wire-mesh-core 4.1.0 → 4.1.2

package/dist/domain/mesh-session.cjs

@@ -280,73 +280,129 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
-	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
-	function start(peer) {
+	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
+	function reportFault(error) {
+		const report = (faultError) => {
+			console.error("the local fault callback failed", faultError);
+		};
+		try {
+			const result = options.onFault?.(error);
+			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+		} catch (faultError) {
+			report(faultError);
+		}
+	}
+	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
+	function abandon(entry, error) {
+		const failure = error instanceof Error ? error : new Error(String(error));
+		if (channels.get(entry.key) === entry) channels.delete(entry.key);
+		entry.settle.reject(failure);
+		entry.sent.reject(failure);
+	}
+	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
+	function start(peer, { answering, track } = {
+		answering: false,
+		track: true
+	}) {
 		const key = require_domain_device_id.deviceIdToHex(peer);
-		const settle = Promise.withResolvers();
 		const pending = beginHandshake(identity, peer);
 		const entry = {
 			status: "awaiting",
 			pending,
-			settle
+			settle: Promise.withResolvers(),
+			key,
+			sent: Promise.withResolvers()
 		};
-		channels.set(key, entry);
-		pending.then(async ({ hello }) => sendHello(peer, hello)).catch((error) => {
-			settle.reject(error instanceof Error ? error : new Error(String(error)));
-			if (channels.get(key) === entry) channels.delete(key);
+		entry.settle.promise.catch(() => void 0);
+		entry.sent.promise.catch(() => void 0);
+		pending.then(async ({ hello }) => {
+			try {
+				await sendHello(peer, hello);
+			} catch (error) {
+				abandon(entry, error);
+				entry.settle.promise.then((channel) => {
+					const held = channels.get(key);
+					if (held?.status === "established" && held.channel === channel) channels.delete(key);
+				}, () => void 0);
+				if (answering && track) reportFault(error);
+				return;
+			}
+			entry.sent.resolve(void 0);
+		}, (error) => {
+			abandon(entry, error);
 		});
+		if (track) channels.set(key, entry);
 		return entry;
 	}
+	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
+	async function complete({ entry, hello, peer, replaces }) {
+		const { key } = entry;
+		const established = await establishChannelFrom(identity, {
+			pending: await entry.pending,
+			remote: hello,
+			peer,
+			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+		});
+		if (established === void 0) {
+			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
+			return;
+		}
+		if (replaces !== void 0) await entry.sent.promise;
+		if (channels.get(key) !== (replaces ?? entry)) return;
+		const channel = {
+			...established,
+			seal: async (frame) => {
+				try {
+					return await established.seal(frame);
+				} catch (error) {
+					const held = channels.get(key);
+					if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+					throw error;
+				}
+			}
+		};
+		channels.set(key, {
+			status: "established",
+			channel,
+			remoteEphemeralKey: hello["ephemeral-key"]
+		});
+		entry.settle.resolve(channel);
+	}
 	return {
 		ensure: async (peer) => {
-			const existing = channels.get(require_domain_device_id.deviceIdToHex(peer));
+			const key = require_domain_device_id.deviceIdToHex(peer);
+			const existing = channels.get(key);
 			if (existing?.status === "established") return existing.channel;
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			let verdict;
+			let entry;
 			try {
-				verdict = await verifyHello(identity, hello);
+				const verdict = await verifyHello(identity, hello);
+				if (!verdict.ok) return;
+				const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
+				const current = channels.get(key);
+				if (current?.status === "established" && require_domain_token_scope.bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
+				const replaces = current?.status === "established" ? current : void 0;
+				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
+					answering: true,
+					track: replaces === void 0
+				});
+				await complete({
+					entry,
+					hello,
+					peer: verdict.peer,
+					replaces
+				});
 			} catch (error) {
-				options.onFault?.(error);
-				return;
-			}
-			if (!verdict.ok) return;
-			const key = require_domain_device_id.deviceIdToHex(verdict.peer.deviceId);
-			const current = channels.get(key);
-			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const established = await establishChannelFrom(identity, {
-				pending: await entry.pending,
-				remote: hello,
-				peer: verdict.peer,
-				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
-			});
-			if (established === void 0) {
-				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-				if (channels.get(key) === entry) channels.delete(key);
-				return;
+				if (entry !== void 0) abandon(entry, error);
+				reportFault(error);
 			}
-			const channel = {
-				...established,
-				seal: async (frame) => {
-					try {
-						return await established.seal(frame);
-					} catch (error) {
-						const held = channels.get(key);
-						if (error instanceof require_domain_channel_exhausted_error.ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-						throw error;
-					}
-				}
-			};
-			channels.set(key, {
-				status: "established",
-				channel
-			});
-			entry.settle.resolve(channel);
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const entry = channels.get(require_domain_device_id.deviceIdToHex(claimedFrom));
+			const key = require_domain_device_id.deviceIdToHex(claimedFrom);
+			const entry = channels.get(key);
 			if (entry?.status !== "established") return;
 			const frame = await entry.channel.open(data);
 			return frame === void 0 ? void 0 : {
@@ -355,13 +411,13 @@ function createRelayChannels(identity, sendHello, options = {}) {
 			};
 		},
 		reset: (reason) => {
-			for (const entry of channels.values()) if (entry.status === "awaiting") entry.settle.reject(new Error(reason));
+			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
 			channels.clear();
 		},
 		forget: (peer) => {
 			const key = require_domain_device_id.deviceIdToHex(peer);
 			const entry = channels.get(key);
-			if (entry?.status === "awaiting") entry.settle.reject(/* @__PURE__ */ new Error("the relay pairing was lost"));
+			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
 			channels.delete(key);
 		}
 	};

