ok: false,
+				reason: "unauthentic"
+			};
 		}
 		highestReceived = Math.max(highestReceived, data.counter);
-		return tryDecodeFrame(plaintext) ?? void 0;
+		const frame = tryDecodeFrame(plaintext);
+		return frame === null ? {
+			ok: false,
+			reason: "undecodable"
+		} : {
+			ok: true,
+			frame
+		};
 	}
+	const openOutcome = async (data) => {
+		const opened = opening.then(async () => openOne(data));
+		opening = opened.catch(() => void 0);
+		return opened;
+	};
 	return {
 		peer,
 		seal: async (frame) => {
-			const counter = nextSendCounter;
-			nextSendCounter += 1;
+			const claimed = claimSendCounter(nextSendCounter);
+			const counter = claimed.counter;
+			nextSendCounter = claimed.next;
 			const sealed = sealing.then(async () => sealAt(frame, counter));
 			sealing = sealed.catch(() => void 0);
 			return sealed;
 		},
 		open: async (data) => {
-			const opened = opening.then(async () => openOne(data));
-			opening = opened.catch(() => void 0);
-			return opened;
-		}
+			const outcome = await openOutcome(data);
+			return outcome.ok ? outcome.frame : void 0;
+		},
+		openOutcome
 	};
 }
 //#endregion
 //#region src/domain/relay-channels.ts
-function createRelayChannels(identity, sendHello) {
+function createRelayChannels(identity, sendHello, options = {}) {
+	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
 	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
 	function start(peer) {
@@ -252,17 +303,40 @@ function createRelayChannels(identity, sendHello) {
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			const verdict = await verifyHello(identity, hello);
+			let verdict;
+			try {
+				verdict = await verifyHello(identity, hello);
+			} catch (error) {
+				options.onFault?.(error);
+				return;
+			}
 			if (!verdict.ok) return;
 			const key = deviceIdToHex(verdict.peer.deviceId);
 			const current = channels.get(key);
 			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const channel = await establishChannel(identity, await entry.pending, hello, verdict.peer);
-			if (channel === void 0) {
+			const established = await establishChannelFrom(identity, {
+				pending: await entry.pending,
+				remote: hello,
+				peer: verdict.peer,
+				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+			});
+			if (established === void 0) {
 				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
 				if (channels.get(key) === entry) channels.delete(key);
 				return;
 			}
+			const channel = {
+				...established,
+				seal: async (frame) => {
+					try {
+						return await established.seal(frame);
+					} catch (error) {
+						const held = channels.get(key);
+						if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+						throw error;
+					}
+				}
+			};
 			channels.set(key, {
 				status: "established",
 				channel
@@ -305,27 +379,16 @@ const HANDSHAKE_TIMEOUT_MS = 3e3;
 * always-on node grows without limit.
 */
 const FRAME_LOG_WINDOW = 256;
-function localHandshake(domains) {
-	return {
-		type: "handshake",
-		version: 1,
-		domains: [...domains]
-	};
-}
 /**
 * Builds the connection-agnostic session state machine and its public MeshSession surface. dial is null for a session that can never (re)connect on its own -- acceptMeshSession's case, where the one connection it will ever have already exists by construction and reconnect therefore cannot apply (only the remote redialing, and being accepted again, produces a fresh connection). createMeshSession supplies dial as transport.connect so its own connect()/reconnect behaviour is unchanged from before this was factored out.
 */
-function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd) {
+function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addresses = [], onFrame, onSessionEnd, onLocalFault) {
 	let connection = null;
 	let state = { status: "idle" };
 	let handshake = { status: "pending" };
 	const directory = /* @__PURE__ */ new Map();
-	const frameLog = [];
-	/** Keeps the frame log at its recent-activity window: newest entries at the end, the oldest dropped once the window is full. */
-	function recordFrame(entry) {
-		frameLog.push(entry);
-		if (frameLog.length > 256) frameLog.splice(0, frameLog.length - 256);
-	}
+	const frameLog = createBoundedLog(256);
+	const recordFrame = frameLog.record;
 	let feedCancelled = false;
 	const eventQueue = createAsyncQueue();
 	let handshakeTimer = null;
@@ -340,7 +403,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		getRelayedDevices: () => relayPairings.list()
 	});
 	const pendingManageRequests = /* @__PURE__ */ new Map();
-	const relayChannels = createRelayChannels(identity, async (peer, hello) => {
+	const sendHello = async (peer, hello) => {
 		if (connection === null) throw new Error("not connected");
 		recordFrame({
 			direction: "sent",
@@ -348,7 +411,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		});
 		await connection.send(wrapRelayData(hello, peer));
 		emit();
-	});
+	};
+	const relayChannels = createRelayChannels(identity, sendHello, { onFault: onLocalFault });
 	const incomingQueue = createAsyncQueue();
 	const revocationQueue = createAsyncQueue();
 	const coordinatorQueue = createAsyncQueue();
@@ -358,7 +422,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		return {
 			state,
 			directory: [...directory.values()],
-			frameLog: [...frameLog]
+			frameLog: frameLog.entries()
 		};
 	}
 	function emit() {
@@ -433,7 +497,7 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 			}
 		};
 		if (isVersionGetCommand(frame.command.params)) {
-			incoming.respond(versionGetOutcome());
+			incoming.respond(versionGetOutcome()).catch(() => void 0);
 			return;
 		}
 		incomingQueue.push(incoming);
@@ -827,8 +891,8 @@ function createSessionCore(identity, clock, reconnect, dial, onPeerAdvert, addre
 		}
 	};
 }
-function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame) {
-	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame);
+function createMeshSession(transport, identity, clock = { now: () => Date.now() }, reconnect = null, addresses = [], onPeerAdvert, onFrame, onLocalFault) {
+	const { session } = createSessionCore(identity, clock, reconnect, async (address) => transport.connect(address), onPeerAdvert, addresses, onFrame, void 0, onLocalFault);
 	return session;
 }
 /** Wires an already-accepted Connection up as a full MeshSession, mirroring exactly what createMeshSession's own dial path does once a connection exists (send handshake, send self-advert, negotiate, consume frames) -- the wire-mesh#45 prerequisite agent-comms needs, since its peers both listen and dial rather than only ever dialing the way web-console's own console UI does. Reconnect does not apply here: if this connection drops, only the remote redialing and being accepted again produces a new connection, and therefore a new session -- there is nothing on this side to retry. */