package/dist/domain/mesh-session.d.cts

@@ -137,8 +137,8 @@ addresses?: readonly string[],
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
 onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
-/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
-onLocalFault?: (error: unknown) => void): MeshSession;
+/** Told of a failure that is local to this session and did not end it, while handling a hello from a peer: an identity port that failed to check or sign, an answering hello that could not be sent, a channel that could not be established. The hello is dropped, any half-made handshake for that peer is discarded, and the peer is told nothing, so no failure in handling a hello ends the session. Called once per failing hello; if it throws, or returns a promise that rejects, that is reported once to the console and swallowed. Omit for a caller with no use for it. */
+onLocalFault?: (error: unknown) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.d.mts

@@ -137,8 +137,8 @@ addresses?: readonly string[],
 onPeerAdvert?: (advert: PeerAdvert) => void,
 /** Fired once per frame received on this session's connection, with the Connection it arrived on: a new Connection after a reconnect is how a caller notices it has to announce itself again, and a core/data reply is how it receives a log it asked a hub for. Omit for a caller with no use for it, exactly today's behaviour. */
 onFrame?: (connection: Readonly<Connection>, frame: Frame) => void | Promise<void>,
-/** Told of a failure that is local to this session and did not end it: an identity port that failed while checking a hello from a peer. The hello is dropped and the peer is told nothing. Omit for a caller with no use for it: the failure is then not reported anywhere. */
-onLocalFault?: (error: unknown) => void): MeshSession;
+/** Told of a failure that is local to this session and did not end it, while handling a hello from a peer: an identity port that failed to check or sign, an answering hello that could not be sent, a channel that could not be established. The hello is dropped, any half-made handshake for that peer is discarded, and the peer is told nothing, so no failure in handling a hello ends the session. Called once per failing hello; if it throws, or returns a promise that rejects, that is reported once to the console and swallowed. Omit for a caller with no use for it. */
+onLocalFault?: (error: unknown) => void | Promise<void>): MeshSession;
 /** A MeshSession built over a connection that already exists (a Transport's own listen() handed it to onConnection), extended with the one thing a dial-side session can't offer: the device-id of the specific peer at the other end. Unlike createMeshSession, which may end up talking to a relay gossiping about many devices at once, an accepted connection is the agent-comms case -- exactly two peers, directly connected -- so "the peer" is well-defined here in a way it structurally isn't for the dial side. */
 export interface AcceptedMeshSession extends MeshSession {
   /** Resolves with the device-id carried by the first peer-advert this connection's remote sends -- the same self-advertisement mechanism createMeshSession's own directory already relies on for every peer, just narrowed to "the one peer this specific connection is with" rather than accumulated into a directory of possibly many. There is no transport-level authentication behind this yet (see wire-mesh#45's own createTlsTransport item): it is only as trustworthy as the remote's own gossip, exactly the same trust level the dial-side directory already has for every entry in it. */

package/dist/domain/mesh-session.mjs

@@ -279,73 +279,129 @@ async function establishChannelFrom(identity, { pending, remote, peer, firstSend
 function createRelayChannels(identity, sendHello, options = {}) {
 	if (options.firstSendCounter !== void 0) assertFirstSendCounter(options.firstSendCounter);
 	const channels = /* @__PURE__ */ new Map();
-	/** Registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second, then sends this side's hello. */
-	function start(peer) {
+	/** Tells the owner of a failure that is local to this side. The callback is the owner's code: its own failure, thrown or as a rejected promise it returns, must not end the session or go unobserved, so it is reported once and swallowed. */
+	function reportFault(error) {
+		const report = (faultError) => {
+			console.error("the local fault callback failed", faultError);
+		};
+		try {
+			const result = options.onFault?.(error);
+			if (typeof result === "object" && result !== null && "then" in result && typeof result.then === "function") Promise.resolve(result).catch(report);
+		} catch (faultError) {
+			report(faultError);
+		}
+	}
+	/** Abandons a handshake that failed: the entry goes if it is still the one held for the peer, and whoever awaits it is told. */
+	function abandon(entry, error) {
+		const failure = error instanceof Error ? error : new Error(String(error));
+		if (channels.get(entry.key) === entry) channels.delete(entry.key);
+		entry.settle.reject(failure);
+		entry.sent.reject(failure);
+	}
+	/** Starts a handshake with the peer: sends this side's hello, and registers the peer as awaiting at once, so a hello arriving meanwhile completes this handshake instead of starting a second. `answering` is true when a received hello started this, so nobody awaits the outcome and a failure to send is reported to the owner. `track` is false for a handshake answering a hello while a channel with that peer is established: it is not registered, so the established channel stays in place and in use until the new one is up and this side's hello has been sent. A hello that could not be sent leaves no channel behind: the peer would never learn this side's key. */
+	function start(peer, { answering, track } = {
+		answering: false,
+		track: true
+	}) {
 		const key = deviceIdToHex(peer);
-		const settle = Promise.withResolvers();
 		const pending = beginHandshake(identity, peer);
 		const entry = {
 			status: "awaiting",
 			pending,
-			settle
+			settle: Promise.withResolvers(),
+			key,
+			sent: Promise.withResolvers()
 		};
-		channels.set(key, entry);
-		pending.then(async ({ hello }) => sendHello(peer, hello)).catch((error) => {
-			settle.reject(error instanceof Error ? error : new Error(String(error)));
-			if (channels.get(key) === entry) channels.delete(key);
+		entry.settle.promise.catch(() => void 0);
+		entry.sent.promise.catch(() => void 0);
+		pending.then(async ({ hello }) => {
+			try {
+				await sendHello(peer, hello);
+			} catch (error) {
+				abandon(entry, error);
+				entry.settle.promise.then((channel) => {
+					const held = channels.get(key);
+					if (held?.status === "established" && held.channel === channel) channels.delete(key);
+				}, () => void 0);
+				if (answering && track) reportFault(error);
+				return;
+			}
+			entry.sent.resolve(void 0);
+		}, (error) => {
+			abandon(entry, error);
 		});
+		if (track) channels.set(key, entry);
 		return entry;
 	}
+	/** Completes the handshake a verified hello belongs to. Throws on any failure of this side; the caller abandons the handshake. */
+	async function complete({ entry, hello, peer, replaces }) {
+		const { key } = entry;
+		const established = await establishChannelFrom(identity, {
+			pending: await entry.pending,
+			remote: hello,
+			peer,
+			...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
+		});
+		if (established === void 0) {
+			abandon(entry, /* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
+			return;
+		}