package/dist/domain/notice-board.d.cts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { RoomNoticeVerdictReason } from "./room.cjs";

package/dist/domain/notice-board.d.mts

@@ -1,6 +1,6 @@
 import { D as DeviceId, Ot as RoomNotice, T as DataHaveFrame, kt as RoomNoticeClaims, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
 import { t as KeyValueStorage } from "../storage-jbGFAYIV.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { RoomNoticeVerdictReason } from "./room.mjs";

package/dist/domain/peer-advert.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/peer-advert.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, et as PeerAdvert } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 //#region src/domain/peer-advert.d.ts
 /**
  * The most a verifier's verdict memo may charge across all its entries, in bytes of key.

package/dist/domain/room-rekey.d.cts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.cjs";
 import { RevocationCheck } from "./tokens.cjs";

package/dist/domain/room-rekey.d.mts

@@ -1,5 +1,5 @@
 import { D as DeviceId, V as ManageCommand, p as CapabilityToken } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { IncomingManageRequest, ManageOutcome, MeshSession } from "./mesh-session.mjs";
 import { RevocationCheck } from "./tokens.mjs";

package/dist/domain/room.d.cts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { RevocationCheck } from "./tokens.cjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Dh7SGJfK.cjs";

package/dist/domain/room.d.mts

@@ -1,5 +1,5 @@
 import { At as RoomPath, Ot as RoomNotice, kt as RoomNoticeClaims, p as CapabilityToken, q as MessageRef } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { RevocationCheck } from "./tokens.mjs";
 import { r as RoomTokenVerdictReason } from "../room-token-verification-Hb1LkpFh.mjs";

package/dist/domain/tokens.cjs

@@ -374,6 +374,14 @@ async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
 * When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
 */
 async function mintCapabilityToken(options) {
+	for (const verb of [
+		options.capability,
+		options.grantsCapability,
+		options.requestsCapability
+	]) if (verb !== void 0 && !require_generated_protocol.capabilityVerbSchema.safeParse(verb).success) return {
+		ok: false,
+		reason: "invalid_capability"
+	};
 	if (options.expires <= options.clock.now()) return {
 		ok: false,
 		reason: "already_expired"