+		if (replaces !== void 0) await entry.sent.promise;
+		if (channels.get(key) !== (replaces ?? entry)) return;
+		const channel = {
+			...established,
+			seal: async (frame) => {
+				try {
+					return await established.seal(frame);
+				} catch (error) {
+					const held = channels.get(key);
+					if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
+					throw error;
+				}
+			}
+		};
+		channels.set(key, {
+			status: "established",
+			channel,
+			remoteEphemeralKey: hello["ephemeral-key"]
+		});
+		entry.settle.resolve(channel);
+	}
 	return {
 		ensure: async (peer) => {
-			const existing = channels.get(deviceIdToHex(peer));
+			const key = deviceIdToHex(peer);
+			const existing = channels.get(key);
 			if (existing?.status === "established") return existing.channel;
 			return (existing ?? start(peer)).settle.promise;
 		},
 		applyHello: async (hello) => {
-			let verdict;
+			let entry;
 			try {
-				verdict = await verifyHello(identity, hello);
+				const verdict = await verifyHello(identity, hello);
+				if (!verdict.ok) return;
+				const key = deviceIdToHex(verdict.peer.deviceId);
+				const current = channels.get(key);
+				if (current?.status === "established" && bytesEqual(current.remoteEphemeralKey, hello["ephemeral-key"])) return;
+				const replaces = current?.status === "established" ? current : void 0;
+				entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId, {
+					answering: true,
+					track: replaces === void 0
+				});
+				await complete({
+					entry,
+					hello,
+					peer: verdict.peer,
+					replaces
+				});
 			} catch (error) {
-				options.onFault?.(error);
-				return;
-			}
-			if (!verdict.ok) return;
-			const key = deviceIdToHex(verdict.peer.deviceId);
-			const current = channels.get(key);
-			const entry = current?.status === "awaiting" ? current : start(verdict.peer.deviceId);
-			const established = await establishChannelFrom(identity, {
-				pending: await entry.pending,
-				remote: hello,
-				peer: verdict.peer,
-				...options.firstSendCounter === void 0 ? {} : { firstSendCounter: options.firstSendCounter }
-			});
-			if (established === void 0) {
-				entry.settle.reject(/* @__PURE__ */ new Error("the peer sent an unusable ephemeral key"));
-				if (channels.get(key) === entry) channels.delete(key);
-				return;
+				if (entry !== void 0) abandon(entry, error);
+				reportFault(error);
 			}
-			const channel = {
-				...established,
-				seal: async (frame) => {
-					try {
-						return await established.seal(frame);
-					} catch (error) {
-						const held = channels.get(key);
-						if (error instanceof ChannelExhaustedError && held?.status === "established" && held.channel === channel) channels.delete(key);
-						throw error;
-					}
-				}
-			};
-			channels.set(key, {
-				status: "established",
-				channel
-			});
-			entry.settle.resolve(channel);
 		},
 		open: async (data, claimedFrom) => {
 			if (claimedFrom === void 0) return;
-			const entry = channels.get(deviceIdToHex(claimedFrom));
+			const key = deviceIdToHex(claimedFrom);
+			const entry = channels.get(key);
 			if (entry?.status !== "established") return;
 			const frame = await entry.channel.open(data);
 			return frame === void 0 ? void 0 : {
@@ -354,13 +410,13 @@ function createRelayChannels(identity, sendHello, options = {}) {
 			};
 		},
 		reset: (reason) => {
-			for (const entry of channels.values()) if (entry.status === "awaiting") entry.settle.reject(new Error(reason));
+			for (const entry of [...channels.values()]) if (entry.status === "awaiting") abandon(entry, new Error(reason));
 			channels.clear();
 		},
 		forget: (peer) => {
 			const key = deviceIdToHex(peer);
 			const entry = channels.get(key);
-			if (entry?.status === "awaiting") entry.settle.reject(/* @__PURE__ */ new Error("the relay pairing was lost"));
+			if (entry?.status === "awaiting") abandon(entry, /* @__PURE__ */ new Error("the relay pairing was lost"));
 			channels.delete(key);
 		}
 	};

package/dist/domain/tokens.cjs

@@ -374,6 +374,14 @@ async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
 * When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
 */
 async function mintCapabilityToken(options) {
+	for (const verb of [
+		options.capability,
+		options.grantsCapability,
+		options.requestsCapability
+	]) if (verb !== void 0 && !require_generated_protocol.capabilityVerbSchema.safeParse(verb).success) return {
+		ok: false,
+		reason: "invalid_capability"
+	};
 	if (options.expires <= options.clock.now()) return {
 		ok: false,
 		reason: "already_expired"

package/dist/domain/tokens.d.cts

@@ -67,7 +67,9 @@ export interface VerifyRevocationEntryOptions {
  * Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
  */
 export declare function verifyRevocationEntry(entry: RevocationEntry, options: VerifyRevocationEntryOptions): Promise<RevocationEntryVerdict>;
-export type MintRefusalReason = "already_expired" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
+export type MintRefusalReason = "already_expired" |
+/** The capability, grants-capability or requests-capability is not a capability verb of the spec's grammar. */
+"invalid_capability" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
 /** parent and authorised-by are mutually exclusive link kinds; a manage:grant capability must be minted through authorised-by only. */
 "links_exclusive" |
 /** The cited grant-capability did not decode, or its own conditions bytes did not. */

package/dist/domain/tokens.d.mts

@@ -67,7 +67,9 @@ export interface VerifyRevocationEntryOptions {
  * Verifies one gossiped revocation-entry (management.cddl): a well-formed COSE_Sign1 whose signature verifies against its own embedded issuer-key, where that issuer-key is self-certifying (sha256(issuer-key.public-key) equals the claimed issuer device-id). A verifier that ingests a revocation-announce frame runs each entry through this before recording it in its revocation view; entries failing here are dropped, not stored. The issuer-match against a specific token's own issuer (only a token's own issuer may revoke it) is deliberately NOT checked here -- it happens at lookup time in RevocationCheck, against whichever token is being verified.
  */
 export declare function verifyRevocationEntry(entry: RevocationEntry, options: VerifyRevocationEntryOptions): Promise<RevocationEntryVerdict>;
-export type MintRefusalReason = "already_expired" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
+export type MintRefusalReason = "already_expired" |
+/** The capability, grants-capability or requests-capability is not a capability verb of the spec's grammar. */
+"invalid_capability" | "parent_malformed" | "parent_bearer_mismatch" | "expires_exceeds_parent" | "scope_does_not_narrow" | "capability_mismatch" | "delegation_exceeds_parent" |
 /** parent and authorised-by are mutually exclusive link kinds; a manage:grant capability must be minted through authorised-by only. */
 "links_exclusive" |
 /** The cited grant-capability did not decode, or its own conditions bytes did not. */

package/dist/domain/tokens.mjs

@@ -1,4 +1,4 @@
-import { capabilityTokenSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
+import { capabilityTokenSchema, capabilityVerbSchema, revocationClaimsSchema, tokenClaimsSchema } from "../generated/protocol.mjs";
 import { bytesToHex } from "./device-id.mjs";
 import { n as firstAsync } from "../sequential-D_W3THly.mjs";
 import { bytesEqual, scopeNarrows } from "./token-scope.mjs";
@@ -373,6 +373,14 @@ async function canGrantVia(heldGrantCapability, deviceId, candidate, now) {
 * When `parent` is given, every one of `tokens.cddl`'s own narrowing obligations is enforced here, at issuance, rather than left for the far end to discover minutes or hours later as a bare `delegation_exceeds_parent` from `verifyCapabilityToken` -- the same "fail loudly, fail early" reasoning that governs every other boundary in this codebase. An issuer minting an invalid delegation is a bug in the caller; this function refuses rather than producing a token indistinguishable from a valid one until someone else verifies it.
 */
 async function mintCapabilityToken(options) {
+	for (const verb of [
+		options.capability,
+		options.grantsCapability,
+		options.requestsCapability
+	]) if (verb !== void 0 && !capabilityVerbSchema.safeParse(verb).success) return {
+		ok: false,
+		reason: "invalid_capability"
+	};
 	if (options.expires <= options.clock.now()) return {
 		ok: false,
 		reason: "already_expired"