package/dist/domain/tokens.d.cts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.cjs";
-import { t as IdentityPort } from "../identity-B6nhlSOT.cjs";
+import { r as IdentityPort } from "../identity-C5jq53NV.cjs";
 import { t as Clock } from "../clock-DhUPRfLh.cjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-lg4TtUxm.cjs";
 import { PredicateNode } from "trilean";
@@ -67,7 +67,9 @@ export interface VerifyRevocationEntryOptions {
  * Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
  */
 export declare function verifyRevocationEntry(entry: RevocationEntry, options: VerifyRevocationEntryOptions): Promise<RevocationEntryVerdict>;
-export type MintRefusalReason = "already_expired" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
+export type MintRefusalReason = "already_expired" |
+/** The capability, grants-capability or requests-capability is not a capability verb of the spec's grammar. */
+"invalid_capability" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
 /** parent and authorised-by are mutually exclusive link kinds; a manage:grant capability must be minted through authorised-by only. */
 "links_exclusive" |
 /** The cited grant-capability did not decode, or its own conditions bytes did not. */

package/dist/domain/tokens.d.mts

@@ -1,5 +1,5 @@
 import { B as IdentityKey, D as DeviceId, bt as RevocationEntry, en as TokenClaims, p as CapabilityToken, yt as RevocationClaims } from "../protocol-DzmpxxUr.mjs";
-import { t as IdentityPort } from "../identity-EV-HHv_D.mjs";
+import { r as IdentityPort } from "../identity-BioGOV9M.mjs";
 import { t as Clock } from "../clock-DhUPRfLh.mjs";
 import { l as GrantSubject, m as TokenDelegateHandler, r as ConditionsContext, u as NarrowingCandidate } from "../token-predicates-CrieP1WI.mjs";
 import { PredicateNode } from "trilean";
@@ -67,7 +67,9 @@ export interface VerifyRevocationEntryOptions {
  * Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
  */
 export declare function verifyRevocationEntry(entry: RevocationEntry, options: VerifyRevocationEntryOptions): Promise<RevocationEntryVerdict>;
-export type MintRefusalReason = "already_expired" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
+export type MintRefusalReason = "already_expired" |
+/** The capability, grants-capability or requests-capability is not a capability verb of the spec's grammar. */
+"invalid_capability" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
 /** parent and authorised-by are mutually exclusive link kinds; a manage:grant capability must be minted through authorised-by only. */
 "links_exclusive" |
 /** The cited grant-capability did not decode, or its own conditions bytes did not. */

package/dist/domain/tokens.mjs

@@ -1,4 +1,4 @@
-import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
+import { capabilityTokenSchema, capabilityVerbSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
 import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
@@ -373,6 +373,14 @@ async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
 * When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
 */
 async function mintCapabilityToken(options) {
+	for (const verb of [
+		options.capability,
+		options.grantsCapability,
+		options.requestsCapability
+	]) if (verb !== void 0 && !capabilityVerbSchema.safeParse(verb).success) return {
+		ok: false,
+		reason: "invalid_capability"
+	};
 	if (options.expires <= options.clock.now()) return {
 		ok: false,
 		reason: "already_expired"

package/dist/generated/protocol.cjs

@@ -201,8 +201,8 @@ const coreDomainNameSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.literal("core/bulk"),
 	zod.z.literal("core/version")
 ]));
-const namespacedDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
-const privateUseDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
+const namespacedDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+)$")));
+const privateUseDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+)$")));
 const handshakeFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("handshake"),
 	"version": zod.z.lazy(() => protocolVersionSchema),
@@ -281,9 +281,9 @@ const topologyPeersSchema = zod.z.lazy(() => zod.z.object({
 }));
 const topologyGetSchema = zod.z.lazy(() => zod.z.object({ "verb": zod.z.literal("topology.get") }));
 const roomPathSchema = zod.z.lazy(() => zod.z.union([zod.z.lazy(() => ownerNamedRoomPathSchema), zod.z.lazy(() => dmRoomPathSchema)]));
-const deviceIdHexSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}")));
-const ownerNamedRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}/[A-Za-z0-9_-]+")));
-const dmRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}\\+[0-9a-f]{64}")));
+const deviceIdHexSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64})$")));
+const ownerNamedRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}/[A-Za-z0-9_-]+)$")));
+const dmRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}\\+[0-9a-f]{64})$")));
 const roomSendSchema = zod.z.lazy(() => zod.z.object({
 	"verb": zod.z.literal("room.send"),
 	"message-id": zod.z.instanceof(Uint8Array),
@@ -438,9 +438,9 @@ const capabilityVerbSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.lazy(() => namespacedCapabilitySchema),
 	zod.z.lazy(() => privateUseCapabilitySchema)
 ]));
-const coreCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z][a-z0-9-]*:[a-z][a-z0-9-]*")));
-const namespacedCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
-const privateUseCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const coreCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z][a-z0-9-]*:[a-z][a-z0-9-]*)$")));
+const namespacedCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
+const privateUseCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
 const capabilityScopeSchema = zod.z.lazy(() => zod.z.object({
 	"kind": zod.z.string(),
 	"path": zod.z.string().optional()