package/dist/generated/protocol.cjs

@@ -201,8 +201,8 @@ const coreDomainNameSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.literal("core/bulk"),
 	zod.z.literal("core/version")
 ]));
-const namespacedDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
-const privateUseDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
+const namespacedDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+)$")));
+const privateUseDomainIdSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+)$")));
 const handshakeFrameSchema = zod.z.lazy(() => zod.z.object({
 	"type": zod.z.literal("handshake"),
 	"version": zod.z.lazy(() => protocolVersionSchema),
@@ -281,9 +281,9 @@ const topologyPeersSchema = zod.z.lazy(() => zod.z.object({
 }));
 const topologyGetSchema = zod.z.lazy(() => zod.z.object({ "verb": zod.z.literal("topology.get") }));
 const roomPathSchema = zod.z.lazy(() => zod.z.union([zod.z.lazy(() => ownerNamedRoomPathSchema), zod.z.lazy(() => dmRoomPathSchema)]));
-const deviceIdHexSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}")));
-const ownerNamedRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}/[A-Za-z0-9_-]+")));
-const dmRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}\\+[0-9a-f]{64}")));
+const deviceIdHexSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64})$")));
+const ownerNamedRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}/[A-Za-z0-9_-]+)$")));
+const dmRoomPathSchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}\\+[0-9a-f]{64})$")));
 const roomSendSchema = zod.z.lazy(() => zod.z.object({
 	"verb": zod.z.literal("room.send"),
 	"message-id": zod.z.instanceof(Uint8Array),
@@ -438,9 +438,9 @@ const capabilityVerbSchema = zod.z.lazy(() => zod.z.union([
 	zod.z.lazy(() => namespacedCapabilitySchema),
 	zod.z.lazy(() => privateUseCapabilitySchema)
 ]));
-const coreCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z][a-z0-9-]*:[a-z][a-z0-9-]*")));
-const namespacedCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
-const privateUseCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const coreCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z][a-z0-9-]*:[a-z][a-z0-9-]*)$")));
+const namespacedCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
+const privateUseCapabilitySchema = zod.z.lazy(() => zod.z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
 const capabilityScopeSchema = zod.z.lazy(() => zod.z.object({
 	"kind": zod.z.string(),
 	"path": zod.z.string().optional()

package/dist/generated/protocol.mjs

@@ -200,8 +200,8 @@ const coreDomainNameSchema = z.lazy(() => z.union([
 	z.literal("core/bulk"),
 	z.literal("core/version")
 ]));
-const namespacedDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+")));
-const privateUseDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+")));
+const namespacedDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9]([a-z0-9-]*[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+/[A-Za-z0-9_.-]+)$")));
+const privateUseDomainIdSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+)$")));
 const handshakeFrameSchema = z.lazy(() => z.object({
 	"type": z.literal("handshake"),
 	"version": z.lazy(() => protocolVersionSchema),
@@ -280,9 +280,9 @@ const topologyPeersSchema = z.lazy(() => z.object({
 }));
 const topologyGetSchema = z.lazy(() => z.object({ "verb": z.literal("topology.get") }));
 const roomPathSchema = z.lazy(() => z.union([z.lazy(() => ownerNamedRoomPathSchema), z.lazy(() => dmRoomPathSchema)]));
-const deviceIdHexSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}")));
-const ownerNamedRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}/[A-Za-z0-9_-]+")));
-const dmRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[0-9a-f]{64}\\+[0-9a-f]{64}")));
+const deviceIdHexSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64})$")));
+const ownerNamedRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}/[A-Za-z0-9_-]+)$")));
+const dmRoomPathSchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[0-9a-f]{64}\\+[0-9a-f]{64})$")));
 const roomSendSchema = z.lazy(() => z.object({
 	"verb": z.literal("room.send"),
 	"message-id": z.instanceof(Uint8Array),
@@ -437,9 +437,9 @@ const capabilityVerbSchema = z.lazy(() => z.union([
 	z.lazy(() => namespacedCapabilitySchema),
 	z.lazy(() => privateUseCapabilitySchema)
 ]));
-const coreCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z][a-z0-9-]*:[a-z][a-z0-9-]*")));
-const namespacedCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
-const privateUseCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+")));
+const coreCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z][a-z0-9-]*:[a-z][a-z0-9-]*)$")));
+const namespacedCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:[a-z0-9.-]+/[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
+const privateUseCapabilitySchema = z.lazy(() => z.string().regex(/* @__PURE__ */ new RegExp("^(?:x-[A-Za-z0-9_.-]+:[A-Za-z0-9_.-]+)$")));
 const capabilityScopeSchema = z.lazy(() => z.object({
 	"kind": z.string(),
 	"path": z.string().optional()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wire-mesh-core",
-  "version": "4.1.0",
+  "version": "4.1.2",
   "dependencies": {
     "cbor2": "2.3.0",
     "cddl.js": "1.0.1",