package/dist/generated/protocol.mjs

@@ -200,8 +200,8 @@ const coreDomainNameSchema = z.lazy(() => z.union([
 	z.literal("core/bulk"),
 	z.literal("core/version")
 ]));
-const namespacedDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
-const privateUseDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
+const namespacedDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+)$")));
+const privateUseDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+)$")));
 const handshakeFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("handshake"),
 	"version": z.lazy(() => protocolVersionSchema),
@@ -280,9 +280,9 @@ const topologyPeersSchema = z.lazy(() => z.object({
 }));
 const topologyGetSchema = z.lazy(() => z.object({ "verb": z.literal("topology.get") }));
 const roomPathSchema = z.lazy(() => z.union([z.lazy(() => ownerNamedRoomPathSchema), z.lazy(() => dmRoomPathSchema)]));
-const deviceIdHexSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}")));
-const ownerNamedRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}/[A-Za-z0-9_-]+")));
-const dmRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}\\+[0-9a-f]{64}")));
+const deviceIdHexSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64})$")));
+const ownerNamedRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}/[A-Za-z0-9_-]+)$")));
+const dmRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}\\+[0-9a-f]{64})$")));
 const roomSendSchema = z.lazy(() => z.object({
 	"verb": z.literal("room.send"),
 	"message-id": z.instanceof(Uint8Array),
@@ -437,9 +437,9 @@ const capabilityVerbSchema = z.lazy(() => z.union([
 	z.lazy(() => namespacedCapabilitySchema),
 	z.lazy(() => privateUseCapabilitySchema)
 ]));
-const coreCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z][a-z0-9-]*:[a-z][a-z0-9-]*")));
-const namespacedCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
-const privateUseCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const coreCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z][a-z0-9-]*:[a-z][a-z0-9-]*)$")));
+const namespacedCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
+const privateUseCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
 const capabilityScopeSchema = z.lazy(() => z.object({
 	"kind": z.string(),
 	"path": z.string().optional()

package/dist/{identity-EV-HHv_D.d.mts → identity-BioGOV9M.d.mts}

@@ -1,5 +1,14 @@
 import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.mjs";
 //#region src/ports/identity.d.ts
+/** Why an identity-key could not be used: its algorithm is not one the implementation verifies, or its key bytes are not a valid key for that algorithm. */
+type IdentityKeyFault = "unsupported_alg" | "invalid_key";
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+declare class IdentityKeyError extends Error {
+  readonly fault: IdentityKeyFault;
+  constructor(fault: IdentityKeyFault, message: string, options?: Readonly<{
+    cause: unknown;
+  }>);
+}
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -16,4 +25,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityPort as t };
+export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };

package/dist/{identity-B6nhlSOT.d.cts → identity-C5jq53NV.d.cts}

@@ -1,5 +1,14 @@
 import { B as IdentityKey, D as DeviceId } from "./protocol-DzmpxxUr.cjs";
 //#region src/ports/identity.d.ts
+/** Why an identity-key could not be used: its algorithm is not one the implementation verifies, or its key bytes are not a valid key for that algorithm. */
+type IdentityKeyFault = "unsupported_alg" | "invalid_key";
+/** Thrown by an IdentityPort's verify for an identity-key it cannot use at all, as opposed to a signature that does not verify (which returns false). Any other error from a port is not a fault of the key: it is a failure of the port itself and is never to be read as a verdict about a peer. */
+declare class IdentityKeyError extends Error {
+  readonly fault: IdentityKeyFault;
+  constructor(fault: IdentityKeyFault, message: string, options?: Readonly<{
+    cause: unknown;
+  }>);
+}
 /**
  * Wraps the local node's own identity plus the signing/verification primitives capability-token handling needs -- never hardcoded to one crypto library's own API shape (Node's webcrypto, a WASM implementation, a hardware key, etc. can all satisfy this same contract).
  */
@@ -16,4 +25,4 @@ interface IdentityPort {
   deriveSharedSecret?: (peerKey: IdentityKey) => Promise<Uint8Array<ArrayBuffer>>;
 }
 //#endregion
-export { IdentityPort as t };
+export { IdentityKeyFault as n, IdentityPort as r, IdentityKeyError as t